@tern-secure/nextjs 5.2.0-canary.v20250919134427 → 5.2.0-canary.v20251002175916

package/dist/cjs/app-router/admin/api/endpoints/abstract.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../src/app-router/admin/api/endpoints/abstract.ts"],"sourcesContent":["import type {\n  AuthEndpoint,\n  SessionSubEndpoint,\n  TernSecureInternalHandlerConfig,\n} from '../../types';\n\nexport interface HandlerContext {\n  request: Request;\n  pathSegments: string[];\n  endpoint: AuthEndpoint;\n  subEndpoint: SessionSubEndpoint | undefined;\n  method: string;\n}\n\nexport interface EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean;\n  handle(\n    handlerContext: HandlerContext,\n    config: TernSecureInternalHandlerConfig,\n  ): Promise<Response>;\n}\n\nexport abstract class BaseEndpointHandler implements EndpointHandler {\n  abstract canHandle(endpoint: AuthEndpoint): boolean;\n  abstract handle(\n    handlerContext: HandlerContext,\n    config: TernSecureInternalHandlerConfig,\n  ): Promise<Response>;\n\n  protected validateMethod(allowedMethods: string[], method: string): boolean {\n    return allowedMethods.includes(method);\n  }\n\n  protected validateSubEndpoint(\n    subEndpoint: SessionSubEndpoint | undefined,\n    requiredSubEndpoint?: boolean,\n  ): boolean {\n    if (requiredSubEndpoint) {\n      return subEndpoint !== undefined;\n    }\n    return true;\n  }\n}"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAsBO,MAAe,oBAA+C;AAAA,EAOzD,eAAe,gBAA0B,QAAyB;AAC1E,WAAO,eAAe,SAAS,MAAM;AAAA,EACvC;AAAA,EAEU,oBACR,aACA,qBACS;AACT,QAAI,qBAAqB;AACvB,aAAO,gBAAgB;AAAA,IACzB;AACA,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../../../../../../src/app-router/admin/api/endpoints/abstract.ts"],"sourcesContent":["import type { RequestProcessorContext } from '../../c-authenticateRequestProcessor';\nimport type {\n  AuthEndpoint,\n  SessionSubEndpoint,\n  TernSecureHandlerOptions,\n} from '../../types';\n\nexport interface HandlerContext {\n  request: Request;\n  pathSegments: string[];\n  endpoint: AuthEndpoint;\n  subEndpoint: SessionSubEndpoint;\n  method: string;\n  requestProcessorContext: RequestProcessorContext;\n}\n\nexport interface EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean;\n  handle(\n    context: RequestProcessorContext,\n    config: TernSecureHandlerOptions,\n  ): Promise<Response>;\n}\n\nexport abstract class BaseEndpointHandler implements EndpointHandler {\n  abstract canHandle(endpoint: AuthEndpoint): boolean;\n  abstract handle(\n    context: RequestProcessorContext,\n    config: TernSecureHandlerOptions,\n  ): Promise<Response>;\n\n  protected validateMethod(allowedMethods: string[], method: string): boolean {\n    return allowedMethods.includes(method);\n  }\n\n  protected validateSubEndpoint(\n    subEndpoint: SessionSubEndpoint | undefined,\n    requiredSubEndpoint?: boolean,\n  ): boolean {\n    if (requiredSubEndpoint) {\n      return subEndpoint !== undefined;\n    }\n    return true;\n  }\n}"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAwBO,MAAe,oBAA+C;AAAA,EAOzD,eAAe,gBAA0B,QAAyB;AAC1E,WAAO,eAAe,SAAS,MAAM;AAAA,EACvC;AAAA,EAEU,oBACR,aACA,qBACS;AACT,QAAI,qBAAqB;AACvB,aAAO,gBAAgB;AAAA,IACzB;AACA,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/cjs/app-router/admin/{claude-authenticateRequestProcessor.js → c-authenticateRequestProcessor.js}

@@ -16,11 +16,11 @@ var __copyProps = (to, from, except, desc) => {
   return to;
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var claude_authenticateRequestProcessor_exports = {};
-__export(claude_authenticateRequestProcessor_exports, {
+var c_authenticateRequestProcessor_exports = {};
+__export(c_authenticateRequestProcessor_exports, {
   createRequestProcessor: () => createRequestProcessor
 });
-module.exports = __toCommonJS(claude_authenticateRequestProcessor_exports);
+module.exports = __toCommonJS(c_authenticateRequestProcessor_exports);
 var import_backend = require("@tern-secure/backend");
 class RequestProcessorContext {
   constructor(ternSecureRequest, options) {
@@ -28,8 +28,13 @@ class RequestProcessorContext {
     this.options = options;
     this.initHeaderValues();
     this.initCookieValues();
+    this.initUrlValues();
+    Object.assign(this, options);
     this.ternUrl = this.ternSecureRequest.ternUrl;
   }
+  get request() {
+    return this.ternSecureRequest;
+  }
   initHeaderValues() {
     this.sessionTokenInHeader = this.parseAuthorizationHeader(
       this.getHeader(import_backend.constants.Headers.Authorization)
@@ -44,10 +49,19 @@ class RequestProcessorContext {
     this.accept = this.getHeader(import_backend.constants.Headers.Accept);
   }
   initCookieValues() {
+    const isProduction = process.env.NODE_ENV === "production";
+    const defaultPrefix = isProduction ? "__HOST-" : "__dev_";
+    this.sessionTokenInCookie = this.getCookie(import_backend.constants.Cookies.Session);
+    this.idTokenInCookie = this.getCookie(`${defaultPrefix}${import_backend.constants.Cookies.IdToken}`);
+    this.refreshTokenInCookie = this.getCookie(`${defaultPrefix}${import_backend.constants.Cookies.Refresh}`);
     this.csrfTokenInCookie = this.getCookie(import_backend.constants.Cookies.CsrfToken);
+    this.customTokenInCookie = this.getCookie(import_backend.constants.Cookies.Custom);
   }
-  getQueryParam(name) {
-    return this.ternSecureRequest.ternUrl.searchParams.get(name);
+  initUrlValues() {
+    this.method = this.ternSecureRequest.method;
+    this.pathSegments = this.ternSecureRequest.ternUrl.pathname.split("/").filter(Boolean);
+    this.endpoint = this.pathSegments[2];
+    this.subEndpoint = this.pathSegments[3];
   }
   getHeader(name) {
     return this.ternSecureRequest.headers.get(name) || void 0;
@@ -69,11 +83,11 @@ class RequestProcessorContext {
     return void 0;
   }
 }
-const createRequestProcessor = async (ternSecureRequest, options) => {
+const createRequestProcessor = (ternSecureRequest, options) => {
   return new RequestProcessorContext(ternSecureRequest, options);
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   createRequestProcessor
 });
-//# sourceMappingURL=claude-authenticateRequestProcessor.js.map
+//# sourceMappingURL=c-authenticateRequestProcessor.js.map

package/dist/cjs/app-router/admin/c-authenticateRequestProcessor.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/app-router/admin/c-authenticateRequestProcessor.ts"],"sourcesContent":["import type { TernSecureRequest } from '@tern-secure/backend';\nimport { constants } from '@tern-secure/backend';\n\nimport type { AuthEndpoint, SessionSubEndpoint, TernSecureHandlerOptions } from './types';\n\n/**\n * Request context for better type safety and clarity\n */\ninterface RequestProcessorContext extends TernSecureHandlerOptions {\n  // header-based values\n  sessionTokenInHeader: string | undefined;\n  origin: string | undefined;\n  host: string | undefined;\n  forwardedHost: string | undefined;\n  forwardedProto: string | undefined;\n  referrer: string | undefined;\n  userAgent: string | undefined;\n  secFetchDest: string | undefined;\n  accept: string | undefined;\n\n  // cookie-based values\n  idTokenInCookie: string | undefined;\n  refreshTokenInCookie: string | undefined;\n  csrfTokenInCookie: string | undefined;\n  sessionTokenInCookie?: string | undefined;\n  customTokenInCookie?: string | undefined;\n\n  method: string;\n  pathSegments: string[];\n  endpoint?: AuthEndpoint;\n  subEndpoint?: SessionSubEndpoint;\n\n  ternUrl: URL;\n  instanceType: string;\n}\n\n/**\n * Request processor utility class for common operations\n */\nclass RequestProcessorContext implements RequestProcessorContext {\n  public constructor(\n    private ternSecureRequest: TernSecureRequest,\n    private options: TernSecureHandlerOptions,\n  ) {\n    this.initHeaderValues();\n    this.initCookieValues();\n    this.initUrlValues();\n    Object.assign(this, options);\n    this.ternUrl = this.ternSecureRequest.ternUrl;\n  }\n\n  public get request(): TernSecureRequest {\n    return this.ternSecureRequest;\n  }\n\n  private initHeaderValues() {\n    this.sessionTokenInHeader = this.parseAuthorizationHeader(\n      this.getHeader(constants.Headers.Authorization),\n    );\n    this.origin = this.getHeader(constants.Headers.Origin);\n    this.host = this.getHeader(constants.Headers.Host);\n    this.forwardedHost = this.getHeader(constants.Headers.ForwardedHost);\n    this.forwardedProto =\n      this.getHeader(constants.Headers.CloudFrontForwardedProto) ||\n      this.getHeader(constants.Headers.ForwardedProto);\n    this.referrer = this.getHeader(constants.Headers.Referrer);\n    this.userAgent = this.getHeader(constants.Headers.UserAgent);\n    this.secFetchDest = this.getHeader(constants.Headers.SecFetchDest);\n    this.accept = this.getHeader(constants.Headers.Accept);\n  }\n\n  private initCookieValues() {\n    const isProduction = process.env.NODE_ENV === 'production';\n    const defaultPrefix = isProduction ? '__HOST-' : '__dev_';\n    this.sessionTokenInCookie = this.getCookie(constants.Cookies.Session);\n\n    // System-fixed cookies using backend constants\n    this.idTokenInCookie = this.getCookie(`${defaultPrefix}${constants.Cookies.IdToken}`);\n    this.refreshTokenInCookie = this.getCookie(`${defaultPrefix}${constants.Cookies.Refresh}`);\n    this.csrfTokenInCookie = this.getCookie(constants.Cookies.CsrfToken);\n    this.customTokenInCookie = this.getCookie(constants.Cookies.Custom);\n  }\n\n  private initUrlValues() {\n    this.method = this.ternSecureRequest.method;\n    this.pathSegments = this.ternSecureRequest.ternUrl.pathname.split('/').filter(Boolean);\n    this.endpoint = this.pathSegments[2] as AuthEndpoint;\n    this.subEndpoint = this.pathSegments[3] as SessionSubEndpoint;\n  }\n\n  private getHeader(name: string) {\n    return this.ternSecureRequest.headers.get(name) || undefined;\n  }\n\n  private getCookie(name: string) {\n    return this.ternSecureRequest.cookies.get(name) || undefined;\n  }\n\n  private parseAuthorizationHeader(\n    authorizationHeader: string | undefined | null,\n  ): string | undefined {\n    if (!authorizationHeader) {\n      return undefined;\n    }\n\n    const [scheme, token] = authorizationHeader.split(' ', 2);\n\n    if (!token) {\n      // No scheme specified, treat the entire value as the token\n      return scheme;\n    }\n\n    if (scheme === 'Bearer') {\n      return token;\n    }\n\n    // Skip all other schemes\n    return undefined;\n  }\n}\n\nexport type { RequestProcessorContext };\n\nexport const createRequestProcessor = (\n  ternSecureRequest: TernSecureRequest,\n  options: TernSecureHandlerOptions,\n): RequestProcessorContext => {\n  return new RequestProcessorContext(ternSecureRequest, options);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,qBAA0B;AAsC1B,MAAM,wBAA2D;AAAA,EACxD,YACG,mBACA,SACR;AAFQ;AACA;AAER,SAAK,iBAAiB;AACtB,SAAK,iBAAiB;AACtB,SAAK,cAAc;AACnB,WAAO,OAAO,MAAM,OAAO;AAC3B,SAAK,UAAU,KAAK,kBAAkB;AAAA,EACxC;AAAA,EAEA,IAAW,UAA6B;AACtC,WAAO,KAAK;AAAA,EACd;AAAA,EAEQ,mBAAmB;AACzB,SAAK,uBAAuB,KAAK;AAAA,MAC/B,KAAK,UAAU,yBAAU,QAAQ,aAAa;AAAA,IAChD;AACA,SAAK,SAAS,KAAK,UAAU,yBAAU,QAAQ,MAAM;AACrD,SAAK,OAAO,KAAK,UAAU,yBAAU,QAAQ,IAAI;AACjD,SAAK,gBAAgB,KAAK,UAAU,yBAAU,QAAQ,aAAa;AACnE,SAAK,iBACH,KAAK,UAAU,yBAAU,QAAQ,wBAAwB,KACzD,KAAK,UAAU,yBAAU,QAAQ,cAAc;AACjD,SAAK,WAAW,KAAK,UAAU,yBAAU,QAAQ,QAAQ;AACzD,SAAK,YAAY,KAAK,UAAU,yBAAU,QAAQ,SAAS;AAC3D,SAAK,eAAe,KAAK,UAAU,yBAAU,QAAQ,YAAY;AACjE,SAAK,SAAS,KAAK,UAAU,yBAAU,QAAQ,MAAM;AAAA,EACvD;AAAA,EAEQ,mBAAmB;AACzB,UAAM,eAAe,QAAQ,IAAI,aAAa;AAC9C,UAAM,gBAAgB,eAAe,YAAY;AACjD,SAAK,uBAAuB,KAAK,UAAU,yBAAU,QAAQ,OAAO;AAGpE,SAAK,kBAAkB,KAAK,UAAU,GAAG,aAAa,GAAG,yBAAU,QAAQ,OAAO,EAAE;AACpF,SAAK,uBAAuB,KAAK,UAAU,GAAG,aAAa,GAAG,yBAAU,QAAQ,OAAO,EAAE;AACzF,SAAK,oBAAoB,KAAK,UAAU,yBAAU,QAAQ,SAAS;AACnE,SAAK,sBAAsB,KAAK,UAAU,yBAAU,QAAQ,MAAM;AAAA,EACpE;AAAA,EAEQ,gBAAgB;AACtB,SAAK,SAAS,KAAK,kBAAkB;AACrC,SAAK,eAAe,KAAK,kBAAkB,QAAQ,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AACrF,SAAK,WAAW,KAAK,aAAa,CAAC;AACnC,SAAK,cAAc,KAAK,aAAa,CAAC;AAAA,EACxC;AAAA,EAEQ,UAAU,MAAc;AAC9B,WAAO,KAAK,kBAAkB,QAAQ,IAAI,IAAI,KAAK;AAAA,EACrD;AAAA,EAEQ,UAAU,MAAc;AAC9B,WAAO,KAAK,kBAAkB,QAAQ,IAAI,IAAI,KAAK;AAAA,EACrD;AAAA,EAEQ,yBACN,qBACoB;AACpB,QAAI,CAAC,qBAAqB;AACxB,aAAO;AAAA,IACT;AAEA,UAAM,CAAC,QAAQ,KAAK,IAAI,oBAAoB,MAAM,KAAK,CAAC;AAExD,QAAI,CAAC,OAAO;AAEV,aAAO;AAAA,IACT;AAEA,QAAI,WAAW,UAAU;AACvB,aAAO;AAAA,IACT;AAGA,WAAO;AAAA,EACT;AACF;AAIO,MAAM,yBAAyB,CACpC,mBACA,YAC4B;AAC5B,SAAO,IAAI,wBAAwB,mBAAmB,OAAO;AAC/D;","names":[]}

package/dist/cjs/app-router/admin/constants.js

@@ -18,12 +18,30 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var constants_exports = {};
 __export(constants_exports, {
+  FIREBASE_API_KEY: () => FIREBASE_API_KEY,
+  FIREBASE_APP_ID: () => FIREBASE_APP_ID,
+  FIREBASE_AUTH_DOMAIN: () => FIREBASE_AUTH_DOMAIN,
+  FIREBASE_MESSAGING_SENDER_ID: () => FIREBASE_MESSAGING_SENDER_ID,
+  FIREBASE_PROJECT_ID: () => FIREBASE_PROJECT_ID,
+  FIREBASE_STORAGE_BUCKET: () => FIREBASE_STORAGE_BUCKET,
   TENANT_ID: () => TENANT_ID
 });
 module.exports = __toCommonJS(constants_exports);
 const TENANT_ID = process.env.NEXT_PUBLIC_FIREBASE_TENANT_ID || "";
+const FIREBASE_API_KEY = process.env.NEXT_PUBLIC_FIREBASE_API_KEY || "";
+const FIREBASE_AUTH_DOMAIN = process.env.NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN || "";
+const FIREBASE_PROJECT_ID = process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID || "";
+const FIREBASE_STORAGE_BUCKET = process.env.NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET || "";
+const FIREBASE_MESSAGING_SENDER_ID = process.env.NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID || "";
+const FIREBASE_APP_ID = process.env.NEXT_PUBLIC_FIREBASE_APP_ID || "";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  FIREBASE_API_KEY,
+  FIREBASE_APP_ID,
+  FIREBASE_AUTH_DOMAIN,
+  FIREBASE_MESSAGING_SENDER_ID,
+  FIREBASE_PROJECT_ID,
+  FIREBASE_STORAGE_BUCKET,
   TENANT_ID
 });
 //# sourceMappingURL=constants.js.map

package/dist/cjs/app-router/admin/constants.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/app-router/admin/constants.ts"],"sourcesContent":["export const TENANT_ID = process.env.NEXT_PUBLIC_FIREBASE_TENANT_ID || '';"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAO,MAAM,YAAY,QAAQ,IAAI,kCAAkC;","names":[]}
+{"version":3,"sources":["../../../../src/app-router/admin/constants.ts"],"sourcesContent":["export const TENANT_ID = process.env.NEXT_PUBLIC_FIREBASE_TENANT_ID || '';\nexport const FIREBASE_API_KEY = process.env.NEXT_PUBLIC_FIREBASE_API_KEY || '';\nexport const FIREBASE_AUTH_DOMAIN = process.env.NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN || '';\nexport const FIREBASE_PROJECT_ID = process.env.NEXT_PUBLIC_FIREBASE_PROJECT_ID || '';\nexport const FIREBASE_STORAGE_BUCKET = process.env.NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET || '';\nexport const FIREBASE_MESSAGING_SENDER_ID = process.env.NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID || '';\nexport const FIREBASE_APP_ID = process.env.NEXT_PUBLIC_FIREBASE_APP_ID || '';"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAO,MAAM,YAAY,QAAQ,IAAI,kCAAkC;AAChE,MAAM,mBAAmB,QAAQ,IAAI,gCAAgC;AACrE,MAAM,uBAAuB,QAAQ,IAAI,oCAAoC;AAC7E,MAAM,sBAAsB,QAAQ,IAAI,mCAAmC;AAC3E,MAAM,0BAA0B,QAAQ,IAAI,uCAAuC;AACnF,MAAM,+BAA+B,QAAQ,IAAI,4CAA4C;AAC7F,MAAM,kBAAkB,QAAQ,IAAI,+BAA+B;","names":[]}

package/dist/cjs/app-router/admin/endpointRouter.js

@@ -27,33 +27,32 @@ class SessionsHandler {
   canHandle(endpoint) {
     return endpoint === "sessions";
   }
-  async handle(handlerContext, config) {
-    const { request, subEndpoint, method } = handlerContext;
-    return await import_sessionHandlers.SessionEndpointHandler.handle(request, method, subEndpoint, config);
+  async handle(context, config) {
+    return await (0, import_sessionHandlers.sessionEndpointHandler)(context, config);
   }
 }
 class UsersHandler {
   canHandle(endpoint) {
     return endpoint === "users";
   }
-  handle(_handlerContext, _config) {
+  handle(_context, _config) {
     return Promise.resolve(
       (0, import_responses.createApiErrorResponse)("ENDPOINT_NOT_IMPLEMENTED", "Users endpoint not implemented", 501)
     );
   }
 }
 class EndpointRouter {
-  static handlers = [
-    new SessionsHandler(),
-    new UsersHandler()
-  ];
-  static async route(handlerContext, config) {
-    const { endpoint } = handlerContext;
+  static handlers = [new SessionsHandler(), new UsersHandler()];
+  static async route(context, config) {
+    const { endpoint } = context;
+    if (!endpoint) {
+      return (0, import_responses.createApiErrorResponse)("ENDPOINT_REQUIRED", "Endpoint is required", 400);
+    }
     const handler = this.handlers.find((h) => h.canHandle(endpoint));
     if (!handler) {
       return (0, import_responses.createApiErrorResponse)("ENDPOINT_NOT_FOUND", "Endpoint not found", 404);
     }
-    return handler.handle(handlerContext, config);
+    return handler.handle(context, config);
   }
   static addHandler(handler) {
     this.handlers.push(handler);

package/dist/cjs/app-router/admin/endpointRouter.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/app-router/admin/endpointRouter.ts"],"sourcesContent":["import type { EndpointHandler} from './api/endpoints/abstract';\nimport type { HandlerContext } from './handlerUtils';\nimport { createApiErrorResponse } from './responses';\nimport { SessionEndpointHandler } from './sessionHandlers';\nimport type { AuthEndpoint, TernSecureInternalHandlerConfig } from './types';\n\nclass SessionsHandler implements EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean {\n    return endpoint === 'sessions';\n  }\n\n  async handle(\n    handlerContext: HandlerContext,\n    config: TernSecureInternalHandlerConfig,\n  ): Promise<Response> {\n    const { request, subEndpoint, method } = handlerContext;\n    return await SessionEndpointHandler.handle(request, method, subEndpoint, config);\n  }\n}\n\nclass UsersHandler implements EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean {\n    return endpoint === 'users';\n  }\n\n  handle(\n    _handlerContext: HandlerContext,\n    _config: TernSecureInternalHandlerConfig,\n  ): Promise<Response> {\n    return Promise.resolve(\n      createApiErrorResponse('ENDPOINT_NOT_IMPLEMENTED', 'Users endpoint not implemented', 501),\n    );\n  }\n}\n\nexport class EndpointRouter {\n  private static readonly handlers: EndpointHandler[] = [\n    new SessionsHandler(),\n    new UsersHandler(),\n  ];\n\n  static async route(\n    handlerContext: HandlerContext,\n    config: TernSecureInternalHandlerConfig,\n  ): Promise<Response> {\n    const { endpoint } = handlerContext;\n\n    const handler = this.handlers.find(h => h.canHandle(endpoint));\n\n    if (!handler) {\n      return createApiErrorResponse('ENDPOINT_NOT_FOUND', 'Endpoint not found', 404);\n    }\n\n    return handler.handle(handlerContext, config);\n  }\n\n  static addHandler(handler: EndpointHandler): void {\n    this.handlers.push(handler);\n  }\n\n  static removeHandler(predicate: (handler: EndpointHandler) => boolean): void {\n    const index = this.handlers.findIndex(predicate);\n    if (index > -1) {\n      this.handlers.splice(index, 1);\n    }\n  }\n}"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,uBAAuC;AACvC,6BAAuC;AAGvC,MAAM,gBAA2C;AAAA,EAC/C,UAAU,UAAiC;AACzC,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,MAAM,OACJ,gBACA,QACmB;AACnB,UAAM,EAAE,SAAS,aAAa,OAAO,IAAI;AACzC,WAAO,MAAM,8CAAuB,OAAO,SAAS,QAAQ,aAAa,MAAM;AAAA,EACjF;AACF;AAEA,MAAM,aAAwC;AAAA,EAC5C,UAAU,UAAiC;AACzC,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,OACE,iBACA,SACmB;AACnB,WAAO,QAAQ;AAAA,UACb,yCAAuB,4BAA4B,kCAAkC,GAAG;AAAA,IAC1F;AAAA,EACF;AACF;AAEO,MAAM,eAAe;AAAA,EAC1B,OAAwB,WAA8B;AAAA,IACpD,IAAI,gBAAgB;AAAA,IACpB,IAAI,aAAa;AAAA,EACnB;AAAA,EAEA,aAAa,MACX,gBACA,QACmB;AACnB,UAAM,EAAE,SAAS,IAAI;AAErB,UAAM,UAAU,KAAK,SAAS,KAAK,OAAK,EAAE,UAAU,QAAQ,CAAC;AAE7D,QAAI,CAAC,SAAS;AACZ,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,WAAO,QAAQ,OAAO,gBAAgB,MAAM;AAAA,EAC9C;AAAA,EAEA,OAAO,WAAW,SAAgC;AAChD,SAAK,SAAS,KAAK,OAAO;AAAA,EAC5B;AAAA,EAEA,OAAO,cAAc,WAAwD;AAC3E,UAAM,QAAQ,KAAK,SAAS,UAAU,SAAS;AAC/C,QAAI,QAAQ,IAAI;AACd,WAAK,SAAS,OAAO,OAAO,CAAC;AAAA,IAC/B;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/app-router/admin/endpointRouter.ts"],"sourcesContent":["import type { RequestProcessorContext } from './c-authenticateRequestProcessor';\nimport { createApiErrorResponse } from './responses';\nimport { sessionEndpointHandler } from './sessionHandlers';\nimport type { AuthEndpoint, TernSecureHandlerOptions } from './types';\n\nexport interface EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean;\n  handle(context: RequestProcessorContext, config: TernSecureHandlerOptions): Promise<Response>;\n}\n\nclass SessionsHandler implements EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean {\n    return endpoint === 'sessions';\n  }\n\n  async handle(\n    context: RequestProcessorContext,\n    config: TernSecureHandlerOptions,\n  ): Promise<Response> {\n    return await sessionEndpointHandler(context, config);\n  }\n}\n\nclass UsersHandler implements EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean {\n    return endpoint === 'users';\n  }\n\n  handle(_context: RequestProcessorContext, _config: TernSecureHandlerOptions): Promise<Response> {\n    return Promise.resolve(\n      createApiErrorResponse('ENDPOINT_NOT_IMPLEMENTED', 'Users endpoint not implemented', 501),\n    );\n  }\n}\n\nexport class EndpointRouter {\n  private static readonly handlers: EndpointHandler[] = [new SessionsHandler(), new UsersHandler()];\n\n  static async route(\n    context: RequestProcessorContext,\n    config: TernSecureHandlerOptions,\n  ): Promise<Response> {\n    const { endpoint } = context;\n\n    if (!endpoint) {\n      return createApiErrorResponse('ENDPOINT_REQUIRED', 'Endpoint is required', 400);\n    }\n\n    const handler = this.handlers.find(h => h.canHandle(endpoint));\n\n    if (!handler) {\n      return createApiErrorResponse('ENDPOINT_NOT_FOUND', 'Endpoint not found', 404);\n    }\n\n    return handler.handle(context, config);\n  }\n\n  static addHandler(handler: EndpointHandler): void {\n    this.handlers.push(handler);\n  }\n\n  static removeHandler(predicate: (handler: EndpointHandler) => boolean): void {\n    const index = this.handlers.findIndex(predicate);\n    if (index > -1) {\n      this.handlers.splice(index, 1);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,uBAAuC;AACvC,6BAAuC;AAQvC,MAAM,gBAA2C;AAAA,EAC/C,UAAU,UAAiC;AACzC,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,MAAM,OACJ,SACA,QACmB;AACnB,WAAO,UAAM,+CAAuB,SAAS,MAAM;AAAA,EACrD;AACF;AAEA,MAAM,aAAwC;AAAA,EAC5C,UAAU,UAAiC;AACzC,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,OAAO,UAAmC,SAAsD;AAC9F,WAAO,QAAQ;AAAA,UACb,yCAAuB,4BAA4B,kCAAkC,GAAG;AAAA,IAC1F;AAAA,EACF;AACF;AAEO,MAAM,eAAe;AAAA,EAC1B,OAAwB,WAA8B,CAAC,IAAI,gBAAgB,GAAG,IAAI,aAAa,CAAC;AAAA,EAEhG,aAAa,MACX,SACA,QACmB;AACnB,UAAM,EAAE,SAAS,IAAI;AAErB,QAAI,CAAC,UAAU;AACb,iBAAO,yCAAuB,qBAAqB,wBAAwB,GAAG;AAAA,IAChF;AAEA,UAAM,UAAU,KAAK,SAAS,KAAK,OAAK,EAAE,UAAU,QAAQ,CAAC;AAE7D,QAAI,CAAC,SAAS;AACZ,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,WAAO,QAAQ,OAAO,SAAS,MAAM;AAAA,EACvC;AAAA,EAEA,OAAO,WAAW,SAAgC;AAChD,SAAK,SAAS,KAAK,OAAO;AAAA,EAC5B;AAAA,EAEA,OAAO,cAAc,WAAwD;AAC3E,UAAM,QAAQ,KAAK,SAAS,UAAU,SAAS;AAC/C,QAAI,QAAQ,IAAI;AACd,WAAK,SAAS,OAAO,OAAO,CAAC;AAAA,IAC/B;AAAA,EACF;AACF;","names":[]}

package/dist/cjs/app-router/admin/fnValidators.js

@@ -18,27 +18,14 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var fnValidators_exports = {};
 __export(fnValidators_exports, {
-  createRequestContext: () => createRequestContext,
   createValidators: () => createValidators
 });
 module.exports = __toCommonJS(fnValidators_exports);
 var import_headers = require("next/headers");
 var import_responses = require("./responses");
-function createRequestContext(request) {
-  const url = new URL(request.url);
-  const pathSegments = url.pathname.split("/").filter(Boolean);
-  return {
-    request,
-    origin: request.headers.get("origin"),
-    host: request.headers.get("host"),
-    referer: request.headers.get("referer"),
-    userAgent: request.headers.get("user-agent") || "",
-    method: request.method,
-    pathSegments
-  };
-}
 function createValidators(context) {
-  const { request, origin, host, referer, userAgent, method, pathSegments } = context;
+  const { origin, host, referrer, userAgent, method, pathSegments } = context;
+  const request = context.request;
   async function validateCors(corsOptions) {
     if (corsOptions.skipSameOrigin) {
       if (!origin || host && origin.includes(host)) {
@@ -93,13 +80,13 @@ function createValidators(context) {
   }
   function validateCsrf(securityOptions) {
     if (securityOptions.requireCSRF && origin && host && !origin.includes(host)) {
-      const hasCSRFHeader = request.headers.get("x-requested-with") === "XMLHttpRequest";
-      const hasValidReferer = referer && host && referer.includes(host);
+      const hasCSRFHeader = context.request.headers.get("x-requested-with") === "XMLHttpRequest";
+      const hasValidReferer = referrer && host && referrer.includes(host);
       if (!hasCSRFHeader && !hasValidReferer) {
-        const isAllowedReferer = securityOptions.allowedReferers?.some(
-          (allowedRef) => referer?.includes(allowedRef)
+        const isAllowedReferrer = securityOptions.allowedReferers?.some(
+          (allowedRef) => referrer?.includes(allowedRef)
         );
-        if (!isAllowedReferer) {
+        if (!isAllowedReferrer) {
           return (0, import_responses.createApiErrorResponse)("CSRF_PROTECTION", "Access denied", 403);
         }
       }
@@ -109,7 +96,7 @@ function createValidators(context) {
   function validateRequiredHeaders(securityOptions) {
     if (securityOptions.requiredHeaders) {
       for (const [headerName, expectedValue] of Object.entries(securityOptions.requiredHeaders)) {
-        const actualValue = request.headers.get(headerName);
+        const actualValue = context.request.headers.get(headerName);
         if (actualValue !== expectedValue) {
           return (0, import_responses.createApiErrorResponse)(
             "INVALID_HEADERS",
@@ -124,7 +111,7 @@ function createValidators(context) {
   function validateUserAgent(securityOptions) {
     if (securityOptions.userAgent?.block?.length) {
       const isBlocked = securityOptions.userAgent.block.some(
-        (blocked) => userAgent.toLowerCase().includes(blocked.toLowerCase())
+        (blocked) => context.request.headers.get("user-agent")?.toLowerCase().includes(blocked.toLowerCase())
       );
       if (isBlocked) {
         return (0, import_responses.createApiErrorResponse)("USER_AGENT_BLOCKED", "Access denied", 403);
@@ -132,7 +119,7 @@ function createValidators(context) {
     }
     if (securityOptions.userAgent?.allow?.length) {
       const isAllowed = securityOptions.userAgent.allow.some(
-        (allowed) => userAgent.toLowerCase().includes(allowed.toLowerCase())
+        (allowed) => request.headers.get("user-agent")?.toLowerCase().includes(allowed.toLowerCase())
       );
       if (!isAllowed) {
         return (0, import_responses.createApiErrorResponse)("USER_AGENT_NOT_ALLOWED", "Access denied", 403);
@@ -290,7 +277,6 @@ function createValidators(context) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  createRequestContext,
   createValidators
 });
 //# sourceMappingURL=fnValidators.js.map

package/dist/cjs/app-router/admin/fnValidators.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/app-router/admin/fnValidators.ts"],"sourcesContent":["import { cookies } from 'next/headers';\n\nimport { createApiErrorResponse } from './responses';\nimport type {\n  AuthEndpoint,\n  ComprehensiveValidationResult,\n  CorsOptions,\n  EndpointConfig,\n  SecurityOptions,\n  SessionSubEndpoint,\n  ValidationConfig,\n} from './types';\n//import type { RequestProcessorContext } from './claude-authenticateRequestProcessor';\n\nexport interface RequestContext {\n  request: Request;\n  origin: string | null;\n  host: string | null;\n  referer: string | null;\n  userAgent: string;\n  method: string;\n  pathSegments: string[];\n}\n\nexport function createRequestContext(request: Request): RequestContext {\n  const url = new URL(request.url);\n  const pathSegments = url.pathname.split('/').filter(Boolean);\n\n  return {\n    request,\n    origin: request.headers.get('origin'),\n    host: request.headers.get('host'),\n    referer: request.headers.get('referer'),\n    userAgent: request.headers.get('user-agent') || '',\n    method: request.method,\n    pathSegments,\n  };\n}\n\n/**\n * Main validators factory function\n * Returns an object containing all validator functions and utilities\n */\nexport function createValidators(context: RequestContext) {\n  const { request, origin, host, referer, userAgent, method, pathSegments } = context;\n\n  async function validateCors(corsOptions: CorsOptions): Promise<Response | null> {\n    if (corsOptions.skipSameOrigin) {\n      if (!origin || (host && origin.includes(host))) {\n        return null;\n      }\n    }\n\n    if (corsOptions.allowedOrigins !== '*') {\n      const isAllowed = corsOptions.allowedOrigins.some(allowedOrigin => {\n        if (allowedOrigin.startsWith('*')) {\n          const domain = allowedOrigin.slice(1);\n          return origin?.endsWith(domain);\n        }\n        return origin === allowedOrigin;\n      });\n\n      if (!isAllowed) {\n        return createApiErrorResponse('CORS_ORIGIN_NOT_ALLOWED', 'Origin not allowed', 403);\n      }\n    }\n\n    return null;\n  }\n\n  function createCorsOptionsResponse(corsOptions: CorsOptions): Response {\n    const response = new Response(null, { status: 204 });\n\n    if (corsOptions.allowedOrigins === '*') {\n      response.headers.set('Access-Control-Allow-Origin', '*');\n    } else {\n      response.headers.set('Access-Control-Allow-Origin', corsOptions.allowedOrigins.join(','));\n    }\n\n    response.headers.set(\n      'Access-Control-Allow-Methods',\n      corsOptions.allowedMethods?.join(',') || 'GET,POST',\n    );\n    response.headers.set(\n      'Access-Control-Allow-Headers',\n      corsOptions.allowedHeaders?.join(',') || 'Content-Type,Authorization',\n    );\n\n    if (corsOptions.allowCredentials) {\n      response.headers.set('Access-Control-Allow-Credentials', 'true');\n    }\n\n    if (corsOptions.maxAge) {\n      response.headers.set('Access-Control-Max-Age', corsOptions.maxAge.toString());\n    }\n\n    return response;\n  }\n\n  async function validateSecurity(securityOptions: SecurityOptions): Promise<Response | null> {\n    const csrfResult = validateCsrf(securityOptions);\n    if (csrfResult) return csrfResult;\n\n    const headersResult = validateRequiredHeaders(securityOptions);\n    if (headersResult) return headersResult;\n\n    const userAgentResult = validateUserAgent(securityOptions);\n    if (userAgentResult) return userAgentResult;\n\n    return null;\n  }\n\n  function validateCsrf(securityOptions: SecurityOptions): Response | null {\n    if (securityOptions.requireCSRF && origin && host && !origin.includes(host)) {\n      const hasCSRFHeader = request.headers.get('x-requested-with') === 'XMLHttpRequest';\n      const hasValidReferer = referer && host && referer.includes(host);\n\n      if (!hasCSRFHeader && !hasValidReferer) {\n        const isAllowedReferer = securityOptions.allowedReferers?.some((allowedRef: string) =>\n          referer?.includes(allowedRef),\n        );\n\n        if (!isAllowedReferer) {\n          return createApiErrorResponse('CSRF_PROTECTION', 'Access denied', 403);\n        }\n      }\n    }\n    return null;\n  }\n\n  function validateRequiredHeaders(securityOptions: SecurityOptions): Response | null {\n    if (securityOptions.requiredHeaders) {\n      for (const [headerName, expectedValue] of Object.entries(securityOptions.requiredHeaders)) {\n        const actualValue = request.headers.get(headerName);\n        if (actualValue !== expectedValue) {\n          return createApiErrorResponse(\n            'INVALID_HEADERS',\n            'Required header missing or invalid',\n            400,\n          );\n        }\n      }\n    }\n    return null;\n  }\n\n  function validateUserAgent(securityOptions: SecurityOptions): Response | null {\n    if (securityOptions.userAgent?.block?.length) {\n      const isBlocked = securityOptions.userAgent.block.some((blocked: string) =>\n        userAgent.toLowerCase().includes(blocked.toLowerCase()),\n      );\n\n      if (isBlocked) {\n        return createApiErrorResponse('USER_AGENT_BLOCKED', 'Access denied', 403);\n      }\n    }\n\n    if (securityOptions.userAgent?.allow?.length) {\n      const isAllowed = securityOptions.userAgent.allow.some((allowed: string) =>\n        userAgent.toLowerCase().includes(allowed.toLowerCase()),\n      );\n\n      if (!isAllowed) {\n        return createApiErrorResponse('USER_AGENT_NOT_ALLOWED', 'Access denied', 403);\n      }\n    }\n\n    return null;\n  }\n\n  function validateCsrfToken(\n    csrfToken: string,\n    csrfCookieValue: string | undefined,\n  ): Response | null {\n    if (!csrfToken) {\n      return createApiErrorResponse('INVALID_CSRF_TOKEN', 'CSRF token is required', 400);\n    }\n\n    if (!csrfCookieValue) {\n      return createApiErrorResponse('CSRF_COOKIE_MISSING', 'CSRF token cookie not found', 403);\n    }\n\n    if (csrfToken !== csrfCookieValue) {\n      return createApiErrorResponse('CSRF_TOKEN_MISMATCH', 'CSRF token mismatch', 403);\n    }\n\n    return null;\n  }\n\n  function validatePathStructure(): Response | null {\n    if (pathSegments.length < 3) {\n      return createApiErrorResponse(\n        'INVALID_ROUTE',\n        'Invalid route structure. Expected: /api/auth/{endpoint}',\n        404,\n      );\n    }\n    return null;\n  }\n\n  function validateEndpoint(\n    _endpoint: AuthEndpoint,\n    endpointConfig: EndpointConfig,\n  ): Response | null {\n    if (!endpointConfig || !endpointConfig.enabled) {\n      return createApiErrorResponse('ENDPOINT_NOT_FOUND', 'Endpoint not found', 404);\n    }\n\n    if (method !== 'OPTIONS' && !endpointConfig.methods.includes(method as any)) {\n      return createApiErrorResponse('METHOD_NOT_ALLOWED', 'Method not allowed', 405);\n    }\n\n    return null;\n  }\n\n  function validateSubEndpoint(\n    subEndpoint: SessionSubEndpoint | undefined,\n    subEndpointConfig: any,\n  ): Response | null {\n    if (!subEndpoint) {\n      return createApiErrorResponse('SUB_ENDPOINT_REQUIRED', 'Session sub-endpoint required', 400);\n    }\n\n    if (!subEndpointConfig || !subEndpointConfig.enabled) {\n      return createApiErrorResponse('ENDPOINT_NOT_FOUND', 'Endpoint not found', 404);\n    }\n\n    if (!subEndpointConfig.methods?.includes(method as any)) {\n      return createApiErrorResponse('METHOD_NOT_ALLOWED', 'Method not allowed', 405);\n    }\n\n    return null;\n  }\n\n  async function validateSessionRequest(): Promise<{\n    body: any;\n    idToken?: string;\n    csrfToken?: string;\n    error?: Response;\n  }> {\n    try {\n      const body = await request.json();\n      return { body, idToken: body.idToken, csrfToken: body.csrfToken };\n    } catch (error) {\n      return {\n        body: null,\n        error: createApiErrorResponse('INVALID_REQUEST_FORMAT', 'Invalid request format', 400),\n      };\n    }\n  }\n\n  function validateIdToken(idToken: string | undefined): Response | null {\n    if (!idToken) {\n      return createApiErrorResponse(\n        'INVALID_TOKEN',\n        'ID token is required for creating session',\n        400,\n      );\n    }\n    return null;\n  }\n\n  /**\n   * Main validation orchestrator function\n   * Runs all configured validations in the correct order\n   */\n  async function validateRequest(config: ValidationConfig): Promise<ComprehensiveValidationResult> {\n    if (method === 'OPTIONS' && config.cors) {\n      return {\n        isValid: true,\n        corsResponse: createCorsOptionsResponse(config.cors),\n      };\n    }\n    const pathError = validatePathStructure();\n    if (pathError) {\n      return { isValid: false, error: pathError };\n    }\n\n    if (config.cors) {\n      const corsError = await validateCors(config.cors);\n      if (corsError) {\n        return { isValid: false, error: corsError };\n      }\n    }\n\n    if (config.security) {\n      const securityError = await validateSecurity(config.security);\n      if (securityError) {\n        return { isValid: false, error: securityError };\n      }\n    }\n\n    if (config.endpoint) {\n      const endpointError = validateEndpoint(config.endpoint.name, config.endpoint.config);\n      if (endpointError) {\n        return { isValid: false, error: endpointError };\n      }\n    }\n\n    if (config.subEndpoint) {\n      const subEndpointError = validateSubEndpoint(\n        config.subEndpoint.name,\n        config.subEndpoint.config,\n      );\n      if (subEndpointError) {\n        return { isValid: false, error: subEndpointError };\n      }\n    }\n\n    let sessionData;\n    if (method === 'POST' && (config.requireIdToken || config.requireCsrfToken)) {\n      const sessionResult = await validateSessionRequest();\n      if (sessionResult.error) {\n        return { isValid: false, error: sessionResult.error };\n      }\n\n      sessionData = sessionResult;\n\n      if (config.requireIdToken) {\n        const idTokenError = validateIdToken(sessionData.idToken);\n        if (idTokenError) {\n          return { isValid: false, error: idTokenError };\n        }\n      }\n\n      if (config.requireCsrfToken && sessionData.csrfToken) {\n        const cookieStore = await cookies();\n        const csrfCookieValue = cookieStore.get('csrfToken')?.value;\n        const csrfError = validateCsrfToken(sessionData.csrfToken, csrfCookieValue);\n        if (csrfError) {\n          return { isValid: false, error: csrfError };\n        }\n      }\n    }\n\n    return {\n      isValid: true,\n      sessionData,\n    };\n  }\n\n  /**\n   * Convenience function for quick validation setup\n   */\n  function createValidationConfig(overrides: Partial<ValidationConfig> = {}): ValidationConfig {\n    return {\n      ...overrides,\n    };\n  }\n\n  return {\n    createValidationConfig,\n\n    validateRequest,\n\n    validateCors,\n    validateSecurity,\n    validatePathStructure,\n    validateEndpoint,\n    validateSubEndpoint,\n    validateSessionRequest,\n    validateIdToken,\n    validateCsrfToken,\n\n    createCorsOptionsResponse,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAAwB;AAExB,uBAAuC;AAsBhC,SAAS,qBAAqB,SAAkC;AACrE,QAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAM,eAAe,IAAI,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AAE3D,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,QAAQ,QAAQ,IAAI,QAAQ;AAAA,IACpC,MAAM,QAAQ,QAAQ,IAAI,MAAM;AAAA,IAChC,SAAS,QAAQ,QAAQ,IAAI,SAAS;AAAA,IACtC,WAAW,QAAQ,QAAQ,IAAI,YAAY,KAAK;AAAA,IAChD,QAAQ,QAAQ;AAAA,IAChB;AAAA,EACF;AACF;AAMO,SAAS,iBAAiB,SAAyB;AACxD,QAAM,EAAE,SAAS,QAAQ,MAAM,SAAS,WAAW,QAAQ,aAAa,IAAI;AAE5E,iBAAe,aAAa,aAAoD;AAC9E,QAAI,YAAY,gBAAgB;AAC9B,UAAI,CAAC,UAAW,QAAQ,OAAO,SAAS,IAAI,GAAI;AAC9C,eAAO;AAAA,MACT;AAAA,IACF;AAEA,QAAI,YAAY,mBAAmB,KAAK;AACtC,YAAM,YAAY,YAAY,eAAe,KAAK,mBAAiB;AACjE,YAAI,cAAc,WAAW,GAAG,GAAG;AACjC,gBAAM,SAAS,cAAc,MAAM,CAAC;AACpC,iBAAO,QAAQ,SAAS,MAAM;AAAA,QAChC;AACA,eAAO,WAAW;AAAA,MACpB,CAAC;AAED,UAAI,CAAC,WAAW;AACd,mBAAO,yCAAuB,2BAA2B,sBAAsB,GAAG;AAAA,MACpF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,0BAA0B,aAAoC;AACrE,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAEnD,QAAI,YAAY,mBAAmB,KAAK;AACtC,eAAS,QAAQ,IAAI,+BAA+B,GAAG;AAAA,IACzD,OAAO;AACL,eAAS,QAAQ,IAAI,+BAA+B,YAAY,eAAe,KAAK,GAAG,CAAC;AAAA,IAC1F;AAEA,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,YAAY,gBAAgB,KAAK,GAAG,KAAK;AAAA,IAC3C;AACA,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,YAAY,gBAAgB,KAAK,GAAG,KAAK;AAAA,IAC3C;AAEA,QAAI,YAAY,kBAAkB;AAChC,eAAS,QAAQ,IAAI,oCAAoC,MAAM;AAAA,IACjE;AAEA,QAAI,YAAY,QAAQ;AACtB,eAAS,QAAQ,IAAI,0BAA0B,YAAY,OAAO,SAAS,CAAC;AAAA,IAC9E;AAEA,WAAO;AAAA,EACT;AAEA,iBAAe,iBAAiB,iBAA4D;AAC1F,UAAM,aAAa,aAAa,eAAe;AAC/C,QAAI,WAAY,QAAO;AAEvB,UAAM,gBAAgB,wBAAwB,eAAe;AAC7D,QAAI,cAAe,QAAO;AAE1B,UAAM,kBAAkB,kBAAkB,eAAe;AACzD,QAAI,gBAAiB,QAAO;AAE5B,WAAO;AAAA,EACT;AAEA,WAAS,aAAa,iBAAmD;AACvE,QAAI,gBAAgB,eAAe,UAAU,QAAQ,CAAC,OAAO,SAAS,IAAI,GAAG;AAC3E,YAAM,gBAAgB,QAAQ,QAAQ,IAAI,kBAAkB,MAAM;AAClE,YAAM,kBAAkB,WAAW,QAAQ,QAAQ,SAAS,IAAI;AAEhE,UAAI,CAAC,iBAAiB,CAAC,iBAAiB;AACtC,cAAM,mBAAmB,gBAAgB,iBAAiB;AAAA,UAAK,CAAC,eAC9D,SAAS,SAAS,UAAU;AAAA,QAC9B;AAEA,YAAI,CAAC,kBAAkB;AACrB,qBAAO,yCAAuB,mBAAmB,iBAAiB,GAAG;AAAA,QACvE;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,WAAS,wBAAwB,iBAAmD;AAClF,QAAI,gBAAgB,iBAAiB;AACnC,iBAAW,CAAC,YAAY,aAAa,KAAK,OAAO,QAAQ,gBAAgB,eAAe,GAAG;AACzF,cAAM,cAAc,QAAQ,QAAQ,IAAI,UAAU;AAClD,YAAI,gBAAgB,eAAe;AACjC,qBAAO;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,WAAS,kBAAkB,iBAAmD;AAC5E,QAAI,gBAAgB,WAAW,OAAO,QAAQ;AAC5C,YAAM,YAAY,gBAAgB,UAAU,MAAM;AAAA,QAAK,CAAC,YACtD,UAAU,YAAY,EAAE,SAAS,QAAQ,YAAY,CAAC;AAAA,MACxD;AAEA,UAAI,WAAW;AACb,mBAAO,yCAAuB,sBAAsB,iBAAiB,GAAG;AAAA,MAC1E;AAAA,IACF;AAEA,QAAI,gBAAgB,WAAW,OAAO,QAAQ;AAC5C,YAAM,YAAY,gBAAgB,UAAU,MAAM;AAAA,QAAK,CAAC,YACtD,UAAU,YAAY,EAAE,SAAS,QAAQ,YAAY,CAAC;AAAA,MACxD;AAEA,UAAI,CAAC,WAAW;AACd,mBAAO,yCAAuB,0BAA0B,iBAAiB,GAAG;AAAA,MAC9E;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,kBACP,WACA,iBACiB;AACjB,QAAI,CAAC,WAAW;AACd,iBAAO,yCAAuB,sBAAsB,0BAA0B,GAAG;AAAA,IACnF;AAEA,QAAI,CAAC,iBAAiB;AACpB,iBAAO,yCAAuB,uBAAuB,+BAA+B,GAAG;AAAA,IACzF;AAEA,QAAI,cAAc,iBAAiB;AACjC,iBAAO,yCAAuB,uBAAuB,uBAAuB,GAAG;AAAA,IACjF;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,wBAAyC;AAChD,QAAI,aAAa,SAAS,GAAG;AAC3B,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,WAAS,iBACP,WACA,gBACiB;AACjB,QAAI,CAAC,kBAAkB,CAAC,eAAe,SAAS;AAC9C,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,QAAI,WAAW,aAAa,CAAC,eAAe,QAAQ,SAAS,MAAa,GAAG;AAC3E,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,oBACP,aACA,mBACiB;AACjB,QAAI,CAAC,aAAa;AAChB,iBAAO,yCAAuB,yBAAyB,iCAAiC,GAAG;AAAA,IAC7F;AAEA,QAAI,CAAC,qBAAqB,CAAC,kBAAkB,SAAS;AACpD,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,QAAI,CAAC,kBAAkB,SAAS,SAAS,MAAa,GAAG;AACvD,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,WAAO;AAAA,EACT;AAEA,iBAAe,yBAKZ;AACD,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,aAAO,EAAE,MAAM,SAAS,KAAK,SAAS,WAAW,KAAK,UAAU;AAAA,IAClE,SAAS,OAAO;AACd,aAAO;AAAA,QACL,MAAM;AAAA,QACN,WAAO,yCAAuB,0BAA0B,0BAA0B,GAAG;AAAA,MACvF;AAAA,IACF;AAAA,EACF;AAEA,WAAS,gBAAgB,SAA8C;AACrE,QAAI,CAAC,SAAS;AACZ,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAMA,iBAAe,gBAAgB,QAAkE;AAC/F,QAAI,WAAW,aAAa,OAAO,MAAM;AACvC,aAAO;AAAA,QACL,SAAS;AAAA,QACT,cAAc,0BAA0B,OAAO,IAAI;AAAA,MACrD;AAAA,IACF;AACA,UAAM,YAAY,sBAAsB;AACxC,QAAI,WAAW;AACb,aAAO,EAAE,SAAS,OAAO,OAAO,UAAU;AAAA,IAC5C;AAEA,QAAI,OAAO,MAAM;AACf,YAAM,YAAY,MAAM,aAAa,OAAO,IAAI;AAChD,UAAI,WAAW;AACb,eAAO,EAAE,SAAS,OAAO,OAAO,UAAU;AAAA,MAC5C;AAAA,IACF;AAEA,QAAI,OAAO,UAAU;AACnB,YAAM,gBAAgB,MAAM,iBAAiB,OAAO,QAAQ;AAC5D,UAAI,eAAe;AACjB,eAAO,EAAE,SAAS,OAAO,OAAO,cAAc;AAAA,MAChD;AAAA,IACF;AAEA,QAAI,OAAO,UAAU;AACnB,YAAM,gBAAgB,iBAAiB,OAAO,SAAS,MAAM,OAAO,SAAS,MAAM;AACnF,UAAI,eAAe;AACjB,eAAO,EAAE,SAAS,OAAO,OAAO,cAAc;AAAA,MAChD;AAAA,IACF;AAEA,QAAI,OAAO,aAAa;AACtB,YAAM,mBAAmB;AAAA,QACvB,OAAO,YAAY;AAAA,QACnB,OAAO,YAAY;AAAA,MACrB;AACA,UAAI,kBAAkB;AACpB,eAAO,EAAE,SAAS,OAAO,OAAO,iBAAiB;AAAA,MACnD;AAAA,IACF;AAEA,QAAI;AACJ,QAAI,WAAW,WAAW,OAAO,kBAAkB,OAAO,mBAAmB;AAC3E,YAAM,gBAAgB,MAAM,uBAAuB;AACnD,UAAI,cAAc,OAAO;AACvB,eAAO,EAAE,SAAS,OAAO,OAAO,cAAc,MAAM;AAAA,MACtD;AAEA,oBAAc;AAEd,UAAI,OAAO,gBAAgB;AACzB,cAAM,eAAe,gBAAgB,YAAY,OAAO;AACxD,YAAI,cAAc;AAChB,iBAAO,EAAE,SAAS,OAAO,OAAO,aAAa;AAAA,QAC/C;AAAA,MACF;AAEA,UAAI,OAAO,oBAAoB,YAAY,WAAW;AACpD,cAAM,cAAc,UAAM,wBAAQ;AAClC,cAAM,kBAAkB,YAAY,IAAI,WAAW,GAAG;AACtD,cAAM,YAAY,kBAAkB,YAAY,WAAW,eAAe;AAC1E,YAAI,WAAW;AACb,iBAAO,EAAE,SAAS,OAAO,OAAO,UAAU;AAAA,QAC5C;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAKA,WAAS,uBAAuB,YAAuC,CAAC,GAAqB;AAC3F,WAAO;AAAA,MACL,GAAG;AAAA,IACL;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IAEA;AAAA,IAEA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IAEA;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/app-router/admin/fnValidators.ts"],"sourcesContent":["import { cookies } from 'next/headers';\n\nimport type { RequestProcessorContext } from './c-authenticateRequestProcessor';\nimport { createApiErrorResponse } from './responses';\nimport type {\n  AuthEndpoint,\n  ComprehensiveValidationResult,\n  CorsOptions,\n  EndpointConfig,\n  SecurityOptions,\n  SessionSubEndpoint,\n  ValidationConfig,\n} from './types';\n\n/**\n * Main validators factory function\n * Returns an object containing all validator functions and utilities\n */\nexport function createValidators(context: RequestProcessorContext) {\n  const { origin, host, referrer, userAgent, method, pathSegments } = context;\n  const request = context.request;\n\n  async function validateCors(corsOptions: CorsOptions): Promise<Response | null> {\n    if (corsOptions.skipSameOrigin) {\n      if (!origin || (host && origin.includes(host))) {\n        return null;\n      }\n    }\n\n    if (corsOptions.allowedOrigins !== '*') {\n      const isAllowed = corsOptions.allowedOrigins.some(allowedOrigin => {\n        if (allowedOrigin.startsWith('*')) {\n          const domain = allowedOrigin.slice(1);\n          return origin?.endsWith(domain);\n        }\n        return origin === allowedOrigin;\n      });\n\n      if (!isAllowed) {\n        return createApiErrorResponse('CORS_ORIGIN_NOT_ALLOWED', 'Origin not allowed', 403);\n      }\n    }\n\n    return null;\n  }\n\n  function createCorsOptionsResponse(corsOptions: CorsOptions): Response {\n    const response = new Response(null, { status: 204 });\n\n    if (corsOptions.allowedOrigins === '*') {\n      response.headers.set('Access-Control-Allow-Origin', '*');\n    } else {\n      response.headers.set('Access-Control-Allow-Origin', corsOptions.allowedOrigins.join(','));\n    }\n\n    response.headers.set(\n      'Access-Control-Allow-Methods',\n      corsOptions.allowedMethods?.join(',') || 'GET,POST',\n    );\n    response.headers.set(\n      'Access-Control-Allow-Headers',\n      corsOptions.allowedHeaders?.join(',') || 'Content-Type,Authorization',\n    );\n\n    if (corsOptions.allowCredentials) {\n      response.headers.set('Access-Control-Allow-Credentials', 'true');\n    }\n\n    if (corsOptions.maxAge) {\n      response.headers.set('Access-Control-Max-Age', corsOptions.maxAge.toString());\n    }\n\n    return response;\n  }\n\n  async function validateSecurity(securityOptions: SecurityOptions): Promise<Response | null> {\n    const csrfResult = validateCsrf(securityOptions);\n    if (csrfResult) return csrfResult;\n\n    const headersResult = validateRequiredHeaders(securityOptions);\n    if (headersResult) return headersResult;\n\n    const userAgentResult = validateUserAgent(securityOptions);\n    if (userAgentResult) return userAgentResult;\n\n    return null;\n  }\n\n  function validateCsrf(securityOptions: SecurityOptions): Response | null {\n    if (securityOptions.requireCSRF && origin && host && !origin.includes(host)) {\n      const hasCSRFHeader = context.request.headers.get('x-requested-with') === 'XMLHttpRequest';\n      const hasValidReferer = referrer && host && referrer.includes(host);\n\n      if (!hasCSRFHeader && !hasValidReferer) {\n        const isAllowedReferrer = securityOptions.allowedReferers?.some((allowedRef: string) =>\n          referrer?.includes(allowedRef),\n        );\n\n        if (!isAllowedReferrer) {\n          return createApiErrorResponse('CSRF_PROTECTION', 'Access denied', 403);\n        }\n      }\n    }\n    return null;\n  }\n\n  function validateRequiredHeaders(securityOptions: SecurityOptions): Response | null {\n    if (securityOptions.requiredHeaders) {\n      for (const [headerName, expectedValue] of Object.entries(securityOptions.requiredHeaders)) {\n        const actualValue = context.request.headers.get(headerName);\n        if (actualValue !== expectedValue) {\n          return createApiErrorResponse(\n            'INVALID_HEADERS',\n            'Required header missing or invalid',\n            400,\n          );\n        }\n      }\n    }\n    return null;\n  }\n\n  function validateUserAgent(securityOptions: SecurityOptions): Response | null {\n    if (securityOptions.userAgent?.block?.length) {\n      const isBlocked = securityOptions.userAgent.block.some((blocked: string) =>\n        context.request.headers.get('user-agent')?.toLowerCase().includes(blocked.toLowerCase()),\n      );\n\n      if (isBlocked) {\n        return createApiErrorResponse('USER_AGENT_BLOCKED', 'Access denied', 403);\n      }\n    }\n\n    if (securityOptions.userAgent?.allow?.length) {\n      const isAllowed = securityOptions.userAgent.allow.some((allowed: string) =>\n        request.headers.get('user-agent')?.toLowerCase().includes(allowed.toLowerCase()),\n      );\n\n      if (!isAllowed) {\n        return createApiErrorResponse('USER_AGENT_NOT_ALLOWED', 'Access denied', 403);\n      }\n    }\n\n    return null;\n  }\n\n  function validateCsrfToken(\n    csrfToken: string,\n    csrfCookieValue: string | undefined,\n  ): Response | null {\n    if (!csrfToken) {\n      return createApiErrorResponse('INVALID_CSRF_TOKEN', 'CSRF token is required', 400);\n    }\n\n    if (!csrfCookieValue) {\n      return createApiErrorResponse('CSRF_COOKIE_MISSING', 'CSRF token cookie not found', 403);\n    }\n\n    if (csrfToken !== csrfCookieValue) {\n      return createApiErrorResponse('CSRF_TOKEN_MISMATCH', 'CSRF token mismatch', 403);\n    }\n\n    return null;\n  }\n\n  function validatePathStructure(): Response | null {\n    if (pathSegments.length < 3) {\n      return createApiErrorResponse(\n        'INVALID_ROUTE',\n        'Invalid route structure. Expected: /api/auth/{endpoint}',\n        404,\n      );\n    }\n    return null;\n  }\n\n  function validateEndpoint(\n    _endpoint: AuthEndpoint,\n    endpointConfig: EndpointConfig,\n  ): Response | null {\n    if (!endpointConfig || !endpointConfig.enabled) {\n      return createApiErrorResponse('ENDPOINT_NOT_FOUND', 'Endpoint not found', 404);\n    }\n\n    if (method !== 'OPTIONS' && !endpointConfig.methods.includes(method as any)) {\n      return createApiErrorResponse('METHOD_NOT_ALLOWED', 'Method not allowed', 405);\n    }\n\n    return null;\n  }\n\n  function validateSubEndpoint(\n    subEndpoint: SessionSubEndpoint | undefined,\n    subEndpointConfig: any,\n  ): Response | null {\n    if (!subEndpoint) {\n      return createApiErrorResponse('SUB_ENDPOINT_REQUIRED', 'Session sub-endpoint required', 400);\n    }\n\n    if (!subEndpointConfig || !subEndpointConfig.enabled) {\n      return createApiErrorResponse('ENDPOINT_NOT_FOUND', 'Endpoint not found', 404);\n    }\n\n    if (!subEndpointConfig.methods?.includes(method as any)) {\n      return createApiErrorResponse('METHOD_NOT_ALLOWED', 'Method not allowed', 405);\n    }\n\n    return null;\n  }\n\n  async function validateSessionRequest(): Promise<{\n    body: any;\n    idToken?: string;\n    csrfToken?: string;\n    error?: Response;\n  }> {\n    try {\n      const body = await request.json();\n      return { body, idToken: body.idToken, csrfToken: body.csrfToken };\n    } catch (error) {\n      return {\n        body: null,\n        error: createApiErrorResponse('INVALID_REQUEST_FORMAT', 'Invalid request format', 400),\n      };\n    }\n  }\n\n  function validateIdToken(idToken: string | undefined): Response | null {\n    if (!idToken) {\n      return createApiErrorResponse(\n        'INVALID_TOKEN',\n        'ID token is required for creating session',\n        400,\n      );\n    }\n    return null;\n  }\n\n  /**\n   * Main validation orchestrator function\n   * Runs all configured validations in the correct order\n   */\n  async function validateRequest(config: ValidationConfig): Promise<ComprehensiveValidationResult> {\n    if (method === 'OPTIONS' && config.cors) {\n      return {\n        isValid: true,\n        corsResponse: createCorsOptionsResponse(config.cors),\n      };\n    }\n    const pathError = validatePathStructure();\n    if (pathError) {\n      return { isValid: false, error: pathError };\n    }\n\n    if (config.cors) {\n      const corsError = await validateCors(config.cors);\n      if (corsError) {\n        return { isValid: false, error: corsError };\n      }\n    }\n\n    if (config.security) {\n      const securityError = await validateSecurity(config.security);\n      if (securityError) {\n        return { isValid: false, error: securityError };\n      }\n    }\n\n    if (config.endpoint) {\n      const endpointError = validateEndpoint(config.endpoint.name, config.endpoint.config);\n      if (endpointError) {\n        return { isValid: false, error: endpointError };\n      }\n    }\n\n    if (config.subEndpoint) {\n      const subEndpointError = validateSubEndpoint(\n        config.subEndpoint.name,\n        config.subEndpoint.config,\n      );\n      if (subEndpointError) {\n        return { isValid: false, error: subEndpointError };\n      }\n    }\n\n    let sessionData;\n    if (method === 'POST' && (config.requireIdToken || config.requireCsrfToken)) {\n      const sessionResult = await validateSessionRequest();\n      if (sessionResult.error) {\n        return { isValid: false, error: sessionResult.error };\n      }\n\n      sessionData = sessionResult;\n\n      if (config.requireIdToken) {\n        const idTokenError = validateIdToken(sessionData.idToken);\n        if (idTokenError) {\n          return { isValid: false, error: idTokenError };\n        }\n      }\n\n      if (config.requireCsrfToken && sessionData.csrfToken) {\n        const cookieStore = await cookies();\n        const csrfCookieValue = cookieStore.get('csrfToken')?.value;\n        const csrfError = validateCsrfToken(sessionData.csrfToken, csrfCookieValue);\n        if (csrfError) {\n          return { isValid: false, error: csrfError };\n        }\n      }\n    }\n\n    return {\n      isValid: true,\n      sessionData,\n    };\n  }\n\n  /**\n   * Convenience function for quick validation setup\n   */\n  function createValidationConfig(overrides: Partial<ValidationConfig> = {}): ValidationConfig {\n    return {\n      ...overrides,\n    };\n  }\n\n  return {\n    createValidationConfig,\n\n    validateRequest,\n\n    validateCors,\n    validateSecurity,\n    validatePathStructure,\n    validateEndpoint,\n    validateSubEndpoint,\n    validateSessionRequest,\n    validateIdToken,\n    validateCsrfToken,\n\n    createCorsOptionsResponse,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAAwB;AAGxB,uBAAuC;AAehC,SAAS,iBAAiB,SAAkC;AACjE,QAAM,EAAE,QAAQ,MAAM,UAAU,WAAW,QAAQ,aAAa,IAAI;AACpE,QAAM,UAAU,QAAQ;AAExB,iBAAe,aAAa,aAAoD;AAC9E,QAAI,YAAY,gBAAgB;AAC9B,UAAI,CAAC,UAAW,QAAQ,OAAO,SAAS,IAAI,GAAI;AAC9C,eAAO;AAAA,MACT;AAAA,IACF;AAEA,QAAI,YAAY,mBAAmB,KAAK;AACtC,YAAM,YAAY,YAAY,eAAe,KAAK,mBAAiB;AACjE,YAAI,cAAc,WAAW,GAAG,GAAG;AACjC,gBAAM,SAAS,cAAc,MAAM,CAAC;AACpC,iBAAO,QAAQ,SAAS,MAAM;AAAA,QAChC;AACA,eAAO,WAAW;AAAA,MACpB,CAAC;AAED,UAAI,CAAC,WAAW;AACd,mBAAO,yCAAuB,2BAA2B,sBAAsB,GAAG;AAAA,MACpF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,0BAA0B,aAAoC;AACrE,UAAM,WAAW,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAEnD,QAAI,YAAY,mBAAmB,KAAK;AACtC,eAAS,QAAQ,IAAI,+BAA+B,GAAG;AAAA,IACzD,OAAO;AACL,eAAS,QAAQ,IAAI,+BAA+B,YAAY,eAAe,KAAK,GAAG,CAAC;AAAA,IAC1F;AAEA,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,YAAY,gBAAgB,KAAK,GAAG,KAAK;AAAA,IAC3C;AACA,aAAS,QAAQ;AAAA,MACf;AAAA,MACA,YAAY,gBAAgB,KAAK,GAAG,KAAK;AAAA,IAC3C;AAEA,QAAI,YAAY,kBAAkB;AAChC,eAAS,QAAQ,IAAI,oCAAoC,MAAM;AAAA,IACjE;AAEA,QAAI,YAAY,QAAQ;AACtB,eAAS,QAAQ,IAAI,0BAA0B,YAAY,OAAO,SAAS,CAAC;AAAA,IAC9E;AAEA,WAAO;AAAA,EACT;AAEA,iBAAe,iBAAiB,iBAA4D;AAC1F,UAAM,aAAa,aAAa,eAAe;AAC/C,QAAI,WAAY,QAAO;AAEvB,UAAM,gBAAgB,wBAAwB,eAAe;AAC7D,QAAI,cAAe,QAAO;AAE1B,UAAM,kBAAkB,kBAAkB,eAAe;AACzD,QAAI,gBAAiB,QAAO;AAE5B,WAAO;AAAA,EACT;AAEA,WAAS,aAAa,iBAAmD;AACvE,QAAI,gBAAgB,eAAe,UAAU,QAAQ,CAAC,OAAO,SAAS,IAAI,GAAG;AAC3E,YAAM,gBAAgB,QAAQ,QAAQ,QAAQ,IAAI,kBAAkB,MAAM;AAC1E,YAAM,kBAAkB,YAAY,QAAQ,SAAS,SAAS,IAAI;AAElE,UAAI,CAAC,iBAAiB,CAAC,iBAAiB;AACtC,cAAM,oBAAoB,gBAAgB,iBAAiB;AAAA,UAAK,CAAC,eAC/D,UAAU,SAAS,UAAU;AAAA,QAC/B;AAEA,YAAI,CAAC,mBAAmB;AACtB,qBAAO,yCAAuB,mBAAmB,iBAAiB,GAAG;AAAA,QACvE;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,WAAS,wBAAwB,iBAAmD;AAClF,QAAI,gBAAgB,iBAAiB;AACnC,iBAAW,CAAC,YAAY,aAAa,KAAK,OAAO,QAAQ,gBAAgB,eAAe,GAAG;AACzF,cAAM,cAAc,QAAQ,QAAQ,QAAQ,IAAI,UAAU;AAC1D,YAAI,gBAAgB,eAAe;AACjC,qBAAO;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,WAAS,kBAAkB,iBAAmD;AAC5E,QAAI,gBAAgB,WAAW,OAAO,QAAQ;AAC5C,YAAM,YAAY,gBAAgB,UAAU,MAAM;AAAA,QAAK,CAAC,YACtD,QAAQ,QAAQ,QAAQ,IAAI,YAAY,GAAG,YAAY,EAAE,SAAS,QAAQ,YAAY,CAAC;AAAA,MACzF;AAEA,UAAI,WAAW;AACb,mBAAO,yCAAuB,sBAAsB,iBAAiB,GAAG;AAAA,MAC1E;AAAA,IACF;AAEA,QAAI,gBAAgB,WAAW,OAAO,QAAQ;AAC5C,YAAM,YAAY,gBAAgB,UAAU,MAAM;AAAA,QAAK,CAAC,YACtD,QAAQ,QAAQ,IAAI,YAAY,GAAG,YAAY,EAAE,SAAS,QAAQ,YAAY,CAAC;AAAA,MACjF;AAEA,UAAI,CAAC,WAAW;AACd,mBAAO,yCAAuB,0BAA0B,iBAAiB,GAAG;AAAA,MAC9E;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,kBACP,WACA,iBACiB;AACjB,QAAI,CAAC,WAAW;AACd,iBAAO,yCAAuB,sBAAsB,0BAA0B,GAAG;AAAA,IACnF;AAEA,QAAI,CAAC,iBAAiB;AACpB,iBAAO,yCAAuB,uBAAuB,+BAA+B,GAAG;AAAA,IACzF;AAEA,QAAI,cAAc,iBAAiB;AACjC,iBAAO,yCAAuB,uBAAuB,uBAAuB,GAAG;AAAA,IACjF;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,wBAAyC;AAChD,QAAI,aAAa,SAAS,GAAG;AAC3B,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,WAAS,iBACP,WACA,gBACiB;AACjB,QAAI,CAAC,kBAAkB,CAAC,eAAe,SAAS;AAC9C,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,QAAI,WAAW,aAAa,CAAC,eAAe,QAAQ,SAAS,MAAa,GAAG;AAC3E,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,WAAO;AAAA,EACT;AAEA,WAAS,oBACP,aACA,mBACiB;AACjB,QAAI,CAAC,aAAa;AAChB,iBAAO,yCAAuB,yBAAyB,iCAAiC,GAAG;AAAA,IAC7F;AAEA,QAAI,CAAC,qBAAqB,CAAC,kBAAkB,SAAS;AACpD,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,QAAI,CAAC,kBAAkB,SAAS,SAAS,MAAa,GAAG;AACvD,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,WAAO;AAAA,EACT;AAEA,iBAAe,yBAKZ;AACD,QAAI;AACF,YAAM,OAAO,MAAM,QAAQ,KAAK;AAChC,aAAO,EAAE,MAAM,SAAS,KAAK,SAAS,WAAW,KAAK,UAAU;AAAA,IAClE,SAAS,OAAO;AACd,aAAO;AAAA,QACL,MAAM;AAAA,QACN,WAAO,yCAAuB,0BAA0B,0BAA0B,GAAG;AAAA,MACvF;AAAA,IACF;AAAA,EACF;AAEA,WAAS,gBAAgB,SAA8C;AACrE,QAAI,CAAC,SAAS;AACZ,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAMA,iBAAe,gBAAgB,QAAkE;AAC/F,QAAI,WAAW,aAAa,OAAO,MAAM;AACvC,aAAO;AAAA,QACL,SAAS;AAAA,QACT,cAAc,0BAA0B,OAAO,IAAI;AAAA,MACrD;AAAA,IACF;AACA,UAAM,YAAY,sBAAsB;AACxC,QAAI,WAAW;AACb,aAAO,EAAE,SAAS,OAAO,OAAO,UAAU;AAAA,IAC5C;AAEA,QAAI,OAAO,MAAM;AACf,YAAM,YAAY,MAAM,aAAa,OAAO,IAAI;AAChD,UAAI,WAAW;AACb,eAAO,EAAE,SAAS,OAAO,OAAO,UAAU;AAAA,MAC5C;AAAA,IACF;AAEA,QAAI,OAAO,UAAU;AACnB,YAAM,gBAAgB,MAAM,iBAAiB,OAAO,QAAQ;AAC5D,UAAI,eAAe;AACjB,eAAO,EAAE,SAAS,OAAO,OAAO,cAAc;AAAA,MAChD;AAAA,IACF;AAEA,QAAI,OAAO,UAAU;AACnB,YAAM,gBAAgB,iBAAiB,OAAO,SAAS,MAAM,OAAO,SAAS,MAAM;AACnF,UAAI,eAAe;AACjB,eAAO,EAAE,SAAS,OAAO,OAAO,cAAc;AAAA,MAChD;AAAA,IACF;AAEA,QAAI,OAAO,aAAa;AACtB,YAAM,mBAAmB;AAAA,QACvB,OAAO,YAAY;AAAA,QACnB,OAAO,YAAY;AAAA,MACrB;AACA,UAAI,kBAAkB;AACpB,eAAO,EAAE,SAAS,OAAO,OAAO,iBAAiB;AAAA,MACnD;AAAA,IACF;AAEA,QAAI;AACJ,QAAI,WAAW,WAAW,OAAO,kBAAkB,OAAO,mBAAmB;AAC3E,YAAM,gBAAgB,MAAM,uBAAuB;AACnD,UAAI,cAAc,OAAO;AACvB,eAAO,EAAE,SAAS,OAAO,OAAO,cAAc,MAAM;AAAA,MACtD;AAEA,oBAAc;AAEd,UAAI,OAAO,gBAAgB;AACzB,cAAM,eAAe,gBAAgB,YAAY,OAAO;AACxD,YAAI,cAAc;AAChB,iBAAO,EAAE,SAAS,OAAO,OAAO,aAAa;AAAA,QAC/C;AAAA,MACF;AAEA,UAAI,OAAO,oBAAoB,YAAY,WAAW;AACpD,cAAM,cAAc,UAAM,wBAAQ;AAClC,cAAM,kBAAkB,YAAY,IAAI,WAAW,GAAG;AACtD,cAAM,YAAY,kBAAkB,YAAY,WAAW,eAAe;AAC1E,YAAI,WAAW;AACb,iBAAO,EAAE,SAAS,OAAO,OAAO,UAAU;AAAA,QAC5C;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAKA,WAAS,uBAAuB,YAAuC,CAAC,GAAqB;AAC3F,WAAO;AAAA,MACL,GAAG;AAAA,IACL;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IAEA;AAAA,IAEA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IAEA;AAAA,EACF;AACF;","names":[]}

package/dist/cjs/app-router/admin/index.js

@@ -19,8 +19,6 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var admin_exports = {};
 __export(admin_exports, {
   EndpointRouter: () => import_endpointRouter.EndpointRouter,
-  RequestContextBuilder: () => import_handlerUtils.RequestContextBuilder,
-  ValidationPipeline: () => import_handlerUtils.ValidationPipeline,
   clearNextSessionCookie: () => import_actions.clearNextSessionCookie,
   clearSessionCookieServer: () => import_actions.clearSessionCookieServer,
   createNextSessionCookie: () => import_actions.createNextSessionCookie,
@@ -33,12 +31,9 @@ module.exports = __toCommonJS(admin_exports);
 var import_ternsecureNextjsHandler = require("./ternsecureNextjsHandler");
 var import_actions = require("./actions");
 var import_endpointRouter = require("./endpointRouter");
-var import_handlerUtils = require("./handlerUtils");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   EndpointRouter,
-  RequestContextBuilder,
-  ValidationPipeline,
   clearNextSessionCookie,
   clearSessionCookieServer,
   createNextSessionCookie,

package/dist/cjs/app-router/admin/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/app-router/admin/index.ts"],"sourcesContent":["export { createTernSecureNextJsHandler } from './ternsecureNextjsHandler'\n\nexport {\n    clearSessionCookieServer,\n    clearNextSessionCookie,\n    createSessionCookieServer,\n    createNextSessionCookie,\n    setNextServerSession,\n    setNextServerToken\n} from './actions'\n\nexport { EndpointRouter } from './endpointRouter'\nexport { RequestContextBuilder, ValidationPipeline } from './handlerUtils'\nexport type { HandlerContext } from './handlerUtils'\n\nexport type { TernSecureHandlerOptions, TernSecureInternalHandlerConfig } from './types'"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qCAA8C;AAE9C,qBAOO;AAEP,4BAA+B;AAC/B,0BAA0D;","names":[]}
+{"version":3,"sources":["../../../../src/app-router/admin/index.ts"],"sourcesContent":["export { createTernSecureNextJsHandler } from './ternsecureNextjsHandler'\n\nexport {\n    clearSessionCookieServer,\n    clearNextSessionCookie,\n    createSessionCookieServer,\n    createNextSessionCookie,\n    setNextServerSession,\n    setNextServerToken\n} from './actions'\n\nexport { EndpointRouter } from './endpointRouter'\n\nexport type { TernSecureHandlerOptions } from './types'"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qCAA8C;AAE9C,qBAOO;AAEP,4BAA+B;","names":[]}

package/dist/cjs/app-router/admin/request.js

@@ -0,0 +1,73 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var request_exports = {};
+__export(request_exports, {
+  refreshCookieWithIdToken: () => refreshCookieWithIdToken
+});
+module.exports = __toCommonJS(request_exports);
+var import_backend = require("@tern-secure/backend");
+var import_auth = require("@tern-secure/backend/auth");
+var import_cookie = require("@tern-secure/shared/cookie");
+var import_ternsecureClient = require("../../server/ternsecureClient");
+var import_constants = require("./constants");
+const COOKIE_OPTIONS = {
+  httpOnly: true,
+  secure: process.env.NODE_ENV === "production",
+  sameSite: "strict"
+};
+async function refreshCookieWithIdToken(idToken, cookieStore, options) {
+  const backendClient = await (0, import_ternsecureClient.ternSecureBackendClient)();
+  const authOptions = {
+    firebaseConfig: {
+      apiKey: import_constants.FIREBASE_API_KEY,
+      authDomain: import_constants.FIREBASE_AUTH_DOMAIN,
+      projectId: import_constants.FIREBASE_PROJECT_ID,
+      storageBucket: import_constants.FIREBASE_STORAGE_BUCKET,
+      messagingSenderId: import_constants.FIREBASE_MESSAGING_SENDER_ID,
+      appId: import_constants.FIREBASE_APP_ID,
+      tenantId: options?.tenantId || void 0
+    },
+    apiClient: backendClient
+  };
+  const { createCustomIdAndRefreshToken } = (0, import_auth.getAuth)(authOptions);
+  const customTokens = await createCustomIdAndRefreshToken(idToken);
+  const cookiePrefix = (0, import_cookie.getCookiePrefix)();
+  await Promise.all([
+    cookieStore.set(
+      (0, import_cookie.getCookieName)(import_backend.constants.Cookies.IdToken, cookiePrefix),
+      customTokens.idToken,
+      COOKIE_OPTIONS
+    ),
+    cookieStore.set(
+      (0, import_cookie.getCookieName)(import_backend.constants.Cookies.Refresh, cookiePrefix),
+      customTokens.refreshToken,
+      COOKIE_OPTIONS
+    ),
+    cookieStore.set(
+      (0, import_cookie.getCookieName)(import_backend.constants.Cookies.Custom, cookiePrefix),
+      customTokens.customToken,
+      COOKIE_OPTIONS
+    )
+  ]);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  refreshCookieWithIdToken
+});
+//# sourceMappingURL=request.js.map

package/dist/cjs/app-router/admin/request.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/app-router/admin/request.ts"],"sourcesContent":["import type { AuthenticateRequestOptions } from '@tern-secure/backend';\nimport { constants } from '@tern-secure/backend';\nimport { getAuth } from '@tern-secure/backend/auth';\nimport { getCookieName, getCookiePrefix } from '@tern-secure/shared/cookie';\n\nimport { ternSecureBackendClient } from '../../server/ternsecureClient';\nimport type { NextCookieStore } from '../../utils/NextCookieAdapter';\nimport {\n  FIREBASE_API_KEY,\n  FIREBASE_APP_ID,\n  FIREBASE_AUTH_DOMAIN,\n  FIREBASE_MESSAGING_SENDER_ID,\n  FIREBASE_PROJECT_ID,\n  FIREBASE_STORAGE_BUCKET,\n} from './constants';\nimport type { TernSecureHandlerOptions } from './types';\n\nconst COOKIE_OPTIONS = {\n  httpOnly: true,\n  secure: process.env.NODE_ENV === 'production',\n  sameSite: 'strict' as const,\n};\n\nexport async function refreshCookieWithIdToken(\n  idToken: string,\n  cookieStore: NextCookieStore,\n  options?: TernSecureHandlerOptions,\n): Promise<void> {\n  const backendClient = await ternSecureBackendClient();\n  const authOptions: AuthenticateRequestOptions = {\n    firebaseConfig: {\n      apiKey: FIREBASE_API_KEY,\n      authDomain: FIREBASE_AUTH_DOMAIN,\n      projectId: FIREBASE_PROJECT_ID,\n      storageBucket: FIREBASE_STORAGE_BUCKET,\n      messagingSenderId: FIREBASE_MESSAGING_SENDER_ID,\n      appId: FIREBASE_APP_ID,\n      tenantId: options?.tenantId || undefined,\n    },\n    apiClient: backendClient,\n  };\n\n  const { createCustomIdAndRefreshToken } = getAuth(authOptions);\n\n  const customTokens = await createCustomIdAndRefreshToken(idToken);\n\n  const cookiePrefix = getCookiePrefix();\n\n  await Promise.all([\n    cookieStore.set(\n      getCookieName(constants.Cookies.IdToken, cookiePrefix),\n      customTokens.idToken,\n      COOKIE_OPTIONS,\n    ),\n    cookieStore.set(\n      getCookieName(constants.Cookies.Refresh, cookiePrefix),\n      customTokens.refreshToken,\n      COOKIE_OPTIONS,\n    ),\n    cookieStore.set(\n      getCookieName(constants.Cookies.Custom, cookiePrefix),\n      customTokens.customToken,\n      COOKIE_OPTIONS,\n    ),\n  ]);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,qBAA0B;AAC1B,kBAAwB;AACxB,oBAA+C;AAE/C,8BAAwC;AAExC,uBAOO;AAGP,MAAM,iBAAiB;AAAA,EACrB,UAAU;AAAA,EACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,EACjC,UAAU;AACZ;AAEA,eAAsB,yBACpB,SACA,aACA,SACe;AACf,QAAM,gBAAgB,UAAM,iDAAwB;AACpD,QAAM,cAA0C;AAAA,IAC9C,gBAAgB;AAAA,MACd,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe;AAAA,MACf,mBAAmB;AAAA,MACnB,OAAO;AAAA,MACP,UAAU,SAAS,YAAY;AAAA,IACjC;AAAA,IACA,WAAW;AAAA,EACb;AAEA,QAAM,EAAE,8BAA8B,QAAI,qBAAQ,WAAW;AAE7D,QAAM,eAAe,MAAM,8BAA8B,OAAO;AAEhE,QAAM,mBAAe,+BAAgB;AAErC,QAAM,QAAQ,IAAI;AAAA,IAChB,YAAY;AAAA,UACV,6BAAc,yBAAU,QAAQ,SAAS,YAAY;AAAA,MACrD,aAAa;AAAA,MACb;AAAA,IACF;AAAA,IACA,YAAY;AAAA,UACV,6BAAc,yBAAU,QAAQ,SAAS,YAAY;AAAA,MACrD,aAAa;AAAA,MACb;AAAA,IACF;AAAA,IACA,YAAY;AAAA,UACV,6BAAc,yBAAU,QAAQ,QAAQ,YAAY;AAAA,MACpD,aAAa;AAAA,MACb;AAAA,IACF;AAAA,EACF,CAAC;AACH;","names":[]}