@tern-secure/nextjs 4.2.1 → 4.2.3

package/dist/cjs/server/edge-session.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/server/edge-session.ts"],"sourcesContent":["import { verifyFirebaseToken } from \"./jwt-edge\"\nimport type { NextRequest } from \"next/server\"\n\nexport interface UserInfo {\n  uid: string\n  email: string | null\n  emailVerified?: boolean\n  authTime?: number\n  disabled?: boolean\n}\n\n\nexport interface SessionResult {\n  isAuthenticated: boolean\n  user: UserInfo | null\n  error?: string\n}\n\n\nexport async function verifySession(request: NextRequest): Promise<SessionResult> {\n  try {\n    //const cookieStore = await cookies()\n\n    // First try session cookie\n    const sessionCookie = request.cookies.get(\"_session_cookie\")?.value\n    if (sessionCookie) {\n      const result = await verifyFirebaseToken(sessionCookie, true)\n      if (result.valid) {\n        return {\n          isAuthenticated: true,\n          user: {\n            uid: result.uid ?? '',\n            email: result.email || null,\n            emailVerified: result.emailVerified ?? false,\n            disabled: false,\n          },\n        }\n      }\n      console.log(\"Session cookie verification failed:\", result.error)\n    }\n\n    // Then try ID token\n    const idToken = request.cookies.get(\"_session_token\")?.value\n    if (idToken) {\n      const result = await verifyFirebaseToken(idToken, false)\n      if (result.valid) {\n        return {\n          isAuthenticated: true,\n          user: {\n            uid: result.uid ?? '',\n            email: result.email || null,\n            emailVerified: result.emailVerified ?? false,\n            disabled: false,\n          },\n        }\n      }\n      console.log(\"ID token verification failed:\", result.error)\n    }\n\n    return {\n      isAuthenticated: false,\n      user: null,\n      error: \"No valid session found\",\n    }\n  } catch (error) {\n    console.error(\"Session verification error:\", error)\n    return {\n      isAuthenticated: false,\n      user: null,\n      error: error instanceof Error ? error.message : \"Session verification failed\",\n    }\n  }\n}"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sBAAoC;AAmBpC,eAAsB,cAAc,SAA8C;AAnBlF;AAoBE,MAAI;AAIF,UAAM,iBAAgB,aAAQ,QAAQ,IAAI,iBAAiB,MAArC,mBAAwC;AAC9D,QAAI,eAAe;AACjB,YAAM,SAAS,UAAM,qCAAoB,eAAe,IAAI;AAC5D,UAAI,OAAO,OAAO;AAChB,eAAO;AAAA,UACL,iBAAiB;AAAA,UACjB,MAAM;AAAA,YACJ,MAAK,YAAO,QAAP,YAAc;AAAA,YACnB,OAAO,OAAO,SAAS;AAAA,YACvB,gBAAe,YAAO,kBAAP,YAAwB;AAAA,YACvC,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AACA,cAAQ,IAAI,uCAAuC,OAAO,KAAK;AAAA,IACjE;AAGA,UAAM,WAAU,aAAQ,QAAQ,IAAI,gBAAgB,MAApC,mBAAuC;AACvD,QAAI,SAAS;AACX,YAAM,SAAS,UAAM,qCAAoB,SAAS,KAAK;AACvD,UAAI,OAAO,OAAO;AAChB,eAAO;AAAA,UACL,iBAAiB;AAAA,UACjB,MAAM;AAAA,YACJ,MAAK,YAAO,QAAP,YAAc;AAAA,YACnB,OAAO,OAAO,SAAS;AAAA,YACvB,gBAAe,YAAO,kBAAP,YAAwB;AAAA,YACvC,UAAU;AAAA,UACZ;AAAA,QACF;AAAA,MACF;AACA,cAAQ,IAAI,iCAAiC,OAAO,KAAK;AAAA,IAC3D;AAEA,WAAO;AAAA,MACL,iBAAiB;AAAA,MACjB,MAAM;AAAA,MACN,OAAO;AAAA,IACT;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,+BAA+B,KAAK;AAClD,WAAO;AAAA,MACL,iBAAiB;AAAA,MACjB,MAAM;AAAA,MACN,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAClD;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/server/edge-session.ts"],"sourcesContent":["import { verifyFirebaseToken } from \"./jwt-edge\"\nimport type { NextRequest } from \"next/server\"\nimport type { SessionResult, UserInfo } from \"./types\"\n\n\n\nexport async function verifySession(request: NextRequest): Promise<SessionResult> {\n  try {\n    //const cookieStore = await cookies()\n\n    // First try session cookie\n\n    const sessionCookie = request.cookies.get(\"_session_cookie\")?.value\n    const idToken = request.cookies.get(\"_session_token\")?.value\n\n    //const sessionCookie = request.cookies.get(\"_session_cookie\")?.value\n    if (sessionCookie) {\n      const result = await verifyFirebaseToken(sessionCookie, true)\n      if (result.valid) {\n          const user: UserInfo = {\n            uid: result.uid ?? '',\n            email: result.email || null,\n            emailVerified: result.emailVerified ?? false,\n            authTime: result.authTime,\n        }\n\n        return {\n          user,\n          token: sessionCookie,\n          sessionId: sessionCookie,\n        }\n      }\n    }\n\n    // Then try ID token\n    //const idToken = request.cookies.get(\"_session_token\")?.value\n    if (idToken) {\n      const result = await verifyFirebaseToken(idToken, false)\n      if (result.valid) {\n        const user: UserInfo =  {\n            uid: result.uid ?? '',\n            email: result.email || null,\n            emailVerified: result.emailVerified ?? false,\n            authTime: result.authTime,\n        }\n\n\n        return {\n          user,\n          token: idToken,\n          sessionId: idToken,\n        }\n      }\n    }\n\n    return {\n      user: null,\n      token: null,\n      sessionId: null,\n      error: \"No valid session found\",\n    }\n  } catch (error) {\n    console.error(\"Session verification error:\", error)\n    return {\n      user: null,\n      token: null,\n      sessionId: null,\n      error: error instanceof Error ? error.message : \"Session verification failed\",\n    }\n  }\n}"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sBAAoC;AAMpC,eAAsB,cAAc,SAA8C;AANlF;AAOE,MAAI;AAKF,UAAM,iBAAgB,aAAQ,QAAQ,IAAI,iBAAiB,MAArC,mBAAwC;AAC9D,UAAM,WAAU,aAAQ,QAAQ,IAAI,gBAAgB,MAApC,mBAAuC;AAGvD,QAAI,eAAe;AACjB,YAAM,SAAS,UAAM,qCAAoB,eAAe,IAAI;AAC5D,UAAI,OAAO,OAAO;AACd,cAAM,OAAiB;AAAA,UACrB,MAAK,YAAO,QAAP,YAAc;AAAA,UACnB,OAAO,OAAO,SAAS;AAAA,UACvB,gBAAe,YAAO,kBAAP,YAAwB;AAAA,UACvC,UAAU,OAAO;AAAA,QACrB;AAEA,eAAO;AAAA,UACL;AAAA,UACA,OAAO;AAAA,UACP,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAIA,QAAI,SAAS;AACX,YAAM,SAAS,UAAM,qCAAoB,SAAS,KAAK;AACvD,UAAI,OAAO,OAAO;AAChB,cAAM,OAAkB;AAAA,UACpB,MAAK,YAAO,QAAP,YAAc;AAAA,UACnB,OAAO,OAAO,SAAS;AAAA,UACvB,gBAAe,YAAO,kBAAP,YAAwB;AAAA,UACvC,UAAU,OAAO;AAAA,QACrB;AAGA,eAAO;AAAA,UACL;AAAA,UACA,OAAO;AAAA,UACP,WAAW;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP,WAAW;AAAA,MACX,OAAO;AAAA,IACT;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,+BAA+B,KAAK;AAClD,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP,WAAW;AAAA,MACX,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAClD;AAAA,EACF;AACF;","names":[]}

package/dist/cjs/server/index.js

@@ -20,7 +20,6 @@ var server_exports = {};
 __export(server_exports, {
   auth: () => import_auth.auth,
   createRouteMatcher: () => import_ternSecureMiddleware.createRouteMatcher,
-  getUserInfo: () => import_auth.getUserInfo,
   ternSecureMiddleware: () => import_ternSecureMiddleware.ternSecureMiddleware
 });
 module.exports = __toCommonJS(server_exports);
@@ -30,7 +29,6 @@ var import_auth = require("./auth");
 0 && (module.exports = {
   auth,
   createRouteMatcher,
-  getUserInfo,
   ternSecureMiddleware
 });
 //# sourceMappingURL=index.js.map

package/dist/cjs/server/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/server/index.ts"],"sourcesContent":["\n\nexport { ternSecureMiddleware, createRouteMatcher } from './ternSecureMiddleware'\nexport { auth, getUserInfo } from './auth'\nexport type { AuthResult } from './auth'"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,kCAAyD;AACzD,kBAAkC;","names":[]}
+{"version":3,"sources":["../../../src/server/index.ts"],"sourcesContent":["export { ternSecureMiddleware, createRouteMatcher } from './ternSecureMiddleware'\nexport { auth, type AuthResult } from './auth'\nexport type { UserInfo, SessionResult } from './types'"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kCAAyD;AACzD,kBAAsC;","names":[]}

package/dist/cjs/server/jwt-edge.js

@@ -22,59 +22,85 @@ __export(jwt_edge_exports, {
 });
 module.exports = __toCommonJS(jwt_edge_exports);
 var import_jose = require("jose");
-const JWKS_URLS = {
-  session: new URL("https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com"),
-  token: new URL("https://identitytoolkit.googleapis.com/v1/sessionCookiePublicKeys")
-};
-const JWKS = {
-  session: (0, import_jose.createRemoteJWKSet)(new URL(JWKS_URLS.session), {
+var import_react = require("react");
+const FIREBASE_ID_TOKEN_URL = "https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com";
+const FIREBASE_SESSION_CERT_URL = "https://identitytoolkit.googleapis.com/v1/sessionCookiePublicKeys";
+const getIdTokenJWKS = (0, import_react.cache)(() => {
+  return (0, import_jose.createRemoteJWKSet)(new URL(FIREBASE_ID_TOKEN_URL), {
     cacheMaxAge: 36e5,
     // 1 hour
     timeoutDuration: 5e3,
     // 5 seconds
     cooldownDuration: 3e4
     // 30 seconds between retries
-  }),
-  token: (0, import_jose.createRemoteJWKSet)(new URL(JWKS_URLS.token), {
+  });
+});
+const getSessionJWKS = (0, import_react.cache)(() => {
+  return (0, import_jose.createRemoteJWKSet)(new URL(FIREBASE_SESSION_CERT_URL), {
     cacheMaxAge: 36e5,
     // 1 hour
     timeoutDuration: 5e3,
     // 5 seconds
     cooldownDuration: 3e4
     // 30 seconds between retries
-  })
-};
+  });
+});
+function decodeJwt(token) {
+  try {
+    const [headerB64, payloadB64] = token.split(".");
+    const header = JSON.parse(Buffer.from(headerB64, "base64").toString());
+    const payload = JSON.parse(Buffer.from(payloadB64, "base64").toString());
+    return { header, payload };
+  } catch (error) {
+    console.error("Error decoding JWT:", error);
+    return null;
+  }
+}
 async function verifyFirebaseToken(token, isSessionCookie = false) {
   try {
     const projectId = process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID;
     if (!projectId) {
       throw new Error("Firebase Project ID is not configured");
     }
-    const keySet = isSessionCookie ? JWKS.session : JWKS.token;
-    const { payload } = await (0, import_jose.jwtVerify)(token, keySet, {
+    const decoded = decodeJwt(token);
+    if (!decoded) {
+      throw new Error("Invalid token format");
+    }
+    console.log("Token details:", {
+      header: decoded.header,
+      type: isSessionCookie ? "session_cookie" : "id_token"
+    });
+    const JWKS = isSessionCookie ? await getSessionJWKS() : await getIdTokenJWKS();
+    const { payload } = await (0, import_jose.jwtVerify)(token, JWKS, {
       issuer: isSessionCookie ? "https://session.firebase.google.com/" + projectId : "https://securetoken.google.com/" + projectId,
       audience: projectId,
       algorithms: ["RS256"]
     });
+    const firebasePayload = payload;
     const now = Math.floor(Date.now() / 1e3);
-    if (payload.exp && payload.exp <= now) {
-      throw new Error("Token has expired");
-    }
-    if (payload.iat && payload.iat > now) {
-      throw new Error("Token issued time is in the future");
-    }
-    if (!payload.sub) {
+    if (!firebasePayload.sub) {
       throw new Error("Token subject is empty");
     }
     return {
       valid: true,
-      uid: payload.sub,
-      email: payload.email,
-      emailVerified: payload.email_verified,
-      authTime: payload.auth_time
+      uid: firebasePayload.sub,
+      email: firebasePayload.email,
+      emailVerified: firebasePayload.email_verified,
+      authTime: firebasePayload.auth_time,
+      issuedAt: firebasePayload.iat,
+      expiresAt: firebasePayload.exp
     };
   } catch (error) {
-    console.error("Token verification error:", error);
+    console.error("Token verification details:", {
+      error: error instanceof Error ? {
+        name: error.name,
+        message: error.message,
+        stack: error.stack
+      } : error,
+      decoded: decodeJwt(token),
+      //projectId,
+      isSessionCookie
+    });
     return {
       valid: false,
       error: error instanceof Error ? error.message : "Invalid token"

package/dist/cjs/server/jwt-edge.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/server/jwt-edge.ts"],"sourcesContent":["import { jwtVerify, createRemoteJWKSet } from \"jose\"\n\n// Firebase public key endpoints with simplified configuration for Edge\nconst JWKS_URLS = {\n  session: new URL(\"https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com\"),\n  token: new URL(\"https://identitytoolkit.googleapis.com/v1/sessionCookiePublicKeys\")\n}\n\n// Simplified JWKS for Edge Runtime\nconst JWKS = {\n    session: createRemoteJWKSet(new URL(JWKS_URLS.session), {\n      cacheMaxAge: 3600000, // 1 hour\n      timeoutDuration: 5000, // 5 seconds\n      cooldownDuration: 30000, // 30 seconds between retries\n    }),\n    token: createRemoteJWKSet(new URL(JWKS_URLS.token), {\n      cacheMaxAge: 3600000, // 1 hour\n      timeoutDuration: 5000, // 5 seconds\n      cooldownDuration: 30000, // 30 seconds between retries\n    })\n  }\n\nexport async function verifyFirebaseToken(token: string, isSessionCookie = false) {\n  try {\n    const projectId = process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID\n    if (!projectId) {\n      throw new Error(\"Firebase Project ID is not configured\")\n    }\n\n    const keySet = isSessionCookie ? JWKS.session : JWKS.token\n\n\n    const { payload } = await jwtVerify(token, keySet, {\n      issuer: isSessionCookie\n        ? \"https://session.firebase.google.com/\" + projectId\n        : \"https://securetoken.google.com/\" + projectId,\n      audience: projectId,\n      algorithms: [\"RS256\"],\n    })\n\n    const now = Math.floor(Date.now() / 1000)\n    if (payload.exp && payload.exp <= now) {\n      throw new Error(\"Token has expired\")\n    }\n\n    if (payload.iat && payload.iat > now) {\n      throw new Error(\"Token issued time is in the future\")\n    }\n\n    if (!payload.sub) {\n      throw new Error(\"Token subject is empty\")\n    }\n\n    return {\n      valid: true,\n      uid: payload.sub,\n      email: payload.email as string | undefined,\n      emailVerified: payload.email_verified as boolean | undefined,\n      authTime: payload.auth_time as number,\n    }\n  } catch (error) {\n    console.error(\"Token verification error:\", error)\n    return {\n      valid: false,\n      error: error instanceof Error ? error.message : \"Invalid token\",\n    }\n  }\n}"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAA8C;AAG9C,MAAM,YAAY;AAAA,EAChB,SAAS,IAAI,IAAI,0FAA0F;AAAA,EAC3G,OAAO,IAAI,IAAI,mEAAmE;AACpF;AAGA,MAAM,OAAO;AAAA,EACT,aAAS,gCAAmB,IAAI,IAAI,UAAU,OAAO,GAAG;AAAA,IACtD,aAAa;AAAA;AAAA,IACb,iBAAiB;AAAA;AAAA,IACjB,kBAAkB;AAAA;AAAA,EACpB,CAAC;AAAA,EACD,WAAO,gCAAmB,IAAI,IAAI,UAAU,KAAK,GAAG;AAAA,IAClD,aAAa;AAAA;AAAA,IACb,iBAAiB;AAAA;AAAA,IACjB,kBAAkB;AAAA;AAAA,EACpB,CAAC;AACH;AAEF,eAAsB,oBAAoB,OAAe,kBAAkB,OAAO;AAChF,MAAI;AACF,UAAM,YAAY,QAAQ,IAAI;AAC9B,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAEA,UAAM,SAAS,kBAAkB,KAAK,UAAU,KAAK;AAGrD,UAAM,EAAE,QAAQ,IAAI,UAAM,uBAAU,OAAO,QAAQ;AAAA,MACjD,QAAQ,kBACJ,yCAAyC,YACzC,oCAAoC;AAAA,MACxC,UAAU;AAAA,MACV,YAAY,CAAC,OAAO;AAAA,IACtB,CAAC;AAED,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,QAAI,QAAQ,OAAO,QAAQ,OAAO,KAAK;AACrC,YAAM,IAAI,MAAM,mBAAmB;AAAA,IACrC;AAEA,QAAI,QAAQ,OAAO,QAAQ,MAAM,KAAK;AACpC,YAAM,IAAI,MAAM,oCAAoC;AAAA,IACtD;AAEA,QAAI,CAAC,QAAQ,KAAK;AAChB,YAAM,IAAI,MAAM,wBAAwB;AAAA,IAC1C;AAEA,WAAO;AAAA,MACL,OAAO;AAAA,MACP,KAAK,QAAQ;AAAA,MACb,OAAO,QAAQ;AAAA,MACf,eAAe,QAAQ;AAAA,MACvB,UAAU,QAAQ;AAAA,IACpB;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,6BAA6B,KAAK;AAChD,WAAO;AAAA,MACL,OAAO;AAAA,MACP,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAClD;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/server/jwt-edge.ts"],"sourcesContent":["import { jwtVerify, createRemoteJWKSet } from \"jose\"\nimport { cache } from \"react\"\n\ninterface FirebaseIdTokenPayload {\n  iss: string\n  aud: string\n  auth_time: number\n  user_id: string\n  sub: string\n  iat: number\n  exp: number\n  email?: string\n  email_verified?: boolean\n  firebase: {\n    identities: {\n      [key: string]: any\n    }\n    sign_in_provider: string\n  }\n}\n\n// Firebase public key endpoints\nconst FIREBASE_ID_TOKEN_URL = \"https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com\"\nconst FIREBASE_SESSION_CERT_URL = \"https://identitytoolkit.googleapis.com/v1/sessionCookiePublicKeys\"\n\n// Cache the JWKS using React cache\nconst getIdTokenJWKS = cache(() => {\n  return createRemoteJWKSet(new URL(FIREBASE_ID_TOKEN_URL), {\n    cacheMaxAge: 3600000, // 1 hour\n    timeoutDuration: 5000, // 5 seconds\n    cooldownDuration: 30000, // 30 seconds between retries\n  })\n})\n\nconst getSessionJWKS = cache(() => {\n  return createRemoteJWKSet(new URL(FIREBASE_SESSION_CERT_URL), {\n    cacheMaxAge: 3600000, // 1 hour\n    timeoutDuration: 5000, // 5 seconds\n    cooldownDuration: 30000, // 30 seconds between retries\n  })\n})\n\n// Helper to decode JWT without verification\nfunction decodeJwt(token: string) {\n  try {\n    const [headerB64, payloadB64] = token.split(\".\")\n    const header = JSON.parse(Buffer.from(headerB64, \"base64\").toString())\n    const payload = JSON.parse(Buffer.from(payloadB64, \"base64\").toString())\n    return { header, payload }\n  } catch (error) {\n    console.error(\"Error decoding JWT:\", error)\n    return null\n  }\n}\n\nexport async function verifyFirebaseToken(token: string, isSessionCookie = false) {\n  try {\n    const projectId = process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID\n    if (!projectId) {\n      throw new Error(\"Firebase Project ID is not configured\")\n    }\n\n    // Decode token for debugging and type checking\n    const decoded = decodeJwt(token)\n    if (!decoded) {\n      throw new Error(\"Invalid token format\")\n    }\n\n    console.log(\"Token details:\", {\n      header: decoded.header,\n      type: isSessionCookie ? \"session_cookie\" : \"id_token\",\n    })\n\n\n        // Use different JWKS based on token type\n    const JWKS = isSessionCookie ? await getSessionJWKS() : await getIdTokenJWKS()\n\n    const { payload } = await jwtVerify(token, JWKS, {\n          issuer: isSessionCookie\n            ? \"https://session.firebase.google.com/\" + projectId\n            : \"https://securetoken.google.com/\" + projectId,\n          audience: projectId,\n          algorithms: [\"RS256\"],\n    })\n\n    const firebasePayload = payload as unknown as FirebaseIdTokenPayload\n    const now = Math.floor(Date.now() / 1000)\n\n\n    if (!firebasePayload.sub) {\n          throw new Error(\"Token subject is empty\")\n    }\n\n    return {\n          valid: true,\n          uid: firebasePayload.sub,\n          email: firebasePayload.email,\n          emailVerified: firebasePayload.email_verified,\n          authTime: firebasePayload.auth_time,\n          issuedAt: firebasePayload.iat,\n          expiresAt: firebasePayload.exp,\n        }\n    } catch (error) {\n        console.error(\"Token verification details:\", {\n          error:\n            error instanceof Error\n              ? {\n                  name: error.name,\n                  message: error.message,\n                  stack: error.stack,\n                }\n              : error,\n          decoded: decodeJwt(token),\n          //projectId,\n          isSessionCookie,\n        })\n    \n        return {\n          valid: false,\n          error: error instanceof Error ? error.message : \"Invalid token\",\n        }\n      }\n    }"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAA8C;AAC9C,mBAAsB;AAqBtB,MAAM,wBAAwB;AAC9B,MAAM,4BAA4B;AAGlC,MAAM,qBAAiB,oBAAM,MAAM;AACjC,aAAO,gCAAmB,IAAI,IAAI,qBAAqB,GAAG;AAAA,IACxD,aAAa;AAAA;AAAA,IACb,iBAAiB;AAAA;AAAA,IACjB,kBAAkB;AAAA;AAAA,EACpB,CAAC;AACH,CAAC;AAED,MAAM,qBAAiB,oBAAM,MAAM;AACjC,aAAO,gCAAmB,IAAI,IAAI,yBAAyB,GAAG;AAAA,IAC5D,aAAa;AAAA;AAAA,IACb,iBAAiB;AAAA;AAAA,IACjB,kBAAkB;AAAA;AAAA,EACpB,CAAC;AACH,CAAC;AAGD,SAAS,UAAU,OAAe;AAChC,MAAI;AACF,UAAM,CAAC,WAAW,UAAU,IAAI,MAAM,MAAM,GAAG;AAC/C,UAAM,SAAS,KAAK,MAAM,OAAO,KAAK,WAAW,QAAQ,EAAE,SAAS,CAAC;AACrE,UAAM,UAAU,KAAK,MAAM,OAAO,KAAK,YAAY,QAAQ,EAAE,SAAS,CAAC;AACvE,WAAO,EAAE,QAAQ,QAAQ;AAAA,EAC3B,SAAS,OAAO;AACd,YAAQ,MAAM,uBAAuB,KAAK;AAC1C,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,oBAAoB,OAAe,kBAAkB,OAAO;AAChF,MAAI;AACF,UAAM,YAAY,QAAQ,IAAI;AAC9B,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAGA,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,sBAAsB;AAAA,IACxC;AAEA,YAAQ,IAAI,kBAAkB;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB,MAAM,kBAAkB,mBAAmB;AAAA,IAC7C,CAAC;AAID,UAAM,OAAO,kBAAkB,MAAM,eAAe,IAAI,MAAM,eAAe;AAE7E,UAAM,EAAE,QAAQ,IAAI,UAAM,uBAAU,OAAO,MAAM;AAAA,MAC3C,QAAQ,kBACJ,yCAAyC,YACzC,oCAAoC;AAAA,MACxC,UAAU;AAAA,MACV,YAAY,CAAC,OAAO;AAAA,IAC1B,CAAC;AAED,UAAM,kBAAkB;AACxB,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAGxC,QAAI,CAAC,gBAAgB,KAAK;AACpB,YAAM,IAAI,MAAM,wBAAwB;AAAA,IAC9C;AAEA,WAAO;AAAA,MACD,OAAO;AAAA,MACP,KAAK,gBAAgB;AAAA,MACrB,OAAO,gBAAgB;AAAA,MACvB,eAAe,gBAAgB;AAAA,MAC/B,UAAU,gBAAgB;AAAA,MAC1B,UAAU,gBAAgB;AAAA,MAC1B,WAAW,gBAAgB;AAAA,IAC7B;AAAA,EACJ,SAAS,OAAO;AACZ,YAAQ,MAAM,+BAA+B;AAAA,MAC3C,OACE,iBAAiB,QACb;AAAA,QACE,MAAM,MAAM;AAAA,QACZ,SAAS,MAAM;AAAA,QACf,OAAO,MAAM;AAAA,MACf,IACA;AAAA,MACN,SAAS,UAAU,KAAK;AAAA;AAAA,MAExB;AAAA,IACF,CAAC;AAED,WAAO;AAAA,MACL,OAAO;AAAA,MACP,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAClD;AAAA,EACF;AACF;","names":[]}

package/dist/cjs/server/jwt.js

@@ -81,19 +81,9 @@ async function verifyFirebaseToken(token, isSessionCookie = false) {
           algorithms: ["RS256"]
         });
         const firebasePayload = payload;
-        const now = Math.floor(Date.now() / 1e3);
-        if (firebasePayload.exp <= now) {
-          throw new Error("Token has expired");
-        }
-        if (firebasePayload.iat > now) {
-          throw new Error("Token issued time is in the future");
-        }
         if (!firebasePayload.sub) {
           throw new Error("Token subject is empty");
         }
-        if (firebasePayload.auth_time > now) {
-          throw new Error("Token auth time is in the future");
-        }
         return {
           valid: true,
           uid: firebasePayload.sub,

package/dist/cjs/server/jwt.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/server/jwt.ts"],"sourcesContent":["import { jwtVerify, createRemoteJWKSet } from \"jose\"\nimport { cache } from \"react\"\n\ninterface FirebaseIdTokenPayload {\n  iss: string\n  aud: string\n  auth_time: number\n  user_id: string\n  sub: string\n  iat: number\n  exp: number\n  email?: string\n  email_verified?: boolean\n  firebase: {\n    identities: {\n      [key: string]: any\n    }\n    sign_in_provider: string\n  }\n}\n\n// Firebase public key endpoints\nconst FIREBASE_ID_TOKEN_URL = \"https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com\"\nconst FIREBASE_SESSION_CERT_URL = \"https://identitytoolkit.googleapis.com/v1/sessionCookiePublicKeys\"\n\n// Cache the JWKS using React cache\nconst getIdTokenJWKS = cache(() => {\n  return createRemoteJWKSet(new URL(FIREBASE_ID_TOKEN_URL), {\n    cacheMaxAge: 3600000, // 1 hour\n    timeoutDuration: 5000, // 5 seconds\n    cooldownDuration: 30000, // 30 seconds between retries\n  })\n})\n\nconst getSessionJWKS = cache(() => {\n  return createRemoteJWKSet(new URL(FIREBASE_SESSION_CERT_URL), {\n    cacheMaxAge: 3600000, // 1 hour\n    timeoutDuration: 5000, // 5 seconds\n    cooldownDuration: 30000, // 30 seconds between retries\n  })\n})\n\n// Helper to decode JWT without verification\nfunction decodeJwt(token: string) {\n  try {\n    const [headerB64, payloadB64] = token.split(\".\")\n    const header = JSON.parse(Buffer.from(headerB64, \"base64\").toString())\n    const payload = JSON.parse(Buffer.from(payloadB64, \"base64\").toString())\n    return { header, payload }\n  } catch (error) {\n    console.error(\"Error decoding JWT:\", error)\n    return null\n  }\n}\n\nexport async function verifyFirebaseToken(token: string, isSessionCookie = false) {\n  try {\n    const projectId = process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID\n    if (!projectId) {\n      throw new Error(\"Firebase Project ID is not configured\")\n    }\n\n    // Decode token for debugging and type checking\n    const decoded = decodeJwt(token)\n    if (!decoded) {\n      throw new Error(\"Invalid token format\")\n    }\n\n    console.log(\"Token details:\", {\n      header: decoded.header,\n      type: isSessionCookie ? \"session_cookie\" : \"id_token\",\n    })\n\n    let retries = 3\n    let lastError: Error | null = null\n\n    while (retries > 0) {\n      try {\n        // Use different JWKS based on token type\n        const JWKS = isSessionCookie ? await getSessionJWKS() : await getIdTokenJWKS()\n\n        const { payload } = await jwtVerify(token, JWKS, {\n          issuer: isSessionCookie\n            ? \"https://session.firebase.google.com/\" + projectId\n            : \"https://securetoken.google.com/\" + projectId,\n          audience: projectId,\n          algorithms: [\"RS256\"],\n        })\n\n        const firebasePayload = payload as unknown as FirebaseIdTokenPayload\n        const now = Math.floor(Date.now() / 1000)\n\n        // Verify token claims\n        if (firebasePayload.exp <= now) {\n          throw new Error(\"Token has expired\")\n        }\n\n        if (firebasePayload.iat > now) {\n          throw new Error(\"Token issued time is in the future\")\n        }\n\n        if (!firebasePayload.sub) {\n          throw new Error(\"Token subject is empty\")\n        }\n\n        if (firebasePayload.auth_time > now) {\n          throw new Error(\"Token auth time is in the future\")\n        }\n\n        return {\n          valid: true,\n          uid: firebasePayload.sub,\n          email: firebasePayload.email,\n          emailVerified: firebasePayload.email_verified,\n          authTime: firebasePayload.auth_time,\n          issuedAt: firebasePayload.iat,\n          expiresAt: firebasePayload.exp,\n        }\n      } catch (error) {\n        lastError = error as Error\n        if (error instanceof Error && error.name === \"JWKSNoMatchingKey\") {\n          console.warn(`JWKS retry attempt ${4 - retries}:`, error.message)\n          retries--\n          if (retries > 0) {\n            await new Promise((resolve) => setTimeout(resolve, 1000))\n            continue\n          }\n        }\n        throw error\n      }\n    }\n\n    throw lastError || new Error(\"Failed to verify token after retries\")\n  } catch (error) {\n    console.error(\"Token verification details:\", {\n      error:\n        error instanceof Error\n          ? {\n              name: error.name,\n              message: error.message,\n              stack: error.stack,\n            }\n          : error,\n      decoded: decodeJwt(token),\n      //projectId,\n      isSessionCookie,\n    })\n\n    return {\n      valid: false,\n      error: error instanceof Error ? error.message : \"Invalid token\",\n    }\n  }\n}"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAA8C;AAC9C,mBAAsB;AAqBtB,MAAM,wBAAwB;AAC9B,MAAM,4BAA4B;AAGlC,MAAM,qBAAiB,oBAAM,MAAM;AACjC,aAAO,gCAAmB,IAAI,IAAI,qBAAqB,GAAG;AAAA,IACxD,aAAa;AAAA;AAAA,IACb,iBAAiB;AAAA;AAAA,IACjB,kBAAkB;AAAA;AAAA,EACpB,CAAC;AACH,CAAC;AAED,MAAM,qBAAiB,oBAAM,MAAM;AACjC,aAAO,gCAAmB,IAAI,IAAI,yBAAyB,GAAG;AAAA,IAC5D,aAAa;AAAA;AAAA,IACb,iBAAiB;AAAA;AAAA,IACjB,kBAAkB;AAAA;AAAA,EACpB,CAAC;AACH,CAAC;AAGD,SAAS,UAAU,OAAe;AAChC,MAAI;AACF,UAAM,CAAC,WAAW,UAAU,IAAI,MAAM,MAAM,GAAG;AAC/C,UAAM,SAAS,KAAK,MAAM,OAAO,KAAK,WAAW,QAAQ,EAAE,SAAS,CAAC;AACrE,UAAM,UAAU,KAAK,MAAM,OAAO,KAAK,YAAY,QAAQ,EAAE,SAAS,CAAC;AACvE,WAAO,EAAE,QAAQ,QAAQ;AAAA,EAC3B,SAAS,OAAO;AACd,YAAQ,MAAM,uBAAuB,KAAK;AAC1C,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,oBAAoB,OAAe,kBAAkB,OAAO;AAChF,MAAI;AACF,UAAM,YAAY,QAAQ,IAAI;AAC9B,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAGA,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,sBAAsB;AAAA,IACxC;AAEA,YAAQ,IAAI,kBAAkB;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB,MAAM,kBAAkB,mBAAmB;AAAA,IAC7C,CAAC;AAED,QAAI,UAAU;AACd,QAAI,YAA0B;AAE9B,WAAO,UAAU,GAAG;AAClB,UAAI;AAEF,cAAM,OAAO,kBAAkB,MAAM,eAAe,IAAI,MAAM,eAAe;AAE7E,cAAM,EAAE,QAAQ,IAAI,UAAM,uBAAU,OAAO,MAAM;AAAA,UAC/C,QAAQ,kBACJ,yCAAyC,YACzC,oCAAoC;AAAA,UACxC,UAAU;AAAA,UACV,YAAY,CAAC,OAAO;AAAA,QACtB,CAAC;AAED,cAAM,kBAAkB;AACxB,cAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAGxC,YAAI,gBAAgB,OAAO,KAAK;AAC9B,gBAAM,IAAI,MAAM,mBAAmB;AAAA,QACrC;AAEA,YAAI,gBAAgB,MAAM,KAAK;AAC7B,gBAAM,IAAI,MAAM,oCAAoC;AAAA,QACtD;AAEA,YAAI,CAAC,gBAAgB,KAAK;AACxB,gBAAM,IAAI,MAAM,wBAAwB;AAAA,QAC1C;AAEA,YAAI,gBAAgB,YAAY,KAAK;AACnC,gBAAM,IAAI,MAAM,kCAAkC;AAAA,QACpD;AAEA,eAAO;AAAA,UACL,OAAO;AAAA,UACP,KAAK,gBAAgB;AAAA,UACrB,OAAO,gBAAgB;AAAA,UACvB,eAAe,gBAAgB;AAAA,UAC/B,UAAU,gBAAgB;AAAA,UAC1B,UAAU,gBAAgB;AAAA,UAC1B,WAAW,gBAAgB;AAAA,QAC7B;AAAA,MACF,SAAS,OAAO;AACd,oBAAY;AACZ,YAAI,iBAAiB,SAAS,MAAM,SAAS,qBAAqB;AAChE,kBAAQ,KAAK,sBAAsB,IAAI,OAAO,KAAK,MAAM,OAAO;AAChE;AACA,cAAI,UAAU,GAAG;AACf,kBAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,GAAI,CAAC;AACxD;AAAA,UACF;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,aAAa,IAAI,MAAM,sCAAsC;AAAA,EACrE,SAAS,OAAO;AACd,YAAQ,MAAM,+BAA+B;AAAA,MAC3C,OACE,iBAAiB,QACb;AAAA,QACE,MAAM,MAAM;AAAA,QACZ,SAAS,MAAM;AAAA,QACf,OAAO,MAAM;AAAA,MACf,IACA;AAAA,MACN,SAAS,UAAU,KAAK;AAAA;AAAA,MAExB;AAAA,IACF,CAAC;AAED,WAAO;AAAA,MACL,OAAO;AAAA,MACP,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAClD;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/server/jwt.ts"],"sourcesContent":["import { jwtVerify, createRemoteJWKSet } from \"jose\"\nimport { cache } from \"react\"\n\ninterface FirebaseIdTokenPayload {\n  iss: string\n  aud: string\n  auth_time: number\n  user_id: string\n  sub: string\n  iat: number\n  exp: number\n  email?: string\n  email_verified?: boolean\n  firebase: {\n    identities: {\n      [key: string]: any\n    }\n    sign_in_provider: string\n  }\n}\n\n// Firebase public key endpoints\nconst FIREBASE_ID_TOKEN_URL = \"https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com\"\nconst FIREBASE_SESSION_CERT_URL = \"https://identitytoolkit.googleapis.com/v1/sessionCookiePublicKeys\"\n\n// Cache the JWKS using React cache\nconst getIdTokenJWKS = cache(() => {\n  return createRemoteJWKSet(new URL(FIREBASE_ID_TOKEN_URL), {\n    cacheMaxAge: 3600000, // 1 hour\n    timeoutDuration: 5000, // 5 seconds\n    cooldownDuration: 30000, // 30 seconds between retries\n  })\n})\n\nconst getSessionJWKS = cache(() => {\n  return createRemoteJWKSet(new URL(FIREBASE_SESSION_CERT_URL), {\n    cacheMaxAge: 3600000, // 1 hour\n    timeoutDuration: 5000, // 5 seconds\n    cooldownDuration: 30000, // 30 seconds between retries\n  })\n})\n\n// Helper to decode JWT without verification\nfunction decodeJwt(token: string) {\n  try {\n    const [headerB64, payloadB64] = token.split(\".\")\n    const header = JSON.parse(Buffer.from(headerB64, \"base64\").toString())\n    const payload = JSON.parse(Buffer.from(payloadB64, \"base64\").toString())\n    return { header, payload }\n  } catch (error) {\n    console.error(\"Error decoding JWT:\", error)\n    return null\n  }\n}\n\nexport async function verifyFirebaseToken(token: string, isSessionCookie = false) {\n  try {\n    const projectId = process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID\n    if (!projectId) {\n      throw new Error(\"Firebase Project ID is not configured\")\n    }\n\n    // Decode token for debugging and type checking\n    const decoded = decodeJwt(token)\n    if (!decoded) {\n      throw new Error(\"Invalid token format\")\n    }\n\n    console.log(\"Token details:\", {\n      header: decoded.header,\n      type: isSessionCookie ? \"session_cookie\" : \"id_token\",\n    })\n\n    let retries = 3\n    let lastError: Error | null = null\n\n    while (retries > 0) {\n      try {\n        // Use different JWKS based on token type\n        const JWKS = isSessionCookie ? await getSessionJWKS() : await getIdTokenJWKS()\n\n        const { payload } = await jwtVerify(token, JWKS, {\n          issuer: isSessionCookie\n            ? \"https://session.firebase.google.com/\" + projectId\n            : \"https://securetoken.google.com/\" + projectId,\n          audience: projectId,\n          algorithms: [\"RS256\"],\n        })\n\n        const firebasePayload = payload as unknown as FirebaseIdTokenPayload\n\n        if (!firebasePayload.sub) {\n          throw new Error(\"Token subject is empty\")\n        }\n\n        return {\n          valid: true,\n          uid: firebasePayload.sub,\n          email: firebasePayload.email,\n          emailVerified: firebasePayload.email_verified,\n          authTime: firebasePayload.auth_time,\n          issuedAt: firebasePayload.iat,\n          expiresAt: firebasePayload.exp,\n        }\n      } catch (error) {\n        lastError = error as Error\n        if (error instanceof Error && error.name === \"JWKSNoMatchingKey\") {\n          console.warn(`JWKS retry attempt ${4 - retries}:`, error.message)\n          retries--\n          if (retries > 0) {\n            await new Promise((resolve) => setTimeout(resolve, 1000))\n            continue\n          }\n        }\n        throw error\n      }\n    }\n\n    throw lastError || new Error(\"Failed to verify token after retries\")\n  } catch (error) {\n    console.error(\"Token verification details:\", {\n      error:\n        error instanceof Error\n          ? {\n              name: error.name,\n              message: error.message,\n              stack: error.stack,\n            }\n          : error,\n      decoded: decodeJwt(token),\n      //projectId,\n      isSessionCookie,\n    })\n\n    return {\n      valid: false,\n      error: error instanceof Error ? error.message : \"Invalid token\",\n    }\n  }\n}"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAA8C;AAC9C,mBAAsB;AAqBtB,MAAM,wBAAwB;AAC9B,MAAM,4BAA4B;AAGlC,MAAM,qBAAiB,oBAAM,MAAM;AACjC,aAAO,gCAAmB,IAAI,IAAI,qBAAqB,GAAG;AAAA,IACxD,aAAa;AAAA;AAAA,IACb,iBAAiB;AAAA;AAAA,IACjB,kBAAkB;AAAA;AAAA,EACpB,CAAC;AACH,CAAC;AAED,MAAM,qBAAiB,oBAAM,MAAM;AACjC,aAAO,gCAAmB,IAAI,IAAI,yBAAyB,GAAG;AAAA,IAC5D,aAAa;AAAA;AAAA,IACb,iBAAiB;AAAA;AAAA,IACjB,kBAAkB;AAAA;AAAA,EACpB,CAAC;AACH,CAAC;AAGD,SAAS,UAAU,OAAe;AAChC,MAAI;AACF,UAAM,CAAC,WAAW,UAAU,IAAI,MAAM,MAAM,GAAG;AAC/C,UAAM,SAAS,KAAK,MAAM,OAAO,KAAK,WAAW,QAAQ,EAAE,SAAS,CAAC;AACrE,UAAM,UAAU,KAAK,MAAM,OAAO,KAAK,YAAY,QAAQ,EAAE,SAAS,CAAC;AACvE,WAAO,EAAE,QAAQ,QAAQ;AAAA,EAC3B,SAAS,OAAO;AACd,YAAQ,MAAM,uBAAuB,KAAK;AAC1C,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,oBAAoB,OAAe,kBAAkB,OAAO;AAChF,MAAI;AACF,UAAM,YAAY,QAAQ,IAAI;AAC9B,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAGA,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,sBAAsB;AAAA,IACxC;AAEA,YAAQ,IAAI,kBAAkB;AAAA,MAC5B,QAAQ,QAAQ;AAAA,MAChB,MAAM,kBAAkB,mBAAmB;AAAA,IAC7C,CAAC;AAED,QAAI,UAAU;AACd,QAAI,YAA0B;AAE9B,WAAO,UAAU,GAAG;AAClB,UAAI;AAEF,cAAM,OAAO,kBAAkB,MAAM,eAAe,IAAI,MAAM,eAAe;AAE7E,cAAM,EAAE,QAAQ,IAAI,UAAM,uBAAU,OAAO,MAAM;AAAA,UAC/C,QAAQ,kBACJ,yCAAyC,YACzC,oCAAoC;AAAA,UACxC,UAAU;AAAA,UACV,YAAY,CAAC,OAAO;AAAA,QACtB,CAAC;AAED,cAAM,kBAAkB;AAExB,YAAI,CAAC,gBAAgB,KAAK;AACxB,gBAAM,IAAI,MAAM,wBAAwB;AAAA,QAC1C;AAEA,eAAO;AAAA,UACL,OAAO;AAAA,UACP,KAAK,gBAAgB;AAAA,UACrB,OAAO,gBAAgB;AAAA,UACvB,eAAe,gBAAgB;AAAA,UAC/B,UAAU,gBAAgB;AAAA,UAC1B,UAAU,gBAAgB;AAAA,UAC1B,WAAW,gBAAgB;AAAA,QAC7B;AAAA,MACF,SAAS,OAAO;AACd,oBAAY;AACZ,YAAI,iBAAiB,SAAS,MAAM,SAAS,qBAAqB;AAChE,kBAAQ,KAAK,sBAAsB,IAAI,OAAO,KAAK,MAAM,OAAO;AAChE;AACA,cAAI,UAAU,GAAG;AACf,kBAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,GAAI,CAAC;AACxD;AAAA,UACF;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,aAAa,IAAI,MAAM,sCAAsC;AAAA,EACrE,SAAS,OAAO;AACd,YAAQ,MAAM,+BAA+B;AAAA,MAC3C,OACE,iBAAiB,QACb;AAAA,QACE,MAAM,MAAM;AAAA,QACZ,SAAS,MAAM;AAAA,QACf,OAAO,MAAM;AAAA,MACf,IACA;AAAA,MACN,SAAS,UAAU,KAAK;AAAA;AAAA,MAExB;AAAA,IACF,CAAC;AAED,WAAO;AAAA,MACL,OAAO;AAAA,MACP,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAClD;AAAA,EACF;AACF;","names":[]}

package/dist/cjs/server/session-store.js

@@ -0,0 +1,72 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var session_store_exports = {};
+__export(session_store_exports, {
+  getVerifiedUser: () => getVerifiedUser,
+  sessionStore: () => sessionStore
+});
+module.exports = __toCommonJS(session_store_exports);
+var import_react = require("react");
+class SessionStore {
+  constructor() {
+    this.currentSessionId = null;
+    this.sessions = /* @__PURE__ */ new Map();
+  }
+  static getInstance() {
+    if (!SessionStore.instance) {
+      SessionStore.instance = new SessionStore();
+    }
+    return SessionStore.instance;
+  }
+  setUser(sessionId, user) {
+    console.log("SessionStore: Setting user:", { sessionId, user });
+    this.sessions.set(sessionId, user);
+    this.currentSessionId = sessionId;
+  }
+  getUser(sessionId) {
+    return this.sessions.get(sessionId) || null;
+  }
+  getCurrentUser() {
+    if (!this.currentSessionId) return null;
+    return this.sessions.get(this.currentSessionId) || null;
+  }
+  removeUser(sessionId) {
+    this.sessions.delete(sessionId);
+  }
+  clear() {
+    this.sessions.clear();
+  }
+  debug() {
+    return {
+      sessionsCount: this.sessions.size,
+      currentSessionId: this.currentSessionId,
+      sessions: Array.from(this.sessions.entries())
+    };
+  }
+}
+const sessionStore = SessionStore.getInstance();
+const getVerifiedUser = (0, import_react.cache)((sessionId) => {
+  return sessionStore.getUser(sessionId);
+});
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getVerifiedUser,
+  sessionStore
+});
+//# sourceMappingURL=session-store.js.map

package/dist/cjs/server/session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/server/session-store.ts"],"sourcesContent":["import { cache } from \"react\"\nimport type { UserInfo } from \"./types\"\n\n/**\n * Simple in-memory session store\n * In a real app, this would be backed by Redis/etc\n */\nclass SessionStore {\n  private static instance: SessionStore\n  private sessions: Map<string, UserInfo>\n  private currentSessionId: string | null = null\n\n  private constructor() {\n    this.sessions = new Map()\n  }\n\n  static getInstance(): SessionStore {\n    if (!SessionStore.instance) {\n      SessionStore.instance = new SessionStore()\n    }\n    return SessionStore.instance\n  }\n\n  setUser(sessionId: string, user: UserInfo) {\n    console.log(\"SessionStore: Setting user:\", { sessionId, user })\n    this.sessions.set(sessionId, user)\n    this.currentSessionId = sessionId\n  }\n\n  getUser(sessionId: string): UserInfo | null {\n    return this.sessions.get(sessionId) || null\n  }\n\n  getCurrentUser(): UserInfo | null {\n    if (!this.currentSessionId) return null\n    return this.sessions.get(this.currentSessionId) || null\n  }\n\n  removeUser(sessionId: string) {\n    this.sessions.delete(sessionId)\n  }\n\n  clear() {\n    this.sessions.clear()\n  }\n\n  debug() {\n    return {\n      sessionsCount: this.sessions.size,\n      currentSessionId: this.currentSessionId,\n      sessions: Array.from(this.sessions.entries())\n    }\n}\n}\n\n// Export singleton instance\nexport const sessionStore = SessionStore.getInstance()\n\n/**\n * Cached function to get user from session store\n * Uses React cache for SSR optimization\n */\nexport const getVerifiedUser = cache((sessionId: string): UserInfo | null => {\n  return sessionStore.getUser(sessionId)\n})\n\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAAsB;AAOtB,MAAM,aAAa;AAAA,EAKT,cAAc;AAFtB,SAAQ,mBAAkC;AAGxC,SAAK,WAAW,oBAAI,IAAI;AAAA,EAC1B;AAAA,EAEA,OAAO,cAA4B;AACjC,QAAI,CAAC,aAAa,UAAU;AAC1B,mBAAa,WAAW,IAAI,aAAa;AAAA,IAC3C;AACA,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,QAAQ,WAAmB,MAAgB;AACzC,YAAQ,IAAI,+BAA+B,EAAE,WAAW,KAAK,CAAC;AAC9D,SAAK,SAAS,IAAI,WAAW,IAAI;AACjC,SAAK,mBAAmB;AAAA,EAC1B;AAAA,EAEA,QAAQ,WAAoC;AAC1C,WAAO,KAAK,SAAS,IAAI,SAAS,KAAK;AAAA,EACzC;AAAA,EAEA,iBAAkC;AAChC,QAAI,CAAC,KAAK,iBAAkB,QAAO;AACnC,WAAO,KAAK,SAAS,IAAI,KAAK,gBAAgB,KAAK;AAAA,EACrD;AAAA,EAEA,WAAW,WAAmB;AAC5B,SAAK,SAAS,OAAO,SAAS;AAAA,EAChC;AAAA,EAEA,QAAQ;AACN,SAAK,SAAS,MAAM;AAAA,EACtB;AAAA,EAEA,QAAQ;AACN,WAAO;AAAA,MACL,eAAe,KAAK,SAAS;AAAA,MAC7B,kBAAkB,KAAK;AAAA,MACvB,UAAU,MAAM,KAAK,KAAK,SAAS,QAAQ,CAAC;AAAA,IAC9C;AAAA,EACJ;AACA;AAGO,MAAM,eAAe,aAAa,YAAY;AAM9C,MAAM,sBAAkB,oBAAM,CAAC,cAAuC;AAC3E,SAAO,aAAa,QAAQ,SAAS;AACvC,CAAC;","names":[]}

package/dist/cjs/server/ternSecureMiddleware.js

@@ -19,13 +19,11 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var ternSecureMiddleware_exports = {};
 __export(ternSecureMiddleware_exports, {
   createRouteMatcher: () => createRouteMatcher,
-  runtime: () => runtime,
   ternSecureMiddleware: () => ternSecureMiddleware
 });
 module.exports = __toCommonJS(ternSecureMiddleware_exports);
 var import_server = require("next/server");
-var import_edge_session = require("./edge-session");
-const runtime = "edge";
+var import_errors = require("../errors");
 function createRouteMatcher(patterns) {
   return (request) => {
     const { pathname } = request.nextUrl;
@@ -37,60 +35,36 @@ function createRouteMatcher(patterns) {
     });
   };
 }
-async function edgeAuth(request) {
-  var _a, _b;
-  async function protect() {
-    throw new Error("Unauthorized access");
-  }
-  try {
-    const sessionResult = await (0, import_edge_session.verifySession)(request);
-    if (sessionResult.isAuthenticated && sessionResult.user) {
-      return {
-        user: sessionResult.user,
-        token: ((_a = request.cookies.get("_session_cookie")) == null ? void 0 : _a.value) || ((_b = request.cookies.get("_session_token")) == null ? void 0 : _b.value) || null,
-        protect: async () => {
-        }
-      };
-    }
-    return {
-      user: null,
-      token: null,
-      protect
-    };
-  } catch (error) {
-    console.error("Auth check error:", error);
-    return {
-      user: null,
-      token: null,
-      protect
-    };
-  }
-}
 function ternSecureMiddleware(callback) {
   return async function middleware(request) {
     try {
-      const auth = await edgeAuth(request);
-      try {
-        await callback(auth, request);
-        const response = import_server.NextResponse.next();
-        if (auth.user) {
-          response.headers.set("x-user-id", auth.user.uid);
-          if (auth.user.email) {
-            response.headers.set("x-user-email", auth.user.email);
-          }
-          if (auth.user.emailVerified !== void 0) {
-            response.headers.set("x-email-verified", auth.user.emailVerified.toString());
-          }
-          if (auth.user.authTime) {
-            response.headers.set("x-auth-time", auth.user.authTime.toString());
+      const hasCookies = request.cookies.has("_session_cookie") || request.cookies.has("_session_token");
+      const auth = {
+        user: null,
+        sessionId: null,
+        protect: async () => {
+          if (!hasCookies) {
+            const currentPath = request.nextUrl.pathname;
+            if (currentPath !== "/sign-in") {
+              const redirectUrl = new URL("/sign-in", request.url);
+              redirectUrl.searchParams.set("redirect", currentPath);
+              throw new import_errors.TernSecureError("UNAUTHENTICATED", redirectUrl.toString());
+            } else {
+              throw new Error("UNAUTHENTICATED");
+            }
           }
         }
-        return response;
+      };
+      if (!callback) {
+        return import_server.NextResponse.next();
+      }
+      try {
+        await callback(auth, request);
+        return import_server.NextResponse.next();
       } catch (error) {
         if (error instanceof Error && error.message === "Unauthorized access") {
-          const redirectUrl = new URL("/sign-in", request.url);
-          redirectUrl.searchParams.set("redirect", request.nextUrl.pathname);
-          return import_server.NextResponse.redirect(redirectUrl);
+          console.log("middleware: Unauthorized access, redirecting to sign-in");
+          return import_server.NextResponse.redirect(error.message);
         }
         throw error;
       }
@@ -103,15 +77,13 @@ function ternSecureMiddleware(callback) {
         } : error,
         path: request.nextUrl.pathname
       });
-      const redirectUrl = new URL("/sign-in", request.url);
-      return import_server.NextResponse.redirect(redirectUrl);
+      return import_server.NextResponse.redirect(new URL("/sign-in", request.url));
     }
   };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   createRouteMatcher,
-  runtime,
   ternSecureMiddleware
 });
 //# sourceMappingURL=ternSecureMiddleware.js.map

package/dist/cjs/server/ternSecureMiddleware.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/server/ternSecureMiddleware.ts"],"sourcesContent":["import { NextRequest, NextResponse } from 'next/server';\nimport { verifySession, type UserInfo } from './edge-session'\n\nexport const runtime = \"edge\"\n\n\ninterface Auth {\n  user: UserInfo | null\n  token: string | null\n  protect: () => Promise<void>\n}\n\ntype MiddlewareCallback = (\n  auth: Auth,\n  request: NextRequest\n) => Promise<void>\n\n\n/**\n * Create a route matcher function for public paths\n */\nexport function createRouteMatcher(patterns: string[]) {\n  return (request: NextRequest): boolean => {\n    const { pathname } = request.nextUrl\n    return patterns.some(pattern => {\n      // Convert route pattern to regex\n      const regexPattern = new RegExp(\n        `^${pattern.replace(/\\*/g, '.*').replace(/\\((.*)\\)/, '(?:$1)?')}$`\n      )\n      return regexPattern.test(pathname)\n    })\n  }\n}\n\n\n/**\n * Edge-compatible auth check\n */\nasync function edgeAuth(request: NextRequest): Promise<Auth> {\n  async function protect() {\n    throw new Error(\"Unauthorized access\")\n  }\n\n  try {\n    const sessionResult = await verifySession(request)\n\n    if (sessionResult.isAuthenticated && sessionResult.user) {\n      return {\n        user: sessionResult.user,\n        token: request.cookies.get(\"_session_cookie\")?.value || request.cookies.get(\"_session_token\")?.value || null,\n        protect: async () => {},\n      }\n    }\n\n    return {\n      user: null,\n      token: null,\n      protect,\n    }\n  } catch (error) {\n    console.error(\"Auth check error:\", error)\n    return {\n      user: null,\n      token: null,\n      protect,\n    }\n  }\n}\n\n\n\n/**\n * Middleware factory that handles authentication and custom logic\n * @param customHandler Optional function for additional custom logic\n */\n\nexport function ternSecureMiddleware(callback: MiddlewareCallback) {\n  return async function middleware(request: NextRequest) {\n    try {\n      const auth = await edgeAuth(request)\n\n      try {\n        \n        await callback(auth, request)\n\n        const response = NextResponse.next()\n\n        if (auth.user) {\n          // Set auth headers\n          response.headers.set(\"x-user-id\", auth.user.uid)\n          if (auth.user.email) {\n            response.headers.set(\"x-user-email\", auth.user.email)\n          }\n          if (auth.user.emailVerified !== undefined) {\n            response.headers.set(\"x-email-verified\", auth.user.emailVerified.toString())\n          }\n          if (auth.user.authTime) {\n            response.headers.set(\"x-auth-time\", auth.user.authTime.toString())\n          }\n        }\n\n        return response\n      } catch (error) {\n        // Handle unauthorized access\n        if (error instanceof Error && error.message === 'Unauthorized access') {\n          const redirectUrl = new URL('/sign-in', request.url)\n          redirectUrl.searchParams.set('redirect', request.nextUrl.pathname)\n          return NextResponse.redirect(redirectUrl)\n        }\n        throw error\n      }\n\n    } catch (error) {\n      console.error(\"Middleware error:\", {\n        error:\n          error instanceof Error\n            ? {\n                name: error.name,\n                message: error.message,\n                stack: error.stack,\n              }\n            : error,\n        path: request.nextUrl.pathname,\n      })\n\n      const redirectUrl = new URL(\"/sign-in\", request.url)\n      return NextResponse.redirect(redirectUrl)\n    }\n  }\n}"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAA0C;AAC1C,0BAA6C;AAEtC,MAAM,UAAU;AAkBhB,SAAS,mBAAmB,UAAoB;AACrD,SAAO,CAAC,YAAkC;AACxC,UAAM,EAAE,SAAS,IAAI,QAAQ;AAC7B,WAAO,SAAS,KAAK,aAAW;AAE9B,YAAM,eAAe,IAAI;AAAA,QACvB,IAAI,QAAQ,QAAQ,OAAO,IAAI,EAAE,QAAQ,YAAY,SAAS,CAAC;AAAA,MACjE;AACA,aAAO,aAAa,KAAK,QAAQ;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAMA,eAAe,SAAS,SAAqC;AAtC7D;AAuCE,iBAAe,UAAU;AACvB,UAAM,IAAI,MAAM,qBAAqB;AAAA,EACvC;AAEA,MAAI;AACF,UAAM,gBAAgB,UAAM,mCAAc,OAAO;AAEjD,QAAI,cAAc,mBAAmB,cAAc,MAAM;AACvD,aAAO;AAAA,QACL,MAAM,cAAc;AAAA,QACpB,SAAO,aAAQ,QAAQ,IAAI,iBAAiB,MAArC,mBAAwC,YAAS,aAAQ,QAAQ,IAAI,gBAAgB,MAApC,mBAAuC,UAAS;AAAA,QACxG,SAAS,YAAY;AAAA,QAAC;AAAA,MACxB;AAAA,IACF;AAEA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,YAAQ,MAAM,qBAAqB,KAAK;AACxC,WAAO;AAAA,MACL,MAAM;AAAA,MACN,OAAO;AAAA,MACP;AAAA,IACF;AAAA,EACF;AACF;AASO,SAAS,qBAAqB,UAA8B;AACjE,SAAO,eAAe,WAAW,SAAsB;AACrD,QAAI;AACF,YAAM,OAAO,MAAM,SAAS,OAAO;AAEnC,UAAI;AAEF,cAAM,SAAS,MAAM,OAAO;AAE5B,cAAM,WAAW,2BAAa,KAAK;AAEnC,YAAI,KAAK,MAAM;AAEb,mBAAS,QAAQ,IAAI,aAAa,KAAK,KAAK,GAAG;AAC/C,cAAI,KAAK,KAAK,OAAO;AACnB,qBAAS,QAAQ,IAAI,gBAAgB,KAAK,KAAK,KAAK;AAAA,UACtD;AACA,cAAI,KAAK,KAAK,kBAAkB,QAAW;AACzC,qBAAS,QAAQ,IAAI,oBAAoB,KAAK,KAAK,cAAc,SAAS,CAAC;AAAA,UAC7E;AACA,cAAI,KAAK,KAAK,UAAU;AACtB,qBAAS,QAAQ,IAAI,eAAe,KAAK,KAAK,SAAS,SAAS,CAAC;AAAA,UACnE;AAAA,QACF;AAEA,eAAO;AAAA,MACT,SAAS,OAAO;AAEd,YAAI,iBAAiB,SAAS,MAAM,YAAY,uBAAuB;AACrE,gBAAM,cAAc,IAAI,IAAI,YAAY,QAAQ,GAAG;AACnD,sBAAY,aAAa,IAAI,YAAY,QAAQ,QAAQ,QAAQ;AACjE,iBAAO,2BAAa,SAAS,WAAW;AAAA,QAC1C;AACA,cAAM;AAAA,MACR;AAAA,IAEF,SAAS,OAAO;AACd,cAAQ,MAAM,qBAAqB;AAAA,QACjC,OACE,iBAAiB,QACb;AAAA,UACE,MAAM,MAAM;AAAA,UACZ,SAAS,MAAM;AAAA,UACf,OAAO,MAAM;AAAA,QACf,IACA;AAAA,QACN,MAAM,QAAQ,QAAQ;AAAA,MACxB,CAAC;AAED,YAAM,cAAc,IAAI,IAAI,YAAY,QAAQ,GAAG;AACnD,aAAO,2BAAa,SAAS,WAAW;AAAA,IAC1C;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../src/server/ternSecureMiddleware.ts"],"sourcesContent":["import { type NextRequest, NextResponse } from 'next/server';\nimport type { UserInfo } from './types'\nimport { TernSecureError } from '../errors';\n\n\n\ninterface Auth {\n  user: UserInfo | null\n  sessionId : string | null\n  protect: () => Promise<void>\n}\n\ntype MiddlewareCallback = (\n  auth: Auth,\n  request: NextRequest\n) => Promise<void>\n\n\n/**\n * Create a route matcher function for public paths\n */\nexport function createRouteMatcher(patterns: string[]) {\n  return (request: NextRequest): boolean => {\n    const { pathname } = request.nextUrl\n    return patterns.some(pattern => {\n      // Convert route pattern to regex\n      const regexPattern = new RegExp(\n        `^${pattern.replace(/\\*/g, '.*').replace(/\\((.*)\\)/, '(?:$1)?')}$`\n      )\n      return regexPattern.test(pathname)\n    })\n  }\n}\n\n\n/**\n * Middleware factory that handles authentication and custom logic\n * @param customHandler Optional function for additional custom logic\n */\n\nexport function ternSecureMiddleware(callback: MiddlewareCallback) {\n  return async function middleware(request: NextRequest) {\n    try {\n\n      const hasCookies = request.cookies.has('_session_cookie') || request.cookies.has('_session_token')\n\n      const auth: Auth = {\n        user: null,\n        sessionId: null,\n        protect: async () => {\n          if (!hasCookies) {\n            const currentPath = request.nextUrl.pathname\n            if (currentPath !== '/sign-in') {\n              const redirectUrl = new URL('/sign-in', request.url)\n              redirectUrl.searchParams.set('redirect', currentPath)\n              throw new TernSecureError('UNAUTHENTICATED', redirectUrl.toString())\n            } else {\n              throw new Error('UNAUTHENTICATED')\n            }\n          }\n        }\n      }\n\n      if (!callback) {\n        return NextResponse.next()\n      }\n\n\n\n      try {\n        await callback(auth, request)\n        return NextResponse.next()\n      } catch (error) {\n        if (error instanceof Error && error.message === 'Unauthorized access') {\n          console.log('middleware: Unauthorized access, redirecting to sign-in')\n          return NextResponse.redirect(error.message)\n        }\n        throw error\n      }\n\n    } catch (error) {\n      console.error(\"Middleware error:\", {\n        error:\n          error instanceof Error\n            ? {\n                name: error.name,\n                message: error.message,\n                stack: error.stack,\n              }\n            : error,\n        path: request.nextUrl.pathname,\n      })\n\n      return NextResponse.redirect(new URL('/sign-in', request.url))\n    }\n  }\n}"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oBAA+C;AAE/C,oBAAgC;AAmBzB,SAAS,mBAAmB,UAAoB;AACrD,SAAO,CAAC,YAAkC;AACxC,UAAM,EAAE,SAAS,IAAI,QAAQ;AAC7B,WAAO,SAAS,KAAK,aAAW;AAE9B,YAAM,eAAe,IAAI;AAAA,QACvB,IAAI,QAAQ,QAAQ,OAAO,IAAI,EAAE,QAAQ,YAAY,SAAS,CAAC;AAAA,MACjE;AACA,aAAO,aAAa,KAAK,QAAQ;AAAA,IACnC,CAAC;AAAA,EACH;AACF;AAQO,SAAS,qBAAqB,UAA8B;AACjE,SAAO,eAAe,WAAW,SAAsB;AACrD,QAAI;AAEF,YAAM,aAAa,QAAQ,QAAQ,IAAI,iBAAiB,KAAK,QAAQ,QAAQ,IAAI,gBAAgB;AAEjG,YAAM,OAAa;AAAA,QACjB,MAAM;AAAA,QACN,WAAW;AAAA,QACX,SAAS,YAAY;AACnB,cAAI,CAAC,YAAY;AACf,kBAAM,cAAc,QAAQ,QAAQ;AACpC,gBAAI,gBAAgB,YAAY;AAC9B,oBAAM,cAAc,IAAI,IAAI,YAAY,QAAQ,GAAG;AACnD,0BAAY,aAAa,IAAI,YAAY,WAAW;AACpD,oBAAM,IAAI,8BAAgB,mBAAmB,YAAY,SAAS,CAAC;AAAA,YACrE,OAAO;AACL,oBAAM,IAAI,MAAM,iBAAiB;AAAA,YACnC;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAEA,UAAI,CAAC,UAAU;AACb,eAAO,2BAAa,KAAK;AAAA,MAC3B;AAIA,UAAI;AACF,cAAM,SAAS,MAAM,OAAO;AAC5B,eAAO,2BAAa,KAAK;AAAA,MAC3B,SAAS,OAAO;AACd,YAAI,iBAAiB,SAAS,MAAM,YAAY,uBAAuB;AACrE,kBAAQ,IAAI,yDAAyD;AACrE,iBAAO,2BAAa,SAAS,MAAM,OAAO;AAAA,QAC5C;AACA,cAAM;AAAA,MACR;AAAA,IAEF,SAAS,OAAO;AACd,cAAQ,MAAM,qBAAqB;AAAA,QACjC,OACE,iBAAiB,QACb;AAAA,UACE,MAAM,MAAM;AAAA,UACZ,SAAS,MAAM;AAAA,UACf,OAAO,MAAM;AAAA,QACf,IACA;AAAA,QACN,MAAM,QAAQ,QAAQ;AAAA,MACxB,CAAC;AAED,aAAO,2BAAa,SAAS,IAAI,IAAI,YAAY,QAAQ,GAAG,CAAC;AAAA,IAC/D;AAAA,EACF;AACF;","names":[]}

package/dist/cjs/server/types.js

@@ -0,0 +1,17 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var types_exports = {};
+module.exports = __toCommonJS(types_exports);
+//# sourceMappingURL=types.js.map

package/dist/cjs/server/types.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/server/types.ts"],"sourcesContent":["export interface UserInfo {\n    uid: string\n    email: string | null\n    emailVerified?: boolean\n    authTime?: number\n    disabled?: boolean\n  }\n  \n  \n  export interface SessionResult {\n    user: UserInfo | null\n    token: string | null\n    sessionId: string | null\n    error?: string\n  }"],"mappings":";;;;;;;;;;;;;;AAAA;AAAA;","names":[]}

package/dist/cjs/server/utils.js

@@ -0,0 +1,108 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var utils_exports = {};
+__export(utils_exports, {
+  Store: () => Store
+});
+module.exports = __toCommonJS(utils_exports);
+const getGlobalObject = () => {
+  if (typeof process !== "undefined") {
+    return process;
+  }
+  return globalThis;
+};
+const STORE_KEY = "__TERN_AUTH_STORE__";
+class Store {
+  static getStore() {
+    const global = getGlobalObject();
+    if (!global[STORE_KEY]) {
+      global[STORE_KEY] = {
+        contexts: /* @__PURE__ */ new Map(),
+        sessions: /* @__PURE__ */ new Map(),
+        currentSession: null
+      };
+    }
+    return global[STORE_KEY];
+  }
+  static setContext(context) {
+    const store = this.getStore();
+    const { user, sessionId } = context;
+    console.log("Store: Setting context:", { sessionId, user });
+    store.contexts.set(sessionId, context);
+    store.sessions.set(sessionId, user);
+    store.currentSession = context;
+    console.log("Store: Updated state:", {
+      contextsSize: store.contexts.size,
+      sessionsSize: store.sessions.size,
+      currentSession: store.currentSession
+    });
+  }
+  static getContext() {
+    const store = this.getStore();
+    if (store.currentSession) {
+      const session = this.getSession(store.currentSession.sessionId);
+      if (session && session.uid === store.currentSession.user.uid) {
+        return store.currentSession;
+      }
+    }
+    for (const [sessionId, user] of store.sessions.entries()) {
+      const context = store.contexts.get(sessionId);
+      if (context && context.user.uid === user.uid) {
+        store.currentSession = context;
+        return context;
+      }
+    }
+    return null;
+  }
+  static setSession(sessionId, user) {
+    const store = this.getStore();
+    store.sessions.set(sessionId, user);
+  }
+  static getSession(sessionId) {
+    const store = this.getStore();
+    return store.sessions.get(sessionId) || null;
+  }
+  static debug() {
+    const store = this.getStore();
+    return {
+      contextsSize: store.contexts.size,
+      sessionsSize: store.sessions.size,
+      currentSession: store.currentSession,
+      contexts: Array.from(store.contexts.entries()),
+      sessions: Array.from(store.sessions.entries())
+    };
+  }
+  static cleanup() {
+    const store = this.getStore();
+    const MAX_ENTRIES = 1e3;
+    if (store.contexts.size > MAX_ENTRIES) {
+      const keys = Array.from(store.contexts.keys());
+      const toDelete = keys.slice(0, keys.length - MAX_ENTRIES);
+      toDelete.forEach((key) => {
+        store.contexts.delete(key);
+        store.sessions.delete(key);
+      });
+    }
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  Store
+});
+//# sourceMappingURL=utils.js.map

package/dist/cjs/server/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/server/utils.ts"],"sourcesContent":["import type { UserInfo } from \"./types\"\n\ninterface RequestContext {\n  user: UserInfo\n  sessionId: string\n}\n\n// Use process.env in Node.js and globalThis in Edge\nconst getGlobalObject = () => {\n  if (typeof process !== 'undefined') {\n    return process\n  }\n  return globalThis\n}\n\nconst STORE_KEY = '__TERN_AUTH_STORE__'\n\nexport class Store {\n  private static getStore() {\n    const global = getGlobalObject() as any\n    \n    if (!global[STORE_KEY]) {\n      global[STORE_KEY] = {\n        contexts: new Map<string, RequestContext>(),\n        sessions: new Map<string, UserInfo>(),\n        currentSession: null as RequestContext | null\n      }\n    }\n    \n    return global[STORE_KEY]\n  }\n\n  static setContext(context: RequestContext) {\n    const store = this.getStore()\n    const { user, sessionId } = context\n    \n    console.log(\"Store: Setting context:\", { sessionId, user })\n    \n    // Store in both maps\n    store.contexts.set(sessionId, context)\n    store.sessions.set(sessionId, user)\n    \n    // Set as current session\n    store.currentSession = context\n    \n    console.log(\"Store: Updated state:\", {\n      contextsSize: store.contexts.size,\n      sessionsSize: store.sessions.size,\n      currentSession: store.currentSession\n    })\n  }\n\n  static getContext(): RequestContext | null {\n    const store = this.getStore()\n    \n    // First try current session\n    if (store.currentSession) {\n      const session = this.getSession(store.currentSession.sessionId)\n      if (session && session.uid === store.currentSession.user.uid) {\n        return store.currentSession\n      }\n    }\n    \n    // Then try to find any valid context\n    for (const [sessionId, user] of store.sessions.entries()) {\n      const context = store.contexts.get(sessionId)\n      if (context && context.user.uid === user.uid) {\n        // Update current session\n        store.currentSession = context\n        return context\n      }\n    }\n    \n    return null\n  }\n\n  static setSession(sessionId: string, user: UserInfo) {\n    const store = this.getStore()\n    store.sessions.set(sessionId, user)\n  }\n\n  static getSession(sessionId: string): UserInfo | null {\n    const store = this.getStore()\n    return store.sessions.get(sessionId) || null\n  }\n\n  static debug() {\n    const store = this.getStore()\n    return {\n      contextsSize: store.contexts.size,\n      sessionsSize: store.sessions.size,\n      currentSession: store.currentSession,\n      contexts: Array.from(store.contexts.entries()),\n      sessions: Array.from(store.sessions.entries())\n    }\n  }\n\n  static cleanup() {\n    const store = this.getStore()\n    const MAX_ENTRIES = 1000\n    \n    if (store.contexts.size > MAX_ENTRIES) {\n      const keys = Array.from(store.contexts.keys())\n      const toDelete = keys.slice(0, keys.length - MAX_ENTRIES)\n      \n      toDelete.forEach(key => {\n        store.contexts.delete(key)\n        store.sessions.delete(key)\n      })\n    }\n  }\n}"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,MAAM,kBAAkB,MAAM;AAC5B,MAAI,OAAO,YAAY,aAAa;AAClC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,MAAM,YAAY;AAEX,MAAM,MAAM;AAAA,EACjB,OAAe,WAAW;AACxB,UAAM,SAAS,gBAAgB;AAE/B,QAAI,CAAC,OAAO,SAAS,GAAG;AACtB,aAAO,SAAS,IAAI;AAAA,QAClB,UAAU,oBAAI,IAA4B;AAAA,QAC1C,UAAU,oBAAI,IAAsB;AAAA,QACpC,gBAAgB;AAAA,MAClB;AAAA,IACF;AAEA,WAAO,OAAO,SAAS;AAAA,EACzB;AAAA,EAEA,OAAO,WAAW,SAAyB;AACzC,UAAM,QAAQ,KAAK,SAAS;AAC5B,UAAM,EAAE,MAAM,UAAU,IAAI;AAE5B,YAAQ,IAAI,2BAA2B,EAAE,WAAW,KAAK,CAAC;AAG1D,UAAM,SAAS,IAAI,WAAW,OAAO;AACrC,UAAM,SAAS,IAAI,WAAW,IAAI;AAGlC,UAAM,iBAAiB;AAEvB,YAAQ,IAAI,yBAAyB;AAAA,MACnC,cAAc,MAAM,SAAS;AAAA,MAC7B,cAAc,MAAM,SAAS;AAAA,MAC7B,gBAAgB,MAAM;AAAA,IACxB,CAAC;AAAA,EACH;AAAA,EAEA,OAAO,aAAoC;AACzC,UAAM,QAAQ,KAAK,SAAS;AAG5B,QAAI,MAAM,gBAAgB;AACxB,YAAM,UAAU,KAAK,WAAW,MAAM,eAAe,SAAS;AAC9D,UAAI,WAAW,QAAQ,QAAQ,MAAM,eAAe,KAAK,KAAK;AAC5D,eAAO,MAAM;AAAA,MACf;AAAA,IACF;AAGA,eAAW,CAAC,WAAW,IAAI,KAAK,MAAM,SAAS,QAAQ,GAAG;AACxD,YAAM,UAAU,MAAM,SAAS,IAAI,SAAS;AAC5C,UAAI,WAAW,QAAQ,KAAK,QAAQ,KAAK,KAAK;AAE5C,cAAM,iBAAiB;AACvB,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,WAAW,WAAmB,MAAgB;AACnD,UAAM,QAAQ,KAAK,SAAS;AAC5B,UAAM,SAAS,IAAI,WAAW,IAAI;AAAA,EACpC;AAAA,EAEA,OAAO,WAAW,WAAoC;AACpD,UAAM,QAAQ,KAAK,SAAS;AAC5B,WAAO,MAAM,SAAS,IAAI,SAAS,KAAK;AAAA,EAC1C;AAAA,EAEA,OAAO,QAAQ;AACb,UAAM,QAAQ,KAAK,SAAS;AAC5B,WAAO;AAAA,MACL,cAAc,MAAM,SAAS;AAAA,MAC7B,cAAc,MAAM,SAAS;AAAA,MAC7B,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM,KAAK,MAAM,SAAS,QAAQ,CAAC;AAAA,MAC7C,UAAU,MAAM,KAAK,MAAM,SAAS,QAAQ,CAAC;AAAA,IAC/C;AAAA,EACF;AAAA,EAEA,OAAO,UAAU;AACf,UAAM,QAAQ,KAAK,SAAS;AAC5B,UAAM,cAAc;AAEpB,QAAI,MAAM,SAAS,OAAO,aAAa;AACrC,YAAM,OAAO,MAAM,KAAK,MAAM,SAAS,KAAK,CAAC;AAC7C,YAAM,WAAW,KAAK,MAAM,GAAG,KAAK,SAAS,WAAW;AAExD,eAAS,QAAQ,SAAO;AACtB,cAAM,SAAS,OAAO,GAAG;AACzB,cAAM,SAAS,OAAO,GAAG;AAAA,MAC3B,CAAC;AAAA,IACH;AAAA,EACF;AACF;","names":[]}