@take-out/better-auth-utils 0.5.0 → 0.5.1

package/dist/cjs/server.cjs

@@ -34,14 +34,9 @@ class NotAuthenticatedError extends Error {}
 class InvalidTokenError extends Error {}
 async function getAuthDataFromRequest(authServer, req, tokenOptions) {
   const authHeader = req.headers.get("authorization");
-  const cookie = authHeader?.split("Bearer ")[1];
-  const newHeaders = new Headers(req.headers);
-  if (cookie) {
-    newHeaders.set("Cookie", cookie);
-  }
   try {
     const session = await authServer.api.getSession({
-      headers: newHeaders
+      headers: req.headers
     });
     if (session?.user) {
       return {

package/dist/cjs/server.native.js

@@ -165,14 +165,9 @@ var InvalidTokenError = /* @__PURE__ */function (Error1) {
 }(_wrap_native_super(Error));
 async function getAuthDataFromRequest(authServer, req, tokenOptions) {
   var authHeader = req.headers.get("authorization");
-  var cookie = authHeader === null || authHeader === void 0 ? void 0 : authHeader.split("Bearer ")[1];
-  var newHeaders = new Headers(req.headers);
-  if (cookie) {
-    newHeaders.set("Cookie", cookie);
-  }
   try {
     var session = await authServer.api.getSession({
-      headers: newHeaders
+      headers: req.headers
     });
     if (session === null || session === void 0 ? void 0 : session.user) {
       return {

package/dist/cjs/server.native.js.map

@@ -1 +1 @@
-{"version":3,"names":["__defProp","Object","defineProperty","__getOwnPropDesc","getOwnPropertyDescriptor","__getOwnPropNames","getOwnPropertyNames","__hasOwnProp","prototype","hasOwnProperty","__export","target","all","name","get","enumerable","__copyProps","to","from","except","desc","key","call","__toCommonJS","mod","value","server_exports","InvalidTokenError","NotAuthenticatedError","getAuthDataFromRequest","isValidJWT","validateToken","module","exports","import_jose","require","_assert_this_initialized","self","ReferenceError","_call_super","_this","derived","args","_get_prototype_of","_possible_constructor_return","_is_native_reflect_construct","Reflect","construct","constructor","apply","_class_call_check","instance","Constructor","TypeError","_construct","Parent","Class","Parent2","args2","Class2","a","push","Function","bind","_set_prototype_of","arguments","o","setPrototypeOf","getPrototypeOf","o2","__proto__","_inherits","subClass","superClass","create","writable","configurable","_instanceof","left","right","Symbol","hasInstance","_is_native_function","fn","toString","indexOf","_type_of","p","p2","obj","_wrap_native_super","_cache","Map","wrapNativeSuper","has","set","Wrapper","result","Boolean","valueOf","_","Error1","NotAuthenticatedError2","Error","InvalidTokenError2","authServer","req","tokenOptions","authHeader","headers","cookie","split","newHeaders","Headers","session","api","getSession","user","id","email","role","err","console","warn","jwtToken","replace","payload","userId","sub","token","options","baseUrl","process","env","ONE_SERVER_URL","forceIssuer","FORCE_ISSUER","jwksPath","normalizedBaseUrl","removeTrailingSlash","url","JWKS","createRemoteJWKSet","URL","verifyOptions","issuer","audience","jwtVerify","error","e","str"],"sources":["server.native.js"],"sourcesContent":["\"use strict\";\nvar __defProp = Object.defineProperty;\nvar __getOwnPropDesc = Object.getOwnPropertyDescriptor;\nvar __getOwnPropNames = Object.getOwnPropertyNames;\nvar __hasOwnProp = Object.prototype.hasOwnProperty;\nvar __export = (target, all) => {\n  for (var name in all)\n    __defProp(target, name, { get: all[name], enumerable: true });\n};\nvar __copyProps = (to, from, except, desc) => {\n  if (from && typeof from === \"object\" || typeof from === \"function\") {\n    for (let key of __getOwnPropNames(from))\n      if (!__hasOwnProp.call(to, key) && key !== except)\n        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });\n  }\n  return to;\n};\nvar __toCommonJS = (mod) => __copyProps(__defProp({}, \"__esModule\", { value: true }), mod);\nvar server_exports = {};\n__export(server_exports, {\n  InvalidTokenError: () => InvalidTokenError,\n  NotAuthenticatedError: () => NotAuthenticatedError,\n  getAuthDataFromRequest: () => getAuthDataFromRequest,\n  isValidJWT: () => isValidJWT,\n  validateToken: () => validateToken\n});\nmodule.exports = __toCommonJS(server_exports);\nvar import_jose = require(\"jose\");\nfunction _assert_this_initialized(self) {\n  if (self === void 0) {\n    throw new ReferenceError(\"this hasn't been initialised - super() hasn't been called\");\n  }\n  return self;\n}\nfunction _call_super(_this, derived, args) {\n  derived = _get_prototype_of(derived);\n  return _possible_constructor_return(_this, _is_native_reflect_construct() ? Reflect.construct(derived, args || [], _get_prototype_of(_this).constructor) : derived.apply(_this, args));\n}\nfunction _class_call_check(instance, Constructor) {\n  if (!(instance instanceof Constructor)) {\n    throw new TypeError(\"Cannot call a class as a function\");\n  }\n}\nfunction _construct(Parent, args, Class) {\n  if (_is_native_reflect_construct()) {\n    _construct = Reflect.construct;\n  } else {\n    _construct = function construct(Parent2, args2, Class2) {\n      var a = [\n        null\n      ];\n      a.push.apply(a, args2);\n      var Constructor = Function.bind.apply(Parent2, a);\n      var instance = new Constructor();\n      if (Class2) _set_prototype_of(instance, Class2.prototype);\n      return instance;\n    };\n  }\n  return _construct.apply(null, arguments);\n}\nfunction _get_prototype_of(o) {\n  _get_prototype_of = Object.setPrototypeOf ? Object.getPrototypeOf : function getPrototypeOf(o2) {\n    return o2.__proto__ || Object.getPrototypeOf(o2);\n  };\n  return _get_prototype_of(o);\n}\nfunction _inherits(subClass, superClass) {\n  if (typeof superClass !== \"function\" && superClass !== null) {\n    throw new TypeError(\"Super expression must either be null or a function\");\n  }\n  subClass.prototype = Object.create(superClass && superClass.prototype, {\n    constructor: {\n      value: subClass,\n      writable: true,\n      configurable: true\n    }\n  });\n  if (superClass) _set_prototype_of(subClass, superClass);\n}\nfunction _instanceof(left, right) {\n  if (right != null && typeof Symbol !== \"undefined\" && right[Symbol.hasInstance]) {\n    return !!right[Symbol.hasInstance](left);\n  } else {\n    return left instanceof right;\n  }\n}\nfunction _is_native_function(fn) {\n  return Function.toString.call(fn).indexOf(\"[native code]\") !== -1;\n}\nfunction _possible_constructor_return(self, call) {\n  if (call && (_type_of(call) === \"object\" || typeof call === \"function\")) {\n    return call;\n  }\n  return _assert_this_initialized(self);\n}\nfunction _set_prototype_of(o, p) {\n  _set_prototype_of = Object.setPrototypeOf || function setPrototypeOf(o2, p2) {\n    o2.__proto__ = p2;\n    return o2;\n  };\n  return _set_prototype_of(o, p);\n}\nfunction _type_of(obj) {\n  \"@swc/helpers - typeof\";\n  return obj && typeof Symbol !== \"undefined\" && obj.constructor === Symbol ? \"symbol\" : typeof obj;\n}\nfunction _wrap_native_super(Class) {\n  var _cache = typeof Map === \"function\" ? /* @__PURE__ */ new Map() : void 0;\n  _wrap_native_super = function wrapNativeSuper(Class2) {\n    if (Class2 === null || !_is_native_function(Class2)) return Class2;\n    if (typeof Class2 !== \"function\") {\n      throw new TypeError(\"Super expression must either be null or a function\");\n    }\n    if (typeof _cache !== \"undefined\") {\n      if (_cache.has(Class2)) return _cache.get(Class2);\n      _cache.set(Class2, Wrapper);\n    }\n    function Wrapper() {\n      return _construct(Class2, arguments, _get_prototype_of(this).constructor);\n    }\n    Wrapper.prototype = Object.create(Class2.prototype, {\n      constructor: {\n        value: Wrapper,\n        enumerable: false,\n        writable: true,\n        configurable: true\n      }\n    });\n    return _set_prototype_of(Wrapper, Class2);\n  };\n  return _wrap_native_super(Class);\n}\nfunction _is_native_reflect_construct() {\n  try {\n    var result = !Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function() {\n    }));\n  } catch (_) {\n  }\n  return (_is_native_reflect_construct = function() {\n    return !!result;\n  })();\n}\nvar NotAuthenticatedError = /* @__PURE__ */ (function(Error1) {\n  \"use strict\";\n  _inherits(NotAuthenticatedError2, Error1);\n  function NotAuthenticatedError2() {\n    _class_call_check(this, NotAuthenticatedError2);\n    return _call_super(this, NotAuthenticatedError2, arguments);\n  }\n  return NotAuthenticatedError2;\n})(_wrap_native_super(Error));\nvar InvalidTokenError = /* @__PURE__ */ (function(Error1) {\n  \"use strict\";\n  _inherits(InvalidTokenError2, Error1);\n  function InvalidTokenError2() {\n    _class_call_check(this, InvalidTokenError2);\n    return _call_super(this, InvalidTokenError2, arguments);\n  }\n  return InvalidTokenError2;\n})(_wrap_native_super(Error));\nasync function getAuthDataFromRequest(authServer, req, tokenOptions) {\n  var authHeader = req.headers.get(\"authorization\");\n  var cookie = authHeader === null || authHeader === void 0 ? void 0 : authHeader.split(\"Bearer \")[1];\n  var newHeaders = new Headers(req.headers);\n  if (cookie) {\n    newHeaders.set(\"Cookie\", cookie);\n  }\n  try {\n    var session = await authServer.api.getSession({\n      headers: newHeaders\n    });\n    if (session === null || session === void 0 ? void 0 : session.user) {\n      return {\n        id: session.user.id,\n        email: session.user.email || void 0,\n        role: session.user.role === \"admin\" ? \"admin\" : void 0\n      };\n    }\n  } catch (err) {\n    console.warn(`Error validating session`, err);\n  }\n  var jwtToken = authHeader === null || authHeader === void 0 ? void 0 : authHeader.replace(\"Bearer \", \"\");\n  if (jwtToken) {\n    try {\n      var payload = await validateToken(jwtToken, tokenOptions);\n      var userId = (payload === null || payload === void 0 ? void 0 : payload.id) || (payload === null || payload === void 0 ? void 0 : payload.sub);\n      if (userId) {\n        return {\n          id: userId,\n          email: payload.email,\n          role: payload.role === \"admin\" ? \"admin\" : void 0\n        };\n      }\n    } catch (err) {\n      if (!_instanceof(err, InvalidTokenError)) {\n        throw err;\n      }\n    }\n  }\n  return null;\n}\nasync function validateToken(token, options) {\n  var { baseUrl = process.env.ONE_SERVER_URL, forceIssuer = process.env.FORCE_ISSUER || \"\", jwksPath = \"/api/auth/jwks\" } = options || {};\n  if (!baseUrl) {\n    throw new Error(`No baseURL!`);\n  }\n  var normalizedBaseUrl = removeTrailingSlash(baseUrl);\n  var url = `${forceIssuer || normalizedBaseUrl}${jwksPath}`;\n  var JWKS = (0, import_jose.createRemoteJWKSet)(new URL(url));\n  try {\n    var verifyOptions = forceIssuer ? {} : {\n      issuer: normalizedBaseUrl,\n      audience: normalizedBaseUrl\n    };\n    var { payload } = await (0, import_jose.jwtVerify)(token, JWKS, verifyOptions);\n    return payload;\n  } catch (error) {\n    throw new InvalidTokenError(`${error}`);\n  }\n}\nasync function isValidJWT(token, options) {\n  try {\n    await validateToken(token, options);\n    return true;\n  } catch (e) {\n    return false;\n  }\n}\nfunction removeTrailingSlash(str) {\n  return str.replace(/\\/$/, \"\");\n}\n//# sourceMappingURL=server.js.map\n"],"mappings":"AAAA,YAAY;;AACZ,IAAIA,SAAS,GAAGC,MAAM,CAACC,cAAc;AACrC,IAAIC,gBAAgB,GAAGF,MAAM,CAACG,wBAAwB;AACtD,IAAIC,iBAAiB,GAAGJ,MAAM,CAACK,mBAAmB;AAClD,IAAIC,YAAY,GAAGN,MAAM,CAACO,SAAS,CAACC,cAAc;AAClD,IAAIC,QAAQ,GAAGA,CAACC,MAAM,EAAEC,GAAG,KAAK;EAC9B,KAAK,IAAIC,IAAI,IAAID,GAAG,EAClBZ,SAAS,CAACW,MAAM,EAAEE,IAAI,EAAE;IAAEC,GAAG,EAAEF,GAAG,CAACC,IAAI,CAAC;IAAEE,UAAU,EAAE;EAAK,CAAC,CAAC;AACjE,CAAC;AACD,IAAIC,WAAW,GAAGA,CAACC,EAAE,EAAEC,IAAI,EAAEC,MAAM,EAAEC,IAAI,KAAK;EAC5C,IAAIF,IAAI,IAAI,OAAOA,IAAI,KAAK,QAAQ,IAAI,OAAOA,IAAI,KAAK,UAAU,EAAE;IAClE,KAAK,IAAIG,GAAG,IAAIhB,iBAAiB,CAACa,IAAI,CAAC,EACrC,IAAI,CAACX,YAAY,CAACe,IAAI,CAACL,EAAE,EAAEI,GAAG,CAAC,IAAIA,GAAG,KAAKF,MAAM,EAC/CnB,SAAS,CAACiB,EAAE,EAAEI,GAAG,EAAE;MAAEP,GAAG,EAAEA,CAAA,KAAMI,IAAI,CAACG,GAAG,CAAC;MAAEN,UAAU,EAAE,EAAEK,IAAI,GAAGjB,gBAAgB,CAACe,IAAI,EAAEG,GAAG,CAAC,CAAC,IAAID,IAAI,CAACL;IAAW,CAAC,CAAC;EACxH;EACA,OAAOE,EAAE;AACX,CAAC;AACD,IAAIM,YAAY,GAAIC,GAAG,IAAKR,WAAW,CAAChB,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE;EAAEyB,KAAK,EAAE;AAAK,CAAC,CAAC,EAAED,GAAG,CAAC;AAC1F,IAAIE,cAAc,GAAG,CAAC,CAAC;AACvBhB,QAAQ,CAACgB,cAAc,EAAE;EACvBC,iBAAiB,EAAEA,CAAA,KAAMA,iBAAiB;EAC1CC,qBAAqB,EAAEA,CAAA,KAAMA,qBAAqB;EAClDC,sBAAsB,EAAEA,CAAA,KAAMA,sBAAsB;EACpDC,UAAU,EAAEA,CAAA,KAAMA,UAAU;EAC5BC,aAAa,EAAEA,CAAA,KAAMA;AACvB,CAAC,CAAC;AACFC,MAAM,CAACC,OAAO,GAAGV,YAAY,CAACG,cAAc,CAAC;AAC7C,IAAIQ,WAAW,GAAGC,OAAO,CAAC,MAAM,CAAC;AACjC,SAASC,wBAAwBA,CAACC,IAAI,EAAE;EACtC,IAAIA,IAAI,KAAK,KAAK,CAAC,EAAE;IACnB,MAAM,IAAIC,cAAc,CAAC,2DAA2D,CAAC;EACvF;EACA,OAAOD,IAAI;AACb;AACA,SAASE,WAAWA,CAACC,KAAK,EAAEC,OAAO,EAAEC,IAAI,EAAE;EACzCD,OAAO,GAAGE,iBAAiB,CAACF,OAAO,CAAC;EACpC,OAAOG,4BAA4B,CAACJ,KAAK,EAAEK,4BAA4B,CAAC,CAAC,GAAGC,OAAO,CAACC,SAAS,CAACN,OAAO,EAAEC,IAAI,IAAI,EAAE,EAAEC,iBAAiB,CAACH,KAAK,CAAC,CAACQ,WAAW,CAAC,GAAGP,OAAO,CAACQ,KAAK,CAACT,KAAK,EAAEE,IAAI,CAAC,CAAC;AACxL;AACA,SAASQ,iBAAiBA,CAACC,QAAQ,EAAEC,WAAW,EAAE;EAChD,IAAI,EAAED,QAAQ,YAAYC,WAAW,CAAC,EAAE;IACtC,MAAM,IAAIC,SAAS,CAAC,mCAAmC,CAAC;EAC1D;AACF;AACA,SAASC,UAAUA,CAACC,MAAM,EAAEb,IAAI,EAAEc,KAAK,EAAE;EACvC,IAAIX,4BAA4B,CAAC,CAAC,EAAE;IAClCS,UAAU,GAAGR,OAAO,CAACC,SAAS;EAChC,CAAC,MAAM;IACLO,UAAU,GAAG,SAASP,SAASA,CAACU,OAAO,EAAEC,KAAK,EAAEC,MAAM,EAAE;MACtD,IAAIC,CAAC,GAAG,CACN,IAAI,CACL;MACDA,CAAC,CAACC,IAAI,CAACZ,KAAK,CAACW,CAAC,EAAEF,KAAK,CAAC;MACtB,IAAIN,WAAW,GAAGU,QAAQ,CAACC,IAAI,CAACd,KAAK,CAACQ,OAAO,EAAEG,CAAC,CAAC;MACjD,IAAIT,QAAQ,GAAG,IAAIC,WAAW,CAAC,CAAC;MAChC,IAAIO,MAAM,EAAEK,iBAAiB,CAACb,QAAQ,EAAEQ,MAAM,CAACnD,SAAS,CAAC;MACzD,OAAO2C,QAAQ;IACjB,CAAC;EACH;EACA,OAAOG,UAAU,CAACL,KAAK,CAAC,IAAI,EAAEgB,SAAS,CAAC;AAC1C;AACA,SAAStB,iBAAiBA,CAACuB,CAAC,EAAE;EAC5BvB,iBAAiB,GAAG1C,MAAM,CAACkE,cAAc,GAAGlE,MAAM,CAACmE,cAAc,GAAG,SAASA,cAAcA,CAACC,EAAE,EAAE;IAC9F,OAAOA,EAAE,CAACC,SAAS,IAAIrE,MAAM,CAACmE,cAAc,CAACC,EAAE,CAAC;EAClD,CAAC;EACD,OAAO1B,iBAAiB,CAACuB,CAAC,CAAC;AAC7B;AACA,SAASK,SAASA,CAACC,QAAQ,EAAEC,UAAU,EAAE;EACvC,IAAI,OAAOA,UAAU,KAAK,UAAU,IAAIA,UAAU,KAAK,IAAI,EAAE;IAC3D,MAAM,IAAIpB,SAAS,CAAC,oDAAoD,CAAC;EAC3E;EACAmB,QAAQ,CAAChE,SAAS,GAAGP,MAAM,CAACyE,MAAM,CAACD,UAAU,IAAIA,UAAU,CAACjE,SAAS,EAAE;IACrEwC,WAAW,EAAE;MACXvB,KAAK,EAAE+C,QAAQ;MACfG,QAAQ,EAAE,IAAI;MACdC,YAAY,EAAE;IAChB;EACF,CAAC,CAAC;EACF,IAAIH,UAAU,EAAET,iBAAiB,CAACQ,QAAQ,EAAEC,UAAU,CAAC;AACzD;AACA,SAASI,WAAWA,CAACC,IAAI,EAAEC,KAAK,EAAE;EAChC,IAAIA,KAAK,IAAI,IAAI,IAAI,OAAOC,MAAM,KAAK,WAAW,IAAID,KAAK,CAACC,MAAM,CAACC,WAAW,CAAC,EAAE;IAC/E,OAAO,CAAC,CAACF,KAAK,CAACC,MAAM,CAACC,WAAW,CAAC,CAACH,IAAI,CAAC;EAC1C,CAAC,MAAM;IACL,OAAOA,IAAI,YAAYC,KAAK;EAC9B;AACF;AACA,SAASG,mBAAmBA,CAACC,EAAE,EAAE;EAC/B,OAAOrB,QAAQ,CAACsB,QAAQ,CAAC9D,IAAI,CAAC6D,EAAE,CAAC,CAACE,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AACnE;AACA,SAASzC,4BAA4BA,CAACP,IAAI,EAAEf,IAAI,EAAE;EAChD,IAAIA,IAAI,KAAKgE,QAAQ,CAAChE,IAAI,CAAC,KAAK,QAAQ,IAAI,OAAOA,IAAI,KAAK,UAAU,CAAC,EAAE;IACvE,OAAOA,IAAI;EACb;EACA,OAAOc,wBAAwB,CAACC,IAAI,CAAC;AACvC;AACA,SAAS2B,iBAAiBA,CAACE,CAAC,EAAEqB,CAAC,EAAE;EAC/BvB,iBAAiB,GAAG/D,MAAM,CAACkE,cAAc,IAAI,SAASA,cAAcA,CAACE,EAAE,EAAEmB,EAAE,EAAE;IAC3EnB,EAAE,CAACC,SAAS,GAAGkB,EAAE;IACjB,OAAOnB,EAAE;EACX,CAAC;EACD,OAAOL,iBAAiB,CAACE,CAAC,EAAEqB,CAAC,CAAC;AAChC;AACA,SAASD,QAAQA,CAACG,GAAG,EAAE;EACrB,uBAAuB;;EACvB,OAAOA,GAAG,IAAI,OAAOT,MAAM,KAAK,WAAW,IAAIS,GAAG,CAACzC,WAAW,KAAKgC,MAAM,GAAG,QAAQ,GAAG,OAAOS,GAAG;AACnG;AACA,SAASC,kBAAkBA,CAAClC,KAAK,EAAE;EACjC,IAAImC,MAAM,GAAG,OAAOC,GAAG,KAAK,UAAU,GAAG,eAAgB,IAAIA,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;EAC3EF,kBAAkB,GAAG,SAASG,eAAeA,CAAClC,MAAM,EAAE;IACpD,IAAIA,MAAM,KAAK,IAAI,IAAI,CAACuB,mBAAmB,CAACvB,MAAM,CAAC,EAAE,OAAOA,MAAM;IAClE,IAAI,OAAOA,MAAM,KAAK,UAAU,EAAE;MAChC,MAAM,IAAIN,SAAS,CAAC,oDAAoD,CAAC;IAC3E;IACA,IAAI,OAAOsC,MAAM,KAAK,WAAW,EAAE;MACjC,IAAIA,MAAM,CAACG,GAAG,CAACnC,MAAM,CAAC,EAAE,OAAOgC,MAAM,CAAC7E,GAAG,CAAC6C,MAAM,CAAC;MACjDgC,MAAM,CAACI,GAAG,CAACpC,MAAM,EAAEqC,OAAO,CAAC;IAC7B;IACA,SAASA,OAAOA,CAAA,EAAG;MACjB,OAAO1C,UAAU,CAACK,MAAM,EAAEM,SAAS,EAAEtB,iBAAiB,CAAC,IAAI,CAAC,CAACK,WAAW,CAAC;IAC3E;IACAgD,OAAO,CAACxF,SAAS,GAAGP,MAAM,CAACyE,MAAM,CAACf,MAAM,CAACnD,SAAS,EAAE;MAClDwC,WAAW,EAAE;QACXvB,KAAK,EAAEuE,OAAO;QACdjF,UAAU,EAAE,KAAK;QACjB4D,QAAQ,EAAE,IAAI;QACdC,YAAY,EAAE;MAChB;IACF,CAAC,CAAC;IACF,OAAOZ,iBAAiB,CAACgC,OAAO,EAAErC,MAAM,CAAC;EAC3C,CAAC;EACD,OAAO+B,kBAAkB,CAAClC,KAAK,CAAC;AAClC;AACA,SAASX,4BAA4BA,CAAA,EAAG;EACtC,IAAI;IACF,IAAIoD,MAAM,GAAG,CAACC,OAAO,CAAC1F,SAAS,CAAC2F,OAAO,CAAC7E,IAAI,CAACwB,OAAO,CAACC,SAAS,CAACmD,OAAO,EAAE,EAAE,EAAE,YAAW,CACvF,CAAC,CAAC,CAAC;EACL,CAAC,CAAC,OAAOE,CAAC,EAAE,CACZ;EACA,OAAO,CAACvD,4BAA4B,GAAG,SAAAA,CAAA,EAAW;IAChD,OAAO,CAAC,CAACoD,MAAM;EACjB,CAAC,EAAE,CAAC;AACN;AACA,IAAIrE,qBAAqB,GAAG,eAAiB,UAASyE,MAAM,EAAE;EAC5D,YAAY;;EACZ9B,SAAS,CAAC+B,sBAAsB,EAAED,MAAM,CAAC;EACzC,SAASC,sBAAsBA,CAAA,EAAG;IAChCpD,iBAAiB,CAAC,IAAI,EAAEoD,sBAAsB,CAAC;IAC/C,OAAO/D,WAAW,CAAC,IAAI,EAAE+D,sBAAsB,EAAErC,SAAS,CAAC;EAC7D;EACA,OAAOqC,sBAAsB;AAC/B,CAAC,CAAEZ,kBAAkB,CAACa,KAAK,CAAC,CAAC;AAC7B,IAAI5E,iBAAiB,GAAG,eAAiB,UAAS0E,MAAM,EAAE;EACxD,YAAY;;EACZ9B,SAAS,CAACiC,kBAAkB,EAAEH,MAAM,CAAC;EACrC,SAASG,kBAAkBA,CAAA,EAAG;IAC5BtD,iBAAiB,CAAC,IAAI,EAAEsD,kBAAkB,CAAC;IAC3C,OAAOjE,WAAW,CAAC,IAAI,EAAEiE,kBAAkB,EAAEvC,SAAS,CAAC;EACzD;EACA,OAAOuC,kBAAkB;AAC3B,CAAC,CAAEd,kBAAkB,CAACa,KAAK,CAAC,CAAC;AAC7B,eAAe1E,sBAAsBA,CAAC4E,UAAU,EAAEC,GAAG,EAAEC,YAAY,EAAE;EACnE,IAAIC,UAAU,GAAGF,GAAG,CAACG,OAAO,CAAC/F,GAAG,CAAC,eAAe,CAAC;EACjD,IAAIgG,MAAM,GAAGF,UAAU,KAAK,IAAI,IAAIA,UAAU,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,UAAU,CAACG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;EACnG,IAAIC,UAAU,GAAG,IAAIC,OAAO,CAACP,GAAG,CAACG,OAAO,CAAC;EACzC,IAAIC,MAAM,EAAE;IACVE,UAAU,CAACjB,GAAG,CAAC,QAAQ,EAAEe,MAAM,CAAC;EAClC;EACA,IAAI;IACF,IAAII,OAAO,GAAG,MAAMT,UAAU,CAACU,GAAG,CAACC,UAAU,CAAC;MAC5CP,OAAO,EAAEG;IACX,CAAC,CAAC;IACF,IAAIE,OAAO,KAAK,IAAI,IAAIA,OAAO,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,OAAO,CAACG,IAAI,EAAE;MAClE,OAAO;QACLC,EAAE,EAAEJ,OAAO,CAACG,IAAI,CAACC,EAAE;QACnBC,KAAK,EAAEL,OAAO,CAACG,IAAI,CAACE,KAAK,IAAI,KAAK,CAAC;QACnCC,IAAI,EAAEN,OAAO,CAACG,IAAI,CAACG,IAAI,KAAK,OAAO,GAAG,OAAO,GAAG,KAAK;MACvD,CAAC;IACH;EACF,CAAC,CAAC,OAAOC,GAAG,EAAE;IACZC,OAAO,CAACC,IAAI,CAAC,0BAA0B,EAAEF,GAAG,CAAC;EAC/C;EACA,IAAIG,QAAQ,GAAGhB,UAAU,KAAK,IAAI,IAAIA,UAAU,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,UAAU,CAACiB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;EACxG,IAAID,QAAQ,EAAE;IACZ,IAAI;MACF,IAAIE,OAAO,GAAG,MAAM/F,aAAa,CAAC6F,QAAQ,EAAEjB,YAAY,CAAC;MACzD,IAAIoB,MAAM,GAAG,CAACD,OAAO,KAAK,IAAI,IAAIA,OAAO,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,OAAO,CAACR,EAAE,MAAMQ,OAAO,KAAK,IAAI,IAAIA,OAAO,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,OAAO,CAACE,GAAG,CAAC;MAC9I,IAAID,MAAM,EAAE;QACV,OAAO;UACLT,EAAE,EAAES,MAAM;UACVR,KAAK,EAAEO,OAAO,CAACP,KAAK;UACpBC,IAAI,EAAEM,OAAO,CAACN,IAAI,KAAK,OAAO,GAAG,OAAO,GAAG,KAAK;QAClD,CAAC;MACH;IACF,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZ,IAAI,CAAC5C,WAAW,CAAC4C,GAAG,EAAE9F,iBAAiB,CAAC,EAAE;QACxC,MAAM8F,GAAG;MACX;IACF;EACF;EACA,OAAO,IAAI;AACb;AACA,eAAe1F,aAAaA,CAACkG,KAAK,EAAEC,OAAO,EAAE;EAC3C,IAAI;IAAEC,OAAO,GAAGC,OAAO,CAACC,GAAG,CAACC,cAAc;IAAEC,WAAW,GAAGH,OAAO,CAACC,GAAG,CAACG,YAAY,IAAI,EAAE;IAAEC,QAAQ,GAAG;EAAiB,CAAC,GAAGP,OAAO,IAAI,CAAC,CAAC;EACvI,IAAI,CAACC,OAAO,EAAE;IACZ,MAAM,IAAI5B,KAAK,CAAC,aAAa,CAAC;EAChC;EACA,IAAImC,iBAAiB,GAAGC,mBAAmB,CAACR,OAAO,CAAC;EACpD,IAAIS,GAAG,GAAG,GAAGL,WAAW,IAAIG,iBAAiB,GAAGD,QAAQ,EAAE;EAC1D,IAAII,IAAI,GAAG,CAAC,CAAC,EAAE3G,WAAW,CAAC4G,kBAAkB,EAAE,IAAIC,GAAG,CAACH,GAAG,CAAC,CAAC;EAC5D,IAAI;IACF,IAAII,aAAa,GAAGT,WAAW,GAAG,CAAC,CAAC,GAAG;MACrCU,MAAM,EAAEP,iBAAiB;MACzBQ,QAAQ,EAAER;IACZ,CAAC;IACD,IAAI;MAAEZ;IAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE5F,WAAW,CAACiH,SAAS,EAAElB,KAAK,EAAEY,IAAI,EAAEG,aAAa,CAAC;IAC9E,OAAOlB,OAAO;EAChB,CAAC,CAAC,OAAOsB,KAAK,EAAE;IACd,MAAM,IAAIzH,iBAAiB,CAAC,GAAGyH,KAAK,EAAE,CAAC;EACzC;AACF;AACA,eAAetH,UAAUA,CAACmG,KAAK,EAAEC,OAAO,EAAE;EACxC,IAAI;IACF,MAAMnG,aAAa,CAACkG,KAAK,EAAEC,OAAO,CAAC;IACnC,OAAO,IAAI;EACb,CAAC,CAAC,OAAOmB,CAAC,EAAE;IACV,OAAO,KAAK;EACd;AACF;AACA,SAASV,mBAAmBA,CAACW,GAAG,EAAE;EAChC,OAAOA,GAAG,CAACzB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AAC/B","ignoreList":[]}
+{"version":3,"names":["__defProp","Object","defineProperty","__getOwnPropDesc","getOwnPropertyDescriptor","__getOwnPropNames","getOwnPropertyNames","__hasOwnProp","prototype","hasOwnProperty","__export","target","all","name","get","enumerable","__copyProps","to","from","except","desc","key","call","__toCommonJS","mod","value","server_exports","InvalidTokenError","NotAuthenticatedError","getAuthDataFromRequest","isValidJWT","validateToken","module","exports","import_jose","require","_assert_this_initialized","self","ReferenceError","_call_super","_this","derived","args","_get_prototype_of","_possible_constructor_return","_is_native_reflect_construct","Reflect","construct","constructor","apply","_class_call_check","instance","Constructor","TypeError","_construct","Parent","Class","Parent2","args2","Class2","a","push","Function","bind","_set_prototype_of","arguments","o","setPrototypeOf","getPrototypeOf","o2","__proto__","_inherits","subClass","superClass","create","writable","configurable","_instanceof","left","right","Symbol","hasInstance","_is_native_function","fn","toString","indexOf","_type_of","p","p2","obj","_wrap_native_super","_cache","Map","wrapNativeSuper","has","set","Wrapper","result","Boolean","valueOf","_","Error1","NotAuthenticatedError2","Error","InvalidTokenError2","authServer","req","tokenOptions","authHeader","headers","session","api","getSession","user","id","email","role","err","console","warn","jwtToken","replace","payload","userId","sub","token","options","baseUrl","process","env","ONE_SERVER_URL","forceIssuer","FORCE_ISSUER","jwksPath","normalizedBaseUrl","removeTrailingSlash","url","JWKS","createRemoteJWKSet","URL","verifyOptions","issuer","audience","jwtVerify","error","e","str"],"sources":["server.native.js"],"sourcesContent":["\"use strict\";\nvar __defProp = Object.defineProperty;\nvar __getOwnPropDesc = Object.getOwnPropertyDescriptor;\nvar __getOwnPropNames = Object.getOwnPropertyNames;\nvar __hasOwnProp = Object.prototype.hasOwnProperty;\nvar __export = (target, all) => {\n  for (var name in all)\n    __defProp(target, name, { get: all[name], enumerable: true });\n};\nvar __copyProps = (to, from, except, desc) => {\n  if (from && typeof from === \"object\" || typeof from === \"function\") {\n    for (let key of __getOwnPropNames(from))\n      if (!__hasOwnProp.call(to, key) && key !== except)\n        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });\n  }\n  return to;\n};\nvar __toCommonJS = (mod) => __copyProps(__defProp({}, \"__esModule\", { value: true }), mod);\nvar server_exports = {};\n__export(server_exports, {\n  InvalidTokenError: () => InvalidTokenError,\n  NotAuthenticatedError: () => NotAuthenticatedError,\n  getAuthDataFromRequest: () => getAuthDataFromRequest,\n  isValidJWT: () => isValidJWT,\n  validateToken: () => validateToken\n});\nmodule.exports = __toCommonJS(server_exports);\nvar import_jose = require(\"jose\");\nfunction _assert_this_initialized(self) {\n  if (self === void 0) {\n    throw new ReferenceError(\"this hasn't been initialised - super() hasn't been called\");\n  }\n  return self;\n}\nfunction _call_super(_this, derived, args) {\n  derived = _get_prototype_of(derived);\n  return _possible_constructor_return(_this, _is_native_reflect_construct() ? Reflect.construct(derived, args || [], _get_prototype_of(_this).constructor) : derived.apply(_this, args));\n}\nfunction _class_call_check(instance, Constructor) {\n  if (!(instance instanceof Constructor)) {\n    throw new TypeError(\"Cannot call a class as a function\");\n  }\n}\nfunction _construct(Parent, args, Class) {\n  if (_is_native_reflect_construct()) {\n    _construct = Reflect.construct;\n  } else {\n    _construct = function construct(Parent2, args2, Class2) {\n      var a = [\n        null\n      ];\n      a.push.apply(a, args2);\n      var Constructor = Function.bind.apply(Parent2, a);\n      var instance = new Constructor();\n      if (Class2) _set_prototype_of(instance, Class2.prototype);\n      return instance;\n    };\n  }\n  return _construct.apply(null, arguments);\n}\nfunction _get_prototype_of(o) {\n  _get_prototype_of = Object.setPrototypeOf ? Object.getPrototypeOf : function getPrototypeOf(o2) {\n    return o2.__proto__ || Object.getPrototypeOf(o2);\n  };\n  return _get_prototype_of(o);\n}\nfunction _inherits(subClass, superClass) {\n  if (typeof superClass !== \"function\" && superClass !== null) {\n    throw new TypeError(\"Super expression must either be null or a function\");\n  }\n  subClass.prototype = Object.create(superClass && superClass.prototype, {\n    constructor: {\n      value: subClass,\n      writable: true,\n      configurable: true\n    }\n  });\n  if (superClass) _set_prototype_of(subClass, superClass);\n}\nfunction _instanceof(left, right) {\n  if (right != null && typeof Symbol !== \"undefined\" && right[Symbol.hasInstance]) {\n    return !!right[Symbol.hasInstance](left);\n  } else {\n    return left instanceof right;\n  }\n}\nfunction _is_native_function(fn) {\n  return Function.toString.call(fn).indexOf(\"[native code]\") !== -1;\n}\nfunction _possible_constructor_return(self, call) {\n  if (call && (_type_of(call) === \"object\" || typeof call === \"function\")) {\n    return call;\n  }\n  return _assert_this_initialized(self);\n}\nfunction _set_prototype_of(o, p) {\n  _set_prototype_of = Object.setPrototypeOf || function setPrototypeOf(o2, p2) {\n    o2.__proto__ = p2;\n    return o2;\n  };\n  return _set_prototype_of(o, p);\n}\nfunction _type_of(obj) {\n  \"@swc/helpers - typeof\";\n  return obj && typeof Symbol !== \"undefined\" && obj.constructor === Symbol ? \"symbol\" : typeof obj;\n}\nfunction _wrap_native_super(Class) {\n  var _cache = typeof Map === \"function\" ? /* @__PURE__ */ new Map() : void 0;\n  _wrap_native_super = function wrapNativeSuper(Class2) {\n    if (Class2 === null || !_is_native_function(Class2)) return Class2;\n    if (typeof Class2 !== \"function\") {\n      throw new TypeError(\"Super expression must either be null or a function\");\n    }\n    if (typeof _cache !== \"undefined\") {\n      if (_cache.has(Class2)) return _cache.get(Class2);\n      _cache.set(Class2, Wrapper);\n    }\n    function Wrapper() {\n      return _construct(Class2, arguments, _get_prototype_of(this).constructor);\n    }\n    Wrapper.prototype = Object.create(Class2.prototype, {\n      constructor: {\n        value: Wrapper,\n        enumerable: false,\n        writable: true,\n        configurable: true\n      }\n    });\n    return _set_prototype_of(Wrapper, Class2);\n  };\n  return _wrap_native_super(Class);\n}\nfunction _is_native_reflect_construct() {\n  try {\n    var result = !Boolean.prototype.valueOf.call(Reflect.construct(Boolean, [], function() {\n    }));\n  } catch (_) {\n  }\n  return (_is_native_reflect_construct = function() {\n    return !!result;\n  })();\n}\nvar NotAuthenticatedError = /* @__PURE__ */ (function(Error1) {\n  \"use strict\";\n  _inherits(NotAuthenticatedError2, Error1);\n  function NotAuthenticatedError2() {\n    _class_call_check(this, NotAuthenticatedError2);\n    return _call_super(this, NotAuthenticatedError2, arguments);\n  }\n  return NotAuthenticatedError2;\n})(_wrap_native_super(Error));\nvar InvalidTokenError = /* @__PURE__ */ (function(Error1) {\n  \"use strict\";\n  _inherits(InvalidTokenError2, Error1);\n  function InvalidTokenError2() {\n    _class_call_check(this, InvalidTokenError2);\n    return _call_super(this, InvalidTokenError2, arguments);\n  }\n  return InvalidTokenError2;\n})(_wrap_native_super(Error));\nasync function getAuthDataFromRequest(authServer, req, tokenOptions) {\n  var authHeader = req.headers.get(\"authorization\");\n  try {\n    var session = await authServer.api.getSession({\n      headers: req.headers\n    });\n    if (session === null || session === void 0 ? void 0 : session.user) {\n      return {\n        id: session.user.id,\n        email: session.user.email || void 0,\n        role: session.user.role === \"admin\" ? \"admin\" : void 0\n      };\n    }\n  } catch (err) {\n    console.warn(`Error validating session`, err);\n  }\n  var jwtToken = authHeader === null || authHeader === void 0 ? void 0 : authHeader.replace(\"Bearer \", \"\");\n  if (jwtToken) {\n    try {\n      var payload = await validateToken(jwtToken, tokenOptions);\n      var userId = (payload === null || payload === void 0 ? void 0 : payload.id) || (payload === null || payload === void 0 ? void 0 : payload.sub);\n      if (userId) {\n        return {\n          id: userId,\n          email: payload.email,\n          role: payload.role === \"admin\" ? \"admin\" : void 0\n        };\n      }\n    } catch (err) {\n      if (!_instanceof(err, InvalidTokenError)) {\n        throw err;\n      }\n    }\n  }\n  return null;\n}\nasync function validateToken(token, options) {\n  var { baseUrl = process.env.ONE_SERVER_URL, forceIssuer = process.env.FORCE_ISSUER || \"\", jwksPath = \"/api/auth/jwks\" } = options || {};\n  if (!baseUrl) {\n    throw new Error(`No baseURL!`);\n  }\n  var normalizedBaseUrl = removeTrailingSlash(baseUrl);\n  var url = `${forceIssuer || normalizedBaseUrl}${jwksPath}`;\n  var JWKS = (0, import_jose.createRemoteJWKSet)(new URL(url));\n  try {\n    var verifyOptions = forceIssuer ? {} : {\n      issuer: normalizedBaseUrl,\n      audience: normalizedBaseUrl\n    };\n    var { payload } = await (0, import_jose.jwtVerify)(token, JWKS, verifyOptions);\n    return payload;\n  } catch (error) {\n    throw new InvalidTokenError(`${error}`);\n  }\n}\nasync function isValidJWT(token, options) {\n  try {\n    await validateToken(token, options);\n    return true;\n  } catch (e) {\n    return false;\n  }\n}\nfunction removeTrailingSlash(str) {\n  return str.replace(/\\/$/, \"\");\n}\n//# sourceMappingURL=server.js.map\n"],"mappings":"AAAA,YAAY;;AACZ,IAAIA,SAAS,GAAGC,MAAM,CAACC,cAAc;AACrC,IAAIC,gBAAgB,GAAGF,MAAM,CAACG,wBAAwB;AACtD,IAAIC,iBAAiB,GAAGJ,MAAM,CAACK,mBAAmB;AAClD,IAAIC,YAAY,GAAGN,MAAM,CAACO,SAAS,CAACC,cAAc;AAClD,IAAIC,QAAQ,GAAGA,CAACC,MAAM,EAAEC,GAAG,KAAK;EAC9B,KAAK,IAAIC,IAAI,IAAID,GAAG,EAClBZ,SAAS,CAACW,MAAM,EAAEE,IAAI,EAAE;IAAEC,GAAG,EAAEF,GAAG,CAACC,IAAI,CAAC;IAAEE,UAAU,EAAE;EAAK,CAAC,CAAC;AACjE,CAAC;AACD,IAAIC,WAAW,GAAGA,CAACC,EAAE,EAAEC,IAAI,EAAEC,MAAM,EAAEC,IAAI,KAAK;EAC5C,IAAIF,IAAI,IAAI,OAAOA,IAAI,KAAK,QAAQ,IAAI,OAAOA,IAAI,KAAK,UAAU,EAAE;IAClE,KAAK,IAAIG,GAAG,IAAIhB,iBAAiB,CAACa,IAAI,CAAC,EACrC,IAAI,CAACX,YAAY,CAACe,IAAI,CAACL,EAAE,EAAEI,GAAG,CAAC,IAAIA,GAAG,KAAKF,MAAM,EAC/CnB,SAAS,CAACiB,EAAE,EAAEI,GAAG,EAAE;MAAEP,GAAG,EAAEA,CAAA,KAAMI,IAAI,CAACG,GAAG,CAAC;MAAEN,UAAU,EAAE,EAAEK,IAAI,GAAGjB,gBAAgB,CAACe,IAAI,EAAEG,GAAG,CAAC,CAAC,IAAID,IAAI,CAACL;IAAW,CAAC,CAAC;EACxH;EACA,OAAOE,EAAE;AACX,CAAC;AACD,IAAIM,YAAY,GAAIC,GAAG,IAAKR,WAAW,CAAChB,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE;EAAEyB,KAAK,EAAE;AAAK,CAAC,CAAC,EAAED,GAAG,CAAC;AAC1F,IAAIE,cAAc,GAAG,CAAC,CAAC;AACvBhB,QAAQ,CAACgB,cAAc,EAAE;EACvBC,iBAAiB,EAAEA,CAAA,KAAMA,iBAAiB;EAC1CC,qBAAqB,EAAEA,CAAA,KAAMA,qBAAqB;EAClDC,sBAAsB,EAAEA,CAAA,KAAMA,sBAAsB;EACpDC,UAAU,EAAEA,CAAA,KAAMA,UAAU;EAC5BC,aAAa,EAAEA,CAAA,KAAMA;AACvB,CAAC,CAAC;AACFC,MAAM,CAACC,OAAO,GAAGV,YAAY,CAACG,cAAc,CAAC;AAC7C,IAAIQ,WAAW,GAAGC,OAAO,CAAC,MAAM,CAAC;AACjC,SAASC,wBAAwBA,CAACC,IAAI,EAAE;EACtC,IAAIA,IAAI,KAAK,KAAK,CAAC,EAAE;IACnB,MAAM,IAAIC,cAAc,CAAC,2DAA2D,CAAC;EACvF;EACA,OAAOD,IAAI;AACb;AACA,SAASE,WAAWA,CAACC,KAAK,EAAEC,OAAO,EAAEC,IAAI,EAAE;EACzCD,OAAO,GAAGE,iBAAiB,CAACF,OAAO,CAAC;EACpC,OAAOG,4BAA4B,CAACJ,KAAK,EAAEK,4BAA4B,CAAC,CAAC,GAAGC,OAAO,CAACC,SAAS,CAACN,OAAO,EAAEC,IAAI,IAAI,EAAE,EAAEC,iBAAiB,CAACH,KAAK,CAAC,CAACQ,WAAW,CAAC,GAAGP,OAAO,CAACQ,KAAK,CAACT,KAAK,EAAEE,IAAI,CAAC,CAAC;AACxL;AACA,SAASQ,iBAAiBA,CAACC,QAAQ,EAAEC,WAAW,EAAE;EAChD,IAAI,EAAED,QAAQ,YAAYC,WAAW,CAAC,EAAE;IACtC,MAAM,IAAIC,SAAS,CAAC,mCAAmC,CAAC;EAC1D;AACF;AACA,SAASC,UAAUA,CAACC,MAAM,EAAEb,IAAI,EAAEc,KAAK,EAAE;EACvC,IAAIX,4BAA4B,CAAC,CAAC,EAAE;IAClCS,UAAU,GAAGR,OAAO,CAACC,SAAS;EAChC,CAAC,MAAM;IACLO,UAAU,GAAG,SAASP,SAASA,CAACU,OAAO,EAAEC,KAAK,EAAEC,MAAM,EAAE;MACtD,IAAIC,CAAC,GAAG,CACN,IAAI,CACL;MACDA,CAAC,CAACC,IAAI,CAACZ,KAAK,CAACW,CAAC,EAAEF,KAAK,CAAC;MACtB,IAAIN,WAAW,GAAGU,QAAQ,CAACC,IAAI,CAACd,KAAK,CAACQ,OAAO,EAAEG,CAAC,CAAC;MACjD,IAAIT,QAAQ,GAAG,IAAIC,WAAW,CAAC,CAAC;MAChC,IAAIO,MAAM,EAAEK,iBAAiB,CAACb,QAAQ,EAAEQ,MAAM,CAACnD,SAAS,CAAC;MACzD,OAAO2C,QAAQ;IACjB,CAAC;EACH;EACA,OAAOG,UAAU,CAACL,KAAK,CAAC,IAAI,EAAEgB,SAAS,CAAC;AAC1C;AACA,SAAStB,iBAAiBA,CAACuB,CAAC,EAAE;EAC5BvB,iBAAiB,GAAG1C,MAAM,CAACkE,cAAc,GAAGlE,MAAM,CAACmE,cAAc,GAAG,SAASA,cAAcA,CAACC,EAAE,EAAE;IAC9F,OAAOA,EAAE,CAACC,SAAS,IAAIrE,MAAM,CAACmE,cAAc,CAACC,EAAE,CAAC;EAClD,CAAC;EACD,OAAO1B,iBAAiB,CAACuB,CAAC,CAAC;AAC7B;AACA,SAASK,SAASA,CAACC,QAAQ,EAAEC,UAAU,EAAE;EACvC,IAAI,OAAOA,UAAU,KAAK,UAAU,IAAIA,UAAU,KAAK,IAAI,EAAE;IAC3D,MAAM,IAAIpB,SAAS,CAAC,oDAAoD,CAAC;EAC3E;EACAmB,QAAQ,CAAChE,SAAS,GAAGP,MAAM,CAACyE,MAAM,CAACD,UAAU,IAAIA,UAAU,CAACjE,SAAS,EAAE;IACrEwC,WAAW,EAAE;MACXvB,KAAK,EAAE+C,QAAQ;MACfG,QAAQ,EAAE,IAAI;MACdC,YAAY,EAAE;IAChB;EACF,CAAC,CAAC;EACF,IAAIH,UAAU,EAAET,iBAAiB,CAACQ,QAAQ,EAAEC,UAAU,CAAC;AACzD;AACA,SAASI,WAAWA,CAACC,IAAI,EAAEC,KAAK,EAAE;EAChC,IAAIA,KAAK,IAAI,IAAI,IAAI,OAAOC,MAAM,KAAK,WAAW,IAAID,KAAK,CAACC,MAAM,CAACC,WAAW,CAAC,EAAE;IAC/E,OAAO,CAAC,CAACF,KAAK,CAACC,MAAM,CAACC,WAAW,CAAC,CAACH,IAAI,CAAC;EAC1C,CAAC,MAAM;IACL,OAAOA,IAAI,YAAYC,KAAK;EAC9B;AACF;AACA,SAASG,mBAAmBA,CAACC,EAAE,EAAE;EAC/B,OAAOrB,QAAQ,CAACsB,QAAQ,CAAC9D,IAAI,CAAC6D,EAAE,CAAC,CAACE,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AACnE;AACA,SAASzC,4BAA4BA,CAACP,IAAI,EAAEf,IAAI,EAAE;EAChD,IAAIA,IAAI,KAAKgE,QAAQ,CAAChE,IAAI,CAAC,KAAK,QAAQ,IAAI,OAAOA,IAAI,KAAK,UAAU,CAAC,EAAE;IACvE,OAAOA,IAAI;EACb;EACA,OAAOc,wBAAwB,CAACC,IAAI,CAAC;AACvC;AACA,SAAS2B,iBAAiBA,CAACE,CAAC,EAAEqB,CAAC,EAAE;EAC/BvB,iBAAiB,GAAG/D,MAAM,CAACkE,cAAc,IAAI,SAASA,cAAcA,CAACE,EAAE,EAAEmB,EAAE,EAAE;IAC3EnB,EAAE,CAACC,SAAS,GAAGkB,EAAE;IACjB,OAAOnB,EAAE;EACX,CAAC;EACD,OAAOL,iBAAiB,CAACE,CAAC,EAAEqB,CAAC,CAAC;AAChC;AACA,SAASD,QAAQA,CAACG,GAAG,EAAE;EACrB,uBAAuB;;EACvB,OAAOA,GAAG,IAAI,OAAOT,MAAM,KAAK,WAAW,IAAIS,GAAG,CAACzC,WAAW,KAAKgC,MAAM,GAAG,QAAQ,GAAG,OAAOS,GAAG;AACnG;AACA,SAASC,kBAAkBA,CAAClC,KAAK,EAAE;EACjC,IAAImC,MAAM,GAAG,OAAOC,GAAG,KAAK,UAAU,GAAG,eAAgB,IAAIA,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;EAC3EF,kBAAkB,GAAG,SAASG,eAAeA,CAAClC,MAAM,EAAE;IACpD,IAAIA,MAAM,KAAK,IAAI,IAAI,CAACuB,mBAAmB,CAACvB,MAAM,CAAC,EAAE,OAAOA,MAAM;IAClE,IAAI,OAAOA,MAAM,KAAK,UAAU,EAAE;MAChC,MAAM,IAAIN,SAAS,CAAC,oDAAoD,CAAC;IAC3E;IACA,IAAI,OAAOsC,MAAM,KAAK,WAAW,EAAE;MACjC,IAAIA,MAAM,CAACG,GAAG,CAACnC,MAAM,CAAC,EAAE,OAAOgC,MAAM,CAAC7E,GAAG,CAAC6C,MAAM,CAAC;MACjDgC,MAAM,CAACI,GAAG,CAACpC,MAAM,EAAEqC,OAAO,CAAC;IAC7B;IACA,SAASA,OAAOA,CAAA,EAAG;MACjB,OAAO1C,UAAU,CAACK,MAAM,EAAEM,SAAS,EAAEtB,iBAAiB,CAAC,IAAI,CAAC,CAACK,WAAW,CAAC;IAC3E;IACAgD,OAAO,CAACxF,SAAS,GAAGP,MAAM,CAACyE,MAAM,CAACf,MAAM,CAACnD,SAAS,EAAE;MAClDwC,WAAW,EAAE;QACXvB,KAAK,EAAEuE,OAAO;QACdjF,UAAU,EAAE,KAAK;QACjB4D,QAAQ,EAAE,IAAI;QACdC,YAAY,EAAE;MAChB;IACF,CAAC,CAAC;IACF,OAAOZ,iBAAiB,CAACgC,OAAO,EAAErC,MAAM,CAAC;EAC3C,CAAC;EACD,OAAO+B,kBAAkB,CAAClC,KAAK,CAAC;AAClC;AACA,SAASX,4BAA4BA,CAAA,EAAG;EACtC,IAAI;IACF,IAAIoD,MAAM,GAAG,CAACC,OAAO,CAAC1F,SAAS,CAAC2F,OAAO,CAAC7E,IAAI,CAACwB,OAAO,CAACC,SAAS,CAACmD,OAAO,EAAE,EAAE,EAAE,YAAW,CACvF,CAAC,CAAC,CAAC;EACL,CAAC,CAAC,OAAOE,CAAC,EAAE,CACZ;EACA,OAAO,CAACvD,4BAA4B,GAAG,SAAAA,CAAA,EAAW;IAChD,OAAO,CAAC,CAACoD,MAAM;EACjB,CAAC,EAAE,CAAC;AACN;AACA,IAAIrE,qBAAqB,GAAG,eAAiB,UAASyE,MAAM,EAAE;EAC5D,YAAY;;EACZ9B,SAAS,CAAC+B,sBAAsB,EAAED,MAAM,CAAC;EACzC,SAASC,sBAAsBA,CAAA,EAAG;IAChCpD,iBAAiB,CAAC,IAAI,EAAEoD,sBAAsB,CAAC;IAC/C,OAAO/D,WAAW,CAAC,IAAI,EAAE+D,sBAAsB,EAAErC,SAAS,CAAC;EAC7D;EACA,OAAOqC,sBAAsB;AAC/B,CAAC,CAAEZ,kBAAkB,CAACa,KAAK,CAAC,CAAC;AAC7B,IAAI5E,iBAAiB,GAAG,eAAiB,UAAS0E,MAAM,EAAE;EACxD,YAAY;;EACZ9B,SAAS,CAACiC,kBAAkB,EAAEH,MAAM,CAAC;EACrC,SAASG,kBAAkBA,CAAA,EAAG;IAC5BtD,iBAAiB,CAAC,IAAI,EAAEsD,kBAAkB,CAAC;IAC3C,OAAOjE,WAAW,CAAC,IAAI,EAAEiE,kBAAkB,EAAEvC,SAAS,CAAC;EACzD;EACA,OAAOuC,kBAAkB;AAC3B,CAAC,CAAEd,kBAAkB,CAACa,KAAK,CAAC,CAAC;AAC7B,eAAe1E,sBAAsBA,CAAC4E,UAAU,EAAEC,GAAG,EAAEC,YAAY,EAAE;EACnE,IAAIC,UAAU,GAAGF,GAAG,CAACG,OAAO,CAAC/F,GAAG,CAAC,eAAe,CAAC;EACjD,IAAI;IACF,IAAIgG,OAAO,GAAG,MAAML,UAAU,CAACM,GAAG,CAACC,UAAU,CAAC;MAC5CH,OAAO,EAAEH,GAAG,CAACG;IACf,CAAC,CAAC;IACF,IAAIC,OAAO,KAAK,IAAI,IAAIA,OAAO,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,OAAO,CAACG,IAAI,EAAE;MAClE,OAAO;QACLC,EAAE,EAAEJ,OAAO,CAACG,IAAI,CAACC,EAAE;QACnBC,KAAK,EAAEL,OAAO,CAACG,IAAI,CAACE,KAAK,IAAI,KAAK,CAAC;QACnCC,IAAI,EAAEN,OAAO,CAACG,IAAI,CAACG,IAAI,KAAK,OAAO,GAAG,OAAO,GAAG,KAAK;MACvD,CAAC;IACH;EACF,CAAC,CAAC,OAAOC,GAAG,EAAE;IACZC,OAAO,CAACC,IAAI,CAAC,0BAA0B,EAAEF,GAAG,CAAC;EAC/C;EACA,IAAIG,QAAQ,GAAGZ,UAAU,KAAK,IAAI,IAAIA,UAAU,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,UAAU,CAACa,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;EACxG,IAAID,QAAQ,EAAE;IACZ,IAAI;MACF,IAAIE,OAAO,GAAG,MAAM3F,aAAa,CAACyF,QAAQ,EAAEb,YAAY,CAAC;MACzD,IAAIgB,MAAM,GAAG,CAACD,OAAO,KAAK,IAAI,IAAIA,OAAO,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,OAAO,CAACR,EAAE,MAAMQ,OAAO,KAAK,IAAI,IAAIA,OAAO,KAAK,KAAK,CAAC,GAAG,KAAK,CAAC,GAAGA,OAAO,CAACE,GAAG,CAAC;MAC9I,IAAID,MAAM,EAAE;QACV,OAAO;UACLT,EAAE,EAAES,MAAM;UACVR,KAAK,EAAEO,OAAO,CAACP,KAAK;UACpBC,IAAI,EAAEM,OAAO,CAACN,IAAI,KAAK,OAAO,GAAG,OAAO,GAAG,KAAK;QAClD,CAAC;MACH;IACF,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZ,IAAI,CAACxC,WAAW,CAACwC,GAAG,EAAE1F,iBAAiB,CAAC,EAAE;QACxC,MAAM0F,GAAG;MACX;IACF;EACF;EACA,OAAO,IAAI;AACb;AACA,eAAetF,aAAaA,CAAC8F,KAAK,EAAEC,OAAO,EAAE;EAC3C,IAAI;IAAEC,OAAO,GAAGC,OAAO,CAACC,GAAG,CAACC,cAAc;IAAEC,WAAW,GAAGH,OAAO,CAACC,GAAG,CAACG,YAAY,IAAI,EAAE;IAAEC,QAAQ,GAAG;EAAiB,CAAC,GAAGP,OAAO,IAAI,CAAC,CAAC;EACvI,IAAI,CAACC,OAAO,EAAE;IACZ,MAAM,IAAIxB,KAAK,CAAC,aAAa,CAAC;EAChC;EACA,IAAI+B,iBAAiB,GAAGC,mBAAmB,CAACR,OAAO,CAAC;EACpD,IAAIS,GAAG,GAAG,GAAGL,WAAW,IAAIG,iBAAiB,GAAGD,QAAQ,EAAE;EAC1D,IAAII,IAAI,GAAG,CAAC,CAAC,EAAEvG,WAAW,CAACwG,kBAAkB,EAAE,IAAIC,GAAG,CAACH,GAAG,CAAC,CAAC;EAC5D,IAAI;IACF,IAAII,aAAa,GAAGT,WAAW,GAAG,CAAC,CAAC,GAAG;MACrCU,MAAM,EAAEP,iBAAiB;MACzBQ,QAAQ,EAAER;IACZ,CAAC;IACD,IAAI;MAAEZ;IAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,EAAExF,WAAW,CAAC6G,SAAS,EAAElB,KAAK,EAAEY,IAAI,EAAEG,aAAa,CAAC;IAC9E,OAAOlB,OAAO;EAChB,CAAC,CAAC,OAAOsB,KAAK,EAAE;IACd,MAAM,IAAIrH,iBAAiB,CAAC,GAAGqH,KAAK,EAAE,CAAC;EACzC;AACF;AACA,eAAelH,UAAUA,CAAC+F,KAAK,EAAEC,OAAO,EAAE;EACxC,IAAI;IACF,MAAM/F,aAAa,CAAC8F,KAAK,EAAEC,OAAO,CAAC;IACnC,OAAO,IAAI;EACb,CAAC,CAAC,OAAOmB,CAAC,EAAE;IACV,OAAO,KAAK;EACd;AACF;AACA,SAASV,mBAAmBA,CAACW,GAAG,EAAE;EAChC,OAAOA,GAAG,CAACzB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AAC/B","ignoreList":[]}

package/dist/esm/server.mjs

@@ -3,14 +3,9 @@ class NotAuthenticatedError extends Error {}
 class InvalidTokenError extends Error {}
 async function getAuthDataFromRequest(authServer, req, tokenOptions) {
   const authHeader = req.headers.get("authorization");
-  const cookie = authHeader?.split("Bearer ")[1];
-  const newHeaders = new Headers(req.headers);
-  if (cookie) {
-    newHeaders.set("Cookie", cookie);
-  }
   try {
     const session = await authServer.api.getSession({
-      headers: newHeaders
+      headers: req.headers
     });
     if (session?.user) {
       return {

package/dist/esm/server.mjs.map

@@ -1 +1 @@
-{"version":3,"names":["createRemoteJWKSet","jwtVerify","NotAuthenticatedError","Error","InvalidTokenError","getAuthDataFromRequest","authServer","req","tokenOptions","authHeader","headers","get","cookie","split","newHeaders","Headers","set","session","api","getSession","user","id","email","role","err","console","warn","jwtToken","replace","payload","validateToken","userId","sub","token","options","baseUrl","process","env","ONE_SERVER_URL","forceIssuer","FORCE_ISSUER","jwksPath","normalizedBaseUrl","removeTrailingSlash","url","JWKS","URL","verifyOptions","issuer","audience","error","isValidJWT","str"],"sources":["../../src/server.ts"],"sourcesContent":[null],"mappings":"AAMA,SAASA,kBAAA,EAAoBC,SAAA,QAAkC;AAiBxD,MAAMC,qBAAA,SAA8BC,KAAA,CAAM;AAC1C,MAAMC,iBAAA,SAA0BD,KAAA,CAAM;AAiB7C,eAAsBE,uBACpBC,UAAA,EACAC,GAAA,EACAC,YAAA,EAC0B;EAI1B,MAAMC,UAAA,GAAaF,GAAA,CAAIG,OAAA,CAAQC,GAAA,CAAI,eAAe;EAClD,MAAMC,MAAA,GAASH,UAAA,EAAYI,KAAA,CAAM,SAAS,EAAE,CAAC;EAE7C,MAAMC,UAAA,GAAa,IAAIC,OAAA,CAAQR,GAAA,CAAIG,OAAO;EAC1C,IAAIE,MAAA,EAAQ;IACVE,UAAA,CAAWE,GAAA,CAAI,UAAUJ,MAAM;EACjC;EAGA,IAAI;IACF,MAAMK,OAAA,GAAU,MAAMX,UAAA,CAAWY,GAAA,CAAIC,UAAA,CAAW;MAAET,OAAA,EAASI;IAAW,CAAC;IACvE,IAAIG,OAAA,EAASG,IAAA,EAAM;MACjB,OAAO;QACLC,EAAA,EAAIJ,OAAA,CAAQG,IAAA,CAAKC,EAAA;QACjBC,KAAA,EAAOL,OAAA,CAAQG,IAAA,CAAKE,KAAA,IAAS;QAC7BC,IAAA,EAAMN,OAAA,CAAQG,IAAA,CAAKG,IAAA,KAAS,UAAU,UAAU;MAClD;IACF;EACF,SAASC,GAAA,EAAK;IACZC,OAAA,CAAQC,IAAA,CAAK,4BAA4BF,GAAG;EAE9C;EAIA,MAAMG,QAAA,GAAWlB,UAAA,EAAYmB,OAAA,CAAQ,WAAW,EAAE;EAElD,IAAID,QAAA,EAAU;IACZ,IAAI;MACF,MAAME,OAAA,GAAU,MAAMC,aAAA,CAAcH,QAAA,EAAUnB,YAAY;MAC1D,MAAMuB,MAAA,GAAUF,OAAA,EAAiBR,EAAA,IAAMQ,OAAA,EAASG,GAAA;MAChD,IAAID,MAAA,EAAQ;QACV,OAAO;UACLV,EAAA,EAAIU,MAAA;UACJT,KAAA,EAAQO,OAAA,CAAgBP,KAAA;UACxBC,IAAA,EAAOM,OAAA,CAAgBN,IAAA,KAAS,UAAU,UAAU;QACtD;MACF;IACF,SAASC,GAAA,EAAK;MACZ,IAAI,EAAEA,GAAA,YAAepB,iBAAA,GAAoB;QACvC,MAAMoB,GAAA;MACR;IACF;EACF;EAEA,OAAO;AACT;AAIA,eAAsBM,cACpBG,KAAA,EACAC,OAAA,EACqB;EACrB,MAAM;IACJC,OAAA,GAAUC,OAAA,CAAQC,GAAA,CAAIC,cAAA;IACtBC,WAAA,GAAcH,OAAA,CAAQC,GAAA,CAAIG,YAAA,IAAgB;IAC1CC,QAAA,GAAW;EACb,IAAIP,OAAA,IAAW,CAAC;EAEhB,IAAI,CAACC,OAAA,EAAS;IACZ,MAAM,IAAIhC,KAAA,CAAM,aAAa;EAC/B;EAEA,MAAMuC,iBAAA,GAAoBC,mBAAA,CAAoBR,OAAO;EACrD,MAAMS,GAAA,GAAM,GAAGL,WAAA,IAAeG,iBAAiB,GAAGD,QAAQ;EAG1D,MAAMI,IAAA,GAAO7C,kBAAA,CAAmB,IAAI8C,GAAA,CAAIF,GAAG,CAAC;EAE5C,IAAI;IACF,MAAMG,aAAA,GAAgBR,WAAA,GAClB,CAAC,IACD;MACES,MAAA,EAAQN,iBAAA;MACRO,QAAA,EAAUP;IACZ;IAEJ,MAAM;MAAEb;IAAQ,IAAI,MAAM5B,SAAA,CAAUgC,KAAA,EAAOY,IAAA,EAAME,aAAa;IAE9D,OAAOlB,OAAA;EACT,SAASqB,KAAA,EAAO;IACd,MAAM,IAAI9C,iBAAA,CAAkB,GAAG8C,KAAK,EAAE;EACxC;AACF;AAEA,eAAsBC,WACpBlB,KAAA,EACAC,OAAA,EACkB;EAClB,IAAI;IACF,MAAMJ,aAAA,CAAcG,KAAA,EAAOC,OAAO;IAClC,OAAO;EACT,QAAQ;IACN,OAAO;EACT;AACF;AAEA,SAASS,oBAAoBS,GAAA,EAAa;EACxC,OAAOA,GAAA,CAAIxB,OAAA,CAAQ,OAAO,EAAE;AAC9B","ignoreList":[]}
+{"version":3,"names":["createRemoteJWKSet","jwtVerify","NotAuthenticatedError","Error","InvalidTokenError","getAuthDataFromRequest","authServer","req","tokenOptions","authHeader","headers","get","session","api","getSession","user","id","email","role","err","console","warn","jwtToken","replace","payload","validateToken","userId","sub","token","options","baseUrl","process","env","ONE_SERVER_URL","forceIssuer","FORCE_ISSUER","jwksPath","normalizedBaseUrl","removeTrailingSlash","url","JWKS","URL","verifyOptions","issuer","audience","error","isValidJWT","str"],"sources":["../../src/server.ts"],"sourcesContent":[null],"mappings":"AAMA,SAASA,kBAAA,EAAoBC,SAAA,QAAkC;AAiBxD,MAAMC,qBAAA,SAA8BC,KAAA,CAAM;AAC1C,MAAMC,iBAAA,SAA0BD,KAAA,CAAM;AAkB7C,eAAsBE,uBACpBC,UAAA,EACAC,GAAA,EACAC,YAAA,EAC0B;EAC1B,MAAMC,UAAA,GAAaF,GAAA,CAAIG,OAAA,CAAQC,GAAA,CAAI,eAAe;EAWlD,IAAI;IACF,MAAMC,OAAA,GAAU,MAAMN,UAAA,CAAWO,GAAA,CAAIC,UAAA,CAAW;MAAEJ,OAAA,EAASH,GAAA,CAAIG;IAAQ,CAAC;IACxE,IAAIE,OAAA,EAASG,IAAA,EAAM;MACjB,OAAO;QACLC,EAAA,EAAIJ,OAAA,CAAQG,IAAA,CAAKC,EAAA;QACjBC,KAAA,EAAOL,OAAA,CAAQG,IAAA,CAAKE,KAAA,IAAS;QAC7BC,IAAA,EAAMN,OAAA,CAAQG,IAAA,CAAKG,IAAA,KAAS,UAAU,UAAU;MAClD;IACF;EACF,SAASC,GAAA,EAAK;IACZC,OAAA,CAAQC,IAAA,CAAK,4BAA4BF,GAAG;EAE9C;EAIA,MAAMG,QAAA,GAAWb,UAAA,EAAYc,OAAA,CAAQ,WAAW,EAAE;EAElD,IAAID,QAAA,EAAU;IACZ,IAAI;MACF,MAAME,OAAA,GAAU,MAAMC,aAAA,CAAcH,QAAA,EAAUd,YAAY;MAC1D,MAAMkB,MAAA,GAAUF,OAAA,EAAiBR,EAAA,IAAMQ,OAAA,EAASG,GAAA;MAChD,IAAID,MAAA,EAAQ;QACV,OAAO;UACLV,EAAA,EAAIU,MAAA;UACJT,KAAA,EAAQO,OAAA,CAAgBP,KAAA;UACxBC,IAAA,EAAOM,OAAA,CAAgBN,IAAA,KAAS,UAAU,UAAU;QACtD;MACF;IACF,SAASC,GAAA,EAAK;MACZ,IAAI,EAAEA,GAAA,YAAef,iBAAA,GAAoB;QACvC,MAAMe,GAAA;MACR;IACF;EACF;EAEA,OAAO;AACT;AAIA,eAAsBM,cACpBG,KAAA,EACAC,OAAA,EACqB;EACrB,MAAM;IACJC,OAAA,GAAUC,OAAA,CAAQC,GAAA,CAAIC,cAAA;IACtBC,WAAA,GAAcH,OAAA,CAAQC,GAAA,CAAIG,YAAA,IAAgB;IAC1CC,QAAA,GAAW;EACb,IAAIP,OAAA,IAAW,CAAC;EAEhB,IAAI,CAACC,OAAA,EAAS;IACZ,MAAM,IAAI3B,KAAA,CAAM,aAAa;EAC/B;EAEA,MAAMkC,iBAAA,GAAoBC,mBAAA,CAAoBR,OAAO;EACrD,MAAMS,GAAA,GAAM,GAAGL,WAAA,IAAeG,iBAAiB,GAAGD,QAAQ;EAG1D,MAAMI,IAAA,GAAOxC,kBAAA,CAAmB,IAAIyC,GAAA,CAAIF,GAAG,CAAC;EAE5C,IAAI;IACF,MAAMG,aAAA,GAAgBR,WAAA,GAClB,CAAC,IACD;MACES,MAAA,EAAQN,iBAAA;MACRO,QAAA,EAAUP;IACZ;IAEJ,MAAM;MAAEb;IAAQ,IAAI,MAAMvB,SAAA,CAAU2B,KAAA,EAAOY,IAAA,EAAME,aAAa;IAE9D,OAAOlB,OAAA;EACT,SAASqB,KAAA,EAAO;IACd,MAAM,IAAIzC,iBAAA,CAAkB,GAAGyC,KAAK,EAAE;EACxC;AACF;AAEA,eAAsBC,WACpBlB,KAAA,EACAC,OAAA,EACkB;EAClB,IAAI;IACF,MAAMJ,aAAA,CAAcG,KAAA,EAAOC,OAAO;IAClC,OAAO;EACT,QAAQ;IACN,OAAO;EACT;AACF;AAEA,SAASS,oBAAoBS,GAAA,EAAa;EACxC,OAAOA,GAAA,CAAIxB,OAAA,CAAQ,OAAO,EAAE;AAC9B","ignoreList":[]}

package/dist/esm/server.native.js

@@ -132,14 +132,9 @@ var InvalidTokenError = /* @__PURE__ */function (Error1) {
 }(_wrap_native_super(Error));
 async function getAuthDataFromRequest(authServer, req, tokenOptions) {
   var authHeader = req.headers.get("authorization");
-  var cookie = authHeader === null || authHeader === void 0 ? void 0 : authHeader.split("Bearer ")[1];
-  var newHeaders = new Headers(req.headers);
-  if (cookie) {
-    newHeaders.set("Cookie", cookie);
-  }
   try {
     var session = await authServer.api.getSession({
-      headers: newHeaders
+      headers: req.headers
     });
     if (session === null || session === void 0 ? void 0 : session.user) {
       return {

package/dist/esm/server.native.js.map

@@ -1 +1 @@
-{"version":3,"names":["createRemoteJWKSet","jwtVerify","_assert_this_initialized","self","ReferenceError","_call_super","_this","derived","args","_get_prototype_of","_possible_constructor_return","_is_native_reflect_construct","Reflect","construct","constructor","apply","_class_call_check","instance","Constructor","TypeError","_construct","Parent","Class","Parent2","args2","Class2","a","push","Function","bind","_set_prototype_of","prototype","arguments","o","Object","setPrototypeOf","getPrototypeOf","o2","__proto__","_inherits","subClass","superClass","create","value","writable","configurable","_instanceof","left","right","Symbol","hasInstance","_is_native_function","fn","toString","call","indexOf","_type_of","p","p2","obj"],"sources":["../../src/server.ts"],"sourcesContent":[null],"mappings":"AAMA,SAASA,kBAAA,EAAoBC,SAAA,QAAkC;AAiBxD,SAAMC,yBAAAC,IAA8B;EAAO,IAAAA,IAAA;IAC3C,MAAM,IAAAC,cAAA,4DAAgC;EAAC;EAiB9C,OAAAD,IAAA;AAQE;AACA,SAAME,WAASA,CAAAC,KAAA,EAAAC,OAAkB,EAAAC,IAAA;EAEjCD,OAAM,GAAAE,iBAAiB,CAAAF,OAAY;EACnC,OAAIG,4BAAQ,CAAAJ,KAAA,EAAAK,4BAAA,KAAAC,OAAA,CAAAC,SAAA,CAAAN,OAAA,EAAAC,IAAA,QAAAC,iBAAA,CAAAH,KAAA,EAAAQ,WAAA,IAAAP,OAAA,CAAAQ,KAAA,CAAAT,KAAA,EAAAE,IAAA;AACV;AAA+B,SACjCQ,kBAAAC,QAAA,EAAAC,WAAA;EAGA,IAAI,EAAAD,QAAA,YAAAC,WAAA;IACF,MAAM,IAAAC,SAAU,oCAAkC;EAClD;AACE;AAAO,SACLC,UAAIA,CAAQC,MAAK,EAAAb,IAAA,EAAAc,KAAA;EAAA,IAAAX,4BACG,IAAS;IAAAS,UACvB,GAAAR,OAAQ,CAAAC,SAAK;EAA6B,OAClD;IACFO,UAAA,YAAAP,UAAAU,OAAA,EAAAC,KAAA,EAAAC,MAAA;MACF,IAAAC,CAAS,IACP,IAAQ,CAEV;MAIAA,CAAA,CAAMC,IAAA,CAAAZ,KAAA,CAAWW,CAAA,EAAAF,KAAA;MAEb,IAAAN,WAAU,GAAAU,QAAA,CAAAC,IAAA,CAAAd,KAAA,CAAAQ,OAAA,EAAAG,CAAA;MACZ,IAAIT,QAAA,OAAAC,WAAA;MACF,IAAAO,MAAM,EAAAK,iBAAgB,CAAAb,QAAc,EAAAQ,MAAU,CAAAM,SAAA;MAC9C,OAAMd,QAAU;IAChB;EACE;EAAO,OAAAG,UACD,CAAAL,KAAA,OAAAiB,SAAA;AAAA;AACoB,SAAAvB,iBACDA,CAAAwB,CAAA;EAA6BxB,iBACtD,GAAAyB,MAAA,CAAAC,cAAA,GAAAD,MAAA,CAAAE,cAAA,YAAAA,eAAAC,EAAA;IAAA,OACFA,EAAA,CAAAC,SAAA,IAAAJ,MAAA,CAAAE,cAAA,CAAAC,EAAA;EAAA;EAEA,OAAA5B,iBAAM,CAAewB,CAAA;AACnB;AAAM,SACRM,UAAAC,QAAA,EAAAC,UAAA;EAAA,IACF,OAAAA,UAAA,mBAAAA,UAAA;IACF,UAAAtB,SAAA;EAEA;EACFqB,QAAA,CAAAT,SAAA,GAAAG,MAAA,CAAAQ,MAAA,CAAAD,UAAA,IAAAA,UAAA,CAAAV,SAAA;IAIAjB,WAAsB;MAIpB6B,KAAM,EAAAH,QAAA;MACJI,QAAU;MACVC,YAAc;IACd;EACF;EAEA,IAAIJ,UAAU,EAAAX,iBAAA,CAAAU,QAAA,EAAAC,UAAA;AACZ;AAA6B,SAC/BK,YAAAC,IAAA,EAAAC,KAAA;EAEA,IAAAA,KAAM,mBAAoBC,MAAA,gBAAoB,IAAOD,KAAA,CAAAC,MAAA,CAAAC,WAAA;IACrD,OAAM,EAAAF,KAAS,CAAAC,MAAA,CAAAC,WAAe,EAAAH,IAAA;EAG9B,OAAM;IAEN,OAAIA,IAAA,YAAAC,KAAA;EACF;AAEI;AACU,SACRG,mBAAUA,CAAAC,EAAA;EAAA,OACZxB,QAAA,CAAAyB,QAAA,CAAAC,IAAA,CAAAF,EAAA,EAAAG,OAAA;AAEJ;AAEA,SAAA7C,4BAAOA,CAAAP,IAAA,EAAAmD,IAAA;EACT,IAAAA,IAAA,KAASE,QAAO,CAAAF,IAAA,yBAAAA,IAAA;IACd,OAAMA,IAAI;EACZ;EACF,OAAApD,wBAAA,CAAAC,IAAA;AAEA;AAIE,SAAI2B,kBAAAG,CAAA,EAAAwB,CAAA;EACF3B,iBAAM,GAAAI,MAAc,CAAAC,cAAc,aAAAA,eAAAE,EAAA,EAAAqB,EAAA;IAClCrB,EAAA,CAAAC,SAAO,GAAAoB,EAAA;IACT,OAAQrB,EAAA;EACN;EACF,OAAAP,iBAAA,CAAAG,CAAA,EAAAwB,CAAA;AACF;AAEA,SAASD,SAAAG,GAAA;EACP,uBAAmB;;EACrB,OAAAA,GAAA,WAAAV,MAAA,oBAAAU,GAAA,CAAA7C,WAAA,KAAAmC,MAAA,qBAAAU,GAAA","ignoreList":[]}
+{"version":3,"names":["createRemoteJWKSet","jwtVerify","_assert_this_initialized","self","ReferenceError","_call_super","_this","derived","args","_get_prototype_of","_possible_constructor_return","_is_native_reflect_construct","Reflect","construct","constructor","apply","_class_call_check","instance","Constructor","TypeError","_construct","Parent","Class","Parent2","args2","Class2","a","push","Function","bind","_set_prototype_of","prototype","arguments","o","Object","setPrototypeOf","getPrototypeOf","o2","__proto__","_inherits","subClass","superClass","create","value","writable","configurable","_instanceof","left","right","Symbol","hasInstance","_is_native_function","fn","toString","call","indexOf","_type_of","p","p2"],"sources":["../../src/server.ts"],"sourcesContent":[null],"mappings":"AAMA,SAASA,kBAAA,EAAoBC,SAAA,QAAkC;AAiBxD,SAAMC,yBAAAC,IAA8B;EAAO,IAAAA,IAAA;IAC3C,MAAM,IAAAC,cAAA,4DAAgC;EAAC;EAkB9C,OAAAD,IAAA;AAKE;AAWA,SAAIE,YAAAC,KAAA,EAAAC,OAAA,EAAAC,IAAA;EACFD,OAAA,GAAME,iBAAgB,CAAAF,OAAW;EACjC,OAAIG,4BAAe,CAAAJ,KAAA,EAAAK,4BAAA,KAAAC,OAAA,CAAAC,SAAA,CAAAN,OAAA,EAAAC,IAAA,QAAAC,iBAAA,CAAAH,KAAA,EAAAQ,WAAA,IAAAP,OAAA,CAAAQ,KAAA,CAAAT,KAAA,EAAAE,IAAA;AACjB;AAAO,SACLQ,iBAAiBA,CAAAC,QAAA,EAAAC,WAAA;EAAA,MACjBD,QAAO,YAAaC,WAAS;IAAA,MAC7B,IAAMC,SAAQ,oCAAkC;EAAA;AAClD;AACF,SACFC,UAAcA,CAAAC,MAAA,EAAAb,IAAA,EAAAc,KAAA;EACZ,IAAAX,4BAAa;IAEfS,UAAA,GAAAR,OAAA,CAAAC,SAAA;EAIA,OAAM;IAENO,UAAI,GAAU,SAAAP,UAAAU,OAAA,EAAAC,KAAA,EAAAC,MAAA;MACZ,IAAIC,CAAA,IACF,IAAM,CACN;MACAA,CAAA,CAAAC,IAAI,CAAAZ,KAAQ,CAAAW,CAAA,EAAAF,KAAA;MACV,IAAAN,WAAO,GAAAU,QAAA,CAAAC,IAAA,CAAAd,KAAA,CAAAQ,OAAA,EAAAG,CAAA;MAAA,IACLT,QAAI,OAAAC,WAAA;MAAA,IACJO,MAAA,EAAQK,iBAAgB,CAAAb,QAAA,EAAAQ,MAAA,CAAAM,SAAA;MAAA,OACxBd,QAAO;IAA6C;EACtD;EACF,OACFG,UAAc,CAAAL,KAAA,OAAAiB,SAAA;AACZ;AACE,SAAAvB,iBAAMA,CAAAwB,CAAA;EAAAxB,iBACR,GAAAyB,MAAA,CAAAC,cAAA,GAAAD,MAAA,CAAAE,cAAA,YAAAA,eAAAC,EAAA;IACF,OAAAA,EAAA,CAAAC,SAAA,IAAAJ,MAAA,CAAAE,cAAA,CAAAC,EAAA;EACF;EAEA,OAAO5B,iBAAA,CAAAwB,CAAA;AACT;AAIA,SAAAM,SAAsBA,CAAAC,QAAA,EACpBC,UACA;EAEA,WAAMA,UAAA,mBAAAA,UAAA;IACJ,UAAUtB,SAAQ,qDAAI;EAAA;EACoBqB,QAC1C,CAAAT,SAAW,GAAAG,MAAA,CAAAQ,MAAA,CAAAD,UAAA,IAAAA,UAAA,CAAAV,SAAA;IACbjB,WAAI,EAAW;MAEX6B,KAAC,EAAAH,QAAS;MACZI,QAAU,MAAM;MAClBC,YAAA;IAEA;EACA;EAGA,IAAAJ,UAAa,EAAAX,iBAAmB,CAAAU,QAAQ,EAAIC,UAAA;AAE5C;AACE,SAAAK,WAAMA,CAAAC,IAAA,EAAgBC,KAAA;EAElB,IACEA,KAAA,IAAQ,eAAAC,MAAA,oBAAAD,KAAA,CAAAC,MAAA,CAAAC,WAAA;IAAA,OACR,EAAAF,KAAU,CAAAC,MAAA,CAAAC,WAAA,EAAAH,IAAA;EAAA,OACZ;IAEJ,OAAMA,IAAE,YAAYC,KAAM;EAE1B;AAAO;AAEP,SAAAG,mBAAUA,CAAAC,EAAA,EAAkB;EAC9B,OAAAxB,QAAA,CAAAyB,QAAA,CAAAC,IAAA,CAAAF,EAAA,EAAAG,OAAA;AACF;AAEA,SAAA7C,4BAEEA,CAAAP,IACkB,EAAAmD,IAAA;EAClB,IAAIA,IAAA,KAAAE,QAAA,CAAAF,IAAA,yBAAAA,IAAA;IACF,OAAMA,IAAA;EACN;EACF,OAAApD,wBAAQ,CAAAC,IAAA;AACN;AAAO,SACT2B,kBAAAG,CAAA,EAAAwB,CAAA;EACF3B,iBAAA,GAAAI,MAAA,CAAAC,cAAA,aAAAA,eAAAE,EAAA,EAAAqB,EAAA;IAEArB,EAAA,CAAAC,SAAS,GAAAoB,EAAA;IACP,OAAOrB,EAAI;EACb","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@take-out/better-auth-utils",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Better auth utilities and client for React/React Native applications",
   "sideEffects": false,
   "type": "module",
@@ -38,7 +38,7 @@
     }
   },
   "dependencies": {
-    "@take-out/helpers": "0.5.0",
+    "@take-out/helpers": "0.5.1",
     "jose": "^6.0.10"
   },
   "peerDependencies": {

package/src/server.ts

@@ -35,29 +35,29 @@ export type AuthServer = {
 }
 
 /**
- * Get auth data from request - tries session cookies first, then JWT header
- * Session: web apps with cookies forwarded by zero
- * JWT: native apps (Tauri, React Native) using Authorization header
+ * Get auth data from request - tries session first, then a JWKS-verified JWT.
+ * Session: web cookies (forwarded by zero) and native bearer tokens resolved by
+ *   the better-auth bearer() plugin — both handled by getSession.
+ * JWT: only for servers using the jwt() plugin instead of bearer().
  */
 export async function getAuthDataFromRequest(
   authServer: AuthServer,
   req: Request,
   tokenOptions?: ValidateTokenOptions,
 ): Promise<AuthData | null> {
-  // from react native, better auth doesnt send cookie but insteead only the Authorization
-  // but better auth wants to find the cookie here, so re-route it:
-
   const authHeader = req.headers.get('authorization')
-  const cookie = authHeader?.split('Bearer ')[1]
-
-  const newHeaders = new Headers(req.headers)
-  if (cookie) {
-    newHeaders.set('Cookie', cookie)
-  }
 
-  // try session-based auth first (web - cookies forwarded by zero)
+  // try session-based auth first, passing the request headers THROUGH UNTOUCHED:
+  // - web sends the forwarded session cookie.
+  // - native (React Native / Tauri) sends `Authorization: Bearer <session-token>`,
+  //   which the better-auth bearer() plugin verifies and rewrites into the session
+  //   cookie internally (with the correct cookie name).
+  // do NOT rewrite the Cookie header from the bearer value: the bearer token is
+  // not a `name=value` cookie, so it never matched a real session cookie, and
+  // overwriting an existing forwarded cookie with it silently dropped authenticated
+  // web requests (cookie + bearer both present) to an `anon` identity.
   try {
-    const session = await authServer.api.getSession({ headers: newHeaders })
+    const session = await authServer.api.getSession({ headers: req.headers })
     if (session?.user) {
       return {
         id: session.user.id,
@@ -70,8 +70,8 @@ export async function getAuthDataFromRequest(
     // session auth failed, try JWT
   }
 
-  // try authorization header (token-based auth for native/tauri)
-
+  // fall back to JWKS-verified JWT for servers using the jwt() plugin (no
+  // bearer() plugin to resolve the token above).
   const jwtToken = authHeader?.replace('Bearer ', '')
 
   if (jwtToken) {

package/types/server.d.ts

@@ -33,9 +33,10 @@ export type AuthServer = {
 	};
 };
 /**
-* Get auth data from request - tries session cookies first, then JWT header
-* Session: web apps with cookies forwarded by zero
-* JWT: native apps (Tauri, React Native) using Authorization header
+* Get auth data from request - tries session first, then a JWKS-verified JWT.
+* Session: web cookies (forwarded by zero) and native bearer tokens resolved by
+*   the better-auth bearer() plugin — both handled by getSession.
+* JWT: only for servers using the jwt() plugin instead of bearer().
 */
 export declare function getAuthDataFromRequest(authServer: AuthServer, req: Request, tokenOptions?: ValidateTokenOptions): Promise<AuthData | null>;
 export declare function validateToken(token: string, options?: ValidateTokenOptions): Promise<JWTPayload>;

package/types/server.d.ts.map

@@ -1,11 +1,11 @@
 {
-  "mappings": ";;;;;AAMA,cAA6C,kBAAkB;AAE/D,iBAAiB,qBAAqB;;CAEpC;;CAEA;;CAEA;;AAGF,iBAAiB,SAAS;CACxB;CACA;CACA,MAAM;;AAGR,OAAO,cAAM,8BAA8B,MAAM;AACjD,OAAO,cAAM,0BAA0B,MAAM;AAE7C,YAAY,aAAa;CACvB,KAAK;EACH,aAAa,MAAM;GAAE,SAAS;QAC1B,QAAQ;GACN,MAAM;IAAE;IAAY;IAAuB;;cAE7C;;;;;;;;AASR,OAAO,iBAAe,uBACpB,YAAY,YACZ,KAAK,SACL,eAAe,uBACd,QAAQ;AAsDX,OAAO,iBAAe,cACpB,eACA,UAAU,uBACT,QAAQ;AAiCX,OAAO,iBAAe,WACpB,eACA,SAAS,uBACR",
+  "mappings": ";;;;;AAMA,cAA6C,kBAAkB;AAE/D,iBAAiB,qBAAqB;;CAEpC;;CAEA;;CAEA;;AAGF,iBAAiB,SAAS;CACxB;CACA;CACA,MAAM;;AAGR,OAAO,cAAM,8BAA8B,MAAM;AACjD,OAAO,cAAM,0BAA0B,MAAM;AAE7C,YAAY,aAAa;CACvB,KAAK;EACH,aAAa,MAAM;GAAE,SAAS;QAC1B,QAAQ;GACN,MAAM;IAAE;IAAY;IAAuB;;cAE7C;;;;;;;;;AAUR,OAAO,iBAAe,uBACpB,YAAY,YACZ,KAAK,SACL,eAAe,uBACd,QAAQ;AAqDX,OAAO,iBAAe,cACpB,eACA,UAAU,uBACT,QAAQ;AAiCX,OAAO,iBAAe,WACpB,eACA,SAAS,uBACR",
   "names": [],
   "sources": [
     "src/server.ts"
   ],
   "version": 3,
   "sourcesContent": [
-    "/**\n * Server-side auth utilities for better-auth\n * - Session validation via cookies (web)\n * - JWT validation via JWKS (native apps)\n */\n\nimport { createRemoteJWKSet, jwtVerify, type JWTPayload } from 'jose'\n\nexport interface ValidateTokenOptions {\n  /** base URL for the auth server (e.g., https://myapp.com) */\n  baseUrl?: string\n  /** optional issuer override for CI/test environments */\n  forceIssuer?: string\n  /** JWKS endpoint path, defaults to /api/auth/jwks */\n  jwksPath?: string\n}\n\nexport interface AuthData {\n  id: string\n  email?: string\n  role: 'admin' | undefined\n}\n\nexport class NotAuthenticatedError extends Error {}\nexport class InvalidTokenError extends Error {}\n\nexport type AuthServer = {\n  api: {\n    getSession: (opts: { headers: Headers }) =>\n      | Promise<{\n          user: { id: string; email?: string | null; role?: string | null }\n        } | null>\n      | Promise<any>\n  }\n}\n\n/**\n * Get auth data from request - tries session cookies first, then JWT header\n * Session: web apps with cookies forwarded by zero\n * JWT: native apps (Tauri, React Native) using Authorization header\n */\nexport async function getAuthDataFromRequest(\n  authServer: AuthServer,\n  req: Request,\n  tokenOptions?: ValidateTokenOptions,\n): Promise<AuthData | null> {\n  // from react native, better auth doesnt send cookie but insteead only the Authorization\n  // but better auth wants to find the cookie here, so re-route it:\n\n  const authHeader = req.headers.get('authorization')\n  const cookie = authHeader?.split('Bearer ')[1]\n\n  const newHeaders = new Headers(req.headers)\n  if (cookie) {\n    newHeaders.set('Cookie', cookie)\n  }\n\n  // try session-based auth first (web - cookies forwarded by zero)\n  try {\n    const session = await authServer.api.getSession({ headers: newHeaders })\n    if (session?.user) {\n      return {\n        id: session.user.id,\n        email: session.user.email || undefined,\n        role: session.user.role === 'admin' ? 'admin' : undefined,\n      }\n    }\n  } catch (err) {\n    console.warn(`Error validating session`, err)\n    // session auth failed, try JWT\n  }\n\n  // try authorization header (token-based auth for native/tauri)\n\n  const jwtToken = authHeader?.replace('Bearer ', '')\n\n  if (jwtToken) {\n    try {\n      const payload = await validateToken(jwtToken, tokenOptions)\n      const userId = (payload as any)?.id || payload?.sub\n      if (userId) {\n        return {\n          id: userId as string,\n          email: (payload as any).email as string | undefined,\n          role: (payload as any).role === 'admin' ? 'admin' : undefined,\n        }\n      }\n    } catch (err) {\n      if (!(err instanceof InvalidTokenError)) {\n        throw err\n      }\n    }\n  }\n\n  return null\n}\n\n// jwt validation for native apps\n\nexport async function validateToken(\n  token: string,\n  options?: ValidateTokenOptions,\n): Promise<JWTPayload> {\n  const {\n    baseUrl = process.env.ONE_SERVER_URL,\n    forceIssuer = process.env.FORCE_ISSUER || '',\n    jwksPath = '/api/auth/jwks',\n  } = options || {}\n\n  if (!baseUrl) {\n    throw new Error(`No baseURL!`)\n  }\n\n  const normalizedBaseUrl = removeTrailingSlash(baseUrl)\n  const url = `${forceIssuer || normalizedBaseUrl}${jwksPath}`\n\n  // create fresh JWKS fetcher each time to avoid stale key cache issues\n  const JWKS = createRemoteJWKSet(new URL(url))\n\n  try {\n    const verifyOptions = forceIssuer\n      ? {}\n      : {\n          issuer: normalizedBaseUrl,\n          audience: normalizedBaseUrl,\n        }\n\n    const { payload } = await jwtVerify(token, JWKS, verifyOptions)\n\n    return payload\n  } catch (error) {\n    throw new InvalidTokenError(`${error}`)\n  }\n}\n\nexport async function isValidJWT(\n  token: string,\n  options: ValidateTokenOptions,\n): Promise<boolean> {\n  try {\n    await validateToken(token, options)\n    return true\n  } catch {\n    return false\n  }\n}\n\nfunction removeTrailingSlash(str: string) {\n  return str.replace(/\\/$/, '')\n}\n"
+    "/**\n * Server-side auth utilities for better-auth\n * - Session validation via cookies (web)\n * - JWT validation via JWKS (native apps)\n */\n\nimport { createRemoteJWKSet, jwtVerify, type JWTPayload } from 'jose'\n\nexport interface ValidateTokenOptions {\n  /** base URL for the auth server (e.g., https://myapp.com) */\n  baseUrl?: string\n  /** optional issuer override for CI/test environments */\n  forceIssuer?: string\n  /** JWKS endpoint path, defaults to /api/auth/jwks */\n  jwksPath?: string\n}\n\nexport interface AuthData {\n  id: string\n  email?: string\n  role: 'admin' | undefined\n}\n\nexport class NotAuthenticatedError extends Error {}\nexport class InvalidTokenError extends Error {}\n\nexport type AuthServer = {\n  api: {\n    getSession: (opts: { headers: Headers }) =>\n      | Promise<{\n          user: { id: string; email?: string | null; role?: string | null }\n        } | null>\n      | Promise<any>\n  }\n}\n\n/**\n * Get auth data from request - tries session first, then a JWKS-verified JWT.\n * Session: web cookies (forwarded by zero) and native bearer tokens resolved by\n *   the better-auth bearer() plugin — both handled by getSession.\n * JWT: only for servers using the jwt() plugin instead of bearer().\n */\nexport async function getAuthDataFromRequest(\n  authServer: AuthServer,\n  req: Request,\n  tokenOptions?: ValidateTokenOptions,\n): Promise<AuthData | null> {\n  const authHeader = req.headers.get('authorization')\n\n  // try session-based auth first, passing the request headers THROUGH UNTOUCHED:\n  // - web sends the forwarded session cookie.\n  // - native (React Native / Tauri) sends `Authorization: Bearer <session-token>`,\n  //   which the better-auth bearer() plugin verifies and rewrites into the session\n  //   cookie internally (with the correct cookie name).\n  // do NOT rewrite the Cookie header from the bearer value: the bearer token is\n  // not a `name=value` cookie, so it never matched a real session cookie, and\n  // overwriting an existing forwarded cookie with it silently dropped authenticated\n  // web requests (cookie + bearer both present) to an `anon` identity.\n  try {\n    const session = await authServer.api.getSession({ headers: req.headers })\n    if (session?.user) {\n      return {\n        id: session.user.id,\n        email: session.user.email || undefined,\n        role: session.user.role === 'admin' ? 'admin' : undefined,\n      }\n    }\n  } catch (err) {\n    console.warn(`Error validating session`, err)\n    // session auth failed, try JWT\n  }\n\n  // fall back to JWKS-verified JWT for servers using the jwt() plugin (no\n  // bearer() plugin to resolve the token above).\n  const jwtToken = authHeader?.replace('Bearer ', '')\n\n  if (jwtToken) {\n    try {\n      const payload = await validateToken(jwtToken, tokenOptions)\n      const userId = (payload as any)?.id || payload?.sub\n      if (userId) {\n        return {\n          id: userId as string,\n          email: (payload as any).email as string | undefined,\n          role: (payload as any).role === 'admin' ? 'admin' : undefined,\n        }\n      }\n    } catch (err) {\n      if (!(err instanceof InvalidTokenError)) {\n        throw err\n      }\n    }\n  }\n\n  return null\n}\n\n// jwt validation for native apps\n\nexport async function validateToken(\n  token: string,\n  options?: ValidateTokenOptions,\n): Promise<JWTPayload> {\n  const {\n    baseUrl = process.env.ONE_SERVER_URL,\n    forceIssuer = process.env.FORCE_ISSUER || '',\n    jwksPath = '/api/auth/jwks',\n  } = options || {}\n\n  if (!baseUrl) {\n    throw new Error(`No baseURL!`)\n  }\n\n  const normalizedBaseUrl = removeTrailingSlash(baseUrl)\n  const url = `${forceIssuer || normalizedBaseUrl}${jwksPath}`\n\n  // create fresh JWKS fetcher each time to avoid stale key cache issues\n  const JWKS = createRemoteJWKSet(new URL(url))\n\n  try {\n    const verifyOptions = forceIssuer\n      ? {}\n      : {\n          issuer: normalizedBaseUrl,\n          audience: normalizedBaseUrl,\n        }\n\n    const { payload } = await jwtVerify(token, JWKS, verifyOptions)\n\n    return payload\n  } catch (error) {\n    throw new InvalidTokenError(`${error}`)\n  }\n}\n\nexport async function isValidJWT(\n  token: string,\n  options: ValidateTokenOptions,\n): Promise<boolean> {\n  try {\n    await validateToken(token, options)\n    return true\n  } catch {\n    return false\n  }\n}\n\nfunction removeTrailingSlash(str: string) {\n  return str.replace(/\\/$/, '')\n}\n"
   ]
 }