@tern-secure/backend 1.2.0-canary.v20251003171521 → 1.2.0-canary.v20251008165428

package/dist/chunk-XTYEXHJD.mjs

@@ -1,554 +0,0 @@
-import {
-  constants,
-  createTernSecureRequest
-} from "./chunk-4SGWLAJG.mjs";
-
-// src/admin/sessionTernSecure.ts
-import { handleFirebaseAuthError } from "@tern-secure/shared/errors";
-
-// src/utils/admin-init.ts
-import admin from "firebase-admin";
-
-// src/utils/config.ts
-var loadAdminConfig = () => ({
-  projectId: process.env.FIREBASE_PROJECT_ID || "",
-  clientEmail: process.env.FIREBASE_CLIENT_EMAIL || "",
-  privateKey: process.env.FIREBASE_PRIVATE_KEY || ""
-});
-var validateAdminConfig = (config) => {
-  const requiredFields = [
-    "projectId",
-    "clientEmail",
-    "privateKey"
-  ];
-  const errors = [];
-  requiredFields.forEach((field) => {
-    if (!config[field]) {
-      errors.push(`Missing required field: FIREBASE_${String(field).toUpperCase()}`);
-    }
-  });
-  return {
-    isValid: errors.length === 0,
-    errors,
-    config
-  };
-};
-var initializeAdminConfig = () => {
-  const config = loadAdminConfig();
-  const validationResult = validateAdminConfig(config);
-  if (!validationResult.isValid) {
-    throw new Error(
-      `Firebase Admin configuration validation failed:
-${validationResult.errors.join("\n")}`
-    );
-  }
-  return config;
-};
-
-// src/utils/admin-init.ts
-if (!admin.apps.length) {
-  try {
-    const config = initializeAdminConfig();
-    admin.initializeApp({
-      credential: admin.credential.cert({
-        ...config,
-        privateKey: config.privateKey.replace(/\\n/g, "\n")
-      })
-    });
-  } catch (error) {
-    console.error("Firebase admin initialization error", error);
-  }
-}
-var adminTernSecureAuth = admin.auth();
-var adminTernSecureDb = admin.firestore();
-var TernSecureTenantManager = admin.auth().tenantManager();
-function getAuthForTenant(tenantId) {
-  if (tenantId) {
-    return TernSecureTenantManager.authForTenant(tenantId);
-  }
-  return admin.auth();
-}
-
-// src/admin/sessionTernSecure.ts
-var SESSION_CONSTANTS = {
-  COOKIE_NAME: "_session_cookie",
-  //DEFAULT_EXPIRES_IN_MS: 60 * 60 * 24 * 5 * 1000, // 5 days
-  //DEFAULT_EXPIRES_IN_SECONDS: 60 * 60 * 24 * 5, // 5days
-  DEFAULT_EXPIRES_IN_MS: 5 * 60 * 1e3,
-  // 5 minutes
-  DEFAULT_EXPIRES_IN_SECONDS: 5 * 60,
-  REVOKE_REFRESH_TOKENS_ON_SIGNOUT: true
-};
-var COOKIE_OPTIONS = {
-  httpOnly: true,
-  secure: process.env.NODE_ENV === "production",
-  sameSite: "strict",
-  path: "/"
-};
-var DEFAULT_COOKIE_CONFIG = {
-  DEFAULT_EXPIRES_IN_MS: 5 * 60 * 1e3,
-  // 5 minutes
-  DEFAULT_EXPIRES_IN_SECONDS: 5 * 60,
-  REVOKE_REFRESH_TOKENS_ON_SIGNOUT: true
-};
-var DEFAULT_COOKIE_OPTIONS = {
-  httpOnly: true,
-  secure: process.env.NODE_ENV === "production",
-  sameSite: "strict",
-  path: "/"
-};
-var getCookieName = (baseName, prefix) => {
-  return prefix ? `${prefix}${baseName}` : baseName;
-};
-var createCookieOptions = (maxAge, overrides) => {
-  return {
-    maxAge,
-    httpOnly: overrides?.httpOnly ?? DEFAULT_COOKIE_OPTIONS.httpOnly,
-    secure: overrides?.secure ?? DEFAULT_COOKIE_OPTIONS.secure,
-    sameSite: overrides?.sameSite ?? DEFAULT_COOKIE_OPTIONS.sameSite,
-    path: overrides?.path ?? DEFAULT_COOKIE_OPTIONS.path
-  };
-};
-var getCookiePrefix = () => {
-  const isProduction = process.env.NODE_ENV === "production";
-  return isProduction ? "__HOST-" : "__dev_";
-};
-async function createSessionCookie(params, cookieStore, options) {
-  try {
-    const tenantAuth = getAuthForTenant(options?.tenantId || "");
-    const idToken = typeof params === "string" ? params : params.idToken;
-    const refreshToken = typeof params === "string" ? void 0 : params.refreshToken;
-    if (!idToken) {
-      return {
-        success: false,
-        message: "ID token is required",
-        error: "INVALID_TOKEN"
-      };
-    }
-    let decodedToken;
-    try {
-      decodedToken = await tenantAuth.verifyIdToken(idToken);
-    } catch (verifyError) {
-      const authError = handleFirebaseAuthError(verifyError);
-      return {
-        success: false,
-        message: authError.message,
-        error: authError.code
-      };
-    }
-    const cookiePromises = [];
-    const cookiePrefix = getCookiePrefix();
-    const idTokenCookieName = getCookieName(constants.Cookies.IdToken, cookiePrefix);
-    cookiePromises.push(
-      cookieStore.set(
-        idTokenCookieName,
-        idToken,
-        createCookieOptions(DEFAULT_COOKIE_CONFIG.DEFAULT_EXPIRES_IN_SECONDS)
-      )
-    );
-    if (refreshToken) {
-      const refreshTokenCookieName = getCookieName(constants.Cookies.Refresh, cookiePrefix);
-      cookiePromises.push(
-        cookieStore.set(
-          refreshTokenCookieName,
-          refreshToken,
-          createCookieOptions(DEFAULT_COOKIE_CONFIG.DEFAULT_EXPIRES_IN_SECONDS)
-        )
-      );
-    }
-    if (options?.cookies?.session) {
-      const sessionOptions = options.cookies.session;
-      const sessionCookieName = getCookieName(constants.Cookies.Session);
-      const expiresIn = sessionOptions.maxAge ? sessionOptions.maxAge * 1e3 : DEFAULT_COOKIE_CONFIG.DEFAULT_EXPIRES_IN_MS;
-      try {
-        const sessionCookie = await tenantAuth.createSessionCookie(idToken, { expiresIn });
-        cookiePromises.push(
-          cookieStore.set(
-            sessionCookieName,
-            sessionCookie,
-            createCookieOptions(
-              sessionOptions.maxAge || DEFAULT_COOKIE_CONFIG.DEFAULT_EXPIRES_IN_SECONDS,
-              {
-                httpOnly: sessionOptions.httpOnly,
-                sameSite: sessionOptions.sameSite,
-                path: sessionOptions.path
-              }
-            )
-          )
-        );
-      } catch (sessionError) {
-        console.error(
-          "[createSessionCookie] Firebase session cookie creation failed:",
-          sessionError
-        );
-        const authError = handleFirebaseAuthError(sessionError);
-        return {
-          success: false,
-          message: authError.message,
-          error: authError.code
-        };
-      }
-    }
-    if (options?.enableCustomToken && decodedToken?.uid) {
-      const customTokenCookieName = getCookieName(constants.Cookies.Custom, cookiePrefix);
-      const customToken = await createCustomToken(decodedToken.uid, options);
-      if (customToken) {
-        cookiePromises.push(
-          cookieStore.set(
-            customTokenCookieName,
-            customToken,
-            createCookieOptions(DEFAULT_COOKIE_CONFIG.DEFAULT_EXPIRES_IN_SECONDS)
-          )
-        );
-      }
-    }
-    await Promise.all(cookiePromises);
-    return {
-      success: true,
-      message: "Session created successfully",
-      expiresIn: DEFAULT_COOKIE_CONFIG.DEFAULT_EXPIRES_IN_SECONDS
-    };
-  } catch (error) {
-    console.error("[createSessionCookie] Unexpected error:", error);
-    const authError = handleFirebaseAuthError(error);
-    return {
-      success: false,
-      message: authError.message || "Failed to create session",
-      error: authError.code || "INTERNAL_ERROR"
-    };
-  }
-}
-async function clearSessionCookie(cookieStore, options) {
-  try {
-    const adminAuth = getAuthForTenant(options?.tenantId || "");
-    const cookiePrefix = getCookiePrefix();
-    const sessionCookieName = getCookieName(constants.Cookies.Session, cookiePrefix);
-    const sessionCookie = await cookieStore.get(sessionCookieName);
-    const deletionPromises = [];
-    if (options?.cookies?.session) {
-      deletionPromises.push(cookieStore.delete(sessionCookieName));
-    }
-    const idTokenCookieName = getCookieName(constants.Cookies.IdToken, cookiePrefix);
-    deletionPromises.push(cookieStore.delete(idTokenCookieName));
-    const refreshTokenCookieName = getCookieName(constants.Cookies.Refresh, cookiePrefix);
-    deletionPromises.push(cookieStore.delete(refreshTokenCookieName));
-    const customTokenCookieName = getCookieName(constants.Cookies.Custom, cookiePrefix);
-    deletionPromises.push(cookieStore.delete(customTokenCookieName));
-    deletionPromises.push(cookieStore.delete(constants.Cookies.Session));
-    await Promise.all(deletionPromises);
-    if (DEFAULT_COOKIE_CONFIG.REVOKE_REFRESH_TOKENS_ON_SIGNOUT && sessionCookie?.value) {
-      try {
-        const decodedClaims = await adminAuth.verifySessionCookie(sessionCookie.value);
-        await adminAuth.revokeRefreshTokens(decodedClaims.sub);
-      } catch (revokeError) {
-        console.error("[clearSessionCookie] Failed to revoke refresh tokens:", revokeError);
-      }
-    }
-    return {
-      success: true,
-      message: "Session cleared successfully"
-    };
-  } catch (error) {
-    const authError = handleFirebaseAuthError(error);
-    return {
-      success: false,
-      message: authError.message || "Failed to clear session",
-      error: authError.code || "INTERNAL_ERROR"
-    };
-  }
-}
-async function createCustomToken(uid, options) {
-  const adminAuth = getAuthForTenant(options?.tenantId || "");
-  try {
-    const customToken = await adminAuth.createCustomToken(uid);
-    return customToken;
-  } catch (error) {
-    console.error("[createCustomToken] Error creating custom token:", error);
-    return null;
-  }
-}
-async function createCustomTokenClaims(uid, developerClaims) {
-  const adminAuth = getAuthForTenant();
-  try {
-    const customToken = await adminAuth.createCustomToken(uid, developerClaims);
-    return customToken;
-  } catch (error) {
-    console.error("[createCustomToken] Error creating custom token:", error);
-    return "";
-  }
-}
-
-// src/admin/tenant.ts
-async function createTenant(displayName, emailSignInConfig, multiFactorConfig) {
-  try {
-    const tenantConfig = {
-      displayName,
-      emailSignInConfig,
-      ...multiFactorConfig && { multiFactorConfig }
-    };
-    const tenant = await TernSecureTenantManager.createTenant(tenantConfig);
-    return {
-      success: true,
-      tenantId: tenant.tenantId,
-      displayName: tenant.displayName
-    };
-  } catch (error) {
-    console.error("Error creating tenant:", error);
-    throw new Error("Failed to create tenant");
-  }
-}
-async function createTenantUser(email, password, tenantId) {
-  try {
-    const tenantAuth = TernSecureTenantManager.authForTenant(tenantId);
-    const userRecord = await tenantAuth.createUser({
-      email,
-      password,
-      emailVerified: false,
-      disabled: false
-    });
-    return {
-      success: true,
-      message: "Tenant user created successfully",
-      user: userRecord.uid
-    };
-  } catch (error) {
-    console.error("Error creating tenant user:", error);
-    throw new Error("Failed to create tenant user");
-  }
-}
-
-// src/admin/nextSessionTernSecure.ts
-import { getCookieName as getCookieName2, getCookiePrefix as getCookiePrefix2 } from "@tern-secure/shared/cookie";
-import { handleFirebaseAuthError as handleFirebaseAuthError2 } from "@tern-secure/shared/errors";
-import { cookies } from "next/headers";
-var SESSION_CONSTANTS2 = {
-  COOKIE_NAME: constants.Cookies.Session,
-  DEFAULT_EXPIRES_IN_MS: 60 * 60 * 24 * 5 * 1e3,
-  // 5 days
-  DEFAULT_EXPIRES_IN_SECONDS: 60 * 60 * 24 * 5,
-  REVOKE_REFRESH_TOKENS_ON_SIGNOUT: true
-};
-async function CreateNextSessionCookie(idToken) {
-  try {
-    const expiresIn = 60 * 60 * 24 * 5 * 1e3;
-    const sessionCookie = await adminTernSecureAuth.createSessionCookie(idToken, {
-      expiresIn
-    });
-    const cookieStore = await cookies();
-    cookieStore.set(constants.Cookies.Session, sessionCookie, {
-      maxAge: expiresIn,
-      httpOnly: true,
-      secure: process.env.NODE_ENV === "production",
-      path: "/"
-    });
-    return { success: true, message: "Session created" };
-  } catch (error) {
-    return { success: false, message: "Failed to create session" };
-  }
-}
-async function GetNextServerSessionCookie() {
-  const cookieStore = await cookies();
-  const sessionCookie = cookieStore.get("_session_cookie")?.value;
-  if (!sessionCookie) {
-    throw new Error("No session cookie found");
-  }
-  try {
-    const decondeClaims = await adminTernSecureAuth.verifySessionCookie(
-      sessionCookie,
-      true
-    );
-    return {
-      token: sessionCookie,
-      userId: decondeClaims.uid
-    };
-  } catch (error) {
-    console.error("Error verifying session:", error);
-    throw new Error("Invalid Session");
-  }
-}
-async function GetNextIdToken() {
-  const cookieStore = await cookies();
-  const token = cookieStore.get("_session_token")?.value;
-  if (!token) {
-    throw new Error("No session cookie found");
-  }
-  try {
-    const decodedClaims = await adminTernSecureAuth.verifyIdToken(token);
-    return {
-      token,
-      userId: decodedClaims.uid
-    };
-  } catch (error) {
-    console.error("Error verifying session:", error);
-    throw new Error("Invalid Session");
-  }
-}
-async function SetNextServerSession(token) {
-  try {
-    const cookieStore = await cookies();
-    cookieStore.set("_session_token", token, {
-      httpOnly: true,
-      secure: process.env.NODE_ENV === "production",
-      sameSite: "strict",
-      maxAge: 60 * 60,
-      // 1 hour
-      path: "/"
-    });
-    return { success: true, message: "Session created" };
-  } catch {
-    return { success: false, message: "Failed to create session" };
-  }
-}
-async function SetNextServerToken(token) {
-  try {
-    const cookieStore = await cookies();
-    cookieStore.set("_tern", token, {
-      httpOnly: true,
-      secure: process.env.NODE_ENV === "production",
-      sameSite: "strict",
-      maxAge: 60 * 60,
-      // 1 hour
-      path: "/"
-    });
-    return { success: true, message: "Session created" };
-  } catch {
-    return { success: false, message: "Failed to create session" };
-  }
-}
-async function VerifyNextTernIdToken(token) {
-  try {
-    const decodedToken = await adminTernSecureAuth.verifyIdToken(token);
-    return {
-      ...decodedToken,
-      valid: true
-    };
-  } catch (error) {
-    console.error("[VerifyNextTernIdToken] Error verifying session:", error);
-    const authError = handleFirebaseAuthError2(error);
-    return {
-      valid: false,
-      error: authError
-    };
-  }
-}
-async function VerifyNextTernSessionCookie(session) {
-  try {
-    const res = await adminTernSecureAuth.verifySessionCookie(session);
-    console.warn(
-      "[VerifyNextTernSessionCookie] uid in Decoded Token:",
-      res.uid
-    );
-    return {
-      valid: true,
-      ...res
-    };
-  } catch (error) {
-    console.error(
-      "[VerifyNextTernSessionCookie] Error verifying session:",
-      error
-    );
-    const authError = handleFirebaseAuthError2(error);
-    return {
-      valid: false,
-      error: authError
-    };
-  }
-}
-async function ClearNextSessionCookie(tenantId) {
-  try {
-    console.log("[clearSessionCookie] Clearing session for tenant:", tenantId);
-    const tenantAuth = getAuthForTenant(tenantId);
-    const cookieStore = await cookies();
-    const sessionCookie = cookieStore.get(SESSION_CONSTANTS2.COOKIE_NAME);
-    const cookiePrefix = getCookiePrefix2();
-    cookieStore.delete(SESSION_CONSTANTS2.COOKIE_NAME);
-    cookieStore.delete(getCookieName2(constants.Cookies.IdToken, cookiePrefix));
-    cookieStore.delete(getCookieName2(constants.Cookies.Refresh, cookiePrefix));
-    cookieStore.delete(constants.Cookies.Custom);
-    if (SESSION_CONSTANTS2.REVOKE_REFRESH_TOKENS_ON_SIGNOUT && sessionCookie?.value) {
-      try {
-        const decodedClaims = await tenantAuth.verifySessionCookie(
-          sessionCookie.value
-        );
-        await tenantAuth.revokeRefreshTokens(decodedClaims.sub);
-        console.log(
-          `[clearSessionCookie] Successfully revoked tokens for user: ${decodedClaims.sub}`
-        );
-      } catch (revokeError) {
-        console.error(
-          "[ClearNextSessionCookie] Failed to revoke refresh tokens:",
-          revokeError
-        );
-      }
-    }
-    return { success: true, message: "Session cleared successfully" };
-  } catch (error) {
-    console.error("Error clearing session:", error);
-    return { success: false, message: "Failed to clear session cookies" };
-  }
-}
-
-// src/instance/backendInstance.ts
-var createBackendInstance = async (request) => {
-  const ternSecureRequest = createTernSecureRequest(request);
-  const requestState = await authenticateRequest(request);
-  return {
-    ternSecureRequest,
-    requestState
-  };
-};
-async function authenticateRequest(request) {
-  const sessionCookie = request.headers.get("cookie");
-  const sessionToken = sessionCookie?.split(";").find((c) => c.trim().startsWith("_session_cookie="))?.split("=")[1];
-  if (!sessionToken) {
-    throw new Error("No session token found");
-  }
-  const verificationResult = await VerifyNextTernSessionCookie(sessionToken);
-  if (!verificationResult.valid) {
-    throw new Error("Invalid session token");
-  }
-  return signedIn(
-    verificationResult,
-    new Headers(request.headers),
-    sessionToken
-  );
-}
-function signInAuthObject(session) {
-  return {
-    session,
-    userId: session.uid,
-    has: {}
-  };
-}
-function signedIn(session, headers = new Headers(), token) {
-  const authObject = signInAuthObject(session);
-  return {
-    auth: () => authObject,
-    token,
-    headers
-  };
-}
-
-export {
-  initializeAdminConfig,
-  adminTernSecureAuth,
-  adminTernSecureDb,
-  TernSecureTenantManager,
-  createSessionCookie,
-  clearSessionCookie,
-  createCustomTokenClaims,
-  createTenant,
-  createTenantUser,
-  CreateNextSessionCookie,
-  GetNextServerSessionCookie,
-  GetNextIdToken,
-  SetNextServerSession,
-  SetNextServerToken,
-  VerifyNextTernIdToken,
-  VerifyNextTernSessionCookie,
-  ClearNextSessionCookie,
-  createBackendInstance,
-  authenticateRequest,
-  signedIn
-};
-//# sourceMappingURL=chunk-XTYEXHJD.mjs.map

package/dist/chunk-XTYEXHJD.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/admin/sessionTernSecure.ts","../src/utils/admin-init.ts","../src/utils/config.ts","../src/admin/tenant.ts","../src/admin/nextSessionTernSecure.ts","../src/instance/backendInstance.ts"],"sourcesContent":["'use server';\r\nimport { handleFirebaseAuthError } from '@tern-secure/shared/errors';\r\nimport type {\r\n  CookieStore,\r\n  SessionParams,\r\n  SessionResult,\r\n  TernSecureHandlerOptions,\r\n} from '@tern-secure/types';\r\n\r\nimport { constants } from '../constants';\r\nimport { getAuthForTenant } from '../utils/admin-init';\r\n\r\nconst SESSION_CONSTANTS = {\r\n  COOKIE_NAME: '_session_cookie',\r\n  //DEFAULT_EXPIRES_IN_MS: 60 * 60 * 24 * 5 * 1000, // 5 days\r\n  //DEFAULT_EXPIRES_IN_SECONDS: 60 * 60 * 24 * 5, // 5days\r\n  DEFAULT_EXPIRES_IN_MS: 5 * 60 * 1000, // 5 minutes\r\n  DEFAULT_EXPIRES_IN_SECONDS: 5 * 60,\r\n  REVOKE_REFRESH_TOKENS_ON_SIGNOUT: true,\r\n} as const;\r\n\r\nconst COOKIE_OPTIONS = {\r\n  httpOnly: true,\r\n  secure: process.env.NODE_ENV === 'production',\r\n  sameSite: 'strict' as const,\r\n  path: '/',\r\n} as const;\r\n\r\nexport async function createSessionCookie_old(\r\n  params: SessionParams | string,\r\n  cookieStore: CookieStore,\r\n  options?: TernSecureHandlerOptions,\r\n): Promise<SessionResult> {\r\n  try {\r\n    const tenantAuth = getAuthForTenant(options?.tenantId || '');\r\n\r\n    let decodedToken;\r\n    let sessionCookie;\r\n\r\n    const idToken = typeof params === 'string' ? params : params.idToken;\r\n\r\n    if (!idToken) {\r\n      return {\r\n        success: false,\r\n        message: 'ID token is required',\r\n        error: 'INVALID_TOKEN',\r\n      };\r\n    }\r\n\r\n    try {\r\n      decodedToken = await tenantAuth.verifyIdToken(idToken);\r\n    } catch (verifyError) {\r\n      const authError = handleFirebaseAuthError(verifyError);\r\n      return {\r\n        success: false,\r\n        message: authError.message,\r\n        error: authError.code,\r\n      };\r\n    }\r\n\r\n    if (!decodedToken) {\r\n      return {\r\n        success: false,\r\n        message: 'Invalid ID token',\r\n        error: 'INVALID_TOKEN',\r\n      };\r\n    }\r\n\r\n    try {\r\n      sessionCookie = await tenantAuth.createSessionCookie(idToken, {\r\n        expiresIn: SESSION_CONSTANTS.DEFAULT_EXPIRES_IN_MS,\r\n      });\r\n    } catch (sessionError) {\r\n      console.error('[createSessionCookie] Firebase session cookie creation failed:', sessionError);\r\n      const authError = handleFirebaseAuthError(sessionError);\r\n      return {\r\n        success: false,\r\n        message: authError.message,\r\n        error: authError.code,\r\n      };\r\n    }\r\n\r\n    try {\r\n      await cookieStore.set(constants.Cookies.IdToken, idToken, {\r\n        maxAge: SESSION_CONSTANTS.DEFAULT_EXPIRES_IN_SECONDS,\r\n        ...COOKIE_OPTIONS,\r\n      });\r\n      await cookieStore.set(SESSION_CONSTANTS.COOKIE_NAME, sessionCookie, {\r\n        maxAge: SESSION_CONSTANTS.DEFAULT_EXPIRES_IN_SECONDS,\r\n        ...COOKIE_OPTIONS,\r\n      });\r\n    } catch (cookieError) {\r\n      console.error('[createSessionCookie] Failed to set session cookie:', cookieError);\r\n      return {\r\n        success: false,\r\n        message: 'Failed to set session cookie',\r\n        error: 'COOKIE_SET_FAILED',\r\n      };\r\n    }\r\n\r\n    return {\r\n      success: true,\r\n      message: 'Session created successfully',\r\n      expiresIn: SESSION_CONSTANTS.DEFAULT_EXPIRES_IN_SECONDS,\r\n    };\r\n  } catch (error) {\r\n    console.error('[createSessionCookie] Unexpected error:', error);\r\n    const authError = handleFirebaseAuthError(error);\r\n    return {\r\n      success: false,\r\n      message: authError.message || 'Failed to create session',\r\n      error: authError.code || 'INTERNAL_ERROR',\r\n    };\r\n  }\r\n}\r\n\r\nexport async function clearSessionCookie_old(\r\n  cookieStore: CookieStore,\r\n  options?: TernSecureHandlerOptions,\r\n): Promise<SessionResult> {\r\n  try {\r\n    const adminAuth = getAuthForTenant(options?.tenantId || '');\r\n    const sessionCookie = await cookieStore.get(SESSION_CONSTANTS.COOKIE_NAME);\r\n\r\n    await cookieStore.delete(SESSION_CONSTANTS.COOKIE_NAME);\r\n    await cookieStore.delete(constants.Cookies.IdToken);\r\n    await cookieStore.delete(constants.Cookies.Refresh);\r\n    await cookieStore.delete(constants.Cookies.Custom);\r\n    await cookieStore.delete(constants.Cookies.Session);\r\n\r\n    if (SESSION_CONSTANTS.REVOKE_REFRESH_TOKENS_ON_SIGNOUT && sessionCookie?.value) {\r\n      try {\r\n        const decodedClaims = await adminAuth.verifySessionCookie(sessionCookie.value);\r\n        await adminAuth.revokeRefreshTokens(decodedClaims.sub);\r\n      } catch (revokeError) {\r\n        console.error('[clearSessionCookie] Failed to revoke refresh tokens:', revokeError);\r\n      }\r\n    }\r\n    return {\r\n      success: true,\r\n      message: 'Session cleared successfully',\r\n    };\r\n  } catch (error) {\r\n    const authError = handleFirebaseAuthError(error);\r\n    return {\r\n      success: false,\r\n      message: authError.message || 'Failed to clear session',\r\n      error: authError.code || 'INTERNAL_ERROR',\r\n    };\r\n  }\r\n}\r\n\r\nexport async function createCustomToken_old(\r\n  uid: string,\r\n  options?: TernSecureHandlerOptions,\r\n): Promise<string | null> {\r\n  const adminAuth = getAuthForTenant(options?.tenantId || '');\r\n  try {\r\n    const customToken = await adminAuth.createCustomToken(uid);\r\n    return customToken;\r\n  } catch (error) {\r\n    console.error('[createCustomToken] Error creating custom token:', error);\r\n    return null;\r\n  }\r\n}\r\n\r\n/**\r\n * Generates cookie name with optional prefix\r\n */\r\n\r\nconst DEFAULT_COOKIE_CONFIG = {\r\n  DEFAULT_EXPIRES_IN_MS: 5 * 60 * 1000, // 5 minutes\r\n  DEFAULT_EXPIRES_IN_SECONDS: 5 * 60,\r\n  REVOKE_REFRESH_TOKENS_ON_SIGNOUT: true,\r\n} as const;\r\n\r\nconst DEFAULT_COOKIE_OPTIONS = {\r\n  httpOnly: true,\r\n  secure: process.env.NODE_ENV === 'production',\r\n  sameSite: 'strict' as const,\r\n  path: '/',\r\n} as const;\r\n\r\n/**\r\n * Generates cookie name with optional prefix\r\n */\r\nconst getCookieName = (baseName: string, prefix?: string): string => {\r\n  return prefix ? `${prefix}${baseName}` : baseName;\r\n};\r\n\r\n/**\r\n * Creates standard cookie options with optional overrides\r\n */\r\nconst createCookieOptions = (\r\n  maxAge: number,\r\n  overrides?: {\r\n    httpOnly?: boolean;\r\n    secure?: boolean;\r\n    sameSite?: 'strict' | 'lax' | 'none';\r\n    path?: string;\r\n  },\r\n) => {\r\n  return {\r\n    maxAge,\r\n    httpOnly: overrides?.httpOnly ?? DEFAULT_COOKIE_OPTIONS.httpOnly,\r\n    secure: overrides?.secure ?? DEFAULT_COOKIE_OPTIONS.secure,\r\n    sameSite: overrides?.sameSite ?? DEFAULT_COOKIE_OPTIONS.sameSite,\r\n    path: overrides?.path ?? DEFAULT_COOKIE_OPTIONS.path,\r\n  };\r\n};\r\n\r\n/**\r\n * Determines the appropriate cookie prefix based on environment and options\r\n */\r\nconst getCookiePrefix = (): string => {\r\n  const isProduction = process.env.NODE_ENV === 'production';\r\n  return isProduction ? '__HOST-' : '__dev_';\r\n};\r\n\r\n/**\r\n * Creates cookies for user session management\r\n * @param params - Session parameters containing idToken and optional refreshToken\r\n * @param cookieStore - Cookie store interface for managing cookies\r\n * @param options - TernSecure handler options containing cookie configurations\r\n */\r\nexport async function createSessionCookie(\r\n  params: SessionParams | string,\r\n  cookieStore: CookieStore,\r\n  options?: TernSecureHandlerOptions,\r\n): Promise<SessionResult> {\r\n  try {\r\n    const tenantAuth = getAuthForTenant(options?.tenantId || '');\r\n\r\n    const idToken = typeof params === 'string' ? params : params.idToken;\r\n    const refreshToken = typeof params === 'string' ? undefined : (params as any).refreshToken;\r\n\r\n    if (!idToken) {\r\n      return {\r\n        success: false,\r\n        message: 'ID token is required',\r\n        error: 'INVALID_TOKEN',\r\n      };\r\n    }\r\n\r\n    // Verify the ID token\r\n    let decodedToken;\r\n    try {\r\n      decodedToken = await tenantAuth.verifyIdToken(idToken);\r\n    } catch (verifyError) {\r\n      const authError = handleFirebaseAuthError(verifyError);\r\n      return {\r\n        success: false,\r\n        message: authError.message,\r\n        error: authError.code,\r\n      };\r\n    }\r\n\r\n    const cookiePromises: Promise<void>[] = [];\r\n    const cookiePrefix = getCookiePrefix();\r\n\r\n    // Always set idToken cookie by default\r\n    const idTokenCookieName = getCookieName(constants.Cookies.IdToken, cookiePrefix);\r\n    cookiePromises.push(\r\n      cookieStore.set(\r\n        idTokenCookieName,\r\n        idToken,\r\n        createCookieOptions(DEFAULT_COOKIE_CONFIG.DEFAULT_EXPIRES_IN_SECONDS),\r\n      ),\r\n    );\r\n\r\n    // Always set refreshToken cookie by default if provided\r\n    if (refreshToken) {\r\n      const refreshTokenCookieName = getCookieName(constants.Cookies.Refresh, cookiePrefix);\r\n      cookiePromises.push(\r\n        cookieStore.set(\r\n          refreshTokenCookieName,\r\n          refreshToken,\r\n          createCookieOptions(DEFAULT_COOKIE_CONFIG.DEFAULT_EXPIRES_IN_SECONDS),\r\n        ),\r\n      );\r\n    }\r\n\r\n    // Create and set session cookie only if session config is provided\r\n    if (options?.cookies?.session) {\r\n      const sessionOptions = options.cookies.session;\r\n      const sessionCookieName = getCookieName(constants.Cookies.Session); //removed prefix for test\r\n      const expiresIn = sessionOptions.maxAge\r\n        ? sessionOptions.maxAge * 1000\r\n        : DEFAULT_COOKIE_CONFIG.DEFAULT_EXPIRES_IN_MS;\r\n\r\n      try {\r\n        const sessionCookie = await tenantAuth.createSessionCookie(idToken, { expiresIn });\r\n        cookiePromises.push(\r\n          cookieStore.set(\r\n            sessionCookieName,\r\n            sessionCookie,\r\n            createCookieOptions(\r\n              sessionOptions.maxAge || DEFAULT_COOKIE_CONFIG.DEFAULT_EXPIRES_IN_SECONDS,\r\n              {\r\n                httpOnly: sessionOptions.httpOnly,\r\n                sameSite: sessionOptions.sameSite,\r\n                path: sessionOptions.path,\r\n              },\r\n            ),\r\n          ),\r\n        );\r\n      } catch (sessionError) {\r\n        console.error(\r\n          '[createSessionCookie] Firebase session cookie creation failed:',\r\n          sessionError,\r\n        );\r\n        const authError = handleFirebaseAuthError(sessionError);\r\n        return {\r\n          success: false,\r\n          message: authError.message,\r\n          error: authError.code,\r\n        };\r\n      }\r\n    }\r\n\r\n    // Create and set custom token cookie only if enableCustomToken is true\r\n    if (options?.enableCustomToken && decodedToken?.uid) {\r\n      const customTokenCookieName = getCookieName(constants.Cookies.Custom, cookiePrefix);\r\n      const customToken = await createCustomToken(decodedToken.uid, options);\r\n      if (customToken) {\r\n        cookiePromises.push(\r\n          cookieStore.set(\r\n            customTokenCookieName,\r\n            customToken,\r\n            createCookieOptions(DEFAULT_COOKIE_CONFIG.DEFAULT_EXPIRES_IN_SECONDS),\r\n          ),\r\n        );\r\n      }\r\n    }\r\n\r\n    await Promise.all(cookiePromises);\r\n\r\n    return {\r\n      success: true,\r\n      message: 'Session created successfully',\r\n      expiresIn: DEFAULT_COOKIE_CONFIG.DEFAULT_EXPIRES_IN_SECONDS,\r\n    };\r\n  } catch (error) {\r\n    console.error('[createSessionCookie] Unexpected error:', error);\r\n    const authError = handleFirebaseAuthError(error);\r\n    return {\r\n      success: false,\r\n      message: authError.message || 'Failed to create session',\r\n      error: authError.code || 'INTERNAL_ERROR',\r\n    };\r\n  }\r\n}\r\n\r\n/**\r\n * Clears user session cookies\r\n * @param cookieStore - Cookie store interface for managing cookies\r\n * @param options - TernSecure handler options containing cookie configurations\r\n */\r\nexport async function clearSessionCookie(\r\n  cookieStore: CookieStore,\r\n  options?: TernSecureHandlerOptions,\r\n): Promise<SessionResult> {\r\n  try {\r\n    const adminAuth = getAuthForTenant(options?.tenantId || '');\r\n    const cookiePrefix = getCookiePrefix();\r\n\r\n    // Get the session cookie name for revocation purposes\r\n    const sessionCookieName = getCookieName(constants.Cookies.Session, cookiePrefix);\r\n    const sessionCookie = await cookieStore.get(sessionCookieName);\r\n\r\n    const deletionPromises: Promise<void>[] = [];\r\n\r\n    // Delete all cookie types\r\n    // Session cookie (only if it was configured)\r\n    if (options?.cookies?.session) {\r\n      deletionPromises.push(cookieStore.delete(sessionCookieName));\r\n    }\r\n\r\n    // Always delete default cookies\r\n    const idTokenCookieName = getCookieName(constants.Cookies.IdToken, cookiePrefix);\r\n    deletionPromises.push(cookieStore.delete(idTokenCookieName));\r\n\r\n    const refreshTokenCookieName = getCookieName(constants.Cookies.Refresh, cookiePrefix);\r\n    deletionPromises.push(cookieStore.delete(refreshTokenCookieName));\r\n\r\n    const customTokenCookieName = getCookieName(constants.Cookies.Custom, cookiePrefix);\r\n    deletionPromises.push(cookieStore.delete(customTokenCookieName));\r\n\r\n    // Also delete legacy cookie names for backward compatibility\r\n    deletionPromises.push(cookieStore.delete(constants.Cookies.Session));\r\n\r\n    await Promise.all(deletionPromises);\r\n\r\n    // Revoke refresh tokens if session cookie exists and revocation is enabled\r\n    if (DEFAULT_COOKIE_CONFIG.REVOKE_REFRESH_TOKENS_ON_SIGNOUT && sessionCookie?.value) {\r\n      try {\r\n        const decodedClaims = await adminAuth.verifySessionCookie(sessionCookie.value);\r\n        await adminAuth.revokeRefreshTokens(decodedClaims.sub);\r\n      } catch (revokeError) {\r\n        console.error('[clearSessionCookie] Failed to revoke refresh tokens:', revokeError);\r\n      }\r\n    }\r\n\r\n    return {\r\n      success: true,\r\n      message: 'Session cleared successfully',\r\n    };\r\n  } catch (error) {\r\n    const authError = handleFirebaseAuthError(error);\r\n    return {\r\n      success: false,\r\n      message: authError.message || 'Failed to clear session',\r\n      error: authError.code || 'INTERNAL_ERROR',\r\n    };\r\n  }\r\n}\r\n\r\n/**\r\n * Creates a custom token for a user\r\n * @param uid - User ID to create the custom token for\r\n * @param options - TernSecure handler options\r\n * @returns Promise resolving to the custom token string or null if creation fails\r\n */\r\nexport async function createCustomToken(\r\n  uid: string,\r\n  options?: TernSecureHandlerOptions,\r\n): Promise<string | null> {\r\n  const adminAuth = getAuthForTenant(options?.tenantId || '');\r\n  try {\r\n    const customToken = await adminAuth.createCustomToken(uid);\r\n    return customToken;\r\n  } catch (error) {\r\n    console.error('[createCustomToken] Error creating custom token:', error);\r\n    return null;\r\n  }\r\n}\r\n\r\n\r\nexport async function createCustomTokenClaims(\r\n  uid: string,\r\n  developerClaims?: { [key: string]: unknown },\r\n): Promise<string> {\r\n  const adminAuth = getAuthForTenant();\r\n  try {\r\n    const customToken = await adminAuth.createCustomToken(uid, developerClaims);\r\n    return customToken;\r\n  } catch (error) {\r\n    console.error('[createCustomToken] Error creating custom token:', error);\r\n    return '';\r\n  }\r\n}\r\n","import admin from 'firebase-admin';\r\n\r\nimport { initializeAdminConfig } from './config';\r\n\r\nif (!admin.apps.length) {\r\n  try {\r\n    const config = initializeAdminConfig();\r\n    admin.initializeApp({\r\n      credential: admin.credential.cert({\r\n        ...config,\r\n        privateKey: config.privateKey.replace(/\\\\n/g, '\\n'),\r\n      }),\r\n    });\r\n  } catch (error) {\r\n    console.error('Firebase admin initialization error', error);\r\n  }\r\n}\r\n\r\nexport const adminTernSecureAuth: admin.auth.Auth = admin.auth();\r\nexport const adminTernSecureDb: admin.firestore.Firestore = admin.firestore();\r\nexport const TernSecureTenantManager: admin.auth.TenantManager = admin.auth().tenantManager();\r\n\r\n/**\r\n * Gets the appropriate Firebase Auth instance.\r\n * If a tenantId is provided, it returns the Auth instance for that tenant.\r\n * Otherwise, it returns the default project-level Auth instance.\r\n * @param tenantId - The optional tenant ID.\r\n * @returns An admin.auth.Auth instance.\r\n */\r\nexport function getAuthForTenant(tenantId?: string): admin.auth.Auth {\r\n  if (tenantId) {\r\n    return TernSecureTenantManager.authForTenant(tenantId) as unknown as admin.auth.Auth;\r\n  }\r\n  return admin.auth();\r\n}","import type { \r\n  AdminConfigValidationResult, \r\n  ConfigValidationResult, \r\n  TernSecureAdminConfig, \r\n  TernSecureConfig} from '@tern-secure/types'\r\n\r\n/**\r\n * Loads Firebase configuration from environment variables\r\n * @returns {TernSecureConfig} Firebase configuration object\r\n */\r\nexport const loadFireConfig = (): TernSecureConfig => ({\r\n  apiKey: process.env.NEXT_PUBLIC_FIREBASE_API_KEY || '',\r\n  authDomain: process.env.NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN || '',\r\n  projectId: process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID || '',\r\n  storageBucket: process.env.NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET || '',\r\n  messagingSenderId: process.env.NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID || '',\r\n  appId: process.env.NEXT_PUBLIC_FIREBASE_APP_ID || '',\r\n  measurementId: process.env.NEXT_PUBLIC_FIREBASE_MEASUREMENT_ID || undefined,\r\n})\r\n\r\n/**\r\n * Validates Firebase configuration\r\n * @param {TernSecureConfig} config - Firebase configuration object\r\n * @throws {Error} If required configuration values are missing\r\n * @returns {TernSecureConfig} Validated configuration object\r\n */\r\nexport const validateConfig = (config: TernSecureConfig): ConfigValidationResult => {\r\n  const requiredFields: (keyof TernSecureConfig)[] = [\r\n    'apiKey',\r\n    'authDomain',\r\n    'projectId',\r\n    'storageBucket',\r\n    'messagingSenderId',\r\n    'appId'\r\n  ]\r\n\r\n  const errors: string[] = []\r\n  \r\n  requiredFields.forEach(field => {\r\n    if (!config[field]) {\r\n      errors.push(`Missing required field: NEXT_PUBLIC_FIREBASE_${String(field).toUpperCase()}`)\r\n    }\r\n  })\r\n\r\n  return {\r\n    isValid: errors.length === 0,\r\n    errors,\r\n    config\r\n  }\r\n}\r\n\r\n/**\r\n * Initializes configuration with validation\r\n * @throws {Error} If configuration is invalid\r\n */\r\nexport const initializeConfig = (): TernSecureConfig => {\r\n  const config = loadFireConfig()\r\n  const validationResult = validateConfig(config)\r\n\r\n  if (!validationResult.isValid) {\r\n    throw new Error(\r\n      `Firebase configuration validation failed:\\n${validationResult.errors.join('\\n')}`\r\n    )\r\n  }\r\n\r\n  return config\r\n}\r\n\r\n/**\r\n * Loads Firebase Admin configuration from environment variables\r\n * @returns {AdminConfig} Firebase Admin configuration object\r\n */\r\nexport const loadAdminConfig = (): TernSecureAdminConfig => ({\r\n  projectId: process.env.FIREBASE_PROJECT_ID || '',\r\n  clientEmail: process.env.FIREBASE_CLIENT_EMAIL || '',\r\n  privateKey: process.env.FIREBASE_PRIVATE_KEY || '',\r\n})\r\n\r\n/**\r\n * Validates Firebase Admin configuration\r\n * @param {AdminConfig} config - Firebase Admin configuration object\r\n * @returns {ConfigValidationResult} Validation result\r\n */\r\nexport const validateAdminConfig = (config: TernSecureAdminConfig): AdminConfigValidationResult => {\r\n  const requiredFields: (keyof TernSecureAdminConfig)[] = [\r\n    'projectId',\r\n    'clientEmail',\r\n    'privateKey'\r\n  ]\r\n\r\n  const errors: string[] = []\r\n  \r\n  requiredFields.forEach(field => {\r\n    if (!config[field]) {\r\n      errors.push(`Missing required field: FIREBASE_${String(field).toUpperCase()}`)\r\n    }\r\n  })\r\n\r\n  return {\r\n    isValid: errors.length === 0,\r\n    errors,\r\n    config\r\n  }\r\n}\r\n\r\n/**\r\n * Initializes admin configuration with validation\r\n * @throws {Error} If configuration is invalid\r\n */\r\nexport const initializeAdminConfig = (): TernSecureAdminConfig => {\r\n  const config = loadAdminConfig()\r\n  const validationResult = validateAdminConfig(config)\r\n\r\n  if (!validationResult.isValid) {\r\n    throw new Error(\r\n      `Firebase Admin configuration validation failed:\\n${validationResult.errors.join('\\n')}`\r\n    )\r\n  }\r\n\r\n  return config\r\n}","import type { SignInResponse } from '@tern-secure/types';\r\n\r\nimport { TernSecureTenantManager } from \"../utils/admin-init\";\r\n\r\n\r\nexport async function createTenant(\r\n  displayName: string,\r\n  emailSignInConfig: {\r\n    enabled: boolean;\r\n    passwordRequired: boolean;\r\n  },\r\n  multiFactorConfig?: {\r\n    state: 'ENABLED' | 'DISABLED';\r\n    factorIds: \"phone\"[];\r\n    testPhoneNumbers?: {\r\n        [phoneNumber: string]: string;\r\n    }\r\n  }\r\n) {\r\n  try {\r\n    const tenantConfig = {\r\n      displayName,\r\n      emailSignInConfig,\r\n      ...(multiFactorConfig && { multiFactorConfig })\r\n    };\r\n\r\n    const tenant = await TernSecureTenantManager.createTenant(tenantConfig);\r\n    \r\n    return {\r\n      success: true,\r\n      tenantId: tenant.tenantId,\r\n      displayName: tenant.displayName,\r\n    };\r\n  } catch (error) {\r\n    console.error('Error creating tenant:', error);\r\n    throw new Error('Failed to create tenant');\r\n  }\r\n}\r\n\r\nexport async function createTenantUser(\r\n  email: string,\r\n  password: string,\r\n  tenantId: string\r\n): Promise<SignInResponse> {\r\n  try {\r\n    const tenantAuth = TernSecureTenantManager.authForTenant(tenantId);\r\n    \r\n    const userRecord = await tenantAuth.createUser({\r\n      email,\r\n      password,\r\n      emailVerified: false,\r\n      disabled: false\r\n    });\r\n\r\n    return {\r\n      success: true,\r\n      message: 'Tenant user created successfully',\r\n      user: userRecord.uid,\r\n    };\r\n  } catch (error) {\r\n    console.error('Error creating tenant user:', error);\r\n    throw new Error('Failed to create tenant user');\r\n  }\r\n}\r\n","\"use server\";\n\nimport { getCookieName, getCookiePrefix } from '@tern-secure/shared/cookie';\nimport { handleFirebaseAuthError } from \"@tern-secure/shared/errors\";\nimport type { TernVerificationResult } from \"@tern-secure/types\";\nimport { cookies } from \"next/headers\";\n\nimport { constants } from '../constants';\nimport { adminTernSecureAuth as adminAuth, getAuthForTenant } from \"../utils/admin-init\";\n\n\nconst SESSION_CONSTANTS = {\n  COOKIE_NAME: constants.Cookies.Session,\n  DEFAULT_EXPIRES_IN_MS: 60 * 60 * 24 * 5 * 1000, // 5 days\n  DEFAULT_EXPIRES_IN_SECONDS: 60 * 60 * 24 * 5,\n  REVOKE_REFRESH_TOKENS_ON_SIGNOUT: true,\n} as const;\n\nexport async function CreateNextSessionCookie(idToken: string) {\n  try {\n    const expiresIn = 60 * 60 * 24 * 5 * 1000;\n    const sessionCookie = await adminAuth.createSessionCookie(idToken, {\n      expiresIn,\n    });\n\n    const cookieStore = await cookies();\n    cookieStore.set(constants.Cookies.Session, sessionCookie, {\n      maxAge: expiresIn,\n      httpOnly: true,\n      secure: process.env.NODE_ENV === \"production\",\n      path: \"/\",\n    });\n    return { success: true, message: \"Session created\" };\n  } catch (error) {\n    return { success: false, message: \"Failed to create session\" };\n  }\n}\n\nexport async function GetNextServerSessionCookie() {\n  const cookieStore = await cookies();\n  const sessionCookie = cookieStore.get(\"_session_cookie\")?.value;\n\n  if (!sessionCookie) {\n    throw new Error(\"No session cookie found\");\n  }\n\n  try {\n    const decondeClaims = await adminAuth.verifySessionCookie(\n      sessionCookie,\n      true\n    );\n    return {\n      token: sessionCookie,\n      userId: decondeClaims.uid,\n    };\n  } catch (error) {\n    console.error(\"Error verifying session:\", error);\n    throw new Error(\"Invalid Session\");\n  }\n}\n\nexport async function GetNextIdToken() {\n  const cookieStore = await cookies();\n  const token = cookieStore.get(\"_session_token\")?.value;\n\n  if (!token) {\n    throw new Error(\"No session cookie found\");\n  }\n\n  try {\n    const decodedClaims = await adminAuth.verifyIdToken(token);\n    return {\n      token: token,\n      userId: decodedClaims.uid,\n    };\n  } catch (error) {\n    console.error(\"Error verifying session:\", error);\n    throw new Error(\"Invalid Session\");\n  }\n}\n\nexport async function SetNextServerSession(token: string) {\n  try {\n    const cookieStore = await cookies();\n    cookieStore.set(\"_session_token\", token, {\n      httpOnly: true,\n      secure: process.env.NODE_ENV === \"production\",\n      sameSite: \"strict\",\n      maxAge: 60 * 60, // 1 hour\n      path: \"/\",\n    });\n    return { success: true, message: \"Session created\" };\n  } catch {\n    return { success: false, message: \"Failed to create session\" };\n  }\n}\n\nexport async function SetNextServerToken(token: string) {\n  try {\n    const cookieStore = await cookies();\n    cookieStore.set(\"_tern\", token, {\n      httpOnly: true,\n      secure: process.env.NODE_ENV === \"production\",\n      sameSite: \"strict\",\n      maxAge: 60 * 60, // 1 hour\n      path: \"/\",\n    });\n    return { success: true, message: \"Session created\" };\n  } catch {\n    return { success: false, message: \"Failed to create session\" };\n  }\n}\n\nexport async function VerifyNextTernIdToken(\n  token: string\n): Promise<TernVerificationResult> {\n  try {\n    const decodedToken = await adminAuth.verifyIdToken(token);\n    return {\n      ...decodedToken,\n      valid: true,\n    };\n  } catch (error) {\n    console.error(\"[VerifyNextTernIdToken] Error verifying session:\", error);\n    const authError = handleFirebaseAuthError(error);\n    return {\n      valid: false,\n      error: authError,\n    };\n  }\n}\n\nexport async function VerifyNextTernSessionCookie(\n  session: string\n): Promise<TernVerificationResult> {\n  try {\n    const res = await adminAuth.verifySessionCookie(session);\n    console.warn(\n      \"[VerifyNextTernSessionCookie] uid in Decoded Token:\",\n      res.uid\n    );\n    return {\n      valid: true,\n      ...res,\n    };\n  } catch (error) {\n    console.error(\n      \"[VerifyNextTernSessionCookie] Error verifying session:\",\n      error\n    );\n    const authError = handleFirebaseAuthError(error);\n    return {\n      valid: false,\n      error: authError,\n    };\n  }\n}\n\nexport async function ClearNextSessionCookie(tenantId?: string) {\n  try {\n    console.log(\"[clearSessionCookie] Clearing session for tenant:\", tenantId);\n    const tenantAuth = getAuthForTenant(tenantId);\n    const cookieStore = await cookies();\n    const sessionCookie = cookieStore.get(SESSION_CONSTANTS.COOKIE_NAME);\n    const cookiePrefix = getCookiePrefix();\n\n    cookieStore.delete(SESSION_CONSTANTS.COOKIE_NAME);\n    cookieStore.delete(getCookieName(constants.Cookies.IdToken, cookiePrefix));\n    cookieStore.delete(getCookieName(constants.Cookies.Refresh, cookiePrefix));\n    cookieStore.delete(constants.Cookies.Custom);\n\n    if (\n      SESSION_CONSTANTS.REVOKE_REFRESH_TOKENS_ON_SIGNOUT &&\n      sessionCookie?.value\n    ) {\n      try {\n        const decodedClaims = await tenantAuth.verifySessionCookie(\n          sessionCookie.value\n        );\n        await tenantAuth.revokeRefreshTokens(decodedClaims.sub);\n        console.log(\n          `[clearSessionCookie] Successfully revoked tokens for user: ${decodedClaims.sub}`\n        );\n      } catch (revokeError) {\n        console.error(\n          \"[ClearNextSessionCookie] Failed to revoke refresh tokens:\",\n          revokeError\n        );\n      }\n    }\n    return { success: true, message: \"Session cleared successfully\" };\n  } catch (error) {\n    console.error(\"Error clearing session:\", error);\n    return { success: false, message: \"Failed to clear session cookies\" };\n  }\n}\n","import type { CheckCustomClaims, DecodedIdToken,SharedSignInAuthObjectProperties } from \"@tern-secure/types\";\n\nimport { VerifyNextTernSessionCookie } from \"../admin/nextSessionTernSecure\";\nimport type { TernSecureRequest} from \"../tokens/ternSecureRequest\";\nimport { createTernSecureRequest } from \"../tokens/ternSecureRequest\";\n\nexport type SignInAuthObject = SharedSignInAuthObjectProperties & {\n  has: CheckCustomClaims\n}\n\nexport type SignInState = {\n  auth: () => SignInAuthObject\n  token: string\n  headers: Headers\n}\n\nexport type RequestState = SignInState\n\nexport interface BackendInstance {\n  ternSecureRequest: TernSecureRequest;\n  requestState: RequestState;\n}\n\nexport const createBackendInstance = async (request: Request): Promise<BackendInstance> => {\n  const ternSecureRequest = createTernSecureRequest(request);\n  const requestState = await authenticateRequest(request);\n  \n  return {\n    ternSecureRequest,\n    requestState,\n  };\n};\n\nexport async function authenticateRequest(request: Request): Promise<RequestState> {\n  const sessionCookie = request.headers.get('cookie');\n  const sessionToken = sessionCookie?.split(';')\n    .find(c => c.trim().startsWith('_session_cookie='))\n    ?.split('=')[1];\n  \n  if (!sessionToken) {\n    throw new Error(\"No session token found\");\n  }\n\n  const verificationResult = await VerifyNextTernSessionCookie(sessionToken);\n\n  if (!verificationResult.valid) {\n    throw new Error(\"Invalid session token\");\n  }\n\n  return signedIn(\n    verificationResult as DecodedIdToken,\n    new Headers(request.headers),\n    sessionToken\n  );\n}\n\nexport function signInAuthObject(\n  session: DecodedIdToken,\n): SignInAuthObject {\n  return {\n    session,\n    userId: session.uid,\n    has: {} as CheckCustomClaims,\n  };\n}\n\nexport function signedIn(\n  session: DecodedIdToken,\n  headers: Headers = new Headers(),\n  token: string\n): SignInState {\n  const authObject = signInAuthObject(session);\n  return {\n    auth: () => authObject,\n    token,\n    headers,\n  };\n}\n"],"mappings":";;;;;;AACA,SAAS,+BAA+B;;;ACDxC,OAAO,WAAW;;;ACwEX,IAAM,kBAAkB,OAA8B;AAAA,EAC3D,WAAW,QAAQ,IAAI,uBAAuB;AAAA,EAC9C,aAAa,QAAQ,IAAI,yBAAyB;AAAA,EAClD,YAAY,QAAQ,IAAI,wBAAwB;AAClD;AAOO,IAAM,sBAAsB,CAAC,WAA+D;AACjG,QAAM,iBAAkD;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,SAAmB,CAAC;AAE1B,iBAAe,QAAQ,WAAS;AAC9B,QAAI,CAAC,OAAO,KAAK,GAAG;AAClB,aAAO,KAAK,oCAAoC,OAAO,KAAK,EAAE,YAAY,CAAC,EAAE;AAAA,IAC/E;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL,SAAS,OAAO,WAAW;AAAA,IAC3B;AAAA,IACA;AAAA,EACF;AACF;AAMO,IAAM,wBAAwB,MAA6B;AAChE,QAAM,SAAS,gBAAgB;AAC/B,QAAM,mBAAmB,oBAAoB,MAAM;AAEnD,MAAI,CAAC,iBAAiB,SAAS;AAC7B,UAAM,IAAI;AAAA,MACR;AAAA,EAAoD,iBAAiB,OAAO,KAAK,IAAI,CAAC;AAAA,IACxF;AAAA,EACF;AAEA,SAAO;AACT;;;ADpHA,IAAI,CAAC,MAAM,KAAK,QAAQ;AACtB,MAAI;AACF,UAAM,SAAS,sBAAsB;AACrC,UAAM,cAAc;AAAA,MAClB,YAAY,MAAM,WAAW,KAAK;AAAA,QAChC,GAAG;AAAA,QACH,YAAY,OAAO,WAAW,QAAQ,QAAQ,IAAI;AAAA,MACpD,CAAC;AAAA,IACH,CAAC;AAAA,EACH,SAAS,OAAO;AACd,YAAQ,MAAM,uCAAuC,KAAK;AAAA,EAC5D;AACF;AAEO,IAAM,sBAAuC,MAAM,KAAK;AACxD,IAAM,oBAA+C,MAAM,UAAU;AACrE,IAAM,0BAAoD,MAAM,KAAK,EAAE,cAAc;AASrF,SAAS,iBAAiB,UAAoC;AACnE,MAAI,UAAU;AACZ,WAAO,wBAAwB,cAAc,QAAQ;AAAA,EACvD;AACA,SAAO,MAAM,KAAK;AACpB;;;ADtBA,IAAM,oBAAoB;AAAA,EACxB,aAAa;AAAA;AAAA;AAAA,EAGb,uBAAuB,IAAI,KAAK;AAAA;AAAA,EAChC,4BAA4B,IAAI;AAAA,EAChC,kCAAkC;AACpC;AAEA,IAAM,iBAAiB;AAAA,EACrB,UAAU;AAAA,EACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,EACjC,UAAU;AAAA,EACV,MAAM;AACR;AAgJA,IAAM,wBAAwB;AAAA,EAC5B,uBAAuB,IAAI,KAAK;AAAA;AAAA,EAChC,4BAA4B,IAAI;AAAA,EAChC,kCAAkC;AACpC;AAEA,IAAM,yBAAyB;AAAA,EAC7B,UAAU;AAAA,EACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,EACjC,UAAU;AAAA,EACV,MAAM;AACR;AAKA,IAAM,gBAAgB,CAAC,UAAkB,WAA4B;AACnE,SAAO,SAAS,GAAG,MAAM,GAAG,QAAQ,KAAK;AAC3C;AAKA,IAAM,sBAAsB,CAC1B,QACA,cAMG;AACH,SAAO;AAAA,IACL;AAAA,IACA,UAAU,WAAW,YAAY,uBAAuB;AAAA,IACxD,QAAQ,WAAW,UAAU,uBAAuB;AAAA,IACpD,UAAU,WAAW,YAAY,uBAAuB;AAAA,IACxD,MAAM,WAAW,QAAQ,uBAAuB;AAAA,EAClD;AACF;AAKA,IAAM,kBAAkB,MAAc;AACpC,QAAM,eAAe,QAAQ,IAAI,aAAa;AAC9C,SAAO,eAAe,YAAY;AACpC;AAQA,eAAsB,oBACpB,QACA,aACA,SACwB;AACxB,MAAI;AACF,UAAM,aAAa,iBAAiB,SAAS,YAAY,EAAE;AAE3D,UAAM,UAAU,OAAO,WAAW,WAAW,SAAS,OAAO;AAC7D,UAAM,eAAe,OAAO,WAAW,WAAW,SAAa,OAAe;AAE9E,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,QACT,OAAO;AAAA,MACT;AAAA,IACF;AAGA,QAAI;AACJ,QAAI;AACF,qBAAe,MAAM,WAAW,cAAc,OAAO;AAAA,IACvD,SAAS,aAAa;AACpB,YAAM,YAAY,wBAAwB,WAAW;AACrD,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS,UAAU;AAAA,QACnB,OAAO,UAAU;AAAA,MACnB;AAAA,IACF;AAEA,UAAM,iBAAkC,CAAC;AACzC,UAAM,eAAe,gBAAgB;AAGrC,UAAM,oBAAoB,cAAc,UAAU,QAAQ,SAAS,YAAY;AAC/E,mBAAe;AAAA,MACb,YAAY;AAAA,QACV;AAAA,QACA;AAAA,QACA,oBAAoB,sBAAsB,0BAA0B;AAAA,MACtE;AAAA,IACF;AAGA,QAAI,cAAc;AAChB,YAAM,yBAAyB,cAAc,UAAU,QAAQ,SAAS,YAAY;AACpF,qBAAe;AAAA,QACb,YAAY;AAAA,UACV;AAAA,UACA;AAAA,UACA,oBAAoB,sBAAsB,0BAA0B;AAAA,QACtE;AAAA,MACF;AAAA,IACF;AAGA,QAAI,SAAS,SAAS,SAAS;AAC7B,YAAM,iBAAiB,QAAQ,QAAQ;AACvC,YAAM,oBAAoB,cAAc,UAAU,QAAQ,OAAO;AACjE,YAAM,YAAY,eAAe,SAC7B,eAAe,SAAS,MACxB,sBAAsB;AAE1B,UAAI;AACF,cAAM,gBAAgB,MAAM,WAAW,oBAAoB,SAAS,EAAE,UAAU,CAAC;AACjF,uBAAe;AAAA,UACb,YAAY;AAAA,YACV;AAAA,YACA;AAAA,YACA;AAAA,cACE,eAAe,UAAU,sBAAsB;AAAA,cAC/C;AAAA,gBACE,UAAU,eAAe;AAAA,gBACzB,UAAU,eAAe;AAAA,gBACzB,MAAM,eAAe;AAAA,cACvB;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,cAAc;AACrB,gBAAQ;AAAA,UACN;AAAA,UACA;AAAA,QACF;AACA,cAAM,YAAY,wBAAwB,YAAY;AACtD,eAAO;AAAA,UACL,SAAS;AAAA,UACT,SAAS,UAAU;AAAA,UACnB,OAAO,UAAU;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAGA,QAAI,SAAS,qBAAqB,cAAc,KAAK;AACnD,YAAM,wBAAwB,cAAc,UAAU,QAAQ,QAAQ,YAAY;AAClF,YAAM,cAAc,MAAM,kBAAkB,aAAa,KAAK,OAAO;AACrE,UAAI,aAAa;AACf,uBAAe;AAAA,UACb,YAAY;AAAA,YACV;AAAA,YACA;AAAA,YACA,oBAAoB,sBAAsB,0BAA0B;AAAA,UACtE;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,QAAQ,IAAI,cAAc;AAEhC,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,MACT,WAAW,sBAAsB;AAAA,IACnC;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,2CAA2C,KAAK;AAC9D,UAAM,YAAY,wBAAwB,KAAK;AAC/C,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS,UAAU,WAAW;AAAA,MAC9B,OAAO,UAAU,QAAQ;AAAA,IAC3B;AAAA,EACF;AACF;AAOA,eAAsB,mBACpB,aACA,SACwB;AACxB,MAAI;AACF,UAAM,YAAY,iBAAiB,SAAS,YAAY,EAAE;AAC1D,UAAM,eAAe,gBAAgB;AAGrC,UAAM,oBAAoB,cAAc,UAAU,QAAQ,SAAS,YAAY;AAC/E,UAAM,gBAAgB,MAAM,YAAY,IAAI,iBAAiB;AAE7D,UAAM,mBAAoC,CAAC;AAI3C,QAAI,SAAS,SAAS,SAAS;AAC7B,uBAAiB,KAAK,YAAY,OAAO,iBAAiB,CAAC;AAAA,IAC7D;AAGA,UAAM,oBAAoB,cAAc,UAAU,QAAQ,SAAS,YAAY;AAC/E,qBAAiB,KAAK,YAAY,OAAO,iBAAiB,CAAC;AAE3D,UAAM,yBAAyB,cAAc,UAAU,QAAQ,SAAS,YAAY;AACpF,qBAAiB,KAAK,YAAY,OAAO,sBAAsB,CAAC;AAEhE,UAAM,wBAAwB,cAAc,UAAU,QAAQ,QAAQ,YAAY;AAClF,qBAAiB,KAAK,YAAY,OAAO,qBAAqB,CAAC;AAG/D,qBAAiB,KAAK,YAAY,OAAO,UAAU,QAAQ,OAAO,CAAC;AAEnE,UAAM,QAAQ,IAAI,gBAAgB;AAGlC,QAAI,sBAAsB,oCAAoC,eAAe,OAAO;AAClF,UAAI;AACF,cAAM,gBAAgB,MAAM,UAAU,oBAAoB,cAAc,KAAK;AAC7E,cAAM,UAAU,oBAAoB,cAAc,GAAG;AAAA,MACvD,SAAS,aAAa;AACpB,gBAAQ,MAAM,yDAAyD,WAAW;AAAA,MACpF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AAAA,EACF,SAAS,OAAO;AACd,UAAM,YAAY,wBAAwB,KAAK;AAC/C,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS,UAAU,WAAW;AAAA,MAC9B,OAAO,UAAU,QAAQ;AAAA,IAC3B;AAAA,EACF;AACF;AAQA,eAAsB,kBACpB,KACA,SACwB;AACxB,QAAM,YAAY,iBAAiB,SAAS,YAAY,EAAE;AAC1D,MAAI;AACF,UAAM,cAAc,MAAM,UAAU,kBAAkB,GAAG;AACzD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,YAAQ,MAAM,oDAAoD,KAAK;AACvE,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,wBACpB,KACA,iBACiB;AACjB,QAAM,YAAY,iBAAiB;AACnC,MAAI;AACF,UAAM,cAAc,MAAM,UAAU,kBAAkB,KAAK,eAAe;AAC1E,WAAO;AAAA,EACT,SAAS,OAAO;AACd,YAAQ,MAAM,oDAAoD,KAAK;AACvE,WAAO;AAAA,EACT;AACF;;;AG7bA,eAAsB,aACpB,aACA,mBAIA,mBAOA;AACA,MAAI;AACF,UAAM,eAAe;AAAA,MACnB;AAAA,MACA;AAAA,MACA,GAAI,qBAAqB,EAAE,kBAAkB;AAAA,IAC/C;AAEA,UAAM,SAAS,MAAM,wBAAwB,aAAa,YAAY;AAEtE,WAAO;AAAA,MACL,SAAS;AAAA,MACT,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,IACtB;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,0BAA0B,KAAK;AAC7C,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AACF;AAEA,eAAsB,iBACpB,OACA,UACA,UACyB;AACzB,MAAI;AACF,UAAM,aAAa,wBAAwB,cAAc,QAAQ;AAEjE,UAAM,aAAa,MAAM,WAAW,WAAW;AAAA,MAC7C;AAAA,MACA;AAAA,MACA,eAAe;AAAA,MACf,UAAU;AAAA,IACZ,CAAC;AAED,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,MACT,MAAM,WAAW;AAAA,IACnB;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,+BAA+B,KAAK;AAClD,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AACF;;;AC7DA,SAAS,iBAAAA,gBAAe,mBAAAC,wBAAuB;AAC/C,SAAS,2BAAAC,gCAA+B;AAExC,SAAS,eAAe;AAMxB,IAAMC,qBAAoB;AAAA,EACxB,aAAa,UAAU,QAAQ;AAAA,EAC/B,uBAAuB,KAAK,KAAK,KAAK,IAAI;AAAA;AAAA,EAC1C,4BAA4B,KAAK,KAAK,KAAK;AAAA,EAC3C,kCAAkC;AACpC;AAEA,eAAsB,wBAAwB,SAAiB;AAC7D,MAAI;AACF,UAAM,YAAY,KAAK,KAAK,KAAK,IAAI;AACrC,UAAM,gBAAgB,MAAM,oBAAU,oBAAoB,SAAS;AAAA,MACjE;AAAA,IACF,CAAC;AAED,UAAM,cAAc,MAAM,QAAQ;AAClC,gBAAY,IAAI,UAAU,QAAQ,SAAS,eAAe;AAAA,MACxD,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,MAAM;AAAA,IACR,CAAC;AACD,WAAO,EAAE,SAAS,MAAM,SAAS,kBAAkB;AAAA,EACrD,SAAS,OAAO;AACd,WAAO,EAAE,SAAS,OAAO,SAAS,2BAA2B;AAAA,EAC/D;AACF;AAEA,eAAsB,6BAA6B;AACjD,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,gBAAgB,YAAY,IAAI,iBAAiB,GAAG;AAE1D,MAAI,CAAC,eAAe;AAClB,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAEA,MAAI;AACF,UAAM,gBAAgB,MAAM,oBAAU;AAAA,MACpC;AAAA,MACA;AAAA,IACF;AACA,WAAO;AAAA,MACL,OAAO;AAAA,MACP,QAAQ,cAAc;AAAA,IACxB;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,4BAA4B,KAAK;AAC/C,UAAM,IAAI,MAAM,iBAAiB;AAAA,EACnC;AACF;AAEA,eAAsB,iBAAiB;AACrC,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,gBAAgB,GAAG;AAEjD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAEA,MAAI;AACF,UAAM,gBAAgB,MAAM,oBAAU,cAAc,KAAK;AACzD,WAAO;AAAA,MACL;AAAA,MACA,QAAQ,cAAc;AAAA,IACxB;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,4BAA4B,KAAK;AAC/C,UAAM,IAAI,MAAM,iBAAiB;AAAA,EACnC;AACF;AAEA,eAAsB,qBAAqB,OAAe;AACxD,MAAI;AACF,UAAM,cAAc,MAAM,QAAQ;AAClC,gBAAY,IAAI,kBAAkB,OAAO;AAAA,MACvC,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ,KAAK;AAAA;AAAA,MACb,MAAM;AAAA,IACR,CAAC;AACD,WAAO,EAAE,SAAS,MAAM,SAAS,kBAAkB;AAAA,EACrD,QAAQ;AACN,WAAO,EAAE,SAAS,OAAO,SAAS,2BAA2B;AAAA,EAC/D;AACF;AAEA,eAAsB,mBAAmB,OAAe;AACtD,MAAI;AACF,UAAM,cAAc,MAAM,QAAQ;AAClC,gBAAY,IAAI,SAAS,OAAO;AAAA,MAC9B,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ,KAAK;AAAA;AAAA,MACb,MAAM;AAAA,IACR,CAAC;AACD,WAAO,EAAE,SAAS,MAAM,SAAS,kBAAkB;AAAA,EACrD,QAAQ;AACN,WAAO,EAAE,SAAS,OAAO,SAAS,2BAA2B;AAAA,EAC/D;AACF;AAEA,eAAsB,sBACpB,OACiC;AACjC,MAAI;AACF,UAAM,eAAe,MAAM,oBAAU,cAAc,KAAK;AACxD,WAAO;AAAA,MACL,GAAG;AAAA,MACH,OAAO;AAAA,IACT;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,oDAAoD,KAAK;AACvE,UAAM,YAAYC,yBAAwB,KAAK;AAC/C,WAAO;AAAA,MACL,OAAO;AAAA,MACP,OAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAsB,4BACpB,SACiC;AACjC,MAAI;AACF,UAAM,MAAM,MAAM,oBAAU,oBAAoB,OAAO;AACvD,YAAQ;AAAA,MACN;AAAA,MACA,IAAI;AAAA,IACN;AACA,WAAO;AAAA,MACL,OAAO;AAAA,MACP,GAAG;AAAA,IACL;AAAA,EACF,SAAS,OAAO;AACd,YAAQ;AAAA,MACN;AAAA,MACA;AAAA,IACF;AACA,UAAM,YAAYA,yBAAwB,KAAK;AAC/C,WAAO;AAAA,MACL,OAAO;AAAA,MACP,OAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAsB,uBAAuB,UAAmB;AAC9D,MAAI;AACF,YAAQ,IAAI,qDAAqD,QAAQ;AACzE,UAAM,aAAa,iBAAiB,QAAQ;AAC5C,UAAM,cAAc,MAAM,QAAQ;AAClC,UAAM,gBAAgB,YAAY,IAAID,mBAAkB,WAAW;AACnE,UAAM,eAAeE,iBAAgB;AAErC,gBAAY,OAAOF,mBAAkB,WAAW;AAChD,gBAAY,OAAOG,eAAc,UAAU,QAAQ,SAAS,YAAY,CAAC;AACzE,gBAAY,OAAOA,eAAc,UAAU,QAAQ,SAAS,YAAY,CAAC;AACzE,gBAAY,OAAO,UAAU,QAAQ,MAAM;AAE3C,QACEH,mBAAkB,oCAClB,eAAe,OACf;AACA,UAAI;AACF,cAAM,gBAAgB,MAAM,WAAW;AAAA,UACrC,cAAc;AAAA,QAChB;AACA,cAAM,WAAW,oBAAoB,cAAc,GAAG;AACtD,gBAAQ;AAAA,UACN,8DAA8D,cAAc,GAAG;AAAA,QACjF;AAAA,MACF,SAAS,aAAa;AACpB,gBAAQ;AAAA,UACN;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,SAAS,MAAM,SAAS,+BAA+B;AAAA,EAClE,SAAS,OAAO;AACd,YAAQ,MAAM,2BAA2B,KAAK;AAC9C,WAAO,EAAE,SAAS,OAAO,SAAS,kCAAkC;AAAA,EACtE;AACF;;;AC5KO,IAAM,wBAAwB,OAAO,YAA+C;AACzF,QAAM,oBAAoB,wBAAwB,OAAO;AACzD,QAAM,eAAe,MAAM,oBAAoB,OAAO;AAEtD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,oBAAoB,SAAyC;AACjF,QAAM,gBAAgB,QAAQ,QAAQ,IAAI,QAAQ;AAClD,QAAM,eAAe,eAAe,MAAM,GAAG,EAC1C,KAAK,OAAK,EAAE,KAAK,EAAE,WAAW,kBAAkB,CAAC,GAChD,MAAM,GAAG,EAAE,CAAC;AAEhB,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI,MAAM,wBAAwB;AAAA,EAC1C;AAEA,QAAM,qBAAqB,MAAM,4BAA4B,YAAY;AAEzE,MAAI,CAAC,mBAAmB,OAAO;AAC7B,UAAM,IAAI,MAAM,uBAAuB;AAAA,EACzC;AAEA,SAAO;AAAA,IACL;AAAA,IACA,IAAI,QAAQ,QAAQ,OAAO;AAAA,IAC3B;AAAA,EACF;AACF;AAEO,SAAS,iBACd,SACkB;AAClB,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,QAAQ;AAAA,IAChB,KAAK,CAAC;AAAA,EACR;AACF;AAEO,SAAS,SACd,SACA,UAAmB,IAAI,QAAQ,GAC/B,OACa;AACb,QAAM,aAAa,iBAAiB,OAAO;AAC3C,SAAO;AAAA,IACL,MAAM,MAAM;AAAA,IACZ;AAAA,IACA;AAAA,EACF;AACF;","names":["getCookieName","getCookiePrefix","handleFirebaseAuthError","SESSION_CONSTANTS","handleFirebaseAuthError","getCookiePrefix","getCookieName"]}

package/dist/chunk-YKIA5EBF.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/tokens/keys.ts","../src/tokens/verify.ts"],"sourcesContent":["import { type RemoteJWKSetOptions } from 'jose';\n\nimport {\n  CACHE_CONTROL_REGEX,\n  DEFAULT_CACHE_DURATION,\n  GOOGLE_PUBLIC_KEYS_URL,\n  MAX_CACHE_LAST_UPDATED_AT_SECONDS\n} from '../constants';\nimport { TokenVerificationError, TokenVerificationErrorReason } from '../utils/errors';\n\nexport type PublicKeys = { [key: string]: string };\n\ninterface PublicKeysResponse {\n  keys: PublicKeys;\n  expiresAt: number;\n}\n\nexport type LoadJWKFromRemoteOptions = RemoteJWKSetOptions & {\n  kid: string;\n  keyURL?: string;\n  skipJwksCache?: boolean;\n};\n\ntype CertificateCache = Record<string, string>;\n\nlet cache: CertificateCache = {};\nlet lastUpdatedAt = 0;\nlet googleExpiresAt = 0;\n\nfunction getFromCache(kid: string) {\n  return cache[kid];\n}\n\nfunction getCacheValues() {\n  return Object.values(cache);\n}\n\nfunction setInCache(kid: string, certificate: string, shouldExpire = true) {\n  cache[kid] = certificate;\n  lastUpdatedAt = shouldExpire ? Date.now() : -1;\n}\n\nasync function fetchPublicKeys(keyUrl: string): Promise<PublicKeysResponse> {\n  const url = new URL(keyUrl);\n  const response = await fetch(url);\n  if (!response.ok) {\n    throw new TokenVerificationError({\n      message: `Error loading public keys from ${url.href} with code=${response.status} `,\n      reason: TokenVerificationErrorReason.TokenInvalid,\n    });\n  }\n\n  const data = await response.json();\n  const expiresAt = getExpiresAt(response);\n\n  return {\n    keys: data,\n    expiresAt,\n  };\n}\n\nexport async function loadJWKFromRemote({\n  keyURL = GOOGLE_PUBLIC_KEYS_URL,\n  skipJwksCache,\n  kid,\n}: LoadJWKFromRemoteOptions): Promise<string> {\n  if (skipJwksCache || isCacheExpired() || !getFromCache(kid)) {\n    const { keys, expiresAt } = await fetchPublicKeys(keyURL);\n\n    if (!keys || Object.keys(keys).length === 0) {\n      throw new TokenVerificationError({\n        message: `The JWKS endpoint ${keyURL} returned no keys`,\n        reason: TokenVerificationErrorReason.RemoteJWKFailedToLoad,\n      });\n    }\n    googleExpiresAt = expiresAt;\n\n    Object.entries(keys).forEach(([keyId, cert]) => {\n      setInCache(keyId, cert);\n    });\n  }\n  const cert = getFromCache(kid);\n  if (!cert) {\n    getCacheValues();\n    const availableKids = Object.keys(cache).sort().join(', ');\n\n    throw new TokenVerificationError({\n      message: `No public key found for kid \"${kid}\". Available kids: [${availableKids}]`,\n      reason: TokenVerificationErrorReason.TokenInvalid,\n    });\n  }\n  return cert;\n}\n\nfunction isCacheExpired() {\n  const now = Date.now();\n  if (lastUpdatedAt === -1) {\n    return false;\n  }\n\n  const cacheAge = now - lastUpdatedAt;\n  const maxCacheAge = MAX_CACHE_LAST_UPDATED_AT_SECONDS * 1000;\n  const localCacheExpired = cacheAge >= maxCacheAge;\n  const googleCacheExpired = now >= googleExpiresAt;\n\n  const isExpired = localCacheExpired || googleCacheExpired;\n\n  if (isExpired) {\n    cache = {};\n  }\n\n  return isExpired;\n}\n\nfunction getExpiresAt(res: Response) {\n  const cacheControlHeader = res.headers.get('cache-control');\n  if (!cacheControlHeader) {\n    return Date.now() + DEFAULT_CACHE_DURATION;\n  }\n  const maxAgeMatch = cacheControlHeader.match(CACHE_CONTROL_REGEX);\n  const maxAge = maxAgeMatch ? parseInt(maxAgeMatch[1], 10) : DEFAULT_CACHE_DURATION / 1000;\n\n  return Date.now() + maxAge * 1000;\n}\n\nexport const getCacheStats = () => ({\n  localExpiry: lastUpdatedAt + MAX_CACHE_LAST_UPDATED_AT_SECONDS * 1000,\n  googleExpiry: googleExpiresAt,\n  cacheCount: Object.keys(cache).length,\n});\n","import type { DecodedIdToken, TernSecureConfig } from '@tern-secure/types';\n\nimport type { JwtReturnType } from '../jwt/types';\nimport { ternDecodeJwt, verifyJwt, type VerifyJwtOptions } from '../jwt/verifyJwt';\nimport { TokenVerificationError, TokenVerificationErrorReason } from '../utils/errors';\nimport type { LoadJWKFromRemoteOptions } from './keys';\nimport { loadJWKFromRemote } from './keys';\n\nexport type VerifyTokenVOptions = Omit<VerifyJwtOptions, 'key'> & Omit<LoadJWKFromRemoteOptions, 'kid'> & {\n  jwtKey?: string;\n};\n\nexport { TernSecureConfig };\n\nexport async function verifyToken(\n  token: string,\n  options: VerifyTokenVOptions,\n): Promise<JwtReturnType<DecodedIdToken, TokenVerificationError>> {\n  const { data: decodedResult, errors } = ternDecodeJwt(token);\n\n  if (errors) {\n    return { errors };\n  }\n\n  const { header } = decodedResult;\n  const { kid } = header;\n\n  if (!kid) {\n    return {\n      errors: [\n        new TokenVerificationError({\n          reason: TokenVerificationErrorReason.TokenInvalid,\n          message: 'JWT \"kid\" header is missing.',\n        }),\n      ],\n    };\n  }\n\n  try {\n    const key = options.jwtKey || (await loadJWKFromRemote({ ...options, kid }));\n\n    if (!key) {\n      return {\n        errors: [\n          new TokenVerificationError({\n            reason: TokenVerificationErrorReason.TokenInvalid,\n            message: `No public key found for kid \"${kid}\".`,\n          }),\n        ],\n      };\n    }\n    return await verifyJwt(token, { ...options, key });\n  } catch (error) {\n    if (error instanceof TokenVerificationError) {\n      return { errors: [error] };\n    }\n    return {\n      errors: [error as TokenVerificationError],\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAyBA,IAAI,QAA0B,CAAC;AAC/B,IAAI,gBAAgB;AACpB,IAAI,kBAAkB;AAEtB,SAAS,aAAa,KAAa;AACjC,SAAO,MAAM,GAAG;AAClB;AAEA,SAAS,iBAAiB;AACxB,SAAO,OAAO,OAAO,KAAK;AAC5B;AAEA,SAAS,WAAW,KAAa,aAAqB,eAAe,MAAM;AACzE,QAAM,GAAG,IAAI;AACb,kBAAgB,eAAe,KAAK,IAAI,IAAI;AAC9C;AAEA,eAAe,gBAAgB,QAA6C;AAC1E,QAAM,MAAM,IAAI,IAAI,MAAM;AAC1B,QAAM,WAAW,MAAM,MAAM,GAAG;AAChC,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,uBAAuB;AAAA,MAC/B,SAAS,kCAAkC,IAAI,IAAI,cAAc,SAAS,MAAM;AAAA,MAChF,QAAQ,6BAA6B;AAAA,IACvC,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAM,YAAY,aAAa,QAAQ;AAEvC,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,EACF;AACF;AAEA,eAAsB,kBAAkB;AAAA,EACtC,SAAS;AAAA,EACT;AAAA,EACA;AACF,GAA8C;AAC5C,MAAI,iBAAiB,eAAe,KAAK,CAAC,aAAa,GAAG,GAAG;AAC3D,UAAM,EAAE,MAAM,UAAU,IAAI,MAAM,gBAAgB,MAAM;AAExD,QAAI,CAAC,QAAQ,OAAO,KAAK,IAAI,EAAE,WAAW,GAAG;AAC3C,YAAM,IAAI,uBAAuB;AAAA,QAC/B,SAAS,qBAAqB,MAAM;AAAA,QACpC,QAAQ,6BAA6B;AAAA,MACvC,CAAC;AAAA,IACH;AACA,sBAAkB;AAElB,WAAO,QAAQ,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAOA,KAAI,MAAM;AAC9C,iBAAW,OAAOA,KAAI;AAAA,IACxB,CAAC;AAAA,EACH;AACA,QAAM,OAAO,aAAa,GAAG;AAC7B,MAAI,CAAC,MAAM;AACT,mBAAe;AACf,UAAM,gBAAgB,OAAO,KAAK,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI;AAEzD,UAAM,IAAI,uBAAuB;AAAA,MAC/B,SAAS,gCAAgC,GAAG,uBAAuB,aAAa;AAAA,MAChF,QAAQ,6BAA6B;AAAA,IACvC,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB;AACxB,QAAM,MAAM,KAAK,IAAI;AACrB,MAAI,kBAAkB,IAAI;AACxB,WAAO;AAAA,EACT;AAEA,QAAM,WAAW,MAAM;AACvB,QAAM,cAAc,oCAAoC;AACxD,QAAM,oBAAoB,YAAY;AACtC,QAAM,qBAAqB,OAAO;AAElC,QAAM,YAAY,qBAAqB;AAEvC,MAAI,WAAW;AACb,YAAQ,CAAC;AAAA,EACX;AAEA,SAAO;AACT;AAEA,SAAS,aAAa,KAAe;AACnC,QAAM,qBAAqB,IAAI,QAAQ,IAAI,eAAe;AAC1D,MAAI,CAAC,oBAAoB;AACvB,WAAO,KAAK,IAAI,IAAI;AAAA,EACtB;AACA,QAAM,cAAc,mBAAmB,MAAM,mBAAmB;AAChE,QAAM,SAAS,cAAc,SAAS,YAAY,CAAC,GAAG,EAAE,IAAI,yBAAyB;AAErF,SAAO,KAAK,IAAI,IAAI,SAAS;AAC/B;;;AC7GA,eAAsB,YACpB,OACA,SACgE;AAChE,QAAM,EAAE,MAAM,eAAe,OAAO,IAAI,cAAc,KAAK;AAE3D,MAAI,QAAQ;AACV,WAAO,EAAE,OAAO;AAAA,EAClB;AAEA,QAAM,EAAE,OAAO,IAAI;AACnB,QAAM,EAAE,IAAI,IAAI;AAEhB,MAAI,CAAC,KAAK;AACR,WAAO;AAAA,MACL,QAAQ;AAAA,QACN,IAAI,uBAAuB;AAAA,UACzB,QAAQ,6BAA6B;AAAA,UACrC,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACF,UAAM,MAAM,QAAQ,UAAW,MAAM,kBAAkB,EAAE,GAAG,SAAS,IAAI,CAAC;AAE1E,QAAI,CAAC,KAAK;AACR,aAAO;AAAA,QACL,QAAQ;AAAA,UACN,IAAI,uBAAuB;AAAA,YACzB,QAAQ,6BAA6B;AAAA,YACrC,SAAS,gCAAgC,GAAG;AAAA,UAC9C,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,WAAO,MAAM,UAAU,OAAO,EAAE,GAAG,SAAS,IAAI,CAAC;AAAA,EACnD,SAAS,OAAO;AACd,QAAI,iBAAiB,wBAAwB;AAC3C,aAAO,EAAE,QAAQ,CAAC,KAAK,EAAE;AAAA,IAC3B;AACA,WAAO;AAAA,MACL,QAAQ,CAAC,KAA+B;AAAA,IAC1C;AAAA,EACF;AACF;","names":["cert"]}

package/dist/tokens/sessionConfig.d.ts

@@ -1,14 +0,0 @@
-import type { RequestOptions } from "./types";
-export declare const getSessionConfig: (options?: RequestOptions) => {
-    COOKIE_NAME: string | undefined;
-    DEFAULT_EXPIRES_IN_MS: number | undefined;
-    DEFAULT_EXPIRES_IN_SECONDS: number;
-    REVOKE_REFRESH_TOKENS_ON_SIGNOUT: boolean | undefined;
-};
-export declare const getCookieOptions: (options?: RequestOptions) => {
-    httpOnly: boolean | undefined;
-    secure: boolean | undefined;
-    sameSite: "none" | "lax" | "strict" | undefined;
-    path: string | undefined;
-};
-//# sourceMappingURL=sessionConfig.d.ts.map