@tern-secure/nextjs 4.0.0 → 4.2.0

package/dist/esm/app-router/server/sessionTernSecure.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/app-router/server/sessionTernSecure.ts"],"sourcesContent":["'use server'\n\nimport { cookies } from 'next/headers';\nimport { adminTernSecureAuth as adminAuth } from '../../utils/admin-init';\n\ninterface FirebaseAuthError extends Error {\n  code?: string;\n}\n\nexport interface User {\n    uid: string | null;\n    email: string | null;\n  }\n\nexport interface Session {\n    user: User | null;\n    token: string | null;\n    error: Error | null;\n}\n\nexport async function createSessionCookie(idToken: string) {\n  try {\n    const expiresIn = 60 * 60 * 24 * 5 * 1000;\n      const sessionCookie = await adminAuth.createSessionCookie(idToken, { expiresIn });\n\n      const cookieStore = await cookies();\n      cookieStore.set('_session_cookie', sessionCookie, {\n          maxAge: expiresIn,\n          httpOnly: true,\n          secure: process.env.NODE_ENV === 'production',\n          path: '/',\n      });\n      return { success: true, message: 'Session created' };\n  } catch (error) {\n      return { success: false, message: 'Failed to create session' };\n  }\n}\n\n\n\nexport async function getServerSessionCookie() {\n  const cookieStore = await cookies();\n  const sessionCookie = cookieStore.get('_session_cookie')?.value;\n\n  if (!sessionCookie) {\n    throw new Error('No session cookie found')\n  }\n    \n  try {\n    const decondeClaims = await adminAuth.verifySessionCookie(sessionCookie, true)\n    return {\n      token: sessionCookie,\n      userId: decondeClaims.uid\n    }\n  } catch (error) {\n    console.error('Error verifying session:', error)\n    throw new Error('Invalid Session')\n  }\n}\n\n\nexport async function getIdToken() {\n  const cookieStore = await cookies();\n  const token = cookieStore.get('_session_token')?.value;\n\n  if (!token) {\n    throw new Error('No session cookie found')\n  }\n    \n  try {\n    const decodedClaims = await adminAuth.verifyIdToken(token)\n    return {\n      token: token,\n      userId: decodedClaims.uid\n    }\n  } catch (error) {\n    console.error('Error verifying session:', error)\n    throw new Error('Invalid Session')\n  }\n}\n\nexport async function setServerSession(token: string) {\n    const cookieStore = await cookies();\n    cookieStore.set('_session', token, {\n      httpOnly: true,\n      secure: process.env.NODE_ENV === 'production',\n      sameSite: 'strict',\n      maxAge: 60 * 60, // 1 hour\n      path: '/',\n    });\n  }\n\n  export async function verifyTernIdToken(token: string): Promise<{ valid: boolean; uid?: string; error?: string }> {\n    try {\n      const decodedToken = await adminAuth.verifyIdToken(token, true);\n      return { valid: true, uid: decodedToken.uid };\n    } catch (error) {\n      if (error instanceof Error) {\n        const firebaseError = error as FirebaseAuthError;\n        if (error.name === 'FirebaseAuthError') {\n          // Handle specific Firebase Auth errors\n          switch (firebaseError.code) {\n            case 'auth/id-token-expired':\n              return { valid: false, error: 'Token has expired' };\n            case 'auth/id-token-revoked':\n              return { valid: false, error: 'Token has been revoked' };\n            case 'auth/user-disabled':\n              return { valid: false, error: 'User account has been disabled' };\n            default:\n              return { valid: false, error: 'Invalid token' };\n          }\n        }\n      }\n      return { valid: false, error: 'Error verifying token' };\n    }\n  }\n  \n\n  export async function verifyTernSessionCookie(session: string): Promise<{ valid: boolean; uid?: any; error?: any }>{\n    try {\n      const res = await adminAuth.verifySessionCookie(session, true);\n      if (res) {\n        return { valid: true, uid: res.uid };\n      } else {\n        return { valid: false, error: 'Invalid session'};\n      }\n    } catch (error) {\n      return {error: error, valid: false}\n    }\n  }\n\n\n  export async function clearSessionCookie() {\n    const cookieStore = await cookies()\n    \n    cookieStore.delete('_session_cookie')\n    cookieStore.delete('_session_token')\n    cookieStore.delete('_session')\n  \n    try {\n      // Verify if there's an active session before revoking\n      const sessionCookie = cookieStore.get('_session_cookie')?.value\n      if (sessionCookie) {\n        // Get the decoded claims to get the user's ID\n        const decodedClaims = await adminAuth.verifySessionCookie(sessionCookie)\n        \n        // Revoke all sessions for the user\n        await adminAuth.revokeRefreshTokens(decodedClaims.uid)\n      }\n      \n      return { success: true, message: 'Session cleared successfully' }\n    } catch (error) {\n      console.error('Error clearing session:', error)\n      // Still return success even if revoking fails, as cookies are cleared\n      return { success: true, message: 'Session cookies cleared' }\n    }\n  }\n\n\n\n/*\n  export async function GET(request: NextRequest) {\n    const cookieStore = await cookies();\n    const sessionCookie = cookieStore.get('session')?.value\n  \n    if (!sessionCookie) {\n      return NextResponse.json({ isAuthenticated: false }, { status: 401 })\n    }\n  \n    try {\n      const decodedClaims = await adminAuth.verifySessionCookie(sessionCookie, true)\n      return NextResponse.json({ isAuthenticated: true, user: decodedClaims }, { status: 200 })\n    } catch (error) {\n      console.error('Error verifying session cookie:', error)\n      return NextResponse.json({ isAuthenticated: false }, { status: 401 })\n    }\n  }\n\n*/"],"mappings":";AAEA,SAAS,eAAe;AACxB,SAAS,uBAAuB,iBAAiB;AAiBjD,eAAsB,oBAAoB,SAAiB;AACzD,MAAI;AACF,UAAM,YAAY,KAAK,KAAK,KAAK,IAAI;AACnC,UAAM,gBAAgB,MAAM,UAAU,oBAAoB,SAAS,EAAE,UAAU,CAAC;AAEhF,UAAM,cAAc,MAAM,QAAQ;AAClC,gBAAY,IAAI,mBAAmB,eAAe;AAAA,MAC9C,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,MAAM;AAAA,IACV,CAAC;AACD,WAAO,EAAE,SAAS,MAAM,SAAS,kBAAkB;AAAA,EACvD,SAAS,OAAO;AACZ,WAAO,EAAE,SAAS,OAAO,SAAS,2BAA2B;AAAA,EACjE;AACF;AAIA,eAAsB,yBAAyB;AAxC/C;AAyCE,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,iBAAgB,iBAAY,IAAI,iBAAiB,MAAjC,mBAAoC;AAE1D,MAAI,CAAC,eAAe;AAClB,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAEA,MAAI;AACF,UAAM,gBAAgB,MAAM,UAAU,oBAAoB,eAAe,IAAI;AAC7E,WAAO;AAAA,MACL,OAAO;AAAA,MACP,QAAQ,cAAc;AAAA,IACxB;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,4BAA4B,KAAK;AAC/C,UAAM,IAAI,MAAM,iBAAiB;AAAA,EACnC;AACF;AAGA,eAAsB,aAAa;AA7DnC;AA8DE,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,SAAQ,iBAAY,IAAI,gBAAgB,MAAhC,mBAAmC;AAEjD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAEA,MAAI;AACF,UAAM,gBAAgB,MAAM,UAAU,cAAc,KAAK;AACzD,WAAO;AAAA,MACL;AAAA,MACA,QAAQ,cAAc;AAAA,IACxB;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,4BAA4B,KAAK;AAC/C,UAAM,IAAI,MAAM,iBAAiB;AAAA,EACnC;AACF;AAEA,eAAsB,iBAAiB,OAAe;AAClD,QAAM,cAAc,MAAM,QAAQ;AAClC,cAAY,IAAI,YAAY,OAAO;AAAA,IACjC,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,QAAQ,KAAK;AAAA;AAAA,IACb,MAAM;AAAA,EACR,CAAC;AACH;AAEA,eAAsB,kBAAkB,OAA0E;AAChH,MAAI;AACF,UAAM,eAAe,MAAM,UAAU,cAAc,OAAO,IAAI;AAC9D,WAAO,EAAE,OAAO,MAAM,KAAK,aAAa,IAAI;AAAA,EAC9C,SAAS,OAAO;AACd,QAAI,iBAAiB,OAAO;AAC1B,YAAM,gBAAgB;AACtB,UAAI,MAAM,SAAS,qBAAqB;AAEtC,gBAAQ,cAAc,MAAM;AAAA,UAC1B,KAAK;AACH,mBAAO,EAAE,OAAO,OAAO,OAAO,oBAAoB;AAAA,UACpD,KAAK;AACH,mBAAO,EAAE,OAAO,OAAO,OAAO,yBAAyB;AAAA,UACzD,KAAK;AACH,mBAAO,EAAE,OAAO,OAAO,OAAO,iCAAiC;AAAA,UACjE;AACE,mBAAO,EAAE,OAAO,OAAO,OAAO,gBAAgB;AAAA,QAClD;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,OAAO,OAAO,OAAO,wBAAwB;AAAA,EACxD;AACF;AAGA,eAAsB,wBAAwB,SAAqE;AACjH,MAAI;AACF,UAAM,MAAM,MAAM,UAAU,oBAAoB,SAAS,IAAI;AAC7D,QAAI,KAAK;AACP,aAAO,EAAE,OAAO,MAAM,KAAK,IAAI,IAAI;AAAA,IACrC,OAAO;AACL,aAAO,EAAE,OAAO,OAAO,OAAO,kBAAiB;AAAA,IACjD;AAAA,EACF,SAAS,OAAO;AACd,WAAO,EAAC,OAAc,OAAO,MAAK;AAAA,EACpC;AACF;AAGA,eAAsB,qBAAqB;AApI7C;AAqII,QAAM,cAAc,MAAM,QAAQ;AAElC,cAAY,OAAO,iBAAiB;AACpC,cAAY,OAAO,gBAAgB;AACnC,cAAY,OAAO,UAAU;AAE7B,MAAI;AAEF,UAAM,iBAAgB,iBAAY,IAAI,iBAAiB,MAAjC,mBAAoC;AAC1D,QAAI,eAAe;AAEjB,YAAM,gBAAgB,MAAM,UAAU,oBAAoB,aAAa;AAGvE,YAAM,UAAU,oBAAoB,cAAc,GAAG;AAAA,IACvD;AAEA,WAAO,EAAE,SAAS,MAAM,SAAS,+BAA+B;AAAA,EAClE,SAAS,OAAO;AACd,YAAQ,MAAM,2BAA2B,KAAK;AAE9C,WAAO,EAAE,SAAS,MAAM,SAAS,0BAA0B;AAAA,EAC7D;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/app-router/server/sessionTernSecure.ts"],"sourcesContent":["'use server'\n\nimport { cookies } from 'next/headers';\nimport { adminTernSecureAuth as adminAuth } from '../../utils/admin-init';\n\ninterface FirebaseAuthError extends Error {\n  code?: string;\n}\n\nexport interface User {\n    uid: string | null;\n    email: string | null;\n  }\n\nexport interface Session {\n    user: User | null;\n    token: string | null;\n    error: Error | null;\n}\n\nexport async function createSessionCookie(idToken: string) {\n  try {\n    const expiresIn = 60 * 60 * 24 * 5 * 1000;\n      const sessionCookie = await adminAuth.createSessionCookie(idToken, { expiresIn });\n\n      const cookieStore = await cookies();\n      cookieStore.set('_session_cookie', sessionCookie, {\n          maxAge: expiresIn,\n          httpOnly: true,\n          secure: process.env.NODE_ENV === 'production',\n          path: '/',\n      });\n      return { success: true, message: 'Session created' };\n  } catch (error) {\n      return { success: false, message: 'Failed to create session' };\n  }\n}\n\n\n\nexport async function getServerSessionCookie() {\n  const cookieStore = await cookies();\n  const sessionCookie = cookieStore.get('_session_cookie')?.value;\n\n  if (!sessionCookie) {\n    throw new Error('No session cookie found')\n  }\n    \n  try {\n    const decondeClaims = await adminAuth.verifySessionCookie(sessionCookie, true)\n    return {\n      token: sessionCookie,\n      userId: decondeClaims.uid\n    }\n  } catch (error) {\n    console.error('Error verifying session:', error)\n    throw new Error('Invalid Session')\n  }\n}\n\n\nexport async function getIdToken() {\n  const cookieStore = await cookies();\n  const token = cookieStore.get('_session_token')?.value;\n\n  if (!token) {\n    throw new Error('No session cookie found')\n  }\n    \n  try {\n    const decodedClaims = await adminAuth.verifyIdToken(token)\n    return {\n      token: token,\n      userId: decodedClaims.uid\n    }\n  } catch (error) {\n    console.error('Error verifying session:', error)\n    throw new Error('Invalid Session')\n  }\n}\n\nexport async function setServerSession(token: string) {\n  try {\n    const cookieStore = await cookies();\n    cookieStore.set('_session_token', token, {\n      httpOnly: true,\n      secure: process.env.NODE_ENV === 'production',\n      sameSite: 'strict',\n      maxAge: 60 * 60, // 1 hour\n      path: '/',\n    });\n    return { success: true, message: 'Session created' };\n  } catch {\n    return { success: false, message: 'Failed to create session' };\n  }\n}\n\n  export async function verifyTernIdToken(token: string): Promise<{ valid: boolean; uid?: string; error?: string }> {\n    try {\n      const decodedToken = await adminAuth.verifyIdToken(token, true);\n      return { valid: true, uid: decodedToken.uid };\n    } catch (error) {\n      if (error instanceof Error) {\n        const firebaseError = error as FirebaseAuthError;\n        if (error.name === 'FirebaseAuthError') {\n          // Handle specific Firebase Auth errors\n          switch (firebaseError.code) {\n            case 'auth/id-token-expired':\n              return { valid: false, error: 'Token has expired' };\n            case 'auth/id-token-revoked':\n              return { valid: false, error: 'Token has been revoked' };\n            case 'auth/user-disabled':\n              return { valid: false, error: 'User account has been disabled' };\n            default:\n              return { valid: false, error: 'Invalid token' };\n          }\n        }\n      }\n      return { valid: false, error: 'Error verifying token' };\n    }\n  }\n  \n\n  export async function verifyTernSessionCookie(session: string): Promise<{ valid: boolean; uid?: any; error?: any }>{\n    try {\n      const res = await adminAuth.verifySessionCookie(session, true);\n      if (res) {\n        return { valid: true, uid: res.uid };\n      } else {\n        return { valid: false, error: 'Invalid session'};\n      }\n    } catch (error) {\n      return {error: error, valid: false}\n    }\n  }\n\n\n  export async function clearSessionCookie() {\n    const cookieStore = await cookies()\n    \n    cookieStore.delete('_session_cookie')\n    cookieStore.delete('_session_token')\n    cookieStore.delete('_session')\n  \n    try {\n      // Verify if there's an active session before revoking\n      const sessionCookie = cookieStore.get('_session_cookie')?.value\n      if (sessionCookie) {\n        // Get the decoded claims to get the user's ID\n        const decodedClaims = await adminAuth.verifySessionCookie(sessionCookie)\n        \n        // Revoke all sessions for the user\n        await adminAuth.revokeRefreshTokens(decodedClaims.uid)\n      }\n      \n      return { success: true, message: 'Session cleared successfully' }\n    } catch (error) {\n      console.error('Error clearing session:', error)\n      // Still return success even if revoking fails, as cookies are cleared\n      return { success: true, message: 'Session cookies cleared' }\n    }\n  }\n\n\n\n/*\n  export async function GET(request: NextRequest) {\n    const cookieStore = await cookies();\n    const sessionCookie = cookieStore.get('session')?.value\n  \n    if (!sessionCookie) {\n      return NextResponse.json({ isAuthenticated: false }, { status: 401 })\n    }\n  \n    try {\n      const decodedClaims = await adminAuth.verifySessionCookie(sessionCookie, true)\n      return NextResponse.json({ isAuthenticated: true, user: decodedClaims }, { status: 200 })\n    } catch (error) {\n      console.error('Error verifying session cookie:', error)\n      return NextResponse.json({ isAuthenticated: false }, { status: 401 })\n    }\n  }\n\n*/"],"mappings":";AAEA,SAAS,eAAe;AACxB,SAAS,uBAAuB,iBAAiB;AAiBjD,eAAsB,oBAAoB,SAAiB;AACzD,MAAI;AACF,UAAM,YAAY,KAAK,KAAK,KAAK,IAAI;AACnC,UAAM,gBAAgB,MAAM,UAAU,oBAAoB,SAAS,EAAE,UAAU,CAAC;AAEhF,UAAM,cAAc,MAAM,QAAQ;AAClC,gBAAY,IAAI,mBAAmB,eAAe;AAAA,MAC9C,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,MAAM;AAAA,IACV,CAAC;AACD,WAAO,EAAE,SAAS,MAAM,SAAS,kBAAkB;AAAA,EACvD,SAAS,OAAO;AACZ,WAAO,EAAE,SAAS,OAAO,SAAS,2BAA2B;AAAA,EACjE;AACF;AAIA,eAAsB,yBAAyB;AAxC/C;AAyCE,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,iBAAgB,iBAAY,IAAI,iBAAiB,MAAjC,mBAAoC;AAE1D,MAAI,CAAC,eAAe;AAClB,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAEA,MAAI;AACF,UAAM,gBAAgB,MAAM,UAAU,oBAAoB,eAAe,IAAI;AAC7E,WAAO;AAAA,MACL,OAAO;AAAA,MACP,QAAQ,cAAc;AAAA,IACxB;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,4BAA4B,KAAK;AAC/C,UAAM,IAAI,MAAM,iBAAiB;AAAA,EACnC;AACF;AAGA,eAAsB,aAAa;AA7DnC;AA8DE,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,SAAQ,iBAAY,IAAI,gBAAgB,MAAhC,mBAAmC;AAEjD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAEA,MAAI;AACF,UAAM,gBAAgB,MAAM,UAAU,cAAc,KAAK;AACzD,WAAO;AAAA,MACL;AAAA,MACA,QAAQ,cAAc;AAAA,IACxB;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,4BAA4B,KAAK;AAC/C,UAAM,IAAI,MAAM,iBAAiB;AAAA,EACnC;AACF;AAEA,eAAsB,iBAAiB,OAAe;AACpD,MAAI;AACF,UAAM,cAAc,MAAM,QAAQ;AAClC,gBAAY,IAAI,kBAAkB,OAAO;AAAA,MACvC,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,UAAU;AAAA,MACV,QAAQ,KAAK;AAAA;AAAA,MACb,MAAM;AAAA,IACR,CAAC;AACD,WAAO,EAAE,SAAS,MAAM,SAAS,kBAAkB;AAAA,EACrD,QAAQ;AACN,WAAO,EAAE,SAAS,OAAO,SAAS,2BAA2B;AAAA,EAC/D;AACF;AAEE,eAAsB,kBAAkB,OAA0E;AAChH,MAAI;AACF,UAAM,eAAe,MAAM,UAAU,cAAc,OAAO,IAAI;AAC9D,WAAO,EAAE,OAAO,MAAM,KAAK,aAAa,IAAI;AAAA,EAC9C,SAAS,OAAO;AACd,QAAI,iBAAiB,OAAO;AAC1B,YAAM,gBAAgB;AACtB,UAAI,MAAM,SAAS,qBAAqB;AAEtC,gBAAQ,cAAc,MAAM;AAAA,UAC1B,KAAK;AACH,mBAAO,EAAE,OAAO,OAAO,OAAO,oBAAoB;AAAA,UACpD,KAAK;AACH,mBAAO,EAAE,OAAO,OAAO,OAAO,yBAAyB;AAAA,UACzD,KAAK;AACH,mBAAO,EAAE,OAAO,OAAO,OAAO,iCAAiC;AAAA,UACjE;AACE,mBAAO,EAAE,OAAO,OAAO,OAAO,gBAAgB;AAAA,QAClD;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,OAAO,OAAO,OAAO,wBAAwB;AAAA,EACxD;AACF;AAGA,eAAsB,wBAAwB,SAAqE;AACjH,MAAI;AACF,UAAM,MAAM,MAAM,UAAU,oBAAoB,SAAS,IAAI;AAC7D,QAAI,KAAK;AACP,aAAO,EAAE,OAAO,MAAM,KAAK,IAAI,IAAI;AAAA,IACrC,OAAO;AACL,aAAO,EAAE,OAAO,OAAO,OAAO,kBAAiB;AAAA,IACjD;AAAA,EACF,SAAS,OAAO;AACd,WAAO,EAAC,OAAc,OAAO,MAAK;AAAA,EACpC;AACF;AAGA,eAAsB,qBAAqB;AAzI7C;AA0II,QAAM,cAAc,MAAM,QAAQ;AAElC,cAAY,OAAO,iBAAiB;AACpC,cAAY,OAAO,gBAAgB;AACnC,cAAY,OAAO,UAAU;AAE7B,MAAI;AAEF,UAAM,iBAAgB,iBAAY,IAAI,iBAAiB,MAAjC,mBAAoC;AAC1D,QAAI,eAAe;AAEjB,YAAM,gBAAgB,MAAM,UAAU,oBAAoB,aAAa;AAGvE,YAAM,UAAU,oBAAoB,cAAc,GAAG;AAAA,IACvD;AAEA,WAAO,EAAE,SAAS,MAAM,SAAS,+BAA+B;AAAA,EAClE,SAAS,OAAO;AACd,YAAQ,MAAM,2BAA2B,KAAK;AAE9C,WAAO,EAAE,SAAS,MAAM,SAAS,0BAA0B;AAAA,EAC7D;AACF;","names":[]}

package/dist/esm/app-router/server/ternSecureMiddleware.js

@@ -1,26 +1,145 @@
 import { NextResponse } from "next/server";
-import { auth } from "./auth";
-function ternSecureMiddleware(options = {}) {
-  const { publicPaths = [], redirectTo = "/login" } = options;
-  return async function middleware(request) {
+import { cookies } from "next/headers";
+import { verifySession } from "./edge-session";
+import { verifyFirebaseToken } from "./jwt";
+const runtime = "edge";
+function createRouteMatcher(patterns) {
+  return (request) => {
+    const { pathname } = request.nextUrl;
+    return patterns.some((pattern) => {
+      const regexPattern = new RegExp(
+        `^${pattern.replace(/\*/g, ".*").replace(/\((.*)\)/, "(?:$1)?")}$`
+      );
+      return regexPattern.test(pathname);
+    });
+  };
+}
+async function edgeAuth(request) {
+  var _a, _b, _c, _d, _e, _f;
+  const cookieStore = await cookies();
+  async function protect() {
     const { pathname } = request.nextUrl;
-    if (publicPaths.includes(pathname)) {
-      return NextResponse.next();
+    throw new Error("Unauthorized access");
+  }
+  try {
+    const sessionCookie = (_a = cookieStore.get("_session_cookie")) == null ? void 0 : _a.value;
+    if (sessionCookie) {
+      const userInfo = await verifyFirebaseToken(sessionCookie, true);
+      console.log("userInfo", userInfo);
+      if (userInfo.valid) {
+        return {
+          user: {
+            uid: (_b = userInfo.uid) != null ? _b : "",
+            email: (_c = userInfo.email) != null ? _c : null
+          },
+          token: sessionCookie,
+          protect: async () => {
+          }
+        };
+      }
     }
+    const idToken = (_d = cookieStore.get("_session_token")) == null ? void 0 : _d.value;
+    if (idToken) {
+      const userInfo = await verifyFirebaseToken(idToken, false);
+      if (userInfo.valid) {
+        return {
+          user: {
+            uid: (_e = userInfo.uid) != null ? _e : "",
+            email: (_f = userInfo.email) != null ? _f : null
+          },
+          token: idToken,
+          protect: async () => {
+          }
+        };
+      }
+    }
+    return {
+      user: null,
+      token: null,
+      protect
+    };
+  } catch (error) {
+    return {
+      user: null,
+      token: null,
+      protect
+    };
+  }
+}
+async function edgeAuthSecond(request) {
+  var _a, _b;
+  async function protect() {
+    throw new Error("Unauthorized access");
+  }
+  try {
+    const sessionResult = await verifySession(request);
+    if (sessionResult.isAuthenticated && sessionResult.user) {
+      return {
+        user: sessionResult.user,
+        token: ((_a = request.cookies.get("_session_cookie")) == null ? void 0 : _a.value) || ((_b = request.cookies.get("_session_token")) == null ? void 0 : _b.value) || null,
+        protect: async () => {
+        }
+      };
+    }
+    return {
+      user: null,
+      token: null,
+      protect
+    };
+  } catch (error) {
+    console.error("Auth check error:", error);
+    return {
+      user: null,
+      token: null,
+      protect
+    };
+  }
+}
+function ternSecureMiddleware(callback) {
+  return async function middleware(request) {
     try {
-      const { userId, token, error } = await auth();
-      if (error || !userId || !token) {
-        return NextResponse.redirect(new URL(redirectTo, request.url));
+      const auth = await edgeAuthSecond(request);
+      try {
+        await callback(auth, request);
+        const response = NextResponse.next();
+        if (auth.user) {
+          response.headers.set("x-user-id", auth.user.uid);
+          if (auth.user.email) {
+            response.headers.set("x-user-email", auth.user.email);
+          }
+          if (auth.user.emailVerified !== void 0) {
+            response.headers.set("x-email-verified", auth.user.emailVerified.toString());
+          }
+          if (auth.user.authTime) {
+            response.headers.set("x-auth-time", auth.user.authTime.toString());
+          }
+        }
+        return response;
+      } catch (error) {
+        if (error instanceof Error && error.message === "Unauthorized access") {
+          const redirectUrl = new URL("/sign-in", request.url);
+          redirectUrl.searchParams.set("redirect", request.nextUrl.pathname);
+          return NextResponse.redirect(redirectUrl);
+        }
+        throw error;
       }
-      const response = NextResponse.next();
-      return response;
     } catch (error) {
-      console.error("Error in ternSecureMiddleware:", error);
-      return NextResponse.redirect(new URL(redirectTo, request.url));
+      console.error("Middleware error:", {
+        error: error instanceof Error ? {
+          name: error.name,
+          message: error.message,
+          stack: error.stack
+        } : error,
+        path: request.nextUrl.pathname
+      });
+      const redirectUrl = new URL("/sign-in", request.url);
+      return NextResponse.redirect(redirectUrl);
     }
   };
 }
 export {
+  createRouteMatcher,
+  runtime,
   ternSecureMiddleware
 };
 //# sourceMappingURL=ternSecureMiddleware.js.map

package/dist/esm/app-router/server/ternSecureMiddleware.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/app-router/server/ternSecureMiddleware.ts"],"sourcesContent":["import { NextRequest, NextResponse } from 'next/server';\nimport { auth } from './auth';\n\nexport interface TernSecureMiddlewareOptions {\n  publicPaths?: string[];\n  redirectTo?: string;\n}\n\nexport function ternSecureMiddleware(options: TernSecureMiddlewareOptions = {}) {\n  const { publicPaths = [], redirectTo = '/login' } = options;\n\n  return async function middleware(request: NextRequest) {\n    const { pathname } = request.nextUrl;\n\n    // Check if the path is public\n    if (publicPaths.includes(pathname)) {\n      return NextResponse.next();\n    }\n\n    try {\n      const { userId, token, error } = await auth();\n\n      if (error || !userId || !token) {\n        // If there's no valid session, redirect to login\n        return NextResponse.redirect(new URL(redirectTo, request.url));\n      }\n\n      // If there's a valid session, allow the request to proceed\n      const response = NextResponse.next();\n      \n      // Optionally, you can set headers here if needed\n      // response.headers.set('X-User-ID', userId);\n\n      return response;\n    } catch (error) {\n      console.error('Error in ternSecureMiddleware:', error);\n      return NextResponse.redirect(new URL(redirectTo, request.url));\n    }\n  };\n}\n\n"],"mappings":"AAAA,SAAsB,oBAAoB;AAC1C,SAAS,YAAY;AAOd,SAAS,qBAAqB,UAAuC,CAAC,GAAG;AAC9E,QAAM,EAAE,cAAc,CAAC,GAAG,aAAa,SAAS,IAAI;AAEpD,SAAO,eAAe,WAAW,SAAsB;AACrD,UAAM,EAAE,SAAS,IAAI,QAAQ;AAG7B,QAAI,YAAY,SAAS,QAAQ,GAAG;AAClC,aAAO,aAAa,KAAK;AAAA,IAC3B;AAEA,QAAI;AACF,YAAM,EAAE,QAAQ,OAAO,MAAM,IAAI,MAAM,KAAK;AAE5C,UAAI,SAAS,CAAC,UAAU,CAAC,OAAO;AAE9B,eAAO,aAAa,SAAS,IAAI,IAAI,YAAY,QAAQ,GAAG,CAAC;AAAA,MAC/D;AAGA,YAAM,WAAW,aAAa,KAAK;AAKnC,aAAO;AAAA,IACT,SAAS,OAAO;AACd,cAAQ,MAAM,kCAAkC,KAAK;AACrD,aAAO,aAAa,SAAS,IAAI,IAAI,YAAY,QAAQ,GAAG,CAAC;AAAA,IAC/D;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/app-router/server/ternSecureMiddleware.ts"],"sourcesContent":["import { NextRequest, NextResponse } from 'next/server';\nimport { cookies } from 'next/headers'\nimport { verifySession, type UserInfo } from './edge-session'\nimport { verifyFirebaseToken } from './jwt';\n\nexport const runtime = \"edge\"\n\n\ninterface Auth {\n  user: UserInfo | null\n  token: string | null\n  protect: () => Promise<void>\n}\n\ntype MiddlewareCallback = (\n  auth: Auth,\n  request: NextRequest\n) => Promise<void>\n\n\n/**\n * Create a route matcher function for public paths\n */\nexport function createRouteMatcher(patterns: string[]) {\n  return (request: NextRequest): boolean => {\n    const { pathname } = request.nextUrl\n    return patterns.some(pattern => {\n      // Convert route pattern to regex\n      const regexPattern = new RegExp(\n        `^${pattern.replace(/\\*/g, '.*').replace(/\\((.*)\\)/, '(?:$1)?')}$`\n      )\n      return regexPattern.test(pathname)\n    })\n  }\n}\n\n\n/**\n * Edge-compatible auth check\n */\nasync function edgeAuth(request: NextRequest): Promise<Auth>{\n  const cookieStore = await cookies()\n\n  async function protect() {\n    const { pathname } = request.nextUrl\n    throw new Error('Unauthorized access')\n  }\n\n  try {\n    // First try session cookie\n    const sessionCookie = cookieStore.get(\"_session_cookie\")?.value\n    if (sessionCookie) {\n      const userInfo = await verifyFirebaseToken(sessionCookie, true)\n      console.log('userInfo', userInfo)\n      if (userInfo.valid) {\n        return { \n          user: {\n            uid: userInfo.uid ?? '',\n            email: userInfo.email ?? null,\n          },\n          token: sessionCookie,\n          protect: async () => {}\n        }\n      }\n    }\n\n    // Then try ID token\n    const idToken = cookieStore.get(\"_session_token\")?.value\n    if (idToken) {\n      const userInfo = await verifyFirebaseToken(idToken, false)\n      if (userInfo.valid) {\n        return { \n          user: {\n            uid: userInfo.uid ?? '',\n            email: userInfo.email ?? null,\n          },\n          token: idToken,\n          protect: async () => {}\n        }\n      }\n    }\n\n    return {\n      user: null,\n      token: null,\n      protect\n    }\n  } catch (error) {\n    return {\n      user: null,\n      token: null,\n      protect\n    }\n  }\n}\n\n/**\n * Edge-compatible auth check\n */\nasync function edgeAuthSecond(request: NextRequest): Promise<Auth> {\n  async function protect() {\n    throw new Error(\"Unauthorized access\")\n  }\n\n  try {\n    const sessionResult = await verifySession(request)\n\n    if (sessionResult.isAuthenticated && sessionResult.user) {\n      return {\n        user: sessionResult.user,\n        token: request.cookies.get(\"_session_cookie\")?.value || request.cookies.get(\"_session_token\")?.value || null,\n        protect: async () => {},\n      }\n    }\n\n    return {\n      user: null,\n      token: null,\n      protect,\n    }\n  } catch (error) {\n    console.error(\"Auth check error:\", error)\n    return {\n      user: null,\n      token: null,\n      protect,\n    }\n  }\n}\n\n\n\n/**\n * Middleware factory that handles authentication and custom logic\n * @param customHandler Optional function for additional custom logic\n */\n\nexport function ternSecureMiddleware(callback: MiddlewareCallback) {\n  return async function middleware(request: NextRequest) {\n    try {\n      const auth = await edgeAuthSecond(request)\n\n      try {\n        \n        await callback(auth, request)\n\n        const response = NextResponse.next()\n\n        if (auth.user) {\n          // Set auth headers\n          response.headers.set(\"x-user-id\", auth.user.uid)\n          if (auth.user.email) {\n            response.headers.set(\"x-user-email\", auth.user.email)\n          }\n          if (auth.user.emailVerified !== undefined) {\n            response.headers.set(\"x-email-verified\", auth.user.emailVerified.toString())\n          }\n          if (auth.user.authTime) {\n            response.headers.set(\"x-auth-time\", auth.user.authTime.toString())\n          }\n        }\n\n        return response\n      } catch (error) {\n        // Handle unauthorized access\n        if (error instanceof Error && error.message === 'Unauthorized access') {\n          const redirectUrl = new URL('/sign-in', request.url)\n          redirectUrl.searchParams.set('redirect', request.nextUrl.pathname)\n          return NextResponse.redirect(redirectUrl)\n        }\n        throw error\n      }\n\n    } catch (error) {\n      console.error(\"Middleware error:\", {\n        error:\n          error instanceof Error\n            ? {\n                name: error.name,\n                message: error.message,\n                stack: error.stack,\n              }\n            : error,\n        path: request.nextUrl.pathname,\n      })\n\n      const redirectUrl = new URL(\"/sign-in\", request.url)\n      return NextResponse.redirect(redirectUrl)\n    }\n  }\n}\n"],"mappings":"AAAA,SAAsB,oBAAoB;AAC1C,SAAS,eAAe;AACxB,SAAS,qBAAoC;AAC7C,SAAS,2BAA2B;AAE7B,MAAM,UAAU;AAkBhB,SAAS,mBAAmB,UAAoB;AACrD,SAAO,CAAC,YAAkC;AACxC,UAAM,EAAE,SAAS,IAAI,QAAQ;AAC7B,WAAO,SAAS,KAAK,aAAW;AAE9B,YAAM,eAAe,IAAI;AAAA,QACvB,IAAI,QAAQ,QAAQ,OAAO,IAAI,EAAE,QAAQ,YAAY,SAAS,CAAC;AAAA,MACjE;AACA,aAAO,aAAa,KAAK,QAAQ;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAMA,eAAe,SAAS,SAAoC;AAxC5D;AAyCE,QAAM,cAAc,MAAM,QAAQ;AAElC,iBAAe,UAAU;AACvB,UAAM,EAAE,SAAS,IAAI,QAAQ;AAC7B,UAAM,IAAI,MAAM,qBAAqB;AAAA,EACvC;AAEA,MAAI;AAEF,UAAM,iBAAgB,iBAAY,IAAI,iBAAiB,MAAjC,mBAAoC;AAC1D,QAAI,eAAe;AACjB,YAAM,WAAW,MAAM,oBAAoB,eAAe,IAAI;AAC9D,cAAQ,IAAI,YAAY,QAAQ;AAChC,UAAI,SAAS,OAAO;AAClB,eAAO;AAAA,UACL,MAAM;AAAA,YACJ,MAAK,cAAS,QAAT,YAAgB;AAAA,YACrB,QAAO,cAAS,UAAT,YAAkB;AAAA,UAC3B;AAAA,UACA,OAAO;AAAA,UACP,SAAS,YAAY;AAAA,UAAC;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAGA,UAAM,WAAU,iBAAY,IAAI,gBAAgB,MAAhC,mBAAmC;AACnD,QAAI,SAAS;AACX,YAAM,WAAW,MAAM,oBAAoB,SAAS,KAAK;AACzD,UAAI,SAAS,OAAO;AAClB,eAAO;AAAA,UACL,MAAM;AAAA,YACJ,MAAK,cAAS,QAAT,YAAgB;AAAA,YACrB,QAAO,cAAS,UAAT,YAAkB;AAAA,UAC3B;AAAA,UACA,OAAO;AAAA,UACP,SAAS,YAAY;AAAA,UAAC;AAAA,QACxB;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF;AACF;AAKA,eAAe,eAAe,SAAqC;AAnGnE;AAoGE,iBAAe,UAAU;AACvB,UAAM,IAAI,MAAM,qBAAqB;AAAA,EACvC;AAEA,MAAI;AACF,UAAM,gBAAgB,MAAM,cAAc,OAAO;AAEjD,QAAI,cAAc,mBAAmB,cAAc,MAAM;AACvD,aAAO;AAAA,QACL,MAAM,cAAc;AAAA,QACpB,SAAO,aAAQ,QAAQ,IAAI,iBAAiB,MAArC,mBAAwC,YAAS,aAAQ,QAAQ,IAAI,gBAAgB,MAApC,mBAAuC,UAAS;AAAA,QACxG,SAAS,YAAY;AAAA,QAAC;AAAA,MACxB;AAAA,IACF;AAEA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,qBAAqB,KAAK;AACxC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF;AACF;AASO,SAAS,qBAAqB,UAA8B;AACjE,SAAO,eAAe,WAAW,SAAsB;AACrD,QAAI;AACF,YAAM,OAAO,MAAM,eAAe,OAAO;AAEzC,UAAI;AAEF,cAAM,SAAS,MAAM,OAAO;AAE5B,cAAM,WAAW,aAAa,KAAK;AAEnC,YAAI,KAAK,MAAM;AAEb,mBAAS,QAAQ,IAAI,aAAa,KAAK,KAAK,GAAG;AAC/C,cAAI,KAAK,KAAK,OAAO;AACnB,qBAAS,QAAQ,IAAI,gBAAgB,KAAK,KAAK,KAAK;AAAA,UACtD;AACA,cAAI,KAAK,KAAK,kBAAkB,QAAW;AACzC,qBAAS,QAAQ,IAAI,oBAAoB,KAAK,KAAK,cAAc,SAAS,CAAC;AAAA,UAC7E;AACA,cAAI,KAAK,KAAK,UAAU;AACtB,qBAAS,QAAQ,IAAI,eAAe,KAAK,KAAK,SAAS,SAAS,CAAC;AAAA,UACnE;AAAA,QACF;AAEA,eAAO;AAAA,MACT,SAAS,OAAO;AAEd,YAAI,iBAAiB,SAAS,MAAM,YAAY,uBAAuB;AACrE,gBAAM,cAAc,IAAI,IAAI,YAAY,QAAQ,GAAG;AACnD,sBAAY,aAAa,IAAI,YAAY,QAAQ,QAAQ,QAAQ;AACjE,iBAAO,aAAa,SAAS,WAAW;AAAA,QAC1C;AACA,cAAM;AAAA,MACR;AAAA,IAEF,SAAS,OAAO;AACd,cAAQ,MAAM,qBAAqB;AAAA,QACjC,OACE,iBAAiB,QACb;AAAA,UACE,MAAM,MAAM;AAAA,UACZ,SAAS,MAAM;AAAA,UACf,OAAO,MAAM;AAAA,QACf,IACA;AAAA,QACN,MAAM,QAAQ,QAAQ;AAAA,MACxB,CAAC;AAED,YAAM,cAAc,IAAI,IAAI,YAAY,QAAQ,GAAG;AACnD,aAAO,aAAa,SAAS,WAAW;AAAA,IAC1C;AAAA,EACF;AACF;","names":[]}

package/dist/esm/boundary/TernSecureClientProvider.js

@@ -4,14 +4,20 @@ import { useState, useEffect, useMemo, useCallback } from "react";
 import { ternSecureAuth } from "../utils/client-init";
 import { onAuthStateChanged } from "firebase/auth";
 import { TernSecureCtx } from "./TernSecureCtx";
-import { useRouter } from "next/navigation";
+import { useRouter, usePathname } from "next/navigation";
+import { isBaseAuthRoute, isInternalRoute, isAuthRoute } from "../app-router/route-handler/internal-route";
+import { hasRedirectLoop } from "../utils/construct";
 function TernSecureClientProvider({
   children,
-  loginPath = "/sign-in",
-  loadingComponent
+  loginPath = process.env.NEXT_PUBLIC_SIGN_IN_PATH || "/sign-in",
+  signUpPath = process.env.NEXT_PUBLIC_SIGN_UP_PATH || "/sign-up",
+  loadingComponent,
+  requiresVerification
 }) {
   const auth = useMemo(() => ternSecureAuth, []);
   const router = useRouter();
+  const pathname = usePathname();
+  const [isRedirecting, setIsRedirecting] = useState(false);
   const [authState, setAuthState] = useState(() => ({
     userId: null,
     isLoaded: false,
@@ -20,9 +26,58 @@ function TernSecureClientProvider({
     isVerified: false,
     isAuthenticated: false,
     token: null,
-    email: null
+    email: null,
+    status: "loading",
+    requiresVerification
   }));
+  const constructUrlWithRedirect = useCallback(
+    (loginPath2, currentPath, loginPathParam, signUpPathParam) => {
+      const baseUrl = window.location.origin;
+      const signInUrl = new URL(loginPath2, baseUrl);
+      if (!currentPath.includes(loginPathParam) && !currentPath.includes(signUpPathParam)) {
+        signInUrl.searchParams.set("redirect", currentPath);
+      }
+      return signInUrl.toString();
+    },
+    []
+  );
+  const shouldRedirect = useCallback(
+    (pathname2, isVerified) => {
+      const searchParams = new URLSearchParams(window.location.search);
+      if (isBaseAuthRoute(pathname2) && !searchParams.has("redirect")) {
+        return false;
+      }
+      if (isInternalRoute(pathname2)) {
+        return false;
+      }
+      if (isAuthRoute(pathname2) && (!requiresVerification || isVerified)) {
+        return false;
+      }
+      return true;
+    },
+    [requiresVerification]
+  );
+  const redirectToLogin = useCallback(
+    (currentPath) => {
+      const path = currentPath || pathname || "/";
+      if (isInternalRoute(path)) {
+        return;
+      }
+      if (hasRedirectLoop(path, loginPath)) {
+        return;
+      }
+      setIsRedirecting(true);
+      const loginUrl = constructUrlWithRedirect(loginPath, path, loginPath, signUpPath);
+      if (process.env.NODE_ENV === "production") {
+        window.location.href = loginUrl;
+      } else {
+        router.push(loginUrl);
+      }
+    },
+    [router, loginPath, signUpPath, pathname, constructUrlWithRedirect]
+  );
   const handleSignOut = useCallback(async (error) => {
+    const currentPath = window.location.pathname;
     await auth.signOut();
     setAuthState({
       isLoaded: true,
@@ -32,56 +87,124 @@ function TernSecureClientProvider({
       token: null,
       email: null,
       isVerified: false,
-      isAuthenticated: false
+      isAuthenticated: false,
+      status: "unauthenticated",
+      requiresVerification
     });
-    router.push(loginPath);
-  }, [auth, router, loginPath]);
+    redirectToLogin(currentPath);
+  }, [auth, redirectToLogin, requiresVerification]);
   const setEmail = useCallback((email) => {
     setAuthState((prev) => ({
       ...prev,
       email
     }));
   }, []);
+  const getAuthError = useCallback(() => {
+    if (authState.error) {
+      const error = authState.error;
+      return {
+        success: false,
+        message: error.message,
+        error: error.code,
+        user: null
+      };
+    }
+    if (authState.requiresVerification && authState.isValid && !authState.isVerified) {
+      return {
+        success: false,
+        message: "Email verification required",
+        error: "EMAIL_NOT_VERIFIED",
+        user: null
+      };
+    }
+    if (!authState.isAuthenticated && authState.status !== "loading") {
+      return {
+        success: false,
+        message: "User is not authenticated",
+        error: "AUTHENTICATED",
+        user: null
+      };
+    }
+    return {
+      success: true,
+      user: ternSecureAuth.currentUser
+    };
+  }, [
+    authState.error,
+    authState.isValid,
+    authState.isVerified,
+    authState.isAuthenticated,
+    authState.status,
+    authState.requiresVerification
+  ]);
   useEffect(() => {
-    const unsubscribe = onAuthStateChanged(auth, async (user) => {
-      if (user) {
-        const isValid = !!user.uid;
-        const isVerified = user.emailVerified;
-        setAuthState({
-          isLoaded: true,
-          userId: user.uid,
-          isValid,
-          isVerified,
-          isAuthenticated: isValid && isVerified,
-          token: user.getIdToken(),
-          error: null,
-          email: user.email
-        });
-      } else {
-        setAuthState({
-          isLoaded: true,
-          userId: null,
-          isValid: false,
-          isVerified: false,
-          isAuthenticated: false,
-          token: null,
-          error: new Error("User is not authenticated"),
-          email: null
-        });
-        if (!window.location.pathname.includes("/sign-up")) {
-          router.push(loginPath);
+    let mounted = true;
+    let initialLoad = true;
+    const unsubscribe = onAuthStateChanged(
+      auth,
+      async (user) => {
+        if (!mounted) return;
+        try {
+          if (user) {
+            const isValid = !!user.uid;
+            const isVerified = user.emailVerified;
+            const isAuthenticated = isValid && (!requiresVerification || isVerified);
+            setAuthState({
+              isLoaded: true,
+              userId: user.uid,
+              isValid,
+              isVerified,
+              isAuthenticated: isValid && isVerified,
+              token: user.getIdToken(),
+              error: null,
+              email: user.email,
+              status: isAuthenticated ? "authenticated" : "unverified",
+              requiresVerification
+            });
+            if (requiresVerification && !isVerified && shouldRedirect(pathname || "", isVerified)) {
+              if (initialLoad || !isRedirecting) {
+                redirectToLogin(pathname);
+              }
+            }
+          } else {
+            setAuthState({
+              isLoaded: true,
+              userId: null,
+              isValid: false,
+              isVerified: false,
+              isAuthenticated: false,
+              token: null,
+              error: null,
+              email: null,
+              status: "unauthenticated",
+              requiresVerification
+            });
+            if (shouldRedirect(pathname || "", false) && initialLoad) {
+              redirectToLogin();
+            }
+          }
+        } catch (error) {
+          console.error("Auth state change error:", error);
+          if (mounted) {
+            handleSignOut(error instanceof Error ? error : new Error("Authentication error occurred"));
+          }
+        } finally {
+          initialLoad = false;
         }
       }
-    }, (error) => {
-      handleSignOut(error instanceof Error ? error : new Error("Authentication error occurred"));
-    });
-    return () => unsubscribe();
-  }, [auth, handleSignOut, router, loginPath]);
+    );
+    return () => {
+      mounted = false;
+      unsubscribe();
+    };
+  }, [auth, handleSignOut, redirectToLogin, requiresVerification, pathname, isRedirecting, shouldRedirect]);
   const contextValue = useMemo(() => ({
     ...authState,
     signOut: handleSignOut,
-    setEmail
-  }), [authState, auth, handleSignOut, setEmail]);
+    setEmail,
+    getAuthError,
+    redirectToLogin
+  }), [authState, handleSignOut, setEmail, getAuthError, redirectToLogin]);
   if (!authState.isLoaded) {
     return /* @__PURE__ */ jsx(TernSecureCtx.Provider, { value: contextValue, children: loadingComponent || /* @__PURE__ */ jsx("div", { "aria-live": "polite", "aria-busy": "true", children: /* @__PURE__ */ jsx("span", { className: "sr-only", children: "Loading authentication state..." }) }) });
   }

package/dist/esm/boundary/TernSecureClientProvider.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/boundary/TernSecureClientProvider.tsx"],"sourcesContent":["\"use client\"\n\nimport React, { useState, useEffect, useMemo, useCallback } from 'react'\nimport { ternSecureAuth } from '../utils/client-init'\nimport { onAuthStateChanged, User } from \"firebase/auth\"\nimport { TernSecureCtx, TernSecureCtxValue } from './TernSecureCtx'\nimport { type TernSecureState } from '../types'\nimport { useRouter } from 'next/navigation'\n\ninterface TernSecureClientProviderProps {\n  children: React.ReactNode;\n  onUserChanged?: (user: User | null) => Promise<void>;\n  loginPath?: string;\n  loadingComponent?: React.ReactNode;\n}\n\nexport function TernSecureClientProvider({ \n  children, \n  loginPath = '/sign-in',\n  loadingComponent\n}: TernSecureClientProviderProps) {\n  const auth = useMemo(() => ternSecureAuth, []);\n  const router = useRouter();\n  const [authState, setAuthState] = useState<TernSecureState>(() => ({\n    userId: null,\n    isLoaded: false,\n    error: null,\n    isValid: false,\n    isVerified: false,\n    isAuthenticated: false,\n    token: null,\n    email: null,\n  }));\n\n  const handleSignOut = useCallback(async (error?: Error) => {\n    await auth.signOut();\n    setAuthState({\n      isLoaded: true,\n      userId: null,\n      error: error || null,\n      isValid: false,\n      token: null,\n      email: null,\n      isVerified: false,\n      isAuthenticated: false,\n    });\n    router.push(loginPath);\n  }, [auth, router, loginPath]);\n\n  const setEmail = useCallback((email: string) => {\n    setAuthState((prev) => ({\n      ...prev,\n      email,\n    }))\n  }, [])\n\nuseEffect(() => {\n    const unsubscribe = onAuthStateChanged(auth, async (user: User | null) => {\n      if (user) {\n        const isValid = !!user.uid;\n        const isVerified = user.emailVerified;\n        setAuthState({\n          isLoaded: true,\n          userId: user.uid,\n          isValid,\n          isVerified,\n          isAuthenticated: isValid && isVerified,\n          token: user.getIdToken(),\n          error: null,\n          email: user.email,\n        })\n      } else {\n        setAuthState({\n          isLoaded: true,\n          userId: null,\n          isValid: false,\n          isVerified: false,\n          isAuthenticated: false,\n          token: null,\n          error: new Error('User is not authenticated'),\n          email: null,\n        })\n        if (!window.location.pathname.includes(\"/sign-up\")) {\n          router.push(loginPath)\n        }\n      }\n    }, (error) => {\n      handleSignOut(error instanceof Error ? error : new Error('Authentication error occurred'));\n    })\n    \n    return () => unsubscribe()\n  }, [auth, handleSignOut, router, loginPath])\n\n  const contextValue: TernSecureCtxValue = useMemo(() => ({\n    ...authState,\n    signOut: handleSignOut,\n    setEmail\n  }), [authState, auth, handleSignOut, setEmail]);\n\n  if (!authState.isLoaded) {\n    return (\n      <TernSecureCtx.Provider value={contextValue}>\n        {loadingComponent || (\n          <div aria-live=\"polite\" aria-busy=\"true\">\n            <span className=\"sr-only\">Loading authentication state...</span>\n          </div>\n        )}\n      </TernSecureCtx.Provider>\n    );\n  }\n\n  return (\n      <TernSecureCtx.Provider value={contextValue}>\n       {children}\n      </TernSecureCtx.Provider>\n  )\n}"],"mappings":";AAwGY;AAtGZ,SAAgB,UAAU,WAAW,SAAS,mBAAmB;AACjE,SAAS,sBAAsB;AAC/B,SAAS,0BAAgC;AACzC,SAAS,qBAAyC;AAElD,SAAS,iBAAiB;AASnB,SAAS,yBAAyB;AAAA,EACvC;AAAA,EACA,YAAY;AAAA,EACZ;AACF,GAAkC;AAChC,QAAM,OAAO,QAAQ,MAAM,gBAAgB,CAAC,CAAC;AAC7C,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,WAAW,YAAY,IAAI,SAA0B,OAAO;AAAA,IACjE,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,OAAO;AAAA,IACP,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,iBAAiB;AAAA,IACjB,OAAO;AAAA,IACP,OAAO;AAAA,EACT,EAAE;AAEF,QAAM,gBAAgB,YAAY,OAAO,UAAkB;AACzD,UAAM,KAAK,QAAQ;AACnB,iBAAa;AAAA,MACX,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,OAAO,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,OAAO;AAAA,MACP,OAAO;AAAA,MACP,YAAY;AAAA,MACZ,iBAAiB;AAAA,IACnB,CAAC;AACD,WAAO,KAAK,SAAS;AAAA,EACvB,GAAG,CAAC,MAAM,QAAQ,SAAS,CAAC;AAE5B,QAAM,WAAW,YAAY,CAAC,UAAkB;AAC9C,iBAAa,CAAC,UAAU;AAAA,MACtB,GAAG;AAAA,MACH;AAAA,IACF,EAAE;AAAA,EACJ,GAAG,CAAC,CAAC;AAEP,YAAU,MAAM;AACZ,UAAM,cAAc,mBAAmB,MAAM,OAAO,SAAsB;AACxE,UAAI,MAAM;AACR,cAAM,UAAU,CAAC,CAAC,KAAK;AACvB,cAAM,aAAa,KAAK;AACxB,qBAAa;AAAA,UACX,UAAU;AAAA,UACV,QAAQ,KAAK;AAAA,UACb;AAAA,UACA;AAAA,UACA,iBAAiB,WAAW;AAAA,UAC5B,OAAO,KAAK,WAAW;AAAA,UACvB,OAAO;AAAA,UACP,OAAO,KAAK;AAAA,QACd,CAAC;AAAA,MACH,OAAO;AACL,qBAAa;AAAA,UACX,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,SAAS;AAAA,UACT,YAAY;AAAA,UACZ,iBAAiB;AAAA,UACjB,OAAO;AAAA,UACP,OAAO,IAAI,MAAM,2BAA2B;AAAA,UAC5C,OAAO;AAAA,QACT,CAAC;AACD,YAAI,CAAC,OAAO,SAAS,SAAS,SAAS,UAAU,GAAG;AAClD,iBAAO,KAAK,SAAS;AAAA,QACvB;AAAA,MACF;AAAA,IACF,GAAG,CAAC,UAAU;AACZ,oBAAc,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,+BAA+B,CAAC;AAAA,IAC3F,CAAC;AAED,WAAO,MAAM,YAAY;AAAA,EAC3B,GAAG,CAAC,MAAM,eAAe,QAAQ,SAAS,CAAC;AAE3C,QAAM,eAAmC,QAAQ,OAAO;AAAA,IACtD,GAAG;AAAA,IACH,SAAS;AAAA,IACT;AAAA,EACF,IAAI,CAAC,WAAW,MAAM,eAAe,QAAQ,CAAC;AAE9C,MAAI,CAAC,UAAU,UAAU;AACvB,WACE,oBAAC,cAAc,UAAd,EAAuB,OAAO,cAC5B,8BACC,oBAAC,SAAI,aAAU,UAAS,aAAU,QAChC,8BAAC,UAAK,WAAU,WAAU,6CAA+B,GAC3D,GAEJ;AAAA,EAEJ;AAEA,SACI,oBAAC,cAAc,UAAd,EAAuB,OAAO,cAC7B,UACF;AAEN;","names":[]}
+{"version":3,"sources":["../../../src/boundary/TernSecureClientProvider.tsx"],"sourcesContent":["\"use client\"\n\nimport React, { useState, useEffect, useMemo, useCallback } from 'react'\nimport { ternSecureAuth } from '../utils/client-init'\nimport { onAuthStateChanged, User } from \"firebase/auth\"\nimport { TernSecureCtx, TernSecureCtxValue } from './TernSecureCtx'\nimport type { TernSecureState, AuthError, SignInResponse } from \"../types\"\nimport type { ERRORS } from '../errors'\nimport { useRouter, usePathname } from 'next/navigation'\nimport { isBaseAuthRoute, isInternalRoute, isAuthRoute} from '../app-router/route-handler/internal-route'\nimport { hasRedirectLoop } from '../utils/construct'\n\n\n\n/**\n * @internal\n * Internal provider props - not meant for direct usage\n */\ninterface TernSecureClientProviderProps {\n  children: React.ReactNode\n  /** Callback when user state changes */\n  onUserChanged?: (user: User | null) => Promise<void>\n  /** Login page path */\n  loginPath?: string\n  /** Signup page path */\n  signUpPath?: string\n  /** Custom loading component */\n  loadingComponent?: React.ReactNode\n  /** Whether email verification is required */\n  requiresVerification: boolean\n}\n\n/**\n * @internal\n * Internal provider component that handles authentication state\n * This is wrapped by the public TernSecureProvider\n */\n\nexport function TernSecureClientProvider({ \n  children, \n  loginPath = process.env.NEXT_PUBLIC_SIGN_IN_PATH || '/sign-in',\n  signUpPath = process.env.NEXT_PUBLIC_SIGN_UP_PATH || '/sign-up',\n  loadingComponent,\n  requiresVerification,\n}: TernSecureClientProviderProps) {\n  const auth = useMemo(() => ternSecureAuth, []);\n  const router = useRouter();\n  const pathname = usePathname() // Get current pathname\n  const [isRedirecting, setIsRedirecting] = useState(false)\n\n  const [authState, setAuthState] = useState<TernSecureState>(() => ({\n    userId: null,\n    isLoaded: false,\n    error: null,\n    isValid: false,\n    isVerified: false,\n    isAuthenticated: false,\n    token: null,\n    email: null,\n    status: \"loading\",\n    requiresVerification,\n  }));\n\n  const constructUrlWithRedirect = useCallback(\n    (loginPath: string, currentPath: string, loginPathParam: string, signUpPathParam: string): string => {\n      const baseUrl = window.location.origin\n      const signInUrl = new URL(loginPath, baseUrl)\n\n      // Only add redirect if not already on login or signup page\n      if (!currentPath.includes(loginPathParam) && !currentPath.includes(signUpPathParam)) {\n        signInUrl.searchParams.set(\"redirect\", currentPath)\n      }\n      return signInUrl.toString()\n    },\n    [],\n  )\n\n\n  const shouldRedirect = useCallback(\n    (pathname: string, isVerified: boolean) => {\n      // Get current search params\n      const searchParams = new URLSearchParams(window.location.search)\n\n      // Don't redirect if we're on the base sign-in page with no redirect param\n      if (isBaseAuthRoute(pathname) && !searchParams.has(\"redirect\")) {\n        return false\n      }\n\n      // Don't redirect if we're on an internal route\n      if (isInternalRoute(pathname)) {\n        return false\n      }\n\n      // Don't redirect if we're in auth routes (except when handling verification)\n      if (isAuthRoute(pathname) && (!requiresVerification || isVerified)) {\n        return false\n      }\n\n      return true\n    },\n    [requiresVerification],\n  )\n\n  const redirectToLogin = useCallback(\n    (currentPath?: string) => {\n      const path = currentPath || pathname || \"/\"\n\n\n      if (isInternalRoute(path)) {  // Don't redirect if we're already on an internal route\n        return\n      }\n\n       // Check for redirect loops\n      if (hasRedirectLoop(path, loginPath)) {\n        return\n      }\n\n      setIsRedirecting(true)\n\n      const loginUrl = constructUrlWithRedirect(loginPath, path, loginPath, signUpPath)\n\n      if (process.env.NODE_ENV === \"production\") {\n        window.location.href = loginUrl\n      } else {\n        // Use router.push for development\n        router.push(loginUrl)\n      }\n  }, \n  [router, loginPath, signUpPath, pathname, constructUrlWithRedirect]\n)\n\n  const handleSignOut = useCallback(async (error?: Error) => {\n    const currentPath = window.location.pathname\n    await auth.signOut();\n    setAuthState({\n      isLoaded: true,\n      userId: null,\n      error: error || null,\n      isValid: false,\n      token: null,\n      email: null,\n      isVerified: false,\n      isAuthenticated: false,\n      status: \"unauthenticated\",\n      requiresVerification,\n    })\n    redirectToLogin(currentPath)\n  }, [auth, redirectToLogin, requiresVerification])\n\n  const setEmail = useCallback((email: string) => {\n    setAuthState((prev) => ({\n      ...prev,\n      email,\n    }))\n  }, [])\n\n  const getAuthError = useCallback((): SignInResponse => {\n    if (authState.error) {\n      const error = authState.error as AuthError;\n      return {\n        success: false,\n        message: error.message,\n        error: error.code as keyof typeof ERRORS,\n        user: null,\n      }\n    }\n\n    if (authState.requiresVerification && authState.isValid && !authState.isVerified) {\n      return {\n        success: false,\n        message: 'Email verification required',\n        error: 'EMAIL_NOT_VERIFIED',\n        user: null,\n      }\n    }\n\n    if (!authState.isAuthenticated && authState.status !== \"loading\") {\n      return {\n        success: false,\n        message: 'User is not authenticated',\n        error: 'AUTHENTICATED',\n        user: null,\n      }\n    }\n\n    return {\n      success: true,\n      user: ternSecureAuth.currentUser,\n    }\n  }, [\n    authState.error,\n    authState.isValid,\n    authState.isVerified,\n    authState.isAuthenticated,\n    authState.status,\n    authState.requiresVerification,\n  ])\n\nuseEffect(() => {\n  let mounted = true\n  let initialLoad = true\n\n  const unsubscribe = onAuthStateChanged(\n    auth,\n      async (user: User | null) => {\n       if (!mounted) return\n       try {\n        if (user) {\n        const isValid = !!user.uid;\n        const isVerified = user.emailVerified;\n        const isAuthenticated = isValid && (!requiresVerification || isVerified) // Consider user authenticated if verification is not required or if email is verified\n\n        setAuthState({\n          isLoaded: true,\n          userId: user.uid,\n          isValid,\n          isVerified,\n          isAuthenticated: isValid && isVerified,\n          token: user.getIdToken(),\n          error: null,\n          email: user.email,\n          status: isAuthenticated ? \"authenticated\" : \"unverified\",\n          requiresVerification,\n        })\n       \n        if (requiresVerification && !isVerified && shouldRedirect(pathname || \"\", isVerified)) {\n          if(initialLoad || !isRedirecting) {\n            redirectToLogin(pathname)\n        }\n      }\n      } else {\n        setAuthState({\n          isLoaded: true,\n          userId: null,\n          isValid: false,\n          isVerified: false,\n          isAuthenticated: false,\n          token: null,\n          error: null,\n          email: null,\n          status: \"unauthenticated\",\n          requiresVerification,\n        })\n        \n        if (shouldRedirect(pathname || \"\", false) && initialLoad) {\n          redirectToLogin()\n        }\n      }\n    } catch (error){\n      console.error(\"Auth state change error:\", error)\n      if (mounted) {\n        handleSignOut(error instanceof Error ? error : new Error(\"Authentication error occurred\"))\n      }\n    } finally {\n      initialLoad = false\n    }\n  })\n    \n  return () => {\n    mounted = false\n    unsubscribe()\n  }\n  }, [auth, handleSignOut, redirectToLogin, requiresVerification, pathname, isRedirecting, shouldRedirect])\n\n  const contextValue: TernSecureCtxValue = useMemo(() => ({\n    ...authState,\n    signOut: handleSignOut,\n    setEmail,\n    getAuthError,\n    redirectToLogin,\n  }), [authState, handleSignOut, setEmail, getAuthError, redirectToLogin]);\n\n  if (!authState.isLoaded) {\n    return (\n      <TernSecureCtx.Provider value={contextValue}>\n        {loadingComponent || (\n          <div aria-live=\"polite\" aria-busy=\"true\">\n            <span className=\"sr-only\">Loading authentication state...</span>\n          </div>\n        )}\n      </TernSecureCtx.Provider>\n    );\n  }\n\n  return (\n      <TernSecureCtx.Provider value={contextValue}>\n       {children}\n      </TernSecureCtx.Provider>\n  )\n}"],"mappings":";AAqRY;AAnRZ,SAAgB,UAAU,WAAW,SAAS,mBAAmB;AACjE,SAAS,sBAAsB;AAC/B,SAAS,0BAAgC;AACzC,SAAS,qBAAyC;AAGlD,SAAS,WAAW,mBAAmB;AACvC,SAAS,iBAAiB,iBAAiB,mBAAkB;AAC7D,SAAS,uBAAuB;AA4BzB,SAAS,yBAAyB;AAAA,EACvC;AAAA,EACA,YAAY,QAAQ,IAAI,4BAA4B;AAAA,EACpD,aAAa,QAAQ,IAAI,4BAA4B;AAAA,EACrD;AAAA,EACA;AACF,GAAkC;AAChC,QAAM,OAAO,QAAQ,MAAM,gBAAgB,CAAC,CAAC;AAC7C,QAAM,SAAS,UAAU;AACzB,QAAM,WAAW,YAAY;AAC7B,QAAM,CAAC,eAAe,gBAAgB,IAAI,SAAS,KAAK;AAExD,QAAM,CAAC,WAAW,YAAY,IAAI,SAA0B,OAAO;AAAA,IACjE,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,OAAO;AAAA,IACP,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,iBAAiB;AAAA,IACjB,OAAO;AAAA,IACP,OAAO;AAAA,IACP,QAAQ;AAAA,IACR;AAAA,EACF,EAAE;AAEF,QAAM,2BAA2B;AAAA,IAC/B,CAACA,YAAmB,aAAqB,gBAAwB,oBAAoC;AACnG,YAAM,UAAU,OAAO,SAAS;AAChC,YAAM,YAAY,IAAI,IAAIA,YAAW,OAAO;AAG5C,UAAI,CAAC,YAAY,SAAS,cAAc,KAAK,CAAC,YAAY,SAAS,eAAe,GAAG;AACnF,kBAAU,aAAa,IAAI,YAAY,WAAW;AAAA,MACpD;AACA,aAAO,UAAU,SAAS;AAAA,IAC5B;AAAA,IACA,CAAC;AAAA,EACH;AAGA,QAAM,iBAAiB;AAAA,IACrB,CAACC,WAAkB,eAAwB;AAEzC,YAAM,eAAe,IAAI,gBAAgB,OAAO,SAAS,MAAM;AAG/D,UAAI,gBAAgBA,SAAQ,KAAK,CAAC,aAAa,IAAI,UAAU,GAAG;AAC9D,eAAO;AAAA,MACT;AAGA,UAAI,gBAAgBA,SAAQ,GAAG;AAC7B,eAAO;AAAA,MACT;AAGA,UAAI,YAAYA,SAAQ,MAAM,CAAC,wBAAwB,aAAa;AAClE,eAAO;AAAA,MACT;AAEA,aAAO;AAAA,IACT;AAAA,IACA,CAAC,oBAAoB;AAAA,EACvB;AAEA,QAAM,kBAAkB;AAAA,IACtB,CAAC,gBAAyB;AACxB,YAAM,OAAO,eAAe,YAAY;AAGxC,UAAI,gBAAgB,IAAI,GAAG;AACzB;AAAA,MACF;AAGA,UAAI,gBAAgB,MAAM,SAAS,GAAG;AACpC;AAAA,MACF;AAEA,uBAAiB,IAAI;AAErB,YAAM,WAAW,yBAAyB,WAAW,MAAM,WAAW,UAAU;AAEhF,UAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,eAAO,SAAS,OAAO;AAAA,MACzB,OAAO;AAEL,eAAO,KAAK,QAAQ;AAAA,MACtB;AAAA,IACJ;AAAA,IACA,CAAC,QAAQ,WAAW,YAAY,UAAU,wBAAwB;AAAA,EACpE;AAEE,QAAM,gBAAgB,YAAY,OAAO,UAAkB;AACzD,UAAM,cAAc,OAAO,SAAS;AACpC,UAAM,KAAK,QAAQ;AACnB,iBAAa;AAAA,MACX,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,OAAO,SAAS;AAAA,MAChB,SAAS;AAAA,MACT,OAAO;AAAA,MACP,OAAO;AAAA,MACP,YAAY;AAAA,MACZ,iBAAiB;AAAA,MACjB,QAAQ;AAAA,MACR;AAAA,IACF,CAAC;AACD,oBAAgB,WAAW;AAAA,EAC7B,GAAG,CAAC,MAAM,iBAAiB,oBAAoB,CAAC;AAEhD,QAAM,WAAW,YAAY,CAAC,UAAkB;AAC9C,iBAAa,CAAC,UAAU;AAAA,MACtB,GAAG;AAAA,MACH;AAAA,IACF,EAAE;AAAA,EACJ,GAAG,CAAC,CAAC;AAEL,QAAM,eAAe,YAAY,MAAsB;AACrD,QAAI,UAAU,OAAO;AACnB,YAAM,QAAQ,UAAU;AACxB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS,MAAM;AAAA,QACf,OAAO,MAAM;AAAA,QACb,MAAM;AAAA,MACR;AAAA,IACF;AAEA,QAAI,UAAU,wBAAwB,UAAU,WAAW,CAAC,UAAU,YAAY;AAChF,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,QACT,OAAO;AAAA,QACP,MAAM;AAAA,MACR;AAAA,IACF;AAEA,QAAI,CAAC,UAAU,mBAAmB,UAAU,WAAW,WAAW;AAChE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,QACT,OAAO;AAAA,QACP,MAAM;AAAA,MACR;AAAA,IACF;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,MAAM,eAAe;AAAA,IACvB;AAAA,EACF,GAAG;AAAA,IACD,UAAU;AAAA,IACV,UAAU;AAAA,IACV,UAAU;AAAA,IACV,UAAU;AAAA,IACV,UAAU;AAAA,IACV,UAAU;AAAA,EACZ,CAAC;AAEH,YAAU,MAAM;AACd,QAAI,UAAU;AACd,QAAI,cAAc;AAElB,UAAM,cAAc;AAAA,MAClB;AAAA,MACE,OAAO,SAAsB;AAC5B,YAAI,CAAC,QAAS;AACd,YAAI;AACH,cAAI,MAAM;AACV,kBAAM,UAAU,CAAC,CAAC,KAAK;AACvB,kBAAM,aAAa,KAAK;AACxB,kBAAM,kBAAkB,YAAY,CAAC,wBAAwB;AAE7D,yBAAa;AAAA,cACX,UAAU;AAAA,cACV,QAAQ,KAAK;AAAA,cACb;AAAA,cACA;AAAA,cACA,iBAAiB,WAAW;AAAA,cAC5B,OAAO,KAAK,WAAW;AAAA,cACvB,OAAO;AAAA,cACP,OAAO,KAAK;AAAA,cACZ,QAAQ,kBAAkB,kBAAkB;AAAA,cAC5C;AAAA,YACF,CAAC;AAED,gBAAI,wBAAwB,CAAC,cAAc,eAAe,YAAY,IAAI,UAAU,GAAG;AACrF,kBAAG,eAAe,CAAC,eAAe;AAChC,gCAAgB,QAAQ;AAAA,cAC5B;AAAA,YACF;AAAA,UACA,OAAO;AACL,yBAAa;AAAA,cACX,UAAU;AAAA,cACV,QAAQ;AAAA,cACR,SAAS;AAAA,cACT,YAAY;AAAA,cACZ,iBAAiB;AAAA,cACjB,OAAO;AAAA,cACP,OAAO;AAAA,cACP,OAAO;AAAA,cACP,QAAQ;AAAA,cACR;AAAA,YACF,CAAC;AAED,gBAAI,eAAe,YAAY,IAAI,KAAK,KAAK,aAAa;AACxD,8BAAgB;AAAA,YAClB;AAAA,UACF;AAAA,QACF,SAAS,OAAM;AACb,kBAAQ,MAAM,4BAA4B,KAAK;AAC/C,cAAI,SAAS;AACX,0BAAc,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,+BAA+B,CAAC;AAAA,UAC3F;AAAA,QACF,UAAE;AACA,wBAAc;AAAA,QAChB;AAAA,MACF;AAAA,IAAC;AAED,WAAO,MAAM;AACX,gBAAU;AACV,kBAAY;AAAA,IACd;AAAA,EACA,GAAG,CAAC,MAAM,eAAe,iBAAiB,sBAAsB,UAAU,eAAe,cAAc,CAAC;AAExG,QAAM,eAAmC,QAAQ,OAAO;AAAA,IACtD,GAAG;AAAA,IACH,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,CAAC,WAAW,eAAe,UAAU,cAAc,eAAe,CAAC;AAEvE,MAAI,CAAC,UAAU,UAAU;AACvB,WACE,oBAAC,cAAc,UAAd,EAAuB,OAAO,cAC5B,8BACC,oBAAC,SAAI,aAAU,UAAS,aAAU,QAChC,8BAAC,UAAK,WAAU,WAAU,6CAA+B,GAC3D,GAEJ;AAAA,EAEJ;AAEA,SACI,oBAAC,cAAc,UAAd,EAAuB,OAAO,cAC7B,UACF;AAEN;","names":["loginPath","pathname"]}

package/dist/esm/boundary/TernSecureCtx.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/boundary/TernSecureCtx.tsx"],"sourcesContent":["\"use client\"\n\nimport { createContext, useContext } from 'react'\nimport { ternSecureAuth } from '../utils/client-init';\nimport { User } from 'firebase/auth';\nimport { type TernSecureState } from '../types';\n\nexport const TernSecureUser = (): User | null => {\n  return ternSecureAuth.currentUser;\n}\n\nexport interface TernSecureCtxValue extends TernSecureState {\n signOut: () => Promise<void>\n setEmail: (email: string) => void\n}\n\nexport const TernSecureCtx = createContext<TernSecureCtxValue | null>(null)\n\nTernSecureCtx.displayName = 'TernSecureCtx'\n\nexport const useTernSecure = (hookName: string) => {\n  const context = useContext(TernSecureCtx)\n  \n  if (!context) {\n    throw new Error(\n      `${hookName} must be used within TernSecureProvider`\n    )\n  }\n\n  return context\n}\n\n"],"mappings":";AAEA,SAAS,eAAe,kBAAkB;AAC1C,SAAS,sBAAsB;AAIxB,MAAM,iBAAiB,MAAmB;AAC/C,SAAO,eAAe;AACxB;AAOO,MAAM,gBAAgB,cAAyC,IAAI;AAE1E,cAAc,cAAc;AAErB,MAAM,gBAAgB,CAAC,aAAqB;AACjD,QAAM,UAAU,WAAW,aAAa;AAExC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR,GAAG,QAAQ;AAAA,IACb;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../../src/boundary/TernSecureCtx.tsx"],"sourcesContent":["\"use client\"\n\nimport { createContext, useContext } from 'react'\nimport { ternSecureAuth } from '../utils/client-init';\nimport { User } from 'firebase/auth';\nimport type { TernSecureState, SignInResponse } from '../types';\n\nexport const TernSecureUser = (): User | null => {\n  return ternSecureAuth.currentUser;\n}\n\nexport interface TernSecureCtxValue extends TernSecureState {\n signOut: () => Promise<void>\n setEmail: (email: string) => void\n getAuthError: () => SignInResponse\n redirectToLogin: () => void\n}\n\nexport const TernSecureCtx = createContext<TernSecureCtxValue | null>(null)\n\nTernSecureCtx.displayName = 'TernSecureCtx'\n\nexport const useTernSecure = (hookName: string) => {\n  const context = useContext(TernSecureCtx)\n  \n  if (!context) {\n    throw new Error(\n      `${hookName} must be used within TernSecureProvider`\n    )\n  }\n\n  return context\n}\n\n"],"mappings":";AAEA,SAAS,eAAe,kBAAkB;AAC1C,SAAS,sBAAsB;AAIxB,MAAM,iBAAiB,MAAmB;AAC/C,SAAO,eAAe;AACxB;AASO,MAAM,gBAAgB,cAAyC,IAAI;AAE1E,cAAc,cAAc;AAErB,MAAM,gBAAgB,CAAC,aAAqB;AACjD,QAAM,UAAU,WAAW,aAAa;AAExC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR,GAAG,QAAQ;AAAA,IACb;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/dist/esm/boundary/hooks/useAuth.js

@@ -10,21 +10,18 @@ function useAuth() {
     isVerified,
     isAuthenticated,
     token,
+    getAuthError,
+    status,
+    requiresVerification,
     signOut
   } = useTernSecure("useAuth");
   const user = TernSecureUser();
-  const getAuthError = () => {
-    if (error) return error;
-    if (isValid && !isVerified) {
-      return new Error("Email verification required");
-    }
-    return null;
-  };
+  const authResponse = getAuthError();
   return {
     user,
     userId,
     isLoaded,
-    error: getAuthError(),
+    error: authResponse.success ? null : authResponse,
     isValid,
     // User is signed in
     isVerified,
@@ -32,6 +29,8 @@ function useAuth() {
     isAuthenticated,
     // User is both signed in and verified
     token,
+    status,
+    requiresVerification,
     signOut
   };
 }

package/dist/esm/boundary/hooks/useAuth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/boundary/hooks/useAuth.ts"],"sourcesContent":["\"use client\"\n\nimport { useTernSecure } from '../TernSecureCtx'\nimport {  User } from 'firebase/auth'\nimport { TernSecureUser } from '../TernSecureCtx'\n\nexport function useAuth() {\n  const {\n    userId,\n    isLoaded,\n    error,\n    isValid,\n    isVerified,\n    isAuthenticated,\n    token,\n    signOut\n  } = useTernSecure('useAuth')\n\n  const user: User | null = TernSecureUser()\n\n  const getAuthError = () => {\n    if (error) return error\n    if (isValid && !isVerified) {\n      return new Error('Email verification required')\n    }\n    return null\n  }\n\n  return {\n    user,\n    userId,\n    isLoaded,\n    error: getAuthError(),\n    isValid,         // User is signed in\n    isVerified,      // Email is verified\n    isAuthenticated, // User is both signed in and verified\n    token,\n    signOut\n  }\n}\n"],"mappings":";AAEA,SAAS,qBAAqB;AAE9B,SAAS,sBAAsB;AAExB,SAAS,UAAU;AACxB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,cAAc,SAAS;AAE3B,QAAM,OAAoB,eAAe;AAEzC,QAAM,eAAe,MAAM;AACzB,QAAI,MAAO,QAAO;AAClB,QAAI,WAAW,CAAC,YAAY;AAC1B,aAAO,IAAI,MAAM,6BAA6B;AAAA,IAChD;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,aAAa;AAAA,IACpB;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/boundary/hooks/useAuth.ts"],"sourcesContent":["\"use client\"\n\nimport { useTernSecure } from '../TernSecureCtx'\nimport {  User } from 'firebase/auth'\nimport { TernSecureUser } from '../TernSecureCtx'\nimport type { SignInResponse } from '../../types'\n\n\nexport function useAuth() {\n  const {\n    userId,\n    isLoaded,\n    error,\n    isValid,\n    isVerified,\n    isAuthenticated,\n    token,\n    getAuthError,\n    status,\n    requiresVerification,\n    signOut\n  } = useTernSecure('useAuth')\n\n  const user: User | null = TernSecureUser()\n  const authResponse: SignInResponse = getAuthError()\n\n\n  return {\n    user,\n    userId,\n    isLoaded,\n    error: authResponse.success ? null : authResponse,\n    isValid,         // User is signed in\n    isVerified,      // Email is verified\n    isAuthenticated, // User is both signed in and verified\n    token,\n    status,\n    requiresVerification,\n    signOut\n  }\n}\n"],"mappings":";AAEA,SAAS,qBAAqB;AAE9B,SAAS,sBAAsB;AAIxB,SAAS,UAAU;AACxB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,cAAc,SAAS;AAE3B,QAAM,OAAoB,eAAe;AACzC,QAAM,eAA+B,aAAa;AAGlD,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,aAAa,UAAU,OAAO;AAAA,IACrC;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;","names":[]}