@tern-secure/backend 1.2.0-canary.v20251127235234 → 1.2.0-canary.v20251202164451

package/dist/index.mjs

@@ -1,20 +1,18 @@
 import {
   getAuth,
   verifyToken
-} from "./chunk-DJLDUW7J.mjs";
+} from "./chunk-UCSJDX6Y.mjs";
 import {
+  constants,
   createTernSecureRequest
-} from "./chunk-GFH5CXQR.mjs";
-import {
-  constants
-} from "./chunk-WIVOBOZR.mjs";
+} from "./chunk-34QENCWP.mjs";
 import {
   RefreshTokenErrorReason,
   TokenVerificationError,
   TokenVerificationErrorReason,
   mapJwtPayloadToDecodedIdToken,
   ternDecodeJwt
-} from "./chunk-NXYWC6YO.mjs";
+} from "./chunk-TUYCJY35.mjs";
 
 // src/createRedirect.ts
 var buildUrl = (_baseUrl, _targetUrl, _returnBackUrl) => {
@@ -74,6 +72,82 @@ var createRedirect = (params) => {
   return { redirectToSignUp, redirectToSignIn };
 };
 
+// src/tokens/c-authenticateRequestProcessor.ts
+var RequestProcessorContext = class {
+  constructor(ternSecureRequest, options) {
+    this.ternSecureRequest = ternSecureRequest;
+    this.options = options;
+    this.initHeaderValues();
+    this.initCookieValues();
+    this.initHandshakeValues();
+    this.initUrlValues();
+    Object.assign(this, options);
+    this.ternUrl = this.ternSecureRequest.ternUrl;
+  }
+  get request() {
+    return this.ternSecureRequest;
+  }
+  initHeaderValues() {
+    this.sessionTokenInHeader = this.parseAuthorizationHeader(
+      this.getHeader(constants.Headers.Authorization)
+    );
+    this.origin = this.getHeader(constants.Headers.Origin);
+    this.host = this.getHeader(constants.Headers.Host);
+    this.forwardedHost = this.getHeader(constants.Headers.ForwardedHost);
+    this.forwardedProto = this.getHeader(constants.Headers.CloudFrontForwardedProto) || this.getHeader(constants.Headers.ForwardedProto);
+    this.referrer = this.getHeader(constants.Headers.Referrer);
+    this.userAgent = this.getHeader(constants.Headers.UserAgent);
+    this.secFetchDest = this.getHeader(constants.Headers.SecFetchDest);
+    this.accept = this.getHeader(constants.Headers.Accept);
+    this.appCheckToken = this.getHeader(constants.Headers.AppCheckToken);
+  }
+  initCookieValues() {
+    const isProduction = process.env.NODE_ENV === "production";
+    const defaultPrefix = isProduction ? "__HOST-" : "__dev_";
+    this.sessionTokenInCookie = this.getCookie(constants.Cookies.Session);
+    this.idTokenInCookie = this.getCookie(`${defaultPrefix}${constants.Cookies.IdToken}`);
+    this.refreshTokenInCookie = this.getCookie(`${defaultPrefix}${constants.Cookies.Refresh}`);
+    this.csrfTokenInCookie = this.getCookie(constants.Cookies.CsrfToken);
+    this.customTokenInCookie = this.getCookie(constants.Cookies.Custom);
+    this.ternAuth = Number.parseInt(this.getCookie(constants.Cookies.TernAut) || "0", 10);
+  }
+  initHandshakeValues() {
+    this.handshakeToken = this.getQueryParam(constants.QueryParameters.Handshake) || this.getCookie(constants.Cookies.Handshake);
+    this.handshakeNonce = this.getQueryParam(constants.QueryParameters.HandshakeNonce) || this.getCookie(constants.Cookies.HandshakeNonce);
+  }
+  initUrlValues() {
+    this.method = this.ternSecureRequest.method;
+    this.pathSegments = this.ternSecureRequest.ternUrl.pathname.split("/").filter(Boolean);
+    this.endpoint = this.pathSegments[2];
+    this.subEndpoint = this.pathSegments[3];
+  }
+  getQueryParam(name) {
+    return this.ternSecureRequest.ternUrl.searchParams.get(name);
+  }
+  getHeader(name) {
+    return this.ternSecureRequest.headers.get(name) || void 0;
+  }
+  getCookie(name) {
+    return this.ternSecureRequest.cookies.get(name) || void 0;
+  }
+  parseAuthorizationHeader(authorizationHeader) {
+    if (!authorizationHeader) {
+      return void 0;
+    }
+    const [scheme, token] = authorizationHeader.split(" ", 2);
+    if (!token) {
+      return scheme;
+    }
+    if (scheme === "Bearer") {
+      return token;
+    }
+    return void 0;
+  }
+};
+var createRequestProcessor = (ternSecureRequest, options) => {
+  return new RequestProcessorContext(ternSecureRequest, options);
+};
+
 // src/tokens/authstate.ts
 var AuthStatus = {
   SignedIn: "signed-in",
@@ -162,6 +236,7 @@ function signedOut(authCtx, reason, message = "", headers = new Headers()) {
     isSignedIn: false,
     auth: () => signedOutAuthObject(),
     token: null,
+    appCheckToken: authCtx.appCheckToken,
     headers
   });
 }
@@ -185,6 +260,12 @@ var decorateHeaders = (requestState) => {
     } catch {
     }
   }
+  if (requestState.appCheckToken) {
+    try {
+      headers.set(constants.Headers.AppCheckToken, requestState.appCheckToken);
+    } catch {
+    }
+  }
   requestState.headers = headers;
   return requestState;
 };
@@ -219,15 +300,11 @@ var AppCheckApi = class extends AbstractAPI {
       "Content-Type": "application/json",
       "Authorization": `Bearer ${accessToken}`
     };
-    const body = {
-      customToken,
-      limitedUse
-    };
     try {
       const response = await fetch(endpoint, {
         method: "POST",
         headers,
-        body: JSON.stringify(body)
+        body: JSON.stringify({ customToken, limitedUse })
       });
       if (!response.ok) {
         const errorText = await response.text();
@@ -690,82 +767,6 @@ function mergePreDefinedOptions(userOptions = {}) {
 // src/tokens/request.ts
 import { ms } from "@tern-secure/shared/ms";
 
-// src/tokens/c-authenticateRequestProcessor.ts
-var RequestProcessorContext = class {
-  constructor(ternSecureRequest, options) {
-    this.ternSecureRequest = ternSecureRequest;
-    this.options = options;
-    this.initHeaderValues();
-    this.initCookieValues();
-    this.initHandshakeValues();
-    this.initUrlValues();
-    Object.assign(this, options);
-    this.ternUrl = this.ternSecureRequest.ternUrl;
-  }
-  get request() {
-    return this.ternSecureRequest;
-  }
-  initHeaderValues() {
-    this.sessionTokenInHeader = this.parseAuthorizationHeader(
-      this.getHeader(constants.Headers.Authorization)
-    );
-    this.origin = this.getHeader(constants.Headers.Origin);
-    this.host = this.getHeader(constants.Headers.Host);
-    this.forwardedHost = this.getHeader(constants.Headers.ForwardedHost);
-    this.forwardedProto = this.getHeader(constants.Headers.CloudFrontForwardedProto) || this.getHeader(constants.Headers.ForwardedProto);
-    this.referrer = this.getHeader(constants.Headers.Referrer);
-    this.userAgent = this.getHeader(constants.Headers.UserAgent);
-    this.secFetchDest = this.getHeader(constants.Headers.SecFetchDest);
-    this.accept = this.getHeader(constants.Headers.Accept);
-    this.appCheckToken = this.getHeader(constants.Headers.AppCheckToken);
-  }
-  initCookieValues() {
-    const isProduction = process.env.NODE_ENV === "production";
-    const defaultPrefix = isProduction ? "__HOST-" : "__dev_";
-    this.sessionTokenInCookie = this.getCookie(constants.Cookies.Session);
-    this.idTokenInCookie = this.getCookie(`${defaultPrefix}${constants.Cookies.IdToken}`);
-    this.refreshTokenInCookie = this.getCookie(`${defaultPrefix}${constants.Cookies.Refresh}`);
-    this.csrfTokenInCookie = this.getCookie(constants.Cookies.CsrfToken);
-    this.customTokenInCookie = this.getCookie(constants.Cookies.Custom);
-    this.ternAuth = Number.parseInt(this.getCookie(constants.Cookies.TernAut) || "0", 10);
-  }
-  initHandshakeValues() {
-    this.handshakeToken = this.getQueryParam(constants.QueryParameters.Handshake) || this.getCookie(constants.Cookies.Handshake);
-    this.handshakeNonce = this.getQueryParam(constants.QueryParameters.HandshakeNonce) || this.getCookie(constants.Cookies.HandshakeNonce);
-  }
-  initUrlValues() {
-    this.method = this.ternSecureRequest.method;
-    this.pathSegments = this.ternSecureRequest.ternUrl.pathname.split("/").filter(Boolean);
-    this.endpoint = this.pathSegments[2];
-    this.subEndpoint = this.pathSegments[3];
-  }
-  getQueryParam(name) {
-    return this.ternSecureRequest.ternUrl.searchParams.get(name);
-  }
-  getHeader(name) {
-    return this.ternSecureRequest.headers.get(name) || void 0;
-  }
-  getCookie(name) {
-    return this.ternSecureRequest.cookies.get(name) || void 0;
-  }
-  parseAuthorizationHeader(authorizationHeader) {
-    if (!authorizationHeader) {
-      return void 0;
-    }
-    const [scheme, token] = authorizationHeader.split(" ", 2);
-    if (!token) {
-      return scheme;
-    }
-    if (scheme === "Bearer") {
-      return token;
-    }
-    return void 0;
-  }
-};
-var createRequestProcessor = (ternSecureRequest, options) => {
-  return new RequestProcessorContext(ternSecureRequest, options);
-};
-
 // src/tokens/cookie.ts
 import { getCookieName as getCookieNameEnvironment, getCookiePrefix } from "@tern-secure/shared/cookie";
 
@@ -781,7 +782,7 @@ function isRequestForRefresh(error, context, request) {
 }
 async function authenticateRequest(request, options) {
   const context = createRequestProcessor(createTernSecureRequest(request), options);
-  const { refreshTokenInCookie, appCheckToken } = context;
+  const { refreshTokenInCookie } = context;
   const { refreshExpiredIdToken } = getAuth(options);
   function checkSessionTimeout(authTimeValue) {
     const defaultMaxAgeSeconds = convertToSeconds("5 days");
@@ -804,8 +805,7 @@ async function authenticateRequest(request, options) {
       };
     }
     return await refreshExpiredIdToken(refreshTokenInCookie, {
-      referer: context.ternUrl.origin,
-      appCheckToken
+      referer: context.ternUrl.origin
     });
   }
   async function handleRefresh() {
@@ -907,24 +907,7 @@ async function authenticateRequest(request, options) {
       if (errors) {
         throw errors[0];
       }
-      const { exchangeAppCheckToken } = getAuth(options);
-      let appCheckTokenValue;
-      try {
-        const idToken = context.idTokenInCookie || "";
-        const appCheckResult = await exchangeAppCheckToken(idToken);
-        console.log("[authenticateRequest] App Check exchange result:", appCheckResult);
-        if (appCheckResult.data?.token) {
-          appCheckTokenValue = appCheckResult.data.token;
-        }
-      } catch (error) {
-        console.warn("App Check token exchange failed:", error);
-      }
-      const headers = new Headers();
-      headers.set(
-        constants.Headers.AppCheckToken,
-        appCheckTokenValue || ""
-      );
-      const signedInRequestState = signedIn(context, data, headers, context.idTokenInCookie);
+      const signedInRequestState = signedIn(context, data, void 0, context.idTokenInCookie);
       return signedInRequestState;
     } catch (err) {
       return handleError(err, "cookie");
@@ -938,23 +921,7 @@ async function authenticateRequest(request, options) {
       if (errors) {
         throw errors[0];
       }
-      const { exchangeAppCheckToken } = getAuth(options);
-      let appCheckTokenValue;
-      try {
-        const token = sessionTokenInHeader || "";
-        const appCheckResult = await exchangeAppCheckToken(token);
-        if (appCheckResult.data?.token) {
-          appCheckTokenValue = appCheckResult.data.token;
-        }
-      } catch (error) {
-        console.warn("App Check token exchange failed:", error);
-      }
-      const headers = new Headers();
-      headers.set(
-        constants.Headers.AppCheckToken,
-        appCheckTokenValue || ""
-      );
-      const signedInRequestState = signedIn(context, data, headers, sessionTokenInHeader);
+      const signedInRequestState = signedIn(context, data, void 0, sessionTokenInHeader);
       return signedInRequestState;
     } catch (err) {
       return handleError(err, "header");
@@ -968,17 +935,8 @@ async function authenticateRequest(request, options) {
     if (isRequestForRefresh(err, context, request)) {
       const { data, error } = await handleRefresh();
       if (data) {
-        const { exchangeAppCheckToken } = getAuth(options);
-        let appCheckTokenValue;
-        try {
-          const appCheckResult = await exchangeAppCheckToken(data.token);
-          if (appCheckResult.data?.token) {
-            appCheckTokenValue = appCheckResult.data.token;
-          }
-        } catch (error2) {
-          console.warn("App Check token exchange failed in error handler:", error2);
-        }
-        return signedIn(context, data.decoded, data.headers, data.token);
+        const signedInState = signedIn(context, data.decoded, data.headers, data.token);
+        return signedInState;
       }
       if (error?.cause?.reason) {
         refreshError = error.cause.reason;
@@ -1294,6 +1252,7 @@ export {
   createAdapter,
   createBackendInstanceClient,
   createRedirect,
+  createRequestProcessor,
   createTernSecureRequest,
   disableDebugLogging,
   enableDebugLogging,
@@ -1301,6 +1260,7 @@ export {
   signedIn,
   signedInAuthObject,
   signedOutAuthObject,
-  validateCheckRevokedOptions
+  validateCheckRevokedOptions,
+  verifyToken
 };
 //# sourceMappingURL=index.mjs.map