@tern-secure/nextjs 5.2.0-canary.v20250919131424 → 5.2.0-canary.v20250926170202

package/dist/cjs/app-router/admin/api/endpoints/abstract.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../src/app-router/admin/api/endpoints/abstract.ts"],"sourcesContent":["import type {\n  AuthEndpoint,\n  SessionSubEndpoint,\n  TernSecureInternalHandlerConfig,\n} from '../../types';\n\nexport interface HandlerContext {\n  request: Request;\n  pathSegments: string[];\n  endpoint: AuthEndpoint;\n  subEndpoint: SessionSubEndpoint | undefined;\n  method: string;\n}\n\nexport interface EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean;\n  handle(\n    handlerContext: HandlerContext,\n    config: TernSecureInternalHandlerConfig,\n  ): Promise<Response>;\n}\n\nexport abstract class BaseEndpointHandler implements EndpointHandler {\n  abstract canHandle(endpoint: AuthEndpoint): boolean;\n  abstract handle(\n    handlerContext: HandlerContext,\n    config: TernSecureInternalHandlerConfig,\n  ): Promise<Response>;\n\n  protected validateMethod(allowedMethods: string[], method: string): boolean {\n    return allowedMethods.includes(method);\n  }\n\n  protected validateSubEndpoint(\n    subEndpoint: SessionSubEndpoint | undefined,\n    requiredSubEndpoint?: boolean,\n  ): boolean {\n    if (requiredSubEndpoint) {\n      return subEndpoint !== undefined;\n    }\n    return true;\n  }\n}"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAsBO,MAAe,oBAA+C;AAAA,EAOzD,eAAe,gBAA0B,QAAyB;AAC1E,WAAO,eAAe,SAAS,MAAM;AAAA,EACvC;AAAA,EAEU,oBACR,aACA,qBACS;AACT,QAAI,qBAAqB;AACvB,aAAO,gBAAgB;AAAA,IACzB;AACA,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../../../../../../src/app-router/admin/api/endpoints/abstract.ts"],"sourcesContent":["import type { RequestProcessorContext } from '../../c-authenticateRequestProcessor';\nimport type {\n  AuthEndpoint,\n  SessionSubEndpoint,\n  TernSecureHandlerOptions,\n} from '../../types';\n\nexport interface HandlerContext {\n  request: Request;\n  pathSegments: string[];\n  endpoint: AuthEndpoint;\n  subEndpoint: SessionSubEndpoint;\n  method: string;\n  requestProcessorContext: RequestProcessorContext;\n}\n\nexport interface EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean;\n  handle(\n    context: RequestProcessorContext,\n    config: TernSecureHandlerOptions,\n  ): Promise<Response>;\n}\n\nexport abstract class BaseEndpointHandler implements EndpointHandler {\n  abstract canHandle(endpoint: AuthEndpoint): boolean;\n  abstract handle(\n    context: RequestProcessorContext,\n    config: TernSecureHandlerOptions,\n  ): Promise<Response>;\n\n  protected validateMethod(allowedMethods: string[], method: string): boolean {\n    return allowedMethods.includes(method);\n  }\n\n  protected validateSubEndpoint(\n    subEndpoint: SessionSubEndpoint | undefined,\n    requiredSubEndpoint?: boolean,\n  ): boolean {\n    if (requiredSubEndpoint) {\n      return subEndpoint !== undefined;\n    }\n    return true;\n  }\n}"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAwBO,MAAe,oBAA+C;AAAA,EAOzD,eAAe,gBAA0B,QAAyB;AAC1E,WAAO,eAAe,SAAS,MAAM;AAAA,EACvC;AAAA,EAEU,oBACR,aACA,qBACS;AACT,QAAI,qBAAqB;AACvB,aAAO,gBAAgB;AAAA,IACzB;AACA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/cjs/app-router/admin/{claude-authenticateRequestProcessor.js → c-authenticateRequestProcessor.js}

@@ -16,11 +16,11 @@ var __copyProps = (to, from, except, desc) => {
   return to;
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var claude_authenticateRequestProcessor_exports = {};
-__export(claude_authenticateRequestProcessor_exports, {
+var c_authenticateRequestProcessor_exports = {};
+__export(c_authenticateRequestProcessor_exports, {
   createRequestProcessor: () => createRequestProcessor
 });
-module.exports = __toCommonJS(claude_authenticateRequestProcessor_exports);
+module.exports = __toCommonJS(c_authenticateRequestProcessor_exports);
 var import_backend = require("@tern-secure/backend");
 class RequestProcessorContext {
   constructor(ternSecureRequest, options) {
@@ -28,8 +28,13 @@ class RequestProcessorContext {
     this.options = options;
     this.initHeaderValues();
     this.initCookieValues();
+    this.initUrlValues();
+    Object.assign(this, options);
     this.ternUrl = this.ternSecureRequest.ternUrl;
   }
+  get request() {
+    return this.ternSecureRequest;
+  }
   initHeaderValues() {
     this.sessionTokenInHeader = this.parseAuthorizationHeader(
       this.getHeader(import_backend.constants.Headers.Authorization)
@@ -44,10 +49,20 @@ class RequestProcessorContext {
     this.accept = this.getHeader(import_backend.constants.Headers.Accept);
   }
   initCookieValues() {
+    const namePrefix = this.options.cookies?.namePrefix;
+    const isProduction = process.env.NODE_ENV === "production";
+    const defaultPrefix = isProduction ? "__HOST-" : "__dev_";
+    this.sessionTokenInCookie = this.getCookie(import_backend.constants.Cookies.Session);
+    this.idTokenInCookie = this.getCookie(`${defaultPrefix}${import_backend.constants.Cookies.IdToken}`);
+    this.refreshTokenInCookie = this.getCookie(`${defaultPrefix}${import_backend.constants.Cookies.Refresh}`);
     this.csrfTokenInCookie = this.getCookie(import_backend.constants.Cookies.CsrfToken);
+    this.customTokenInCookie = this.getCookie(import_backend.constants.Cookies.Custom);
   }
-  getQueryParam(name) {
-    return this.ternSecureRequest.ternUrl.searchParams.get(name);
+  initUrlValues() {
+    this.method = this.ternSecureRequest.method;
+    this.pathSegments = this.ternSecureRequest.ternUrl.pathname.split("/").filter(Boolean);
+    this.endpoint = this.pathSegments[2];
+    this.subEndpoint = this.pathSegments[3];
   }
   getHeader(name) {
     return this.ternSecureRequest.headers.get(name) || void 0;
@@ -69,11 +84,11 @@ class RequestProcessorContext {
     return void 0;
   }
 }
-const createRequestProcessor = async (ternSecureRequest, options) => {
+const createRequestProcessor = (ternSecureRequest, options) => {
   return new RequestProcessorContext(ternSecureRequest, options);
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   createRequestProcessor
 });
-//# sourceMappingURL=claude-authenticateRequestProcessor.js.map
+//# sourceMappingURL=c-authenticateRequestProcessor.js.map

package/dist/cjs/app-router/admin/c-authenticateRequestProcessor.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/app-router/admin/c-authenticateRequestProcessor.ts"],"sourcesContent":["import type { TernSecureRequest } from '@tern-secure/backend';\nimport { constants } from '@tern-secure/backend';\n\nimport type { AuthEndpoint, SessionSubEndpoint, TernSecureHandlerOptions } from './types';\n\n/**\n * Request context for better type safety and clarity\n */\ninterface RequestProcessorContext extends TernSecureHandlerOptions {\n  // header-based values\n  sessionTokenInHeader: string | undefined;\n  origin: string | undefined;\n  host: string | undefined;\n  forwardedHost: string | undefined;\n  forwardedProto: string | undefined;\n  referrer: string | undefined;\n  userAgent: string | undefined;\n  secFetchDest: string | undefined;\n  accept: string | undefined;\n\n  // cookie-based values\n  idTokenInCookie: string | undefined;\n  refreshTokenInCookie: string | undefined;\n  csrfTokenInCookie: string | undefined;\n  sessionTokenInCookie?: string | undefined;\n  customTokenInCookie?: string | undefined;\n\n  method: string;\n  pathSegments: string[];\n  endpoint?: AuthEndpoint;\n  subEndpoint?: SessionSubEndpoint;\n\n  ternUrl: URL;\n  instanceType: string;\n}\n\n/**\n * Request processor utility class for common operations\n */\nclass RequestProcessorContext implements RequestProcessorContext {\n  public constructor(\n    private ternSecureRequest: TernSecureRequest,\n    private options: TernSecureHandlerOptions,\n  ) {\n    this.initHeaderValues();\n    this.initCookieValues();\n    this.initUrlValues();\n    Object.assign(this, options);\n    this.ternUrl = this.ternSecureRequest.ternUrl;\n  }\n\n  public get request(): TernSecureRequest {\n    return this.ternSecureRequest;\n  }\n\n  private initHeaderValues() {\n    this.sessionTokenInHeader = this.parseAuthorizationHeader(\n      this.getHeader(constants.Headers.Authorization),\n    );\n    this.origin = this.getHeader(constants.Headers.Origin);\n    this.host = this.getHeader(constants.Headers.Host);\n    this.forwardedHost = this.getHeader(constants.Headers.ForwardedHost);\n    this.forwardedProto =\n      this.getHeader(constants.Headers.CloudFrontForwardedProto) ||\n      this.getHeader(constants.Headers.ForwardedProto);\n    this.referrer = this.getHeader(constants.Headers.Referrer);\n    this.userAgent = this.getHeader(constants.Headers.UserAgent);\n    this.secFetchDest = this.getHeader(constants.Headers.SecFetchDest);\n    this.accept = this.getHeader(constants.Headers.Accept);\n  }\n\n  private initCookieValues() {\n    // Consumer-controlled session cookie using namePrefix\n    const namePrefix = this.options.cookies?.namePrefix;\n    const isProduction = process.env.NODE_ENV === 'production';\n    const defaultPrefix = isProduction ? '__HOST-' : '__dev_';\n    this.sessionTokenInCookie = this.getCookie(constants.Cookies.Session);\n\n    // System-fixed cookies using backend constants\n    this.idTokenInCookie = this.getCookie(`${defaultPrefix}${constants.Cookies.IdToken}`);\n    this.refreshTokenInCookie = this.getCookie(`${defaultPrefix}${constants.Cookies.Refresh}`);\n    this.csrfTokenInCookie = this.getCookie(constants.Cookies.CsrfToken);\n    this.customTokenInCookie = this.getCookie(constants.Cookies.Custom);\n  }\n\n  private initUrlValues() {\n    this.method = this.ternSecureRequest.method;\n    this.pathSegments = this.ternSecureRequest.ternUrl.pathname.split('/').filter(Boolean);\n    this.endpoint = this.pathSegments[2] as AuthEndpoint;\n    this.subEndpoint = this.pathSegments[3] as SessionSubEndpoint;\n  }\n\n  private getHeader(name: string) {\n    return this.ternSecureRequest.headers.get(name) || undefined;\n  }\n\n  private getCookie(name: string) {\n    return this.ternSecureRequest.cookies.get(name) || undefined;\n  }\n\n  private parseAuthorizationHeader(\n    authorizationHeader: string | undefined | null,\n  ): string | undefined {\n    if (!authorizationHeader) {\n      return undefined;\n    }\n\n    const [scheme, token] = authorizationHeader.split(' ', 2);\n\n    if (!token) {\n      // No scheme specified, treat the entire value as the token\n      return scheme;\n    }\n\n    if (scheme === 'Bearer') {\n      return token;\n    }\n\n    // Skip all other schemes\n    return undefined;\n  }\n}\n\nexport type { RequestProcessorContext };\n\nexport const createRequestProcessor = (\n  ternSecureRequest: TernSecureRequest,\n  options: TernSecureHandlerOptions,\n): RequestProcessorContext => {\n  return new RequestProcessorContext(ternSecureRequest, options);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,qBAA0B;AAsC1B,MAAM,wBAA2D;AAAA,EACxD,YACG,mBACA,SACR;AAFQ;AACA;AAER,SAAK,iBAAiB;AACtB,SAAK,iBAAiB;AACtB,SAAK,cAAc;AACnB,WAAO,OAAO,MAAM,OAAO;AAC3B,SAAK,UAAU,KAAK,kBAAkB;AAAA,EACxC;AAAA,EAEA,IAAW,UAA6B;AACtC,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,mBAAmB;AACzB,SAAK,uBAAuB,KAAK;AAAA,MAC/B,KAAK,UAAU,yBAAU,QAAQ,aAAa;AAAA,IAChD;AACA,SAAK,SAAS,KAAK,UAAU,yBAAU,QAAQ,MAAM;AACrD,SAAK,OAAO,KAAK,UAAU,yBAAU,QAAQ,IAAI;AACjD,SAAK,gBAAgB,KAAK,UAAU,yBAAU,QAAQ,aAAa;AACnE,SAAK,iBACH,KAAK,UAAU,yBAAU,QAAQ,wBAAwB,KACzD,KAAK,UAAU,yBAAU,QAAQ,cAAc;AACjD,SAAK,WAAW,KAAK,UAAU,yBAAU,QAAQ,QAAQ;AACzD,SAAK,YAAY,KAAK,UAAU,yBAAU,QAAQ,SAAS;AAC3D,SAAK,eAAe,KAAK,UAAU,yBAAU,QAAQ,YAAY;AACjE,SAAK,SAAS,KAAK,UAAU,yBAAU,QAAQ,MAAM;AAAA,EACvD;AAAA,EAEQ,mBAAmB;AAEzB,UAAM,aAAa,KAAK,QAAQ,SAAS;AACzC,UAAM,eAAe,QAAQ,IAAI,aAAa;AAC9C,UAAM,gBAAgB,eAAe,YAAY;AACjD,SAAK,uBAAuB,KAAK,UAAU,yBAAU,QAAQ,OAAO;AAGpE,SAAK,kBAAkB,KAAK,UAAU,GAAG,aAAa,GAAG,yBAAU,QAAQ,OAAO,EAAE;AACpF,SAAK,uBAAuB,KAAK,UAAU,GAAG,aAAa,GAAG,yBAAU,QAAQ,OAAO,EAAE;AACzF,SAAK,oBAAoB,KAAK,UAAU,yBAAU,QAAQ,SAAS;AACnE,SAAK,sBAAsB,KAAK,UAAU,yBAAU,QAAQ,MAAM;AAAA,EACpE;AAAA,EAEQ,gBAAgB;AACtB,SAAK,SAAS,KAAK,kBAAkB;AACrC,SAAK,eAAe,KAAK,kBAAkB,QAAQ,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AACrF,SAAK,WAAW,KAAK,aAAa,CAAC;AACnC,SAAK,cAAc,KAAK,aAAa,CAAC;AAAA,EACxC;AAAA,EAEQ,UAAU,MAAc;AAC9B,WAAO,KAAK,kBAAkB,QAAQ,IAAI,IAAI,KAAK;AAAA,EACrD;AAAA,EAEQ,UAAU,MAAc;AAC9B,WAAO,KAAK,kBAAkB,QAAQ,IAAI,IAAI,KAAK;AAAA,EACrD;AAAA,EAEQ,yBACN,qBACoB;AACpB,QAAI,CAAC,qBAAqB;AACxB,aAAO;AAAA,IACT;AAEA,UAAM,CAAC,QAAQ,KAAK,IAAI,oBAAoB,MAAM,KAAK,CAAC;AAExD,QAAI,CAAC,OAAO;AAEV,aAAO;AAAA,IACT;AAEA,QAAI,WAAW,UAAU;AACvB,aAAO;AAAA,IACT;AAGA,WAAO;AAAA,EACT;AACF;AAIO,MAAM,yBAAyB,CACpC,mBACA,YAC4B;AAC5B,SAAO,IAAI,wBAAwB,mBAAmB,OAAO;AAC/D;","names":[]}

package/dist/cjs/app-router/admin/endpointRouter.js

@@ -27,33 +27,32 @@ class SessionsHandler {
   canHandle(endpoint) {
     return endpoint === "sessions";
   }
-  async handle(handlerContext, config) {
-    const { request, subEndpoint, method } = handlerContext;
-    return await import_sessionHandlers.SessionEndpointHandler.handle(request, method, subEndpoint, config);
+  async handle(context, config) {
+    return await (0, import_sessionHandlers.sessionEndpointHandler)(context, config);
   }
 }
 class UsersHandler {
   canHandle(endpoint) {
     return endpoint === "users";
   }
-  handle(_handlerContext, _config) {
+  handle(_context, _config) {
     return Promise.resolve(
       (0, import_responses.createApiErrorResponse)("ENDPOINT_NOT_IMPLEMENTED", "Users endpoint not implemented", 501)
     );
   }
 }
 class EndpointRouter {
-  static handlers = [
-    new SessionsHandler(),
-    new UsersHandler()
-  ];
-  static async route(handlerContext, config) {
-    const { endpoint } = handlerContext;
+  static handlers = [new SessionsHandler(), new UsersHandler()];
+  static async route(context, config) {
+    const { endpoint } = context;
+    if (!endpoint) {
+      return (0, import_responses.createApiErrorResponse)("ENDPOINT_REQUIRED", "Endpoint is required", 400);
+    }
     const handler = this.handlers.find((h) => h.canHandle(endpoint));
     if (!handler) {
       return (0, import_responses.createApiErrorResponse)("ENDPOINT_NOT_FOUND", "Endpoint not found", 404);
     }
-    return handler.handle(handlerContext, config);
+    return handler.handle(context, config);
   }
   static addHandler(handler) {
     this.handlers.push(handler);

package/dist/cjs/app-router/admin/endpointRouter.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/app-router/admin/endpointRouter.ts"],"sourcesContent":["import type { EndpointHandler} from './api/endpoints/abstract';\nimport type { HandlerContext } from './handlerUtils';\nimport { createApiErrorResponse } from './responses';\nimport { SessionEndpointHandler } from './sessionHandlers';\nimport type { AuthEndpoint, TernSecureInternalHandlerConfig } from './types';\n\nclass SessionsHandler implements EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean {\n    return endpoint === 'sessions';\n  }\n\n  async handle(\n    handlerContext: HandlerContext,\n    config: TernSecureInternalHandlerConfig,\n  ): Promise<Response> {\n    const { request, subEndpoint, method } = handlerContext;\n    return await SessionEndpointHandler.handle(request, method, subEndpoint, config);\n  }\n}\n\nclass UsersHandler implements EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean {\n    return endpoint === 'users';\n  }\n\n  handle(\n    _handlerContext: HandlerContext,\n    _config: TernSecureInternalHandlerConfig,\n  ): Promise<Response> {\n    return Promise.resolve(\n      createApiErrorResponse('ENDPOINT_NOT_IMPLEMENTED', 'Users endpoint not implemented', 501),\n    );\n  }\n}\n\nexport class EndpointRouter {\n  private static readonly handlers: EndpointHandler[] = [\n    new SessionsHandler(),\n    new UsersHandler(),\n  ];\n\n  static async route(\n    handlerContext: HandlerContext,\n    config: TernSecureInternalHandlerConfig,\n  ): Promise<Response> {\n    const { endpoint } = handlerContext;\n\n    const handler = this.handlers.find(h => h.canHandle(endpoint));\n\n    if (!handler) {\n      return createApiErrorResponse('ENDPOINT_NOT_FOUND', 'Endpoint not found', 404);\n    }\n\n    return handler.handle(handlerContext, config);\n  }\n\n  static addHandler(handler: EndpointHandler): void {\n    this.handlers.push(handler);\n  }\n\n  static removeHandler(predicate: (handler: EndpointHandler) => boolean): void {\n    const index = this.handlers.findIndex(predicate);\n    if (index > -1) {\n      this.handlers.splice(index, 1);\n    }\n  }\n}"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,uBAAuC;AACvC,6BAAuC;AAGvC,MAAM,gBAA2C;AAAA,EAC/C,UAAU,UAAiC;AACzC,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,MAAM,OACJ,gBACA,QACmB;AACnB,UAAM,EAAE,SAAS,aAAa,OAAO,IAAI;AACzC,WAAO,MAAM,8CAAuB,OAAO,SAAS,QAAQ,aAAa,MAAM;AAAA,EACjF;AACF;AAEA,MAAM,aAAwC;AAAA,EAC5C,UAAU,UAAiC;AACzC,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,OACE,iBACA,SACmB;AACnB,WAAO,QAAQ;AAAA,UACb,yCAAuB,4BAA4B,kCAAkC,GAAG;AAAA,IAC1F;AAAA,EACF;AACF;AAEO,MAAM,eAAe;AAAA,EAC1B,OAAwB,WAA8B;AAAA,IACpD,IAAI,gBAAgB;AAAA,IACpB,IAAI,aAAa;AAAA,EACnB;AAAA,EAEA,aAAa,MACX,gBACA,QACmB;AACnB,UAAM,EAAE,SAAS,IAAI;AAErB,UAAM,UAAU,KAAK,SAAS,KAAK,OAAK,EAAE,UAAU,QAAQ,CAAC;AAE7D,QAAI,CAAC,SAAS;AACZ,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,WAAO,QAAQ,OAAO,gBAAgB,MAAM;AAAA,EAC9C;AAAA,EAEA,OAAO,WAAW,SAAgC;AAChD,SAAK,SAAS,KAAK,OAAO;AAAA,EAC5B;AAAA,EAEA,OAAO,cAAc,WAAwD;AAC3E,UAAM,QAAQ,KAAK,SAAS,UAAU,SAAS;AAC/C,QAAI,QAAQ,IAAI;AACd,WAAK,SAAS,OAAO,OAAO,CAAC;AAAA,IAC/B;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/app-router/admin/endpointRouter.ts"],"sourcesContent":["import type { RequestProcessorContext } from './c-authenticateRequestProcessor';\nimport { createApiErrorResponse } from './responses';\nimport { sessionEndpointHandler } from './sessionHandlers';\nimport type { AuthEndpoint, TernSecureHandlerOptions } from './types';\n\nexport interface EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean;\n  handle(context: RequestProcessorContext, config: TernSecureHandlerOptions): Promise<Response>;\n}\n\nclass SessionsHandler implements EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean {\n    return endpoint === 'sessions';\n  }\n\n  async handle(\n    context: RequestProcessorContext,\n    config: TernSecureHandlerOptions,\n  ): Promise<Response> {\n    return await sessionEndpointHandler(context, config);\n  }\n}\n\nclass UsersHandler implements EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean {\n    return endpoint === 'users';\n  }\n\n  handle(_context: RequestProcessorContext, _config: TernSecureHandlerOptions): Promise<Response> {\n    return Promise.resolve(\n      createApiErrorResponse('ENDPOINT_NOT_IMPLEMENTED', 'Users endpoint not implemented', 501),\n    );\n  }\n}\n\nexport class EndpointRouter {\n  private static readonly handlers: EndpointHandler[] = [new SessionsHandler(), new UsersHandler()];\n\n  static async route(\n    context: RequestProcessorContext,\n    config: TernSecureHandlerOptions,\n  ): Promise<Response> {\n    const { endpoint } = context;\n\n    if (!endpoint) {\n      return createApiErrorResponse('ENDPOINT_REQUIRED', 'Endpoint is required', 400);\n    }\n\n    const handler = this.handlers.find(h => h.canHandle(endpoint));\n\n    if (!handler) {\n      return createApiErrorResponse('ENDPOINT_NOT_FOUND', 'Endpoint not found', 404);\n    }\n\n    return handler.handle(context, config);\n  }\n\n  static addHandler(handler: EndpointHandler): void {\n    this.handlers.push(handler);\n  }\n\n  static removeHandler(predicate: (handler: EndpointHandler) => boolean): void {\n    const index = this.handlers.findIndex(predicate);\n    if (index > -1) {\n      this.handlers.splice(index, 1);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,uBAAuC;AACvC,6BAAuC;AAQvC,MAAM,gBAA2C;AAAA,EAC/C,UAAU,UAAiC;AACzC,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,MAAM,OACJ,SACA,QACmB;AACnB,WAAO,UAAM,+CAAuB,SAAS,MAAM;AAAA,EACrD;AACF;AAEA,MAAM,aAAwC;AAAA,EAC5C,UAAU,UAAiC;AACzC,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,OAAO,UAAmC,SAAsD;AAC9F,WAAO,QAAQ;AAAA,UACb,yCAAuB,4BAA4B,kCAAkC,GAAG;AAAA,IAC1F;AAAA,EACF;AACF;AAEO,MAAM,eAAe;AAAA,EAC1B,OAAwB,WAA8B,CAAC,IAAI,gBAAgB,GAAG,IAAI,aAAa,CAAC;AAAA,EAEhG,aAAa,MACX,SACA,QACmB;AACnB,UAAM,EAAE,SAAS,IAAI;AAErB,QAAI,CAAC,UAAU;AACb,iBAAO,yCAAuB,qBAAqB,wBAAwB,GAAG;AAAA,IAChF;AAEA,UAAM,UAAU,KAAK,SAAS,KAAK,OAAK,EAAE,UAAU,QAAQ,CAAC;AAE7D,QAAI,CAAC,SAAS;AACZ,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,WAAO,QAAQ,OAAO,SAAS,MAAM;AAAA,EACvC;AAAA,EAEA,OAAO,WAAW,SAAgC;AAChD,SAAK,SAAS,KAAK,OAAO;AAAA,EAC5B;AAAA,EAEA,OAAO,cAAc,WAAwD;AAC3E,UAAM,QAAQ,KAAK,SAAS,UAAU,SAAS;AAC/C,QAAI,QAAQ,IAAI;AACd,WAAK,SAAS,OAAO,OAAO,CAAC;AAAA,IAC/B;AAAA,EACF;AACF;","names":[]}

package/dist/cjs/app-router/admin/fnValidators.js

@@ -18,27 +18,14 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var fnValidators_exports = {};
 __export(fnValidators_exports, {
-  createRequestContext: () => createRequestContext,
   createValidators: () => createValidators
 });
 module.exports = __toCommonJS(fnValidators_exports);
 var import_headers = require("next/headers");
 var import_responses = require("./responses");
-function createRequestContext(request) {
-  const url = new URL(request.url);
-  const pathSegments = url.pathname.split("/").filter(Boolean);
-  return {
-    request,
-    origin: request.headers.get("origin"),
-    host: request.headers.get("host"),
-    referer: request.headers.get("referer"),
-    userAgent: request.headers.get("user-agent") || "",
-    method: request.method,
-    pathSegments
-  };
-}
 function createValidators(context) {
-  const { request, origin, host, referer, userAgent, method, pathSegments } = context;
+  const { origin, host, referrer, userAgent, method, pathSegments } = context;
+  const request = context.request;
   async function validateCors(corsOptions) {
     if (corsOptions.skipSameOrigin) {
       if (!origin || host && origin.includes(host)) {
@@ -93,13 +80,13 @@ function createValidators(context) {
   }
   function validateCsrf(securityOptions) {
     if (securityOptions.requireCSRF && origin && host && !origin.includes(host)) {
-      const hasCSRFHeader = request.headers.get("x-requested-with") === "XMLHttpRequest";
-      const hasValidReferer = referer && host && referer.includes(host);
+      const hasCSRFHeader = context.request.headers.get("x-requested-with") === "XMLHttpRequest";
+      const hasValidReferer = referrer && host && referrer.includes(host);
       if (!hasCSRFHeader && !hasValidReferer) {
-        const isAllowedReferer = securityOptions.allowedReferers?.some(
-          (allowedRef) => referer?.includes(allowedRef)
+        const isAllowedReferrer = securityOptions.allowedReferers?.some(
+          (allowedRef) => referrer?.includes(allowedRef)
         );
-        if (!isAllowedReferer) {
+        if (!isAllowedReferrer) {
           return (0, import_responses.createApiErrorResponse)("CSRF_PROTECTION", "Access denied", 403);
         }
       }
@@ -109,7 +96,7 @@ function createValidators(context) {
   function validateRequiredHeaders(securityOptions) {
     if (securityOptions.requiredHeaders) {
       for (const [headerName, expectedValue] of Object.entries(securityOptions.requiredHeaders)) {
-        const actualValue = request.headers.get(headerName);
+        const actualValue = context.request.headers.get(headerName);
         if (actualValue !== expectedValue) {
           return (0, import_responses.createApiErrorResponse)(
             "INVALID_HEADERS",
@@ -124,7 +111,7 @@ function createValidators(context) {
   function validateUserAgent(securityOptions) {
     if (securityOptions.userAgent?.block?.length) {
       const isBlocked = securityOptions.userAgent.block.some(
-        (blocked) => userAgent.toLowerCase().includes(blocked.toLowerCase())
+        (blocked) => context.request.headers.get("user-agent")?.toLowerCase().includes(blocked.toLowerCase())
       );
       if (isBlocked) {
         return (0, import_responses.createApiErrorResponse)("USER_AGENT_BLOCKED", "Access denied", 403);
@@ -132,7 +119,7 @@ function createValidators(context) {
     }
     if (securityOptions.userAgent?.allow?.length) {
       const isAllowed = securityOptions.userAgent.allow.some(
-        (allowed) => userAgent.toLowerCase().includes(allowed.toLowerCase())
+        (allowed) => request.headers.get("user-agent")?.toLowerCase().includes(allowed.toLowerCase())
       );
       if (!isAllowed) {
         return (0, import_responses.createApiErrorResponse)("USER_AGENT_NOT_ALLOWED", "Access denied", 403);
@@ -290,7 +277,6 @@ function createValidators(context) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  createRequestContext,
   createValidators
 });
 //# sourceMappingURL=fnValidators.js.map

package/dist/cjs/app-router/admin/fnValidators.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/app-router/admin/fnValidators.ts"],"sourcesContent":["import { cookies } from 'next/headers';\n\nimport { createApiErrorResponse } from './responses';\nimport type {\n  AuthEndpoint,\n  ComprehensiveValidationResult,\n  CorsOptions,\n  EndpointConfig,\n  SecurityOptions,\n  SessionSubEndpoint,\n  ValidationConfig,\n} from './types';\n//import type { RequestProcessorContext } from './claude-authenticateRequestProcessor';\n\nexport interface RequestContext {\n  request: Request;\n  origin: string | null;\n  host: string | null;\n  referer: string | null;\n  userAgent: string;\n  method: string;\n  pathSegments: string[];\n}\n\nexport function createRequestContext(request: Request): RequestContext {\n  const url = new URL(request.url);\n  const pathSegments = url.pathname.split('/').filter(Boolean);\n\n  return {\n    request,\n    origin: request.headers.get('origin'),\n    host: request.headers.get('host'),\n    referer: request.headers.get('referer'),\n    userAgent: request.headers.get('user-agent') || '',\n    method: request.method,\n    pathSegments,\n  };\n}\n\n/**\n * Main validators factory function\n * Returns an object containing all validator functions and utilities\n */\nexport function createValidators(context: RequestContext) {\n  const { request, origin, host, referer, userAgent, method, pathSegments } = context;\n\n  async function validateCors(corsOptions: CorsOptions): Promise<Response | null> {\n    if (corsOptions.skipSameOrigin) {\n      if (!origin || (host && origin.includes(host))) {\n        return null;\n      }\n    }\n\n    if (corsOptions.allowedOrigins !== '*') {\n      const isAllowed = corsOptions.allowedOrigins.some(allowedOrigin => {\n        if (allowedOrigin.startsWith('*')) {\n          const domain = allowedOrigin.slice(1);\n          return origin?.endsWith(domain);\n        }\n        return origin === allowedOrigin;\n      });\n\n      if (!isAllowed) {\n        return createApiErrorResponse('CORS_ORIGIN_NOT_ALLOWED', 'Origin not allowed', 403);\n      }\n    }\n\n    return null;\n  }\n\n  function createCorsOptionsResponse(corsOptions: CorsOptions): Response {\n    const response = new Response(null, { status: 204 });\n\n    if (corsOptions.allowedOrigins === '*') {\n      response.headers.set('Access-Control-Allow-Origin', '*');\n    } else {\n      response.headers.set('Access-Control-Allow-Origin', corsOptions.allowedOrigins.join(','));\n    }\n\n    response.headers.set(\n      'Access-Control-Allow-Methods',\n      corsOptions.allowedMethods?.join(',') || 'GET,POST',\n    );\n    response.headers.set(\n      'Access-Control-Allow-Headers',\n      corsOptions.allowedHeaders?.join(',') || 'Content-Type,Authorization',\n    );\n\n    if (corsOptions.allowCredentials) {\n      response.headers.set('Access-Control-Allow-Credentials', 'true');\n    }\n\n    if (corsOptions.maxAge) {\n      response.headers.set('Access-Control-Max-Age', corsOptions.maxAge.toString());\n    }\n\n    return response;\n  }\n\n  async function validateSecurity(securityOptions: SecurityOptions): Promise<Response | null> {\n    const csrfResult = validateCsrf(securityOptions);\n    if (csrfResult) return csrfResult;\n\n    const headersResult = validateRequiredHeaders(securityOptions);\n    if (headersResult) return headersResult;\n\n    const userAgentResult = validateUserAgent(securityOptions);\n    if (userAgentResult) return userAgentResult;\n\n    return null;\n  }\n\n  function validateCsrf(securityOptions: SecurityOptions): Response | null {\n    if (securityOptions.requireCSRF && origin && host && !origin.includes(host)) {\n      const hasCSRFHeader = request.headers.get('x-requested-with') === 'XMLHttpRequest';\n      const hasValidReferer = referer && host && referer.includes(host);\n\n      if (!hasCSRFHeader && !hasValidReferer) {\n        const isAllowedReferer = securityOptions.allowedReferers?.some((allowedRef: string) =>\n          referer?.includes(allowedRef),\n        );\n\n        if (!isAllowedReferer) {\n          return createApiErrorResponse('CSRF_PROTECTION', 'Access denied', 403);\n        }\n      }\n    }\n    return null;\n  }\n\n  function validateRequiredHeaders(securityOptions: SecurityOptions): Response | null {\n    if (securityOptions.requiredHeaders) {\n      for (const [headerName, expectedValue] of Object.entries(securityOptions.requiredHeaders)) {\n        const actualValue = request.headers.get(headerName);\n        if (actualValue !== expectedValue) {\n          return createApiErrorResponse(\n            'INVALID_HEADERS',\n            'Required header missing or invalid',\n            400,\n          );\n        }\n      }\n    }\n    return null;\n  }\n\n  function validateUserAgent(securityOptions: SecurityOptions): Response | null {\n    if (securityOptions.userAgent?.block?.length) {\n      const isBlocked = securityOptions.userAgent.block.some((blocked: string) =>\n        userAgent.toLowerCase().includes(blocked.toLowerCase()),\n      );\n\n      if (isBlocked) {\n        return createApiErrorResponse('USER_AGENT_BLOCKED', 'Access denied', 403);\n      }\n    }\n\n    if (securityOptions.userAgent?.allow?.length) {\n      const isAllowed = securityOptions.userAgent.allow.some((allowed: string) =>\n        userAgent.toLowerCase().includes(allowed.toLowerCase()),\n      );\n\n      if (!isAllowed) {\n        return createApiErrorResponse('USER_AGENT_NOT_ALLOWED', 'Access denied', 403);\n      }\n    }\n\n    return null;\n  }\n\n  function validateCsrfToken(\n    csrfToken: string,\n    csrfCookieValue: string | undefined,\n  ): Response | null {\n    if (!csrfToken) {\n      return createApiErrorResponse('INVALID_CSRF_TOKEN', 'CSRF token is required', 400);\n    }\n\n    if (!csrfCookieValue) {\n      return createApiErrorResponse('CSRF_COOKIE_MISSING', 'CSRF token cookie not found', 403);\n    }\n\n    if (csrfToken !== csrfCookieValue) {\n      return createApiErrorResponse('CSRF_TOKEN_MISMATCH', 'CSRF token mismatch', 403);\n    }\n\n    return null;\n  }\n\n  function validatePathStructure(): Response | null {\n    if (pathSegments.length < 3) {\n      return createApiErrorResponse(\n        'INVALID_ROUTE',\n        'Invalid route structure. Expected: /api/auth/{endpoint}',\n        404,\n      );\n    }\n    return null;\n  }\n\n  function validateEndpoint(\n    _endpoint: AuthEndpoint,\n    endpointConfig: EndpointConfig,\n  ): Response | null {\n    if (!endpointConfig || !endpointConfig.enabled) {\n      return createApiErrorResponse('ENDPOINT_NOT_FOUND', 'Endpoint not found', 404);\n    }\n\n    if (method !== 'OPTIONS' && !endpointConfig.methods.includes(method as any)) {\n      return createApiErrorResponse('METHOD_NOT_ALLOWED', 'Method not allowed', 405);\n    }\n\n    return null;\n  }\n\n  function validateSubEndpoint(\n    subEndpoint: SessionSubEndpoint | undefined,\n    subEndpointConfig: any,\n  ): Response | null {\n    if (!subEndpoint) {\n      return createApiErrorResponse('SUB_ENDPOINT_REQUIRED', 'Session sub-endpoint required', 400);\n    }\n\n    if (!subEndpointConfig || !subEndpointConfig.enabled) {\n      return createApiErrorResponse('ENDPOINT_NOT_FOUND', 'Endpoint not found', 404);\n    }\n\n    if (!subEndpointConfig.methods?.includes(method as any)) {\n      return createApiErrorResponse('METHOD_NOT_ALLOWED', 'Method not allowed', 405);\n    }\n\n    return null;\n  }\n\n  async function validateSessionRequest(): Promise<{\n    body: any;\n    idToken?: string;\n    csrfToken?: string;\n    error?: Response;\n  }> {\n    try {\n      const body = await request.json();\n      return { body, idToken: body.idToken, csrfToken: body.csrfToken };\n    } catch (error) {\n      return {\n        body: null,\n        error: createApiErrorResponse('INVALID_REQUEST_FORMAT', 'Invalid request format', 400),\n      };\n    }\n  }\n\n  function validateIdToken(idToken: string | undefined): Response | null {\n    if (!idToken) {\n      return createApiErrorResponse(\n        'INVALID_TOKEN',\n        'ID token is required for creating session',\n        400,\n      );\n    }\n    return null;\n  }\n\n  /**\n   * Main validation orchestrator function\n   * Runs all configured validations in the correct order\n   */\n  async function validateRequest(config: ValidationConfig): Promise<ComprehensiveValidationResult> {\n    if (method === 'OPTIONS' && config.cors) {\n      return {\n        isValid: true,\n        corsResponse: createCorsOptionsResponse(config.cors),\n      };\n    }\n    const pathError = validatePathStructure();\n    if (pathError) {\n      return { isValid: false, error: pathError };\n    }\n\n    if (config.cors) {\n      const corsError = await validateCors(config.cors);\n      if (corsError) {\n        return { isValid: false, error: corsError };\n      }\n    }\n\n    if (config.security) {\n      const securityError = await validateSecurity(config.security);\n      if (securityError) {\n        return { isValid: false, error: securityError };\n      }\n    }\n\n    if (config.endpoint) {\n      const endpointError = validateEndpoint(config.endpoint.name, config.endpoint.config);\n      if (endpointError) {\n        return { isValid: false, error: endpointError };\n      }\n    }\n\n    if (config.subEndpoint) {\n      const subEndpointError = validateSubEndpoint(\n        config.subEndpoint.name,\n        config.subEndpoint.config,\n      );\n      if (subEndpointError) {\n        return { isValid: false, error: subEndpointError };\n      }\n    }\n\n    let sessionData;\n    if (method === 'POST' && (config.requireIdToken || config.requireCsrfToken)) {\n      const sessionResult = await validateSessionRequest();\n      if (sessionResult.error) {\n        return { isValid: false, error: sessionResult.error };\n      }\n\n      sessionData = sessionResult;\n\n      if (config.requireIdToken) {\n        const idTokenError = validateIdToken(sessionData.idToken);\n        if (idTokenError) {\n          return { isValid: false, error: idTokenError };\n        }\n      }\n\n      if (config.requireCsrfToken && sessionData.csrfToken) {\n        const cookieStore = await cookies();\n        const csrfCookieValue = cookieStore.get('csrfToken')?.value;\n        const csrfError = validateCsrfToken(sessionData.csrfToken, csrfCookieValue);\n        if (csrfError) {\n          return { isValid: false, error: csrfError };\n        }\n      }\n    }\n\n    return {\n      isValid: true,\n      sessionData,\n    };\n  }\n\n  /**\n   * Convenience function for quick validation setup\n   */\n  function createValidationConfig(overrides: Partial<ValidationConfig> = {}): ValidationConfig {\n    return {\n      ...overrides,\n    };\n  }\n\n  return {\n    createValidationConfig,\n\n    validateRequest,\n\n    validateCors,\n    validateSecurity,\n    validatePathStructure,\n    validateEndpoint,\n    validateSubEndpoint,\n    validateSessionRequest,\n    validateIdToken,\n    validateCsrfToken,\n\n    createCorsOptionsResponse,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAAwB;AAExB,uBAAuC;AAsBhC,SAAS,qBAAqB,SAAkC;AACrE,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAM,eAAe,IAAI,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AAE3D,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,QAAQ,QAAQ,IAAI,QAAQ;AAAA,IACpC,MAAM,QAAQ,QAAQ,IAAI,MAAM;AAAA,IAChC,SAAS,QAAQ,QAAQ,IAAI,SAAS;AAAA,IACtC,WAAW,QAAQ,QAAQ,IAAI,YAAY,KAAK;AAAA,IAChD,QAAQ,QAAQ;AAAA,IAChB;AAAA,EACF;AACF;AAMO,SAAS,iBAAiB,SAAyB;AACxD,QAAM,EAAE,SAAS,QAAQ,MAAM,SAAS,WAAW,QAAQ,aAAa,IAAI;AAE5E,iBAAe,aAAa,aAAoD;AAC9E,QAAI,YAAY,gBAAgB;AAC9B,UAAI,CAAC,UAAW,QAAQ,OAAO,SAAS,IAAI,GAAI;AAC9C,eAAO;AAAA,MACT;AAAA,IACF;AAEA,QAAI,YAAY,mBAAmB,KAAK;AACtC,YAAM,YAAY,YAAY,eAAe,KAAK,mBAAiB;AACjE,YAAI,cAAc,WAAW,GAAG,GAAG;AACjC,gBAAM,SAAS,cAAc,MAAM,CAAC;AACpC,iBAAO,QAAQ,SAAS,MAAM;AAAA,QAChC;AACA,eAAO,WAAW;AAAA,MACpB,CAAC;AAED,UAAI,CAAC,WAAW;AACd,mBAAO,yCAAuB,2BAA2B,sBAAsB,GAAG;AAAA,MACpF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,0BAA0B,aAAoC;AACrE,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAEnD,QAAI,YAAY,mBAAmB,KAAK;AACtC,eAAS,QAAQ,IAAI,+BAA+B,GAAG;AAAA,IACzD,OAAO;AACL,eAAS,QAAQ,IAAI,+BAA+B,YAAY,eAAe,KAAK,GAAG,CAAC;AAAA,IAC1F;AAEA,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,YAAY,gBAAgB,KAAK,GAAG,KAAK;AAAA,IAC3C;AACA,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,YAAY,gBAAgB,KAAK,GAAG,KAAK;AAAA,IAC3C;AAEA,QAAI,YAAY,kBAAkB;AAChC,eAAS,QAAQ,IAAI,oCAAoC,MAAM;AAAA,IACjE;AAEA,QAAI,YAAY,QAAQ;AACtB,eAAS,QAAQ,IAAI,0BAA0B,YAAY,OAAO,SAAS,CAAC;AAAA,IAC9E;AAEA,WAAO;AAAA,EACT;AAEA,iBAAe,iBAAiB,iBAA4D;AAC1F,UAAM,aAAa,aAAa,eAAe;AAC/C,QAAI,WAAY,QAAO;AAEvB,UAAM,gBAAgB,wBAAwB,eAAe;AAC7D,QAAI,cAAe,QAAO;AAE1B,UAAM,kBAAkB,kBAAkB,eAAe;AACzD,QAAI,gBAAiB,QAAO;AAE5B,WAAO;AAAA,EACT;AAEA,WAAS,aAAa,iBAAmD;AACvE,QAAI,gBAAgB,eAAe,UAAU,QAAQ,CAAC,OAAO,SAAS,IAAI,GAAG;AAC3E,YAAM,gBAAgB,QAAQ,QAAQ,IAAI,kBAAkB,MAAM;AAClE,YAAM,kBAAkB,WAAW,QAAQ,QAAQ,SAAS,IAAI;AAEhE,UAAI,CAAC,iBAAiB,CAAC,iBAAiB;AACtC,cAAM,mBAAmB,gBAAgB,iBAAiB;AAAA,UAAK,CAAC,eAC9D,SAAS,SAAS,UAAU;AAAA,QAC9B;AAEA,YAAI,CAAC,kBAAkB;AACrB,qBAAO,yCAAuB,mBAAmB,iBAAiB,GAAG;AAAA,QACvE;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,WAAS,wBAAwB,iBAAmD;AAClF,QAAI,gBAAgB,iBAAiB;AACnC,iBAAW,CAAC,YAAY,aAAa,KAAK,OAAO,QAAQ,gBAAgB,eAAe,GAAG;AACzF,cAAM,cAAc,QAAQ,QAAQ,IAAI,UAAU;AAClD,YAAI,gBAAgB,eAAe;AACjC,qBAAO;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,WAAS,kBAAkB,iBAAmD;AAC5E,QAAI,gBAAgB,WAAW,OAAO,QAAQ;AAC5C,YAAM,YAAY,gBAAgB,UAAU,MAAM;AAAA,QAAK,CAAC,YACtD,UAAU,YAAY,EAAE,SAAS,QAAQ,YAAY,CAAC;AAAA,MACxD;AAEA,UAAI,WAAW;AACb,mBAAO,yCAAuB,sBAAsB,iBAAiB,GAAG;AAAA,MAC1E;AAAA,IACF;AAEA,QAAI,gBAAgB,WAAW,OAAO,QAAQ;AAC5C,YAAM,YAAY,gBAAgB,UAAU,MAAM;AAAA,QAAK,CAAC,YACtD,UAAU,YAAY,EAAE,SAAS,QAAQ,YAAY,CAAC;AAAA,MACxD;AAEA,UAAI,CAAC,WAAW;AACd,mBAAO,yCAAuB,0BAA0B,iBAAiB,GAAG;AAAA,MAC9E;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,kBACP,WACA,iBACiB;AACjB,QAAI,CAAC,WAAW;AACd,iBAAO,yCAAuB,sBAAsB,0BAA0B,GAAG;AAAA,IACnF;AAEA,QAAI,CAAC,iBAAiB;AACpB,iBAAO,yCAAuB,uBAAuB,+BAA+B,GAAG;AAAA,IACzF;AAEA,QAAI,cAAc,iBAAiB;AACjC,iBAAO,yCAAuB,uBAAuB,uBAAuB,GAAG;AAAA,IACjF;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,wBAAyC;AAChD,QAAI,aAAa,SAAS,GAAG;AAC3B,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,WAAS,iBACP,WACA,gBACiB;AACjB,QAAI,CAAC,kBAAkB,CAAC,eAAe,SAAS;AAC9C,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,QAAI,WAAW,aAAa,CAAC,eAAe,QAAQ,SAAS,MAAa,GAAG;AAC3E,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,oBACP,aACA,mBACiB;AACjB,QAAI,CAAC,aAAa;AAChB,iBAAO,yCAAuB,yBAAyB,iCAAiC,GAAG;AAAA,IAC7F;AAEA,QAAI,CAAC,qBAAqB,CAAC,kBAAkB,SAAS;AACpD,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,QAAI,CAAC,kBAAkB,SAAS,SAAS,MAAa,GAAG;AACvD,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,WAAO;AAAA,EACT;AAEA,iBAAe,yBAKZ;AACD,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,aAAO,EAAE,MAAM,SAAS,KAAK,SAAS,WAAW,KAAK,UAAU;AAAA,IAClE,SAAS,OAAO;AACd,aAAO;AAAA,QACL,MAAM;AAAA,QACN,WAAO,yCAAuB,0BAA0B,0BAA0B,GAAG;AAAA,MACvF;AAAA,IACF;AAAA,EACF;AAEA,WAAS,gBAAgB,SAA8C;AACrE,QAAI,CAAC,SAAS;AACZ,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAMA,iBAAe,gBAAgB,QAAkE;AAC/F,QAAI,WAAW,aAAa,OAAO,MAAM;AACvC,aAAO;AAAA,QACL,SAAS;AAAA,QACT,cAAc,0BAA0B,OAAO,IAAI;AAAA,MACrD;AAAA,IACF;AACA,UAAM,YAAY,sBAAsB;AACxC,QAAI,WAAW;AACb,aAAO,EAAE,SAAS,OAAO,OAAO,UAAU;AAAA,IAC5C;AAEA,QAAI,OAAO,MAAM;AACf,YAAM,YAAY,MAAM,aAAa,OAAO,IAAI;AAChD,UAAI,WAAW;AACb,eAAO,EAAE,SAAS,OAAO,OAAO,UAAU;AAAA,MAC5C;AAAA,IACF;AAEA,QAAI,OAAO,UAAU;AACnB,YAAM,gBAAgB,MAAM,iBAAiB,OAAO,QAAQ;AAC5D,UAAI,eAAe;AACjB,eAAO,EAAE,SAAS,OAAO,OAAO,cAAc;AAAA,MAChD;AAAA,IACF;AAEA,QAAI,OAAO,UAAU;AACnB,YAAM,gBAAgB,iBAAiB,OAAO,SAAS,MAAM,OAAO,SAAS,MAAM;AACnF,UAAI,eAAe;AACjB,eAAO,EAAE,SAAS,OAAO,OAAO,cAAc;AAAA,MAChD;AAAA,IACF;AAEA,QAAI,OAAO,aAAa;AACtB,YAAM,mBAAmB;AAAA,QACvB,OAAO,YAAY;AAAA,QACnB,OAAO,YAAY;AAAA,MACrB;AACA,UAAI,kBAAkB;AACpB,eAAO,EAAE,SAAS,OAAO,OAAO,iBAAiB;AAAA,MACnD;AAAA,IACF;AAEA,QAAI;AACJ,QAAI,WAAW,WAAW,OAAO,kBAAkB,OAAO,mBAAmB;AAC3E,YAAM,gBAAgB,MAAM,uBAAuB;AACnD,UAAI,cAAc,OAAO;AACvB,eAAO,EAAE,SAAS,OAAO,OAAO,cAAc,MAAM;AAAA,MACtD;AAEA,oBAAc;AAEd,UAAI,OAAO,gBAAgB;AACzB,cAAM,eAAe,gBAAgB,YAAY,OAAO;AACxD,YAAI,cAAc;AAChB,iBAAO,EAAE,SAAS,OAAO,OAAO,aAAa;AAAA,QAC/C;AAAA,MACF;AAEA,UAAI,OAAO,oBAAoB,YAAY,WAAW;AACpD,cAAM,cAAc,UAAM,wBAAQ;AAClC,cAAM,kBAAkB,YAAY,IAAI,WAAW,GAAG;AACtD,cAAM,YAAY,kBAAkB,YAAY,WAAW,eAAe;AAC1E,YAAI,WAAW;AACb,iBAAO,EAAE,SAAS,OAAO,OAAO,UAAU;AAAA,QAC5C;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAKA,WAAS,uBAAuB,YAAuC,CAAC,GAAqB;AAC3F,WAAO;AAAA,MACL,GAAG;AAAA,IACL;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IAEA;AAAA,IAEA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IAEA;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/app-router/admin/fnValidators.ts"],"sourcesContent":["import { cookies } from 'next/headers';\n\nimport type { RequestProcessorContext } from './c-authenticateRequestProcessor';\nimport { createApiErrorResponse } from './responses';\nimport type {\n  AuthEndpoint,\n  ComprehensiveValidationResult,\n  CorsOptions,\n  EndpointConfig,\n  SecurityOptions,\n  SessionSubEndpoint,\n  ValidationConfig,\n} from './types';\n\n/**\n * Main validators factory function\n * Returns an object containing all validator functions and utilities\n */\nexport function createValidators(context: RequestProcessorContext) {\n  const { origin, host, referrer, userAgent, method, pathSegments } = context;\n  const request = context.request;\n\n  async function validateCors(corsOptions: CorsOptions): Promise<Response | null> {\n    if (corsOptions.skipSameOrigin) {\n      if (!origin || (host && origin.includes(host))) {\n        return null;\n      }\n    }\n\n    if (corsOptions.allowedOrigins !== '*') {\n      const isAllowed = corsOptions.allowedOrigins.some(allowedOrigin => {\n        if (allowedOrigin.startsWith('*')) {\n          const domain = allowedOrigin.slice(1);\n          return origin?.endsWith(domain);\n        }\n        return origin === allowedOrigin;\n      });\n\n      if (!isAllowed) {\n        return createApiErrorResponse('CORS_ORIGIN_NOT_ALLOWED', 'Origin not allowed', 403);\n      }\n    }\n\n    return null;\n  }\n\n  function createCorsOptionsResponse(corsOptions: CorsOptions): Response {\n    const response = new Response(null, { status: 204 });\n\n    if (corsOptions.allowedOrigins === '*') {\n      response.headers.set('Access-Control-Allow-Origin', '*');\n    } else {\n      response.headers.set('Access-Control-Allow-Origin', corsOptions.allowedOrigins.join(','));\n    }\n\n    response.headers.set(\n      'Access-Control-Allow-Methods',\n      corsOptions.allowedMethods?.join(',') || 'GET,POST',\n    );\n    response.headers.set(\n      'Access-Control-Allow-Headers',\n      corsOptions.allowedHeaders?.join(',') || 'Content-Type,Authorization',\n    );\n\n    if (corsOptions.allowCredentials) {\n      response.headers.set('Access-Control-Allow-Credentials', 'true');\n    }\n\n    if (corsOptions.maxAge) {\n      response.headers.set('Access-Control-Max-Age', corsOptions.maxAge.toString());\n    }\n\n    return response;\n  }\n\n  async function validateSecurity(securityOptions: SecurityOptions): Promise<Response | null> {\n    const csrfResult = validateCsrf(securityOptions);\n    if (csrfResult) return csrfResult;\n\n    const headersResult = validateRequiredHeaders(securityOptions);\n    if (headersResult) return headersResult;\n\n    const userAgentResult = validateUserAgent(securityOptions);\n    if (userAgentResult) return userAgentResult;\n\n    return null;\n  }\n\n  function validateCsrf(securityOptions: SecurityOptions): Response | null {\n    if (securityOptions.requireCSRF && origin && host && !origin.includes(host)) {\n      const hasCSRFHeader = context.request.headers.get('x-requested-with') === 'XMLHttpRequest';\n      const hasValidReferer = referrer && host && referrer.includes(host);\n\n      if (!hasCSRFHeader && !hasValidReferer) {\n        const isAllowedReferrer = securityOptions.allowedReferers?.some((allowedRef: string) =>\n          referrer?.includes(allowedRef),\n        );\n\n        if (!isAllowedReferrer) {\n          return createApiErrorResponse('CSRF_PROTECTION', 'Access denied', 403);\n        }\n      }\n    }\n    return null;\n  }\n\n  function validateRequiredHeaders(securityOptions: SecurityOptions): Response | null {\n    if (securityOptions.requiredHeaders) {\n      for (const [headerName, expectedValue] of Object.entries(securityOptions.requiredHeaders)) {\n        const actualValue = context.request.headers.get(headerName);\n        if (actualValue !== expectedValue) {\n          return createApiErrorResponse(\n            'INVALID_HEADERS',\n            'Required header missing or invalid',\n            400,\n          );\n        }\n      }\n    }\n    return null;\n  }\n\n  function validateUserAgent(securityOptions: SecurityOptions): Response | null {\n    if (securityOptions.userAgent?.block?.length) {\n      const isBlocked = securityOptions.userAgent.block.some((blocked: string) =>\n        context.request.headers.get('user-agent')?.toLowerCase().includes(blocked.toLowerCase()),\n      );\n\n      if (isBlocked) {\n        return createApiErrorResponse('USER_AGENT_BLOCKED', 'Access denied', 403);\n      }\n    }\n\n    if (securityOptions.userAgent?.allow?.length) {\n      const isAllowed = securityOptions.userAgent.allow.some((allowed: string) =>\n        request.headers.get('user-agent')?.toLowerCase().includes(allowed.toLowerCase()),\n      );\n\n      if (!isAllowed) {\n        return createApiErrorResponse('USER_AGENT_NOT_ALLOWED', 'Access denied', 403);\n      }\n    }\n\n    return null;\n  }\n\n  function validateCsrfToken(\n    csrfToken: string,\n    csrfCookieValue: string | undefined,\n  ): Response | null {\n    if (!csrfToken) {\n      return createApiErrorResponse('INVALID_CSRF_TOKEN', 'CSRF token is required', 400);\n    }\n\n    if (!csrfCookieValue) {\n      return createApiErrorResponse('CSRF_COOKIE_MISSING', 'CSRF token cookie not found', 403);\n    }\n\n    if (csrfToken !== csrfCookieValue) {\n      return createApiErrorResponse('CSRF_TOKEN_MISMATCH', 'CSRF token mismatch', 403);\n    }\n\n    return null;\n  }\n\n  function validatePathStructure(): Response | null {\n    if (pathSegments.length < 3) {\n      return createApiErrorResponse(\n        'INVALID_ROUTE',\n        'Invalid route structure. Expected: /api/auth/{endpoint}',\n        404,\n      );\n    }\n    return null;\n  }\n\n  function validateEndpoint(\n    _endpoint: AuthEndpoint,\n    endpointConfig: EndpointConfig,\n  ): Response | null {\n    if (!endpointConfig || !endpointConfig.enabled) {\n      return createApiErrorResponse('ENDPOINT_NOT_FOUND', 'Endpoint not found', 404);\n    }\n\n    if (method !== 'OPTIONS' && !endpointConfig.methods.includes(method as any)) {\n      return createApiErrorResponse('METHOD_NOT_ALLOWED', 'Method not allowed', 405);\n    }\n\n    return null;\n  }\n\n  function validateSubEndpoint(\n    subEndpoint: SessionSubEndpoint | undefined,\n    subEndpointConfig: any,\n  ): Response | null {\n    if (!subEndpoint) {\n      return createApiErrorResponse('SUB_ENDPOINT_REQUIRED', 'Session sub-endpoint required', 400);\n    }\n\n    if (!subEndpointConfig || !subEndpointConfig.enabled) {\n      return createApiErrorResponse('ENDPOINT_NOT_FOUND', 'Endpoint not found', 404);\n    }\n\n    if (!subEndpointConfig.methods?.includes(method as any)) {\n      return createApiErrorResponse('METHOD_NOT_ALLOWED', 'Method not allowed', 405);\n    }\n\n    return null;\n  }\n\n  async function validateSessionRequest(): Promise<{\n    body: any;\n    idToken?: string;\n    csrfToken?: string;\n    error?: Response;\n  }> {\n    try {\n      const body = await request.json();\n      return { body, idToken: body.idToken, csrfToken: body.csrfToken };\n    } catch (error) {\n      return {\n        body: null,\n        error: createApiErrorResponse('INVALID_REQUEST_FORMAT', 'Invalid request format', 400),\n      };\n    }\n  }\n\n  function validateIdToken(idToken: string | undefined): Response | null {\n    if (!idToken) {\n      return createApiErrorResponse(\n        'INVALID_TOKEN',\n        'ID token is required for creating session',\n        400,\n      );\n    }\n    return null;\n  }\n\n  /**\n   * Main validation orchestrator function\n   * Runs all configured validations in the correct order\n   */\n  async function validateRequest(config: ValidationConfig): Promise<ComprehensiveValidationResult> {\n    if (method === 'OPTIONS' && config.cors) {\n      return {\n        isValid: true,\n        corsResponse: createCorsOptionsResponse(config.cors),\n      };\n    }\n    const pathError = validatePathStructure();\n    if (pathError) {\n      return { isValid: false, error: pathError };\n    }\n\n    if (config.cors) {\n      const corsError = await validateCors(config.cors);\n      if (corsError) {\n        return { isValid: false, error: corsError };\n      }\n    }\n\n    if (config.security) {\n      const securityError = await validateSecurity(config.security);\n      if (securityError) {\n        return { isValid: false, error: securityError };\n      }\n    }\n\n    if (config.endpoint) {\n      const endpointError = validateEndpoint(config.endpoint.name, config.endpoint.config);\n      if (endpointError) {\n        return { isValid: false, error: endpointError };\n      }\n    }\n\n    if (config.subEndpoint) {\n      const subEndpointError = validateSubEndpoint(\n        config.subEndpoint.name,\n        config.subEndpoint.config,\n      );\n      if (subEndpointError) {\n        return { isValid: false, error: subEndpointError };\n      }\n    }\n\n    let sessionData;\n    if (method === 'POST' && (config.requireIdToken || config.requireCsrfToken)) {\n      const sessionResult = await validateSessionRequest();\n      if (sessionResult.error) {\n        return { isValid: false, error: sessionResult.error };\n      }\n\n      sessionData = sessionResult;\n\n      if (config.requireIdToken) {\n        const idTokenError = validateIdToken(sessionData.idToken);\n        if (idTokenError) {\n          return { isValid: false, error: idTokenError };\n        }\n      }\n\n      if (config.requireCsrfToken && sessionData.csrfToken) {\n        const cookieStore = await cookies();\n        const csrfCookieValue = cookieStore.get('csrfToken')?.value;\n        const csrfError = validateCsrfToken(sessionData.csrfToken, csrfCookieValue);\n        if (csrfError) {\n          return { isValid: false, error: csrfError };\n        }\n      }\n    }\n\n    return {\n      isValid: true,\n      sessionData,\n    };\n  }\n\n  /**\n   * Convenience function for quick validation setup\n   */\n  function createValidationConfig(overrides: Partial<ValidationConfig> = {}): ValidationConfig {\n    return {\n      ...overrides,\n    };\n  }\n\n  return {\n    createValidationConfig,\n\n    validateRequest,\n\n    validateCors,\n    validateSecurity,\n    validatePathStructure,\n    validateEndpoint,\n    validateSubEndpoint,\n    validateSessionRequest,\n    validateIdToken,\n    validateCsrfToken,\n\n    createCorsOptionsResponse,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAAwB;AAGxB,uBAAuC;AAehC,SAAS,iBAAiB,SAAkC;AACjE,QAAM,EAAE,QAAQ,MAAM,UAAU,WAAW,QAAQ,aAAa,IAAI;AACpE,QAAM,UAAU,QAAQ;AAExB,iBAAe,aAAa,aAAoD;AAC9E,QAAI,YAAY,gBAAgB;AAC9B,UAAI,CAAC,UAAW,QAAQ,OAAO,SAAS,IAAI,GAAI;AAC9C,eAAO;AAAA,MACT;AAAA,IACF;AAEA,QAAI,YAAY,mBAAmB,KAAK;AACtC,YAAM,YAAY,YAAY,eAAe,KAAK,mBAAiB;AACjE,YAAI,cAAc,WAAW,GAAG,GAAG;AACjC,gBAAM,SAAS,cAAc,MAAM,CAAC;AACpC,iBAAO,QAAQ,SAAS,MAAM;AAAA,QAChC;AACA,eAAO,WAAW;AAAA,MACpB,CAAC;AAED,UAAI,CAAC,WAAW;AACd,mBAAO,yCAAuB,2BAA2B,sBAAsB,GAAG;AAAA,MACpF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,0BAA0B,aAAoC;AACrE,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAEnD,QAAI,YAAY,mBAAmB,KAAK;AACtC,eAAS,QAAQ,IAAI,+BAA+B,GAAG;AAAA,IACzD,OAAO;AACL,eAAS,QAAQ,IAAI,+BAA+B,YAAY,eAAe,KAAK,GAAG,CAAC;AAAA,IAC1F;AAEA,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,YAAY,gBAAgB,KAAK,GAAG,KAAK;AAAA,IAC3C;AACA,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,YAAY,gBAAgB,KAAK,GAAG,KAAK;AAAA,IAC3C;AAEA,QAAI,YAAY,kBAAkB;AAChC,eAAS,QAAQ,IAAI,oCAAoC,MAAM;AAAA,IACjE;AAEA,QAAI,YAAY,QAAQ;AACtB,eAAS,QAAQ,IAAI,0BAA0B,YAAY,OAAO,SAAS,CAAC;AAAA,IAC9E;AAEA,WAAO;AAAA,EACT;AAEA,iBAAe,iBAAiB,iBAA4D;AAC1F,UAAM,aAAa,aAAa,eAAe;AAC/C,QAAI,WAAY,QAAO;AAEvB,UAAM,gBAAgB,wBAAwB,eAAe;AAC7D,QAAI,cAAe,QAAO;AAE1B,UAAM,kBAAkB,kBAAkB,eAAe;AACzD,QAAI,gBAAiB,QAAO;AAE5B,WAAO;AAAA,EACT;AAEA,WAAS,aAAa,iBAAmD;AACvE,QAAI,gBAAgB,eAAe,UAAU,QAAQ,CAAC,OAAO,SAAS,IAAI,GAAG;AAC3E,YAAM,gBAAgB,QAAQ,QAAQ,QAAQ,IAAI,kBAAkB,MAAM;AAC1E,YAAM,kBAAkB,YAAY,QAAQ,SAAS,SAAS,IAAI;AAElE,UAAI,CAAC,iBAAiB,CAAC,iBAAiB;AACtC,cAAM,oBAAoB,gBAAgB,iBAAiB;AAAA,UAAK,CAAC,eAC/D,UAAU,SAAS,UAAU;AAAA,QAC/B;AAEA,YAAI,CAAC,mBAAmB;AACtB,qBAAO,yCAAuB,mBAAmB,iBAAiB,GAAG;AAAA,QACvE;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,WAAS,wBAAwB,iBAAmD;AAClF,QAAI,gBAAgB,iBAAiB;AACnC,iBAAW,CAAC,YAAY,aAAa,KAAK,OAAO,QAAQ,gBAAgB,eAAe,GAAG;AACzF,cAAM,cAAc,QAAQ,QAAQ,QAAQ,IAAI,UAAU;AAC1D,YAAI,gBAAgB,eAAe;AACjC,qBAAO;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,WAAS,kBAAkB,iBAAmD;AAC5E,QAAI,gBAAgB,WAAW,OAAO,QAAQ;AAC5C,YAAM,YAAY,gBAAgB,UAAU,MAAM;AAAA,QAAK,CAAC,YACtD,QAAQ,QAAQ,QAAQ,IAAI,YAAY,GAAG,YAAY,EAAE,SAAS,QAAQ,YAAY,CAAC;AAAA,MACzF;AAEA,UAAI,WAAW;AACb,mBAAO,yCAAuB,sBAAsB,iBAAiB,GAAG;AAAA,MAC1E;AAAA,IACF;AAEA,QAAI,gBAAgB,WAAW,OAAO,QAAQ;AAC5C,YAAM,YAAY,gBAAgB,UAAU,MAAM;AAAA,QAAK,CAAC,YACtD,QAAQ,QAAQ,IAAI,YAAY,GAAG,YAAY,EAAE,SAAS,QAAQ,YAAY,CAAC;AAAA,MACjF;AAEA,UAAI,CAAC,WAAW;AACd,mBAAO,yCAAuB,0BAA0B,iBAAiB,GAAG;AAAA,MAC9E;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,kBACP,WACA,iBACiB;AACjB,QAAI,CAAC,WAAW;AACd,iBAAO,yCAAuB,sBAAsB,0BAA0B,GAAG;AAAA,IACnF;AAEA,QAAI,CAAC,iBAAiB;AACpB,iBAAO,yCAAuB,uBAAuB,+BAA+B,GAAG;AAAA,IACzF;AAEA,QAAI,cAAc,iBAAiB;AACjC,iBAAO,yCAAuB,uBAAuB,uBAAuB,GAAG;AAAA,IACjF;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,wBAAyC;AAChD,QAAI,aAAa,SAAS,GAAG;AAC3B,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,WAAS,iBACP,WACA,gBACiB;AACjB,QAAI,CAAC,kBAAkB,CAAC,eAAe,SAAS;AAC9C,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,QAAI,WAAW,aAAa,CAAC,eAAe,QAAQ,SAAS,MAAa,GAAG;AAC3E,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,oBACP,aACA,mBACiB;AACjB,QAAI,CAAC,aAAa;AAChB,iBAAO,yCAAuB,yBAAyB,iCAAiC,GAAG;AAAA,IAC7F;AAEA,QAAI,CAAC,qBAAqB,CAAC,kBAAkB,SAAS;AACpD,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,QAAI,CAAC,kBAAkB,SAAS,SAAS,MAAa,GAAG;AACvD,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,WAAO;AAAA,EACT;AAEA,iBAAe,yBAKZ;AACD,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,aAAO,EAAE,MAAM,SAAS,KAAK,SAAS,WAAW,KAAK,UAAU;AAAA,IAClE,SAAS,OAAO;AACd,aAAO;AAAA,QACL,MAAM;AAAA,QACN,WAAO,yCAAuB,0BAA0B,0BAA0B,GAAG;AAAA,MACvF;AAAA,IACF;AAAA,EACF;AAEA,WAAS,gBAAgB,SAA8C;AACrE,QAAI,CAAC,SAAS;AACZ,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAMA,iBAAe,gBAAgB,QAAkE;AAC/F,QAAI,WAAW,aAAa,OAAO,MAAM;AACvC,aAAO;AAAA,QACL,SAAS;AAAA,QACT,cAAc,0BAA0B,OAAO,IAAI;AAAA,MACrD;AAAA,IACF;AACA,UAAM,YAAY,sBAAsB;AACxC,QAAI,WAAW;AACb,aAAO,EAAE,SAAS,OAAO,OAAO,UAAU;AAAA,IAC5C;AAEA,QAAI,OAAO,MAAM;AACf,YAAM,YAAY,MAAM,aAAa,OAAO,IAAI;AAChD,UAAI,WAAW;AACb,eAAO,EAAE,SAAS,OAAO,OAAO,UAAU;AAAA,MAC5C;AAAA,IACF;AAEA,QAAI,OAAO,UAAU;AACnB,YAAM,gBAAgB,MAAM,iBAAiB,OAAO,QAAQ;AAC5D,UAAI,eAAe;AACjB,eAAO,EAAE,SAAS,OAAO,OAAO,cAAc;AAAA,MAChD;AAAA,IACF;AAEA,QAAI,OAAO,UAAU;AACnB,YAAM,gBAAgB,iBAAiB,OAAO,SAAS,MAAM,OAAO,SAAS,MAAM;AACnF,UAAI,eAAe;AACjB,eAAO,EAAE,SAAS,OAAO,OAAO,cAAc;AAAA,MAChD;AAAA,IACF;AAEA,QAAI,OAAO,aAAa;AACtB,YAAM,mBAAmB;AAAA,QACvB,OAAO,YAAY;AAAA,QACnB,OAAO,YAAY;AAAA,MACrB;AACA,UAAI,kBAAkB;AACpB,eAAO,EAAE,SAAS,OAAO,OAAO,iBAAiB;AAAA,MACnD;AAAA,IACF;AAEA,QAAI;AACJ,QAAI,WAAW,WAAW,OAAO,kBAAkB,OAAO,mBAAmB;AAC3E,YAAM,gBAAgB,MAAM,uBAAuB;AACnD,UAAI,cAAc,OAAO;AACvB,eAAO,EAAE,SAAS,OAAO,OAAO,cAAc,MAAM;AAAA,MACtD;AAEA,oBAAc;AAEd,UAAI,OAAO,gBAAgB;AACzB,cAAM,eAAe,gBAAgB,YAAY,OAAO;AACxD,YAAI,cAAc;AAChB,iBAAO,EAAE,SAAS,OAAO,OAAO,aAAa;AAAA,QAC/C;AAAA,MACF;AAEA,UAAI,OAAO,oBAAoB,YAAY,WAAW;AACpD,cAAM,cAAc,UAAM,wBAAQ;AAClC,cAAM,kBAAkB,YAAY,IAAI,WAAW,GAAG;AACtD,cAAM,YAAY,kBAAkB,YAAY,WAAW,eAAe;AAC1E,YAAI,WAAW;AACb,iBAAO,EAAE,SAAS,OAAO,OAAO,UAAU;AAAA,QAC5C;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAKA,WAAS,uBAAuB,YAAuC,CAAC,GAAqB;AAC3F,WAAO;AAAA,MACL,GAAG;AAAA,IACL;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IAEA;AAAA,IAEA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IAEA;AAAA,EACF;AACF;","names":[]}

package/dist/cjs/app-router/admin/index.js

@@ -19,8 +19,6 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var admin_exports = {};
 __export(admin_exports, {
   EndpointRouter: () => import_endpointRouter.EndpointRouter,
-  RequestContextBuilder: () => import_handlerUtils.RequestContextBuilder,
-  ValidationPipeline: () => import_handlerUtils.ValidationPipeline,
   clearNextSessionCookie: () => import_actions.clearNextSessionCookie,
   clearSessionCookieServer: () => import_actions.clearSessionCookieServer,
   createNextSessionCookie: () => import_actions.createNextSessionCookie,
@@ -33,12 +31,9 @@ module.exports = __toCommonJS(admin_exports);
 var import_ternsecureNextjsHandler = require("./ternsecureNextjsHandler");
 var import_actions = require("./actions");
 var import_endpointRouter = require("./endpointRouter");
-var import_handlerUtils = require("./handlerUtils");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   EndpointRouter,
-  RequestContextBuilder,
-  ValidationPipeline,
   clearNextSessionCookie,
   clearSessionCookieServer,
   createNextSessionCookie,

package/dist/cjs/app-router/admin/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/app-router/admin/index.ts"],"sourcesContent":["export { createTernSecureNextJsHandler } from './ternsecureNextjsHandler'\n\nexport {\n    clearSessionCookieServer,\n    clearNextSessionCookie,\n    createSessionCookieServer,\n    createNextSessionCookie,\n    setNextServerSession,\n    setNextServerToken\n} from './actions'\n\nexport { EndpointRouter } from './endpointRouter'\nexport { RequestContextBuilder, ValidationPipeline } from './handlerUtils'\nexport type { HandlerContext } from './handlerUtils'\n\nexport type { TernSecureHandlerOptions, TernSecureInternalHandlerConfig } from './types'"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qCAA8C;AAE9C,qBAOO;AAEP,4BAA+B;AAC/B,0BAA0D;","names":[]}
+{"version":3,"sources":["../../../../src/app-router/admin/index.ts"],"sourcesContent":["export { createTernSecureNextJsHandler } from './ternsecureNextjsHandler'\n\nexport {\n    clearSessionCookieServer,\n    clearNextSessionCookie,\n    createSessionCookieServer,\n    createNextSessionCookie,\n    setNextServerSession,\n    setNextServerToken\n} from './actions'\n\nexport { EndpointRouter } from './endpointRouter'\n\nexport type { TernSecureHandlerOptions } from './types'"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qCAA8C;AAE9C,qBAOO;AAEP,4BAA+B;","names":[]}

package/dist/cjs/app-router/admin/sessionHandlers.js

@@ -1,9 +1,7 @@
 "use strict";
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -17,153 +15,115 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var sessionHandlers_exports = {};
 __export(sessionHandlers_exports, {
-  SessionEndpointHandler: () => SessionEndpointHandler,
-  SessionGetHandler: () => SessionGetHandler,
-  SessionPostHandler: () => SessionPostHandler
+  sessionEndpointHandler: () => sessionEndpointHandler
 });
 module.exports = __toCommonJS(sessionHandlers_exports);
 var import_admin = require("@tern-secure/backend/admin");
 var import_jwt = require("@tern-secure/backend/jwt");
 var import_headers = require("next/headers");
 var import_NextCookieAdapter = require("../../utils/NextCookieAdapter");
+var import_fnValidators = require("./fnValidators");
 var import_responses = require("./responses");
-var import_validators = require("./validators");
-class SessionGetHandler {
-  static async handle(subEndpoint, _config) {
-    switch (subEndpoint) {
-      case "verify":
-        return this.handleVerify();
-      default:
-        return import_responses.HttpResponseHelper.createNotFoundResponse();
-    }
+async function sessionEndpointHandler(context, options) {
+  const { subEndpoint, method } = context;
+  const validators = (0, import_fnValidators.createValidators)(context);
+  const {
+    validateSubEndpoint,
+    validateSecurity,
+    validateSessionRequest,
+    validateCsrfToken,
+    validateIdToken
+  } = validators;
+  if (!subEndpoint) {
+    return (0, import_responses.createApiErrorResponse)("SUB_ENDPOINT_REQUIRED", "Session sub-endpoint required", 400);
   }
-  static async handleVerify() {
-    try {
-      const cookieStore = await (0, import_headers.cookies)();
-      const sessionCookie = cookieStore.get("_session_cookie")?.value;
-      if (!sessionCookie) {
-        return import_responses.SessionResponseHelper.createUnauthorizedResponse();
-      }
-      const { data: decodedSession, errors } = (0, import_jwt.ternDecodeJwtUnguarded)(sessionCookie);
-      if (errors) {
+  const sessionsConfig = options.endpoints?.sessions;
+  const subEndpointConfig = sessionsConfig?.subEndpoints?.[subEndpoint];
+  validateSubEndpoint(subEndpoint, subEndpointConfig);
+  if (subEndpointConfig?.security) {
+    await validateSecurity(subEndpointConfig.security);
+  }
+  const SessionGetHandler = async (subEndpoint2) => {
+    const handleSessionVerify = async () => {
+      try {
+        const cookieStore = await (0, import_headers.cookies)();
+        const sessionCookie = cookieStore.get("_session_cookie")?.value;
+        if (!sessionCookie) {
+          return import_responses.SessionResponseHelper.createUnauthorizedResponse();
+        }
+        const { data: decodedSession, errors } = (0, import_jwt.ternDecodeJwtUnguarded)(sessionCookie);
+        if (errors) {
+          return import_responses.SessionResponseHelper.createUnauthorizedResponse();
+        }
+        return import_responses.SessionResponseHelper.createVerificationResponse(decodedSession);
+      } catch (error) {
         return import_responses.SessionResponseHelper.createUnauthorizedResponse();
       }
-      return import_responses.SessionResponseHelper.createVerificationResponse(decodedSession);
-    } catch (error) {
-      return import_responses.SessionResponseHelper.createUnauthorizedResponse();
+    };
+    switch (subEndpoint2) {
+      case "verify":
+        return handleSessionVerify();
+      default:
+        return import_responses.HttpResponseHelper.createNotFoundResponse();
     }
-  }
-}
-class SessionPostHandler {
-  static async handle(request, subEndpoint, _config) {
+  };
+  const SessionPostHandler = async (subEndpoint2) => {
     const cookieStore = new import_NextCookieAdapter.NextCookieStore();
-    const { idToken, csrfToken, error } = await import_validators.RequestValidator.validateSessionRequest(request);
+    const { idToken, csrfToken, error } = await validateSessionRequest();
     if (error) return error;
     const csrfCookieValue = await cookieStore.get("_session_terncf");
-    const csrfValidationError = import_validators.CsrfValidator.validate(csrfToken || "", csrfCookieValue.value);
-    if (csrfValidationError) return csrfValidationError;
-    const options = {
-      tenantId: _config.tenantId
+    validateCsrfToken(csrfToken || "", csrfCookieValue.value);
+    const handleCreateSession = async (cookieStore2, idToken2) => {
+      try {
+        const res = await (0, import_admin.createSessionCookie)(idToken2, cookieStore2, options);
+        return import_responses.SessionResponseHelper.createSessionCreationResponse(res);
+      } catch (error2) {
+        return (0, import_responses.createApiErrorResponse)("SESSION_CREATION_FAILED", "Session creation failed", 500);
+      }
     };
-    switch (subEndpoint) {
-      case "createsession":
-        return this.handleCreateSession(options, idToken, cookieStore);
+    const handleRefreshSession = async (cookieStore2, idToken2) => {
+      try {
+        const decodedSession = (0, import_jwt.ternDecodeJwtUnguarded)(idToken2);
+        if (decodedSession.errors) {
+          return (0, import_responses.createApiErrorResponse)("INVALID_SESSION", "Invalid session for refresh", 401);
+        }
+        const refreshRes = await (0, import_admin.createSessionCookie)(idToken2, cookieStore2, options);
+        return import_responses.SessionResponseHelper.createRefreshResponse(refreshRes);
+      } catch (error2) {
+        return (0, import_responses.createApiErrorResponse)("REFRESH_FAILED", "Session refresh failed", 500);
+      }
+    };
+    const handleRevokeSession = async (cookieStore2) => {
+      const res = await (0, import_admin.clearSessionCookie)(cookieStore2);
+      return import_responses.SessionResponseHelper.createRevokeResponse(res);
+    };
+    switch (subEndpoint2) {
+      case "createsession": {
+        validateIdToken(idToken);
+        return handleCreateSession(cookieStore, idToken);
+      }
       case "refresh":
-        return this.handleRefreshSession(cookieStore);
+        return handleRefreshSession(cookieStore, idToken);
       case "revoke":
-        return this.handleRevokeSession(cookieStore);
+        return handleRevokeSession(cookieStore);
       default:
         return import_responses.HttpResponseHelper.createSubEndpointNotSupportedResponse();
     }
-  }
-  static async handleCreateSession(options, idToken, cookieStore) {
-    const validationError = import_validators.RequestValidator.validateIdToken(idToken);
-    if (validationError) return validationError;
-    if (!idToken) {
-      return (0, import_responses.createApiErrorResponse)("ID_TOKEN_REQUIRED", "ID token is required", 400);
-    }
-    try {
-      const res = await (0, import_admin.createSessionCookie)(idToken, cookieStore, options);
-      return import_responses.SessionResponseHelper.createSessionCreationResponse(res);
-    } catch (error) {
-      return (0, import_responses.createApiErrorResponse)("SESSION_CREATION_FAILED", "Session creation failed", 500);
-    }
-  }
-  static async handleRefreshSession(cookieStore) {
-    const currentSessionCookie = await cookieStore.get("__session");
-    if (!currentSessionCookie) {
-      return (0, import_responses.createApiErrorResponse)("NO_SESSION", "No session to refresh", 401);
-    }
-    try {
-      const decodedSession = (0, import_jwt.ternDecodeJwtUnguarded)(currentSessionCookie.value || "");
-      if (decodedSession.errors) {
-        return (0, import_responses.createApiErrorResponse)("INVALID_SESSION", "Invalid session for refresh", 401);
-      }
-      const refreshRes = await (0, import_admin.createSessionCookie)(
-        decodedSession.data?.payload?.sub || "",
-        cookieStore
-      );
-      return import_responses.SessionResponseHelper.createRefreshResponse(refreshRes);
-    } catch (error) {
-      return (0, import_responses.createApiErrorResponse)("REFRESH_FAILED", "Session refresh failed", 500);
-    }
-  }
-  static async handleRevokeSession(cookieStore) {
-    const res = await (0, import_admin.clearSessionCookie)(cookieStore);
-    return import_responses.SessionResponseHelper.createRevokeResponse(res);
-  }
-}
-class SessionEndpointHandler {
-  static async handle(request, method, subEndpoint, config) {
-    const sessionsConfig = config.endpoints.sessions;
-    if (!subEndpoint) {
-      return (0, import_responses.createApiErrorResponse)("SUB_ENDPOINT_REQUIRED", "Session sub-endpoint required", 400);
-    }
-    const subEndpointConfig = sessionsConfig?.subEndpoints?.[subEndpoint];
-    const subEndpointValidation = this.validateSubEndpoint(subEndpoint, subEndpointConfig, method);
-    if (subEndpointValidation) return subEndpointValidation;
-    if (subEndpointConfig?.security) {
-      const { SecurityValidator } = await import("./validators.js");
-      const securityResult = await SecurityValidator.validate(request, subEndpointConfig.security);
-      if (securityResult) return securityResult;
-    }
-    switch (method) {
-      case "GET":
-        return SessionGetHandler.handle(subEndpoint, config);
-      case "POST":
-        return SessionPostHandler.handle(request, subEndpoint, config);
-      default:
-        return import_responses.HttpResponseHelper.createMethodNotAllowedResponse();
-    }
-  }
-  static validateSubEndpoint(subEndpoint, subEndpointConfig, method) {
-    if (!subEndpoint) {
-      return (0, import_responses.createApiErrorResponse)("SUB_ENDPOINT_REQUIRED", "Session sub-endpoint required", 400);
-    }
-    if (!subEndpointConfig || !subEndpointConfig.enabled) {
-      return (0, import_responses.createApiErrorResponse)("ENDPOINT_NOT_FOUND", "Endpoint not found", 404);
-    }
-    if (!subEndpointConfig.methods?.includes(method)) {
-      return (0, import_responses.createApiErrorResponse)("METHOD_NOT_ALLOWED", "Method not allowed", 405);
-    }
-    return null;
+  };
+  switch (method) {
+    case "GET":
+      return SessionGetHandler(subEndpoint);
+    case "POST":
+      return SessionPostHandler(subEndpoint);
+    default:
+      return import_responses.HttpResponseHelper.createMethodNotAllowedResponse();
   }
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  SessionEndpointHandler,
-  SessionGetHandler,
-  SessionPostHandler
+  sessionEndpointHandler
 });
 //# sourceMappingURL=sessionHandlers.js.map