@tern-secure/nextjs 5.2.0-canary.v20250919134427 → 5.2.0-canary.v20251002175916

package/dist/esm/server/ternSecureEdgeMiddleware.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/server/ternSecureEdgeMiddleware.ts"],"sourcesContent":["import type {\r\n  AuthObject,\r\n  RequestOptions,\r\n  TernSecureRequest,\r\n} from '@tern-secure/backend';\r\nimport {\r\n  constants,\r\n  createBackendInstanceClient,\r\n  createTernSecureRequest,\r\n  enableDebugLogging,\r\n} from '@tern-secure/backend';\r\nimport type {\r\n  TernSecureConfig,\r\n} from '@tern-secure/types';\r\nimport { notFound as nextjsNotFound } from 'next/navigation';\r\nimport type { NextMiddleware,NextRequest } from 'next/server';\r\nimport { NextResponse } from 'next/server';\r\n\r\nimport { isRedirect, setHeader } from '../utils/response';\r\nimport { serverRedirectWithAuth } from '../utils/serverRedirectAuth';\r\nimport { createEdgeCompatibleLogger } from '../utils/withLogger';\r\nimport { API_URL, API_VERSION,SIGN_IN_URL, SIGN_UP_URL } from './constant';\r\nimport {\r\n  isNextjsNotFoundError,\r\n  isNextjsRedirectError,\r\n  isRedirectToSignInError,\r\n  isRedirectToSignUpError,\r\n  nextjsRedirectError,\r\n  redirectToSignInError,\r\n  redirectToSignUpError,\r\n} from './nextErrors';\r\nimport { type AuthProtect,createProtect } from './protect';\r\nimport { createRedirect, type RedirectFun } from './redirect';\r\nimport type {\r\n  NextMiddlewareEvtParam,\r\n  NextMiddlewareRequestParam,\r\n  NextMiddlewareReturn,\r\n} from './types';\r\nimport { decorateRequest } from './utils';\r\n\r\nexport type MiddlewareAuthObject = AuthObject & {\r\n  redirectToSignIn: RedirectFun<Response>;\r\n  redirectToSignUp: RedirectFun<Response>;\r\n};\r\n\r\nexport interface MiddlewareAuth {\r\n  (): Promise<MiddlewareAuthObject>;\r\n\r\n  protect: AuthProtect;\r\n}\r\n\r\ntype MiddlewareHandler = (\r\n  auth: MiddlewareAuth,\r\n  request: NextMiddlewareRequestParam,\r\n  event: NextMiddlewareEvtParam,\r\n) => NextMiddlewareReturn;\r\n\r\nexport interface MiddlewareOptions extends RequestOptions {\r\n  debug?: boolean;\r\n  firebaseOptions?: TernSecureConfig;\r\n}\r\ntype MiddlewareOptionsCallback = (\r\n  req: NextRequest,\r\n) => MiddlewareOptions | Promise<MiddlewareOptions>;\r\n\r\ninterface TernSecureMiddleware {\r\n  /**\r\n   * @example\r\n   * export default ternSecureMiddleware((auth, request, event) => { ... }, options);\r\n   */\r\n  (handler: MiddlewareHandler, options?: MiddlewareOptions): NextMiddleware;\r\n\r\n  /**\r\n   * @example\r\n   * export default ternSecureMiddleware((auth, request, event) => { ... }, (req) => options);\r\n   */\r\n  (handler: MiddlewareHandler, options?: MiddlewareOptionsCallback): NextMiddleware;\r\n\r\n  /**\r\n   * @example\r\n   * export default ternSecureMiddleware(options);\r\n   */\r\n  (options?: MiddlewareOptions): NextMiddleware;\r\n  /**\r\n   * @example\r\n   * export default ternSecureMiddleware;\r\n   */\r\n  (request: NextMiddlewareRequestParam, event: NextMiddlewareEvtParam): NextMiddlewareReturn;\r\n}\r\n\r\nconst backendClientDefaultOptions = {\r\n  apiUrl: API_URL,\r\n  apiVersion: API_VERSION,\r\n};\r\n\r\nconst ternSecureBackendClient = async () => {\r\n  return createBackendClientWithOptions({});\r\n};\r\n\r\nconst createBackendClientWithOptions: typeof createBackendInstanceClient = options => {\r\n  return createBackendInstanceClient({\r\n    ...backendClientDefaultOptions,\r\n    ...options,\r\n  });\r\n};\r\n\r\nexport const ternSecureMiddleware = ((\r\n  ...args: unknown[]\r\n): NextMiddleware | NextMiddlewareReturn => {\r\n  const [request, event] = parseRequestAndEvent(args);\r\n  const [handler, params] = parseHandlerAndOptions(args);\r\n\r\n  const middleware = () => {\r\n    const withAuthNextMiddleware: NextMiddleware = async (request, event) => {\r\n      const resolvedParams = typeof params === 'function' ? await params(request) : params;\r\n      const signInUrl = resolvedParams.signInUrl || SIGN_IN_URL;\r\n      const signUpUrl = resolvedParams.signUpUrl || SIGN_UP_URL;\r\n\r\n      const options = {\r\n        signInUrl,\r\n        signUpUrl,\r\n        ...resolvedParams,\r\n      };\r\n\r\n      const logger = createEdgeCompatibleLogger(options.debug);\r\n\r\n      if (options.debug) {\r\n        enableDebugLogging();\r\n      }\r\n\r\n      //const { authObject, headers: authHeaders } =\r\n      //  await authenticateMiddlewareRequest(request, checkRevoked, logger);\r\n\r\n      //const reqBackend = await createBackendInstanceEdge(request, checkRevoked);\r\n      const reqBackendClient = await ternSecureBackendClient();\r\n      //const requestState = reqBackend.requestState;\r\n      //const authObject = requestState.auth();\r\n      //const authHeaders = requestState.headers;\r\n\r\n      const ternSecureRequest = createTernSecureRequest(request);\r\n\r\n      const requestStateClient = await reqBackendClient.authenticateRequest(\r\n        ternSecureRequest,\r\n        options,\r\n      );\r\n\r\n      const authObjectClient = requestStateClient.auth();\r\n\r\n      const { redirectToSignIn } = createMiddlewareRedirects(ternSecureRequest);\r\n\r\n      const { redirectToSignUp } = createMiddlewareRedirects(ternSecureRequest);\r\n\r\n      const protect = await createMiddlewareProtect(\r\n        ternSecureRequest,\r\n        authObjectClient,\r\n        redirectToSignIn,\r\n      );\r\n\r\n      const authObj: MiddlewareAuthObject = Object.assign(authObjectClient, {\r\n        redirectToSignIn,\r\n        redirectToSignUp,\r\n      });\r\n\r\n      const authHandler = () => Promise.resolve(authObj);\r\n      authHandler.protect = protect;\r\n\r\n      let handlerResult: Response = NextResponse.next();\r\n\r\n      try {\r\n        const userHandlerResult = await handler?.(authHandler, request, event);\r\n        handlerResult = userHandlerResult || handlerResult;\r\n      } catch (error: any) {\r\n        handlerResult = handleControlError(error, ternSecureRequest, request);\r\n      }\r\n\r\n      if (requestStateClient.headers) {\r\n        requestStateClient.headers.forEach((value, key) => {\r\n          handlerResult.headers.append(key, value);\r\n        });\r\n      }\r\n\r\n      if (isRedirect(handlerResult)) {\r\n        return serverRedirectWithAuth(ternSecureRequest, handlerResult);\r\n      }\r\n\r\n      decorateRequest(ternSecureRequest, handlerResult, requestStateClient);\r\n      return handlerResult;\r\n    };\r\n\r\n    const fireNextMiddleware: NextMiddleware = async (request) => {\r\n      console.log('[TernSecureMiddleware] Firebase Request URL:', request.url);\r\n      if (isFirebaseCookieRequest(request)) {\r\n        const options = typeof params === 'function' ? await params(request) : params;\r\n        rewriteFirebaseRequest(options, request);\r\n        return handleFirebaseAuthRequest(request);\r\n      }\r\n    };\r\n\r\n    const nextMiddleware: NextMiddleware = async (request, event) => {\r\n       if (isFirebaseCookieRequest(request)) {\r\n        return fireNextMiddleware(request, event);\r\n       }\r\n      return withAuthNextMiddleware(request, event);\r\n    };\r\n\r\n    if (request && event) {\r\n      return nextMiddleware(request, event);\r\n    }\r\n\r\n    return nextMiddleware;\r\n  };\r\n  return middleware();\r\n}) as TernSecureMiddleware;\r\n\r\nconst parseRequestAndEvent = (args: unknown[]) => {\r\n  return [\r\n    args[0] instanceof Request ? args[0] : undefined,\r\n    args[0] instanceof Request ? args[1] : undefined,\r\n  ] as [NextMiddlewareRequestParam | undefined, NextMiddlewareEvtParam | undefined];\r\n};\r\n\r\nconst parseHandlerAndOptions = (args: unknown[]) => {\r\n  return [\r\n    typeof args[0] === 'function' ? args[0] : undefined,\r\n    (args.length === 2 ? args[1] : typeof args[0] === 'function' ? {} : args[0]) || {},\r\n  ] as [MiddlewareHandler | undefined, MiddlewareOptions | MiddlewareOptionsCallback];\r\n};\r\n\r\nconst isFirebaseRequest = (request: NextMiddlewareRequestParam) =>\r\n  request.nextUrl.pathname.startsWith('/__/');\r\n\r\nconst rewriteFirebaseRequest = (options: MiddlewareOptions, request: NextMiddlewareRequestParam) => {\r\n  const newUrl = new URL(request.url);\r\n  newUrl.host = options.firebaseOptions?.authDomain || '';\r\n  newUrl.port = '';\r\n  return NextResponse.rewrite(newUrl);\r\n}\r\n\r\nconst finalTarget = (request: NextMiddlewareRequestParam) => {\r\n  const finalTargetUrl = request.nextUrl.searchParams.get('finalTarget');\r\n  return finalTargetUrl ? new URL(finalTargetUrl, request.url) : undefined;\r\n};\r\n\r\nconst isFirebaseCookieRequest = (request: NextMiddlewareRequestParam) =>\r\n  request.nextUrl.pathname === '/__cookies__';\r\n\r\n/**\r\n * Create middleware redirect functions\r\n */\r\nconst createMiddlewareRedirects = (ternSecureRequest: TernSecureRequest) => {\r\n  const redirectToSignIn: MiddlewareAuthObject['redirectToSignIn'] = (opts = {}) => {\r\n    const url = ternSecureRequest.ternUrl.toString();\r\n    redirectToSignInError(url, opts.returnBackUrl);\r\n  };\r\n\r\n  const redirectToSignUp: MiddlewareAuthObject['redirectToSignUp'] = (opts = {}) => {\r\n    const url = ternSecureRequest.ternUrl.toString();\r\n    redirectToSignUpError(url, opts.returnBackUrl);\r\n  };\r\n\r\n  return { redirectToSignIn, redirectToSignUp };\r\n};\r\n\r\nconst createMiddlewareProtect = (\r\n  ternSecureRequest: TernSecureRequest,\r\n  authObject: AuthObject,\r\n  redirectToSignIn: RedirectFun<Response>,\r\n) => {\r\n  return (async (params: any, options: any) => {\r\n    const notFound = () => nextjsNotFound();\r\n\r\n    const redirect = (url: string) =>\r\n      nextjsRedirectError(url, {\r\n        redirectUrl: url,\r\n      });\r\n\r\n    return createProtect({\r\n      request: ternSecureRequest,\r\n      redirect,\r\n      notFound,\r\n      authObject,\r\n      redirectToSignIn,\r\n    })(params, options);\r\n  }) as unknown as Promise<AuthProtect>;\r\n};\r\n\r\nexport const redirectAdapter = (url: string | URL) => {\r\n  return NextResponse.redirect(url, {\r\n    headers: { [constants.Headers.TernSecureRedirectTo]: 'true' },\r\n  });\r\n};\r\n\r\n/**\r\n * Handle control flow errors in middleware\r\n */\r\nconst handleControlError = (\r\n  error: any,\r\n  ternSecureRequest: TernSecureRequest,\r\n  nextrequest: NextRequest,\r\n): Response => {\r\n  if (isNextjsNotFoundError(error)) {\r\n    return setHeader(\r\n      NextResponse.rewrite(new URL(`/tern_${Date.now()}`, nextrequest.url)),\r\n      constants.Headers.AuthReason,\r\n      'protect-rewrite',\r\n    );\r\n  }\r\n\r\n  const isRedirectToSignIn = isRedirectToSignInError(error);\r\n  const isRedirectToSignUp = isRedirectToSignUpError(error);\r\n\r\n  if (isRedirectToSignIn || isRedirectToSignUp) {\r\n    const redirect = createRedirect({\r\n      redirectAdapter,\r\n      baseUrl: ternSecureRequest.ternUrl,\r\n      signInUrl: SIGN_IN_URL,\r\n      signUpUrl: SIGN_UP_URL,\r\n    });\r\n\r\n    const { returnBackUrl } = error;\r\n\r\n    return redirect[isRedirectToSignIn ? 'redirectToSignIn' : 'redirectToSignUp']({\r\n      returnBackUrl,\r\n    });\r\n  }\r\n\r\n  if (isNextjsRedirectError(error)) {\r\n    return redirectAdapter(error.redirectUrl);\r\n  }\r\n\r\n  throw error;\r\n};\r\n\r\nconst handleFirebaseAuthRequest = async (\r\n  request: NextRequest,\r\n): Promise<NextResponse | null> => {\r\n\r\n  console.log('Checking for __cookies__ path');\r\n\r\n  const isDevMode = process.env.NODE_ENV === 'development';\r\n  const ID_TOKEN_COOKIE_NAME = isDevMode ? `__dev_FIREBASE_[DEFAULT]` : `__HOST-FIREBASE_[DEFAULT]`;\r\n  const REFRESH_TOKEN_COOKIE_NAME = isDevMode\r\n    ? '__dev_FIREBASEID_[DEFAULT]'\r\n    : `__HOST-FIREBASEID_[DEFAULT]`;\r\n  const ID_TOKEN_COOKIE = {\r\n    path: '/',\r\n    secure: !isDevMode,\r\n    sameSite: 'strict',\r\n    partitioned: true,\r\n    name: ID_TOKEN_COOKIE_NAME,\r\n    maxAge: 34560000,\r\n    priority: 'high',\r\n  } as const;\r\n  const REFRESH_TOKEN_COOKIE = {\r\n    ...ID_TOKEN_COOKIE,\r\n    httpOnly: true,\r\n    name: REFRESH_TOKEN_COOKIE_NAME,\r\n  } as const;\r\n\r\n  if (request.nextUrl.pathname === '/__cookies__') {\r\n    console.log('Handling /__cookies__ request');\r\n    const method = request.method;\r\n    if (method === 'DELETE') {\r\n      const response = new NextResponse('');\r\n      response.cookies.delete({ ...ID_TOKEN_COOKIE, maxAge: 0 });\r\n      response.cookies.delete({ ...REFRESH_TOKEN_COOKIE, maxAge: 0 });\r\n      return response;\r\n    }\r\n\r\n    const headers: Record<string, string> = {};\r\n        const headerNames = [\r\n      'content-type',\r\n      'X-Firebase-Client',\r\n      'X-Firebase-gmpid',\r\n      'X-Firebase-AppCheck',\r\n      'X-Client-Version',\r\n    ];\r\n\r\n    headerNames.forEach(headerName => {\r\n      const headerValue = request.headers.get(headerName);\r\n      if (headerValue) {\r\n        headers[headerName] = headerValue;\r\n      }\r\n    });\r\n\r\n    const finalTargetParam = request.nextUrl.searchParams.get('finalTarget');\r\n\r\n    const url = new URL(finalTargetParam || '');\r\n    let body: ReadableStream<any> | string | null = request.body;\r\n\r\n    const isTokenRequest = !!url.pathname.match(/^(\\/securetoken\\.googleapis\\.com)?\\/v1\\/token/);\r\n    const isSignInRequest = !!url.pathname.match(\r\n      /^(\\/identitytoolkit\\.googleapis\\.com)?\\/v1\\/accounts:signInWith/,\r\n    );\r\n\r\n    if (!isTokenRequest && !isSignInRequest)\r\n      throw new Error('Could not determine the request type to proxy');\r\n\r\n    if (isTokenRequest) {\r\n      body = await request.text();\r\n      const bodyParams = new URLSearchParams(body.trim());\r\n      if (bodyParams.has('refresh_token')) {\r\n        const refreshToken = request.cookies.get(REFRESH_TOKEN_COOKIE.name)?.value;\r\n        if (refreshToken) {\r\n          bodyParams.set('refresh_token', refreshToken);\r\n          body = bodyParams.toString();\r\n        }\r\n      }\r\n    }\r\n\r\n    const response = await fetch(url, { method, body, headers });\r\n    const json = await response.json();\r\n\r\n    if (!response.ok) {\r\n      return NextResponse.json(json, { status: response.status, statusText: response.statusText });\r\n    }\r\n\r\n    let refreshToken, idToken, maxAge;\r\n    if (isSignInRequest) {\r\n      refreshToken = json.refreshToken;\r\n      idToken = json.idToken;\r\n      maxAge = json.expiresIn;\r\n      json.refreshToken = 'REDACTED';\r\n    } else {\r\n      refreshToken = json.refresh_token;\r\n      idToken = json.id_token;\r\n      maxAge = json.expires_in;\r\n      json.refresh_token = 'REDACTED';\r\n    }\r\n\r\n    const nextResponse = NextResponse.json(json);\r\n    if (idToken) nextResponse.cookies.set({ ...ID_TOKEN_COOKIE, maxAge, value: idToken });\r\n    if (refreshToken) nextResponse.cookies.set({ ...REFRESH_TOKEN_COOKIE, value: refreshToken });\r\n    return nextResponse;\r\n  }\r\n  return null;\r\n};\r\n"],"mappings":"AAKA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP,SAAS,YAAY,sBAAsB;AAE3C,SAAS,oBAAoB;AAE7B,SAAS,YAAY,iBAAiB;AACtC,SAAS,8BAA8B;AACvC,SAAS,kCAAkC;AAC3C,SAAS,SAAS,aAAY,aAAa,mBAAmB;AAC9D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAA0B,qBAAqB;AAC/C,SAAS,sBAAwC;AAMjD,SAAS,uBAAuB;AAoDhC,MAAM,8BAA8B;AAAA,EAClC,QAAQ;AAAA,EACR,YAAY;AACd;AAEA,MAAM,0BAA0B,YAAY;AAC1C,SAAO,+BAA+B,CAAC,CAAC;AAC1C;AAEA,MAAM,iCAAqE,aAAW;AACpF,SAAO,4BAA4B;AAAA,IACjC,GAAG;AAAA,IACH,GAAG;AAAA,EACL,CAAC;AACH;AAEO,MAAM,uBAAwB,IAChC,SACuC;AAC1C,QAAM,CAAC,SAAS,KAAK,IAAI,qBAAqB,IAAI;AAClD,QAAM,CAAC,SAAS,MAAM,IAAI,uBAAuB,IAAI;AAErD,QAAM,aAAa,MAAM;AACvB,UAAM,yBAAyC,OAAOA,UAASC,WAAU;AACvE,YAAM,iBAAiB,OAAO,WAAW,aAAa,MAAM,OAAOD,QAAO,IAAI;AAC9E,YAAM,YAAY,eAAe,aAAa;AAC9C,YAAM,YAAY,eAAe,aAAa;AAE9C,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,QACA,GAAG;AAAA,MACL;AAEA,YAAM,SAAS,2BAA2B,QAAQ,KAAK;AAEvD,UAAI,QAAQ,OAAO;AACjB,2BAAmB;AAAA,MACrB;AAMA,YAAM,mBAAmB,MAAM,wBAAwB;AAKvD,YAAM,oBAAoB,wBAAwBA,QAAO;AAEzD,YAAM,qBAAqB,MAAM,iBAAiB;AAAA,QAChD;AAAA,QACA;AAAA,MACF;AAEA,YAAM,mBAAmB,mBAAmB,KAAK;AAEjD,YAAM,EAAE,iBAAiB,IAAI,0BAA0B,iBAAiB;AAExE,YAAM,EAAE,iBAAiB,IAAI,0BAA0B,iBAAiB;AAExE,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAEA,YAAM,UAAgC,OAAO,OAAO,kBAAkB;AAAA,QACpE;AAAA,QACA;AAAA,MACF,CAAC;AAED,YAAM,cAAc,MAAM,QAAQ,QAAQ,OAAO;AACjD,kBAAY,UAAU;AAEtB,UAAI,gBAA0B,aAAa,KAAK;AAEhD,UAAI;AACF,cAAM,oBAAoB,MAAM,UAAU,aAAaA,UAASC,MAAK;AACrE,wBAAgB,qBAAqB;AAAA,MACvC,SAAS,OAAY;AACnB,wBAAgB,mBAAmB,OAAO,mBAAmBD,QAAO;AAAA,MACtE;AAEA,UAAI,mBAAmB,SAAS;AAC9B,2BAAmB,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AACjD,wBAAc,QAAQ,OAAO,KAAK,KAAK;AAAA,QACzC,CAAC;AAAA,MACH;AAEA,UAAI,WAAW,aAAa,GAAG;AAC7B,eAAO,uBAAuB,mBAAmB,aAAa;AAAA,MAChE;AAEA,sBAAgB,mBAAmB,eAAe,kBAAkB;AACpE,aAAO;AAAA,IACT;AAEA,UAAM,qBAAqC,OAAOA,aAAY;AAC5D,cAAQ,IAAI,gDAAgDA,SAAQ,GAAG;AACvE,UAAI,wBAAwBA,QAAO,GAAG;AACpC,cAAM,UAAU,OAAO,WAAW,aAAa,MAAM,OAAOA,QAAO,IAAI;AACvE,+BAAuB,SAASA,QAAO;AACvC,eAAO,0BAA0BA,QAAO;AAAA,MAC1C;AAAA,IACF;AAEA,UAAM,iBAAiC,OAAOA,UAASC,WAAU;AAC9D,UAAI,wBAAwBD,QAAO,GAAG;AACrC,eAAO,mBAAmBA,UAASC,MAAK;AAAA,MACzC;AACD,aAAO,uBAAuBD,UAASC,MAAK;AAAA,IAC9C;AAEA,QAAI,WAAW,OAAO;AACpB,aAAO,eAAe,SAAS,KAAK;AAAA,IACtC;AAEA,WAAO;AAAA,EACT;AACA,SAAO,WAAW;AACpB;AAEA,MAAM,uBAAuB,CAAC,SAAoB;AAChD,SAAO;AAAA,IACL,KAAK,CAAC,aAAa,UAAU,KAAK,CAAC,IAAI;AAAA,IACvC,KAAK,CAAC,aAAa,UAAU,KAAK,CAAC,IAAI;AAAA,EACzC;AACF;AAEA,MAAM,yBAAyB,CAAC,SAAoB;AAClD,SAAO;AAAA,IACL,OAAO,KAAK,CAAC,MAAM,aAAa,KAAK,CAAC,IAAI;AAAA,KACzC,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC;AAAA,EACnF;AACF;AAEA,MAAM,oBAAoB,CAAC,YACzB,QAAQ,QAAQ,SAAS,WAAW,MAAM;AAE5C,MAAM,yBAAyB,CAAC,SAA4B,YAAwC;AAClG,QAAM,SAAS,IAAI,IAAI,QAAQ,GAAG;AAClC,SAAO,OAAO,QAAQ,iBAAiB,cAAc;AACrD,SAAO,OAAO;AACd,SAAO,aAAa,QAAQ,MAAM;AACpC;AAEA,MAAM,cAAc,CAAC,YAAwC;AAC3D,QAAM,iBAAiB,QAAQ,QAAQ,aAAa,IAAI,aAAa;AACrE,SAAO,iBAAiB,IAAI,IAAI,gBAAgB,QAAQ,GAAG,IAAI;AACjE;AAEA,MAAM,0BAA0B,CAAC,YAC/B,QAAQ,QAAQ,aAAa;AAK/B,MAAM,4BAA4B,CAAC,sBAAyC;AAC1E,QAAM,mBAA6D,CAAC,OAAO,CAAC,MAAM;AAChF,UAAM,MAAM,kBAAkB,QAAQ,SAAS;AAC/C,0BAAsB,KAAK,KAAK,aAAa;AAAA,EAC/C;AAEA,QAAM,mBAA6D,CAAC,OAAO,CAAC,MAAM;AAChF,UAAM,MAAM,kBAAkB,QAAQ,SAAS;AAC/C,0BAAsB,KAAK,KAAK,aAAa;AAAA,EAC/C;AAEA,SAAO,EAAE,kBAAkB,iBAAiB;AAC9C;AAEA,MAAM,0BAA0B,CAC9B,mBACA,YACA,qBACG;AACH,SAAQ,OAAO,QAAa,YAAiB;AAC3C,UAAM,WAAW,MAAM,eAAe;AAEtC,UAAM,WAAW,CAAC,QAChB,oBAAoB,KAAK;AAAA,MACvB,aAAa;AAAA,IACf,CAAC;AAEH,WAAO,cAAc;AAAA,MACnB,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC,EAAE,QAAQ,OAAO;AAAA,EACpB;AACF;AAEO,MAAM,kBAAkB,CAAC,QAAsB;AACpD,SAAO,aAAa,SAAS,KAAK;AAAA,IAChC,SAAS,EAAE,CAAC,UAAU,QAAQ,oBAAoB,GAAG,OAAO;AAAA,EAC9D,CAAC;AACH;AAKA,MAAM,qBAAqB,CACzB,OACA,mBACA,gBACa;AACb,MAAI,sBAAsB,KAAK,GAAG;AAChC,WAAO;AAAA,MACL,aAAa,QAAQ,IAAI,IAAI,SAAS,KAAK,IAAI,CAAC,IAAI,YAAY,GAAG,CAAC;AAAA,MACpE,UAAU,QAAQ;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,qBAAqB,wBAAwB,KAAK;AACxD,QAAM,qBAAqB,wBAAwB,KAAK;AAExD,MAAI,sBAAsB,oBAAoB;AAC5C,UAAM,WAAW,eAAe;AAAA,MAC9B;AAAA,MACA,SAAS,kBAAkB;AAAA,MAC3B,WAAW;AAAA,MACX,WAAW;AAAA,IACb,CAAC;AAED,UAAM,EAAE,cAAc,IAAI;AAE1B,WAAO,SAAS,qBAAqB,qBAAqB,kBAAkB,EAAE;AAAA,MAC5E;AAAA,IACF,CAAC;AAAA,EACH;AAEA,MAAI,sBAAsB,KAAK,GAAG;AAChC,WAAO,gBAAgB,MAAM,WAAW;AAAA,EAC1C;AAEA,QAAM;AACR;AAEA,MAAM,4BAA4B,OAChC,YACiC;AAEjC,UAAQ,IAAI,+BAA+B;AAE3C,QAAM,YAAY,QAAQ,IAAI,aAAa;AAC3C,QAAM,uBAAuB,YAAY,6BAA6B;AACtE,QAAM,4BAA4B,YAC9B,+BACA;AACJ,QAAM,kBAAkB;AAAA,IACtB,MAAM;AAAA,IACN,QAAQ,CAAC;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AACA,QAAM,uBAAuB;AAAA,IAC3B,GAAG;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AAEA,MAAI,QAAQ,QAAQ,aAAa,gBAAgB;AAC/C,YAAQ,IAAI,+BAA+B;AAC3C,UAAM,SAAS,QAAQ;AACvB,QAAI,WAAW,UAAU;AACvB,YAAMC,YAAW,IAAI,aAAa,EAAE;AACpC,MAAAA,UAAS,QAAQ,OAAO,EAAE,GAAG,iBAAiB,QAAQ,EAAE,CAAC;AACzD,MAAAA,UAAS,QAAQ,OAAO,EAAE,GAAG,sBAAsB,QAAQ,EAAE,CAAC;AAC9D,aAAOA;AAAA,IACT;AAEA,UAAM,UAAkC,CAAC;AACrC,UAAM,cAAc;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,gBAAY,QAAQ,gBAAc;AAChC,YAAM,cAAc,QAAQ,QAAQ,IAAI,UAAU;AAClD,UAAI,aAAa;AACf,gBAAQ,UAAU,IAAI;AAAA,MACxB;AAAA,IACF,CAAC;AAED,UAAM,mBAAmB,QAAQ,QAAQ,aAAa,IAAI,aAAa;AAEvE,UAAM,MAAM,IAAI,IAAI,oBAAoB,EAAE;AAC1C,QAAI,OAA4C,QAAQ;AAExD,UAAM,iBAAiB,CAAC,CAAC,IAAI,SAAS,MAAM,+CAA+C;AAC3F,UAAM,kBAAkB,CAAC,CAAC,IAAI,SAAS;AAAA,MACrC;AAAA,IACF;AAEA,QAAI,CAAC,kBAAkB,CAAC;AACtB,YAAM,IAAI,MAAM,+CAA+C;AAEjE,QAAI,gBAAgB;AAClB,aAAO,MAAM,QAAQ,KAAK;AAC1B,YAAM,aAAa,IAAI,gBAAgB,KAAK,KAAK,CAAC;AAClD,UAAI,WAAW,IAAI,eAAe,GAAG;AACnC,cAAMC,gBAAe,QAAQ,QAAQ,IAAI,qBAAqB,IAAI,GAAG;AACrE,YAAIA,eAAc;AAChB,qBAAW,IAAI,iBAAiBA,aAAY;AAC5C,iBAAO,WAAW,SAAS;AAAA,QAC7B;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,MAAM,QAAQ,CAAC;AAC3D,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,QAAI,CAAC,SAAS,IAAI;AAChB,aAAO,aAAa,KAAK,MAAM,EAAE,QAAQ,SAAS,QAAQ,YAAY,SAAS,WAAW,CAAC;AAAA,IAC7F;AAEA,QAAI,cAAc,SAAS;AAC3B,QAAI,iBAAiB;AACnB,qBAAe,KAAK;AACpB,gBAAU,KAAK;AACf,eAAS,KAAK;AACd,WAAK,eAAe;AAAA,IACtB,OAAO;AACL,qBAAe,KAAK;AACpB,gBAAU,KAAK;AACf,eAAS,KAAK;AACd,WAAK,gBAAgB;AAAA,IACvB;AAEA,UAAM,eAAe,aAAa,KAAK,IAAI;AAC3C,QAAI,QAAS,cAAa,QAAQ,IAAI,EAAE,GAAG,iBAAiB,QAAQ,OAAO,QAAQ,CAAC;AACpF,QAAI,aAAc,cAAa,QAAQ,IAAI,EAAE,GAAG,sBAAsB,OAAO,aAAa,CAAC;AAC3F,WAAO;AAAA,EACT;AACA,SAAO;AACT;","names":["request","event","response","refreshToken"]}
+{"version":3,"sources":["../../../src/server/ternSecureEdgeMiddleware.ts"],"sourcesContent":["import type {\r\n  AuthObject,\r\n  RequestOptions,\r\n  TernSecureRequest,\r\n} from '@tern-secure/backend';\r\nimport {\r\n  constants,\r\n  createTernSecureRequest,\r\n  enableDebugLogging,\r\n} from '@tern-secure/backend';\r\nimport type {\r\n  TernSecureConfig,\r\n} from '@tern-secure/types';\r\nimport { notFound as nextjsNotFound } from 'next/navigation';\r\nimport type { NextMiddleware,NextRequest } from 'next/server';\r\nimport { NextResponse } from 'next/server';\r\n\r\nimport { isRedirect, setHeader } from '../utils/response';\r\nimport { serverRedirectWithAuth } from '../utils/serverRedirectAuth';\r\nimport { createEdgeCompatibleLogger } from '../utils/withLogger';\r\nimport { SIGN_IN_URL, SIGN_UP_URL } from './constant';\r\nimport {\r\n  isNextjsNotFoundError,\r\n  isNextjsRedirectError,\r\n  isRedirectToSignInError,\r\n  isRedirectToSignUpError,\r\n  nextjsRedirectError,\r\n  redirectToSignInError,\r\n  redirectToSignUpError,\r\n} from './nextErrors';\r\nimport { type AuthProtect,createProtect } from './protect';\r\nimport { createRedirect, type RedirectFun } from './redirect';\r\nimport { ternSecureBackendClient } from './ternsecureClient';\r\nimport type {\r\n  NextMiddlewareEvtParam,\r\n  NextMiddlewareRequestParam,\r\n  NextMiddlewareReturn,\r\n} from './types';\r\nimport { decorateRequest } from './utils';\r\n\r\nexport type MiddlewareAuthObject = AuthObject & {\r\n  redirectToSignIn: RedirectFun<Response>;\r\n  redirectToSignUp: RedirectFun<Response>;\r\n};\r\n\r\nexport interface MiddlewareAuth {\r\n  (): Promise<MiddlewareAuthObject>;\r\n\r\n  protect: AuthProtect;\r\n}\r\n\r\ntype MiddlewareHandler = (\r\n  auth: MiddlewareAuth,\r\n  request: NextMiddlewareRequestParam,\r\n  event: NextMiddlewareEvtParam,\r\n) => NextMiddlewareReturn;\r\n\r\nexport interface MiddlewareOptions extends RequestOptions {\r\n  debug?: boolean;\r\n  firebaseOptions?: TernSecureConfig;\r\n}\r\ntype MiddlewareOptionsCallback = (\r\n  req: NextRequest,\r\n) => MiddlewareOptions | Promise<MiddlewareOptions>;\r\n\r\ninterface TernSecureMiddleware {\r\n  /**\r\n   * @example\r\n   * export default ternSecureMiddleware((auth, request, event) => { ... }, options);\r\n   */\r\n  (handler: MiddlewareHandler, options?: MiddlewareOptions): NextMiddleware;\r\n\r\n  /**\r\n   * @example\r\n   * export default ternSecureMiddleware((auth, request, event) => { ... }, (req) => options);\r\n   */\r\n  (handler: MiddlewareHandler, options?: MiddlewareOptionsCallback): NextMiddleware;\r\n\r\n  /**\r\n   * @example\r\n   * export default ternSecureMiddleware(options);\r\n   */\r\n  (options?: MiddlewareOptions): NextMiddleware;\r\n  /**\r\n   * @example\r\n   * export default ternSecureMiddleware;\r\n   */\r\n  (request: NextMiddlewareRequestParam, event: NextMiddlewareEvtParam): NextMiddlewareReturn;\r\n}\r\n\r\nexport const ternSecureMiddleware = ((\r\n  ...args: unknown[]\r\n): NextMiddleware | NextMiddlewareReturn => {\r\n  const [request, event] = parseRequestAndEvent(args);\r\n  const [handler, params] = parseHandlerAndOptions(args);\r\n\r\n  const middleware = () => {\r\n    const withAuthNextMiddleware: NextMiddleware = async (request, event) => {\r\n      const resolvedParams = typeof params === 'function' ? await params(request) : params;\r\n      const signInUrl = resolvedParams.signInUrl || SIGN_IN_URL;\r\n      const signUpUrl = resolvedParams.signUpUrl || SIGN_UP_URL;\r\n\r\n      const options = {\r\n        signInUrl,\r\n        signUpUrl,\r\n        ...resolvedParams,\r\n      };\r\n\r\n      const logger = createEdgeCompatibleLogger(options.debug);\r\n\r\n      if (options.debug) {\r\n        enableDebugLogging();\r\n      }\r\n\r\n      //const { authObject, headers: authHeaders } =\r\n      //  await authenticateMiddlewareRequest(request, checkRevoked, logger);\r\n\r\n      //const reqBackend = await createBackendInstanceEdge(request, checkRevoked);\r\n      const reqBackendClient = await ternSecureBackendClient();\r\n      //const requestState = reqBackend.requestState;\r\n      //const authObject = requestState.auth();\r\n      //const authHeaders = requestState.headers;\r\n\r\n      const ternSecureRequest = createTernSecureRequest(request);\r\n\r\n      const requestStateClient = await reqBackendClient.authenticateRequest(\r\n        ternSecureRequest,\r\n        options,\r\n      );\r\n\r\n      const authObjectClient = requestStateClient.auth();\r\n\r\n      const { redirectToSignIn } = createMiddlewareRedirects(ternSecureRequest);\r\n\r\n      const { redirectToSignUp } = createMiddlewareRedirects(ternSecureRequest);\r\n\r\n      const protect = await createMiddlewareProtect(\r\n        ternSecureRequest,\r\n        authObjectClient,\r\n        redirectToSignIn,\r\n      );\r\n\r\n      const authObj: MiddlewareAuthObject = Object.assign(authObjectClient, {\r\n        redirectToSignIn,\r\n        redirectToSignUp,\r\n      });\r\n\r\n      const authHandler = () => Promise.resolve(authObj);\r\n      authHandler.protect = protect;\r\n\r\n      let handlerResult: Response = NextResponse.next();\r\n\r\n      try {\r\n        const userHandlerResult = await handler?.(authHandler, request, event);\r\n        handlerResult = userHandlerResult || handlerResult;\r\n      } catch (error: any) {\r\n        handlerResult = handleControlError(error, ternSecureRequest, request);\r\n      }\r\n\r\n      if (requestStateClient.headers) {\r\n        requestStateClient.headers.forEach((value, key) => {\r\n          handlerResult.headers.append(key, value);\r\n        });\r\n      }\r\n\r\n      if (isRedirect(handlerResult)) {\r\n        return serverRedirectWithAuth(ternSecureRequest, handlerResult);\r\n      }\r\n\r\n      decorateRequest(ternSecureRequest, handlerResult, requestStateClient);\r\n      return handlerResult;\r\n    };\r\n\r\n\r\n    const nextMiddleware: NextMiddleware = async (request, event) => {\r\n      if(isFirebaseCookieRequest(request)) {\r\n        return handleFirebaseAuthRequest(request);\r\n      }\r\n      return withAuthNextMiddleware(request, event);\r\n    };\r\n\r\n    if (request && event) {\r\n      return nextMiddleware(request, event);\r\n    }\r\n\r\n    return nextMiddleware;\r\n  };\r\n  return middleware();\r\n}) as TernSecureMiddleware;\r\n\r\nconst parseRequestAndEvent = (args: unknown[]) => {\r\n  return [\r\n    args[0] instanceof Request ? args[0] : undefined,\r\n    args[0] instanceof Request ? args[1] : undefined,\r\n  ] as [NextMiddlewareRequestParam | undefined, NextMiddlewareEvtParam | undefined];\r\n};\r\n\r\nconst parseHandlerAndOptions = (args: unknown[]) => {\r\n  return [\r\n    typeof args[0] === 'function' ? args[0] : undefined,\r\n    (args.length === 2 ? args[1] : typeof args[0] === 'function' ? {} : args[0]) || {},\r\n  ] as [MiddlewareHandler | undefined, MiddlewareOptions | MiddlewareOptionsCallback];\r\n};\r\n\r\nconst isFirebaseRequest = (request: NextMiddlewareRequestParam) =>\r\n  request.nextUrl.pathname.startsWith('/__/');\r\n\r\nconst rewriteFirebaseRequest = (options: MiddlewareOptions, request: NextMiddlewareRequestParam) => {\r\n  const newUrl = new URL(request.url);\r\n  newUrl.host = options.firebaseOptions?.authDomain || '';\r\n  newUrl.port = '';\r\n  return NextResponse.rewrite(newUrl);\r\n}\r\n\r\nconst finalTarget = (request: NextMiddlewareRequestParam) => {\r\n  const finalTargetUrl = request.nextUrl.searchParams.get('finalTarget');\r\n  return finalTargetUrl ? new URL(finalTargetUrl, request.url) : undefined;\r\n};\r\n\r\nconst isFirebaseCookieRequest = (request: NextMiddlewareRequestParam) =>\r\n  request.nextUrl.pathname === '/__cookies__';\r\n\r\n/**\r\n * Create middleware redirect functions\r\n */\r\nconst createMiddlewareRedirects = (ternSecureRequest: TernSecureRequest) => {\r\n  const redirectToSignIn: MiddlewareAuthObject['redirectToSignIn'] = (opts = {}) => {\r\n    const url = ternSecureRequest.ternUrl.toString();\r\n    redirectToSignInError(url, opts.returnBackUrl);\r\n  };\r\n\r\n  const redirectToSignUp: MiddlewareAuthObject['redirectToSignUp'] = (opts = {}) => {\r\n    const url = ternSecureRequest.ternUrl.toString();\r\n    redirectToSignUpError(url, opts.returnBackUrl);\r\n  };\r\n\r\n  return { redirectToSignIn, redirectToSignUp };\r\n};\r\n\r\nconst createMiddlewareProtect = (\r\n  ternSecureRequest: TernSecureRequest,\r\n  authObject: AuthObject,\r\n  redirectToSignIn: RedirectFun<Response>,\r\n) => {\r\n  return (async (params: any, options: any) => {\r\n    const notFound = () => nextjsNotFound();\r\n\r\n    const redirect = (url: string) =>\r\n      nextjsRedirectError(url, {\r\n        redirectUrl: url,\r\n      });\r\n\r\n    return createProtect({\r\n      request: ternSecureRequest,\r\n      redirect,\r\n      notFound,\r\n      authObject,\r\n      redirectToSignIn,\r\n    })(params, options);\r\n  }) as unknown as Promise<AuthProtect>;\r\n};\r\n\r\nexport const redirectAdapter = (url: string | URL) => {\r\n  return NextResponse.redirect(url, {\r\n    headers: { [constants.Headers.TernSecureRedirectTo]: 'true' },\r\n  });\r\n};\r\n\r\n/**\r\n * Handle control flow errors in middleware\r\n */\r\nconst handleControlError = (\r\n  error: any,\r\n  ternSecureRequest: TernSecureRequest,\r\n  nextrequest: NextRequest,\r\n): Response => {\r\n  if (isNextjsNotFoundError(error)) {\r\n    return setHeader(\r\n      NextResponse.rewrite(new URL(`/tern_${Date.now()}`, nextrequest.url)),\r\n      constants.Headers.AuthReason,\r\n      'protect-rewrite',\r\n    );\r\n  }\r\n\r\n  const isRedirectToSignIn = isRedirectToSignInError(error);\r\n  const isRedirectToSignUp = isRedirectToSignUpError(error);\r\n\r\n  if (isRedirectToSignIn || isRedirectToSignUp) {\r\n    const redirect = createRedirect({\r\n      redirectAdapter,\r\n      baseUrl: ternSecureRequest.ternUrl,\r\n      signInUrl: SIGN_IN_URL,\r\n      signUpUrl: SIGN_UP_URL,\r\n    });\r\n\r\n    const { returnBackUrl } = error;\r\n\r\n    return redirect[isRedirectToSignIn ? 'redirectToSignIn' : 'redirectToSignUp']({\r\n      returnBackUrl,\r\n    });\r\n  }\r\n\r\n  if (isNextjsRedirectError(error)) {\r\n    return redirectAdapter(error.redirectUrl);\r\n  }\r\n\r\n  throw error;\r\n};\r\n\r\nconst handleFirebaseAuthRequest = async (\r\n  request: NextRequest,\r\n): Promise<NextResponse | null> => {\r\n\r\n  console.log('Checking for __cookies__ path');\r\n\r\n  const isDevMode = process.env.NODE_ENV === 'development';\r\n  const ID_TOKEN_COOKIE_NAME = isDevMode ? `__dev_FIREBASE_[DEFAULT]` : `__HOST-FIREBASE_[DEFAULT]`;\r\n  const REFRESH_TOKEN_COOKIE_NAME = isDevMode\r\n    ? '__dev_FIREBASEID_[DEFAULT]'\r\n    : `__HOST-FIREBASEID_[DEFAULT]`;\r\n  const ID_TOKEN_COOKIE = {\r\n    path: '/',\r\n    secure: !isDevMode,\r\n    sameSite: 'strict',\r\n    partitioned: true,\r\n    name: ID_TOKEN_COOKIE_NAME,\r\n    maxAge: 34560000,\r\n    priority: 'high',\r\n  } as const;\r\n  const REFRESH_TOKEN_COOKIE = {\r\n    ...ID_TOKEN_COOKIE,\r\n    httpOnly: true,\r\n    name: REFRESH_TOKEN_COOKIE_NAME,\r\n  } as const;\r\n\r\n  if (request.nextUrl.pathname === '/__cookies__') {\r\n    console.log('Handling /__cookies__ request');\r\n    const method = request.method;\r\n    if (method === 'DELETE') {\r\n      const response = new NextResponse('');\r\n      response.cookies.delete({ ...ID_TOKEN_COOKIE, maxAge: 0 });\r\n      response.cookies.delete({ ...REFRESH_TOKEN_COOKIE, maxAge: 0 });\r\n      return response;\r\n    }\r\n\r\n    const headers: Record<string, string> = {};\r\n        const headerNames = [\r\n      'content-type',\r\n      'X-Firebase-Client',\r\n      'X-Firebase-gmpid',\r\n      'X-Firebase-AppCheck',\r\n      'X-Client-Version',\r\n    ];\r\n\r\n    headerNames.forEach(headerName => {\r\n      const headerValue = request.headers.get(headerName);\r\n      if (headerValue) {\r\n        headers[headerName] = headerValue;\r\n      }\r\n    });\r\n\r\n    const finalTargetParam = request.nextUrl.searchParams.get('finalTarget');\r\n\r\n    const url = new URL(finalTargetParam || '');\r\n    let body: ReadableStream<any> | string | null = request.body;\r\n\r\n    const isTokenRequest = !!url.pathname.match(/^(\\/securetoken\\.googleapis\\.com)?\\/v1\\/token/);\r\n    const isSignInRequest = !!url.pathname.match(\r\n      /^(\\/identitytoolkit\\.googleapis\\.com)?\\/v1\\/accounts:signInWith/,\r\n    );\r\n\r\n    if (!isTokenRequest && !isSignInRequest)\r\n      throw new Error('Could not determine the request type to proxy');\r\n\r\n    if (isTokenRequest) {\r\n      body = await request.text();\r\n      const bodyParams = new URLSearchParams(body.trim());\r\n      if (bodyParams.has('refresh_token')) {\r\n        const refreshToken = request.cookies.get(REFRESH_TOKEN_COOKIE.name)?.value;\r\n        if (refreshToken) {\r\n          bodyParams.set('refresh_token', refreshToken);\r\n          body = bodyParams.toString();\r\n        }\r\n      }\r\n    }\r\n\r\n    const response = await fetch(url, { method, body, headers });\r\n    const json = await response.json();\r\n\r\n    if (!response.ok) {\r\n      return NextResponse.json(json, { status: response.status, statusText: response.statusText });\r\n    }\r\n\r\n    let refreshToken, idToken, maxAge;\r\n    if (isSignInRequest) {\r\n      refreshToken = json.refreshToken;\r\n      idToken = json.idToken;\r\n      maxAge = json.expiresIn;\r\n      json.refreshToken = 'REDACTED';\r\n    } else {\r\n      refreshToken = json.refresh_token;\r\n      idToken = json.id_token;\r\n      maxAge = json.expires_in;\r\n      json.refresh_token = 'REDACTED';\r\n    }\r\n\r\n    const nextResponse = NextResponse.json(json);\r\n    if (idToken) nextResponse.cookies.set({ ...ID_TOKEN_COOKIE, maxAge, value: idToken });\r\n    if (refreshToken) nextResponse.cookies.set({ ...REFRESH_TOKEN_COOKIE, value: refreshToken });\r\n    return nextResponse;\r\n  }\r\n  return null;\r\n};\r\n"],"mappings":"AAKA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP,SAAS,YAAY,sBAAsB;AAE3C,SAAS,oBAAoB;AAE7B,SAAS,YAAY,iBAAiB;AACtC,SAAS,8BAA8B;AACvC,SAAS,kCAAkC;AAC3C,SAAS,aAAa,mBAAmB;AACzC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAA0B,qBAAqB;AAC/C,SAAS,sBAAwC;AACjD,SAAS,+BAA+B;AAMxC,SAAS,uBAAuB;AAoDzB,MAAM,uBAAwB,IAChC,SACuC;AAC1C,QAAM,CAAC,SAAS,KAAK,IAAI,qBAAqB,IAAI;AAClD,QAAM,CAAC,SAAS,MAAM,IAAI,uBAAuB,IAAI;AAErD,QAAM,aAAa,MAAM;AACvB,UAAM,yBAAyC,OAAOA,UAASC,WAAU;AACvE,YAAM,iBAAiB,OAAO,WAAW,aAAa,MAAM,OAAOD,QAAO,IAAI;AAC9E,YAAM,YAAY,eAAe,aAAa;AAC9C,YAAM,YAAY,eAAe,aAAa;AAE9C,YAAM,UAAU;AAAA,QACd;AAAA,QACA;AAAA,QACA,GAAG;AAAA,MACL;AAEA,YAAM,SAAS,2BAA2B,QAAQ,KAAK;AAEvD,UAAI,QAAQ,OAAO;AACjB,2BAAmB;AAAA,MACrB;AAMA,YAAM,mBAAmB,MAAM,wBAAwB;AAKvD,YAAM,oBAAoB,wBAAwBA,QAAO;AAEzD,YAAM,qBAAqB,MAAM,iBAAiB;AAAA,QAChD;AAAA,QACA;AAAA,MACF;AAEA,YAAM,mBAAmB,mBAAmB,KAAK;AAEjD,YAAM,EAAE,iBAAiB,IAAI,0BAA0B,iBAAiB;AAExE,YAAM,EAAE,iBAAiB,IAAI,0BAA0B,iBAAiB;AAExE,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAEA,YAAM,UAAgC,OAAO,OAAO,kBAAkB;AAAA,QACpE;AAAA,QACA;AAAA,MACF,CAAC;AAED,YAAM,cAAc,MAAM,QAAQ,QAAQ,OAAO;AACjD,kBAAY,UAAU;AAEtB,UAAI,gBAA0B,aAAa,KAAK;AAEhD,UAAI;AACF,cAAM,oBAAoB,MAAM,UAAU,aAAaA,UAASC,MAAK;AACrE,wBAAgB,qBAAqB;AAAA,MACvC,SAAS,OAAY;AACnB,wBAAgB,mBAAmB,OAAO,mBAAmBD,QAAO;AAAA,MACtE;AAEA,UAAI,mBAAmB,SAAS;AAC9B,2BAAmB,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AACjD,wBAAc,QAAQ,OAAO,KAAK,KAAK;AAAA,QACzC,CAAC;AAAA,MACH;AAEA,UAAI,WAAW,aAAa,GAAG;AAC7B,eAAO,uBAAuB,mBAAmB,aAAa;AAAA,MAChE;AAEA,sBAAgB,mBAAmB,eAAe,kBAAkB;AACpE,aAAO;AAAA,IACT;AAGA,UAAM,iBAAiC,OAAOA,UAASC,WAAU;AAC/D,UAAG,wBAAwBD,QAAO,GAAG;AACnC,eAAO,0BAA0BA,QAAO;AAAA,MAC1C;AACA,aAAO,uBAAuBA,UAASC,MAAK;AAAA,IAC9C;AAEA,QAAI,WAAW,OAAO;AACpB,aAAO,eAAe,SAAS,KAAK;AAAA,IACtC;AAEA,WAAO;AAAA,EACT;AACA,SAAO,WAAW;AACpB;AAEA,MAAM,uBAAuB,CAAC,SAAoB;AAChD,SAAO;AAAA,IACL,KAAK,CAAC,aAAa,UAAU,KAAK,CAAC,IAAI;AAAA,IACvC,KAAK,CAAC,aAAa,UAAU,KAAK,CAAC,IAAI;AAAA,EACzC;AACF;AAEA,MAAM,yBAAyB,CAAC,SAAoB;AAClD,SAAO;AAAA,IACL,OAAO,KAAK,CAAC,MAAM,aAAa,KAAK,CAAC,IAAI;AAAA,KACzC,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC;AAAA,EACnF;AACF;AAEA,MAAM,oBAAoB,CAAC,YACzB,QAAQ,QAAQ,SAAS,WAAW,MAAM;AAE5C,MAAM,yBAAyB,CAAC,SAA4B,YAAwC;AAClG,QAAM,SAAS,IAAI,IAAI,QAAQ,GAAG;AAClC,SAAO,OAAO,QAAQ,iBAAiB,cAAc;AACrD,SAAO,OAAO;AACd,SAAO,aAAa,QAAQ,MAAM;AACpC;AAEA,MAAM,cAAc,CAAC,YAAwC;AAC3D,QAAM,iBAAiB,QAAQ,QAAQ,aAAa,IAAI,aAAa;AACrE,SAAO,iBAAiB,IAAI,IAAI,gBAAgB,QAAQ,GAAG,IAAI;AACjE;AAEA,MAAM,0BAA0B,CAAC,YAC/B,QAAQ,QAAQ,aAAa;AAK/B,MAAM,4BAA4B,CAAC,sBAAyC;AAC1E,QAAM,mBAA6D,CAAC,OAAO,CAAC,MAAM;AAChF,UAAM,MAAM,kBAAkB,QAAQ,SAAS;AAC/C,0BAAsB,KAAK,KAAK,aAAa;AAAA,EAC/C;AAEA,QAAM,mBAA6D,CAAC,OAAO,CAAC,MAAM;AAChF,UAAM,MAAM,kBAAkB,QAAQ,SAAS;AAC/C,0BAAsB,KAAK,KAAK,aAAa;AAAA,EAC/C;AAEA,SAAO,EAAE,kBAAkB,iBAAiB;AAC9C;AAEA,MAAM,0BAA0B,CAC9B,mBACA,YACA,qBACG;AACH,SAAQ,OAAO,QAAa,YAAiB;AAC3C,UAAM,WAAW,MAAM,eAAe;AAEtC,UAAM,WAAW,CAAC,QAChB,oBAAoB,KAAK;AAAA,MACvB,aAAa;AAAA,IACf,CAAC;AAEH,WAAO,cAAc;AAAA,MACnB,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC,EAAE,QAAQ,OAAO;AAAA,EACpB;AACF;AAEO,MAAM,kBAAkB,CAAC,QAAsB;AACpD,SAAO,aAAa,SAAS,KAAK;AAAA,IAChC,SAAS,EAAE,CAAC,UAAU,QAAQ,oBAAoB,GAAG,OAAO;AAAA,EAC9D,CAAC;AACH;AAKA,MAAM,qBAAqB,CACzB,OACA,mBACA,gBACa;AACb,MAAI,sBAAsB,KAAK,GAAG;AAChC,WAAO;AAAA,MACL,aAAa,QAAQ,IAAI,IAAI,SAAS,KAAK,IAAI,CAAC,IAAI,YAAY,GAAG,CAAC;AAAA,MACpE,UAAU,QAAQ;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,qBAAqB,wBAAwB,KAAK;AACxD,QAAM,qBAAqB,wBAAwB,KAAK;AAExD,MAAI,sBAAsB,oBAAoB;AAC5C,UAAM,WAAW,eAAe;AAAA,MAC9B;AAAA,MACA,SAAS,kBAAkB;AAAA,MAC3B,WAAW;AAAA,MACX,WAAW;AAAA,IACb,CAAC;AAED,UAAM,EAAE,cAAc,IAAI;AAE1B,WAAO,SAAS,qBAAqB,qBAAqB,kBAAkB,EAAE;AAAA,MAC5E;AAAA,IACF,CAAC;AAAA,EACH;AAEA,MAAI,sBAAsB,KAAK,GAAG;AAChC,WAAO,gBAAgB,MAAM,WAAW;AAAA,EAC1C;AAEA,QAAM;AACR;AAEA,MAAM,4BAA4B,OAChC,YACiC;AAEjC,UAAQ,IAAI,+BAA+B;AAE3C,QAAM,YAAY,QAAQ,IAAI,aAAa;AAC3C,QAAM,uBAAuB,YAAY,6BAA6B;AACtE,QAAM,4BAA4B,YAC9B,+BACA;AACJ,QAAM,kBAAkB;AAAA,IACtB,MAAM;AAAA,IACN,QAAQ,CAAC;AAAA,IACT,UAAU;AAAA,IACV,aAAa;AAAA,IACb,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AACA,QAAM,uBAAuB;AAAA,IAC3B,GAAG;AAAA,IACH,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AAEA,MAAI,QAAQ,QAAQ,aAAa,gBAAgB;AAC/C,YAAQ,IAAI,+BAA+B;AAC3C,UAAM,SAAS,QAAQ;AACvB,QAAI,WAAW,UAAU;AACvB,YAAMC,YAAW,IAAI,aAAa,EAAE;AACpC,MAAAA,UAAS,QAAQ,OAAO,EAAE,GAAG,iBAAiB,QAAQ,EAAE,CAAC;AACzD,MAAAA,UAAS,QAAQ,OAAO,EAAE,GAAG,sBAAsB,QAAQ,EAAE,CAAC;AAC9D,aAAOA;AAAA,IACT;AAEA,UAAM,UAAkC,CAAC;AACrC,UAAM,cAAc;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,gBAAY,QAAQ,gBAAc;AAChC,YAAM,cAAc,QAAQ,QAAQ,IAAI,UAAU;AAClD,UAAI,aAAa;AACf,gBAAQ,UAAU,IAAI;AAAA,MACxB;AAAA,IACF,CAAC;AAED,UAAM,mBAAmB,QAAQ,QAAQ,aAAa,IAAI,aAAa;AAEvE,UAAM,MAAM,IAAI,IAAI,oBAAoB,EAAE;AAC1C,QAAI,OAA4C,QAAQ;AAExD,UAAM,iBAAiB,CAAC,CAAC,IAAI,SAAS,MAAM,+CAA+C;AAC3F,UAAM,kBAAkB,CAAC,CAAC,IAAI,SAAS;AAAA,MACrC;AAAA,IACF;AAEA,QAAI,CAAC,kBAAkB,CAAC;AACtB,YAAM,IAAI,MAAM,+CAA+C;AAEjE,QAAI,gBAAgB;AAClB,aAAO,MAAM,QAAQ,KAAK;AAC1B,YAAM,aAAa,IAAI,gBAAgB,KAAK,KAAK,CAAC;AAClD,UAAI,WAAW,IAAI,eAAe,GAAG;AACnC,cAAMC,gBAAe,QAAQ,QAAQ,IAAI,qBAAqB,IAAI,GAAG;AACrE,YAAIA,eAAc;AAChB,qBAAW,IAAI,iBAAiBA,aAAY;AAC5C,iBAAO,WAAW,SAAS;AAAA,QAC7B;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,MAAM,KAAK,EAAE,QAAQ,MAAM,QAAQ,CAAC;AAC3D,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,QAAI,CAAC,SAAS,IAAI;AAChB,aAAO,aAAa,KAAK,MAAM,EAAE,QAAQ,SAAS,QAAQ,YAAY,SAAS,WAAW,CAAC;AAAA,IAC7F;AAEA,QAAI,cAAc,SAAS;AAC3B,QAAI,iBAAiB;AACnB,qBAAe,KAAK;AACpB,gBAAU,KAAK;AACf,eAAS,KAAK;AACd,WAAK,eAAe;AAAA,IACtB,OAAO;AACL,qBAAe,KAAK;AACpB,gBAAU,KAAK;AACf,eAAS,KAAK;AACd,WAAK,gBAAgB;AAAA,IACvB;AAEA,UAAM,eAAe,aAAa,KAAK,IAAI;AAC3C,QAAI,QAAS,cAAa,QAAQ,IAAI,EAAE,GAAG,iBAAiB,QAAQ,OAAO,QAAQ,CAAC;AACpF,QAAI,aAAc,cAAa,QAAQ,IAAI,EAAE,GAAG,sBAAsB,OAAO,aAAa,CAAC;AAC3F,WAAO;AAAA,EACT;AACA,SAAO;AACT;","names":["request","event","response","refreshToken"]}

package/dist/esm/server/ternsecureClient.js

@@ -0,0 +1,22 @@
+import {
+  createBackendInstanceClient
+} from "@tern-secure/backend";
+import { API_KEY, API_URL, API_VERSION } from "./constant";
+const backendClientDefaultOptions = {
+  apiKey: API_KEY,
+  apiUrl: API_URL,
+  apiVersion: API_VERSION
+};
+const ternSecureBackendClient = async () => {
+  return createBackendClientWithOptions({});
+};
+const createBackendClientWithOptions = (options) => {
+  return createBackendInstanceClient({
+    ...backendClientDefaultOptions,
+    ...options
+  });
+};
+export {
+  ternSecureBackendClient
+};
+//# sourceMappingURL=ternsecureClient.js.map

package/dist/esm/server/ternsecureClient.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/server/ternsecureClient.ts"],"sourcesContent":["import {\n  createBackendInstanceClient,\n} from '@tern-secure/backend';\n\nimport { API_KEY, API_URL, API_VERSION } from './constant';\n\nconst backendClientDefaultOptions = {\n  apiKey: API_KEY,\n  apiUrl: API_URL,\n  apiVersion: API_VERSION,\n};\n\nconst ternSecureBackendClient = async () => {\n  return createBackendClientWithOptions({});\n};\n\nconst createBackendClientWithOptions: typeof createBackendInstanceClient = options => {\n  return createBackendInstanceClient({\n    ...backendClientDefaultOptions,\n    ...options,\n  });\n};\n\nexport { ternSecureBackendClient };"],"mappings":"AAAA;AAAA,EACE;AAAA,OACK;AAEP,SAAS,SAAS,SAAS,mBAAmB;AAE9C,MAAM,8BAA8B;AAAA,EAClC,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,YAAY;AACd;AAEA,MAAM,0BAA0B,YAAY;AAC1C,SAAO,+BAA+B,CAAC,CAAC;AAC1C;AAEA,MAAM,iCAAqE,aAAW;AACpF,SAAO,4BAA4B;AAAA,IACjC,GAAG;AAAA,IACH,GAAG;AAAA,EACL,CAAC;AACH;","names":[]}

package/dist/types/app-router/admin/api/endpoints/abstract.d.ts

@@ -1,18 +1,20 @@
-import type { AuthEndpoint, SessionSubEndpoint, TernSecureInternalHandlerConfig } from '../../types';
+import type { RequestProcessorContext } from '../../c-authenticateRequestProcessor';
+import type { AuthEndpoint, SessionSubEndpoint, TernSecureHandlerOptions } from '../../types';
 export interface HandlerContext {
     request: Request;
     pathSegments: string[];
     endpoint: AuthEndpoint;
-    subEndpoint: SessionSubEndpoint | undefined;
+    subEndpoint: SessionSubEndpoint;
     method: string;
+    requestProcessorContext: RequestProcessorContext;
 }
 export interface EndpointHandler {
     canHandle(endpoint: AuthEndpoint): boolean;
-    handle(handlerContext: HandlerContext, config: TernSecureInternalHandlerConfig): Promise<Response>;
+    handle(context: RequestProcessorContext, config: TernSecureHandlerOptions): Promise<Response>;
 }
 export declare abstract class BaseEndpointHandler implements EndpointHandler {
     abstract canHandle(endpoint: AuthEndpoint): boolean;
-    abstract handle(handlerContext: HandlerContext, config: TernSecureInternalHandlerConfig): Promise<Response>;
+    abstract handle(context: RequestProcessorContext, config: TernSecureHandlerOptions): Promise<Response>;
     protected validateMethod(allowedMethods: string[], method: string): boolean;
     protected validateSubEndpoint(subEndpoint: SessionSubEndpoint | undefined, requiredSubEndpoint?: boolean): boolean;
 }

package/dist/types/app-router/admin/api/endpoints/abstract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"abstract.d.ts","sourceRoot":"","sources":["../../../../../../src/app-router/admin/api/endpoints/abstract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,+BAA+B,EAChC,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,YAAY,CAAC;IACvB,WAAW,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC;IAC3C,MAAM,CACJ,cAAc,EAAE,cAAc,EAC9B,MAAM,EAAE,+BAA+B,GACtC,OAAO,CAAC,QAAQ,CAAC,CAAC;CACtB;AAED,8BAAsB,mBAAoB,YAAW,eAAe;IAClE,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO;IACnD,QAAQ,CAAC,MAAM,CACb,cAAc,EAAE,cAAc,EAC9B,MAAM,EAAE,+BAA+B,GACtC,OAAO,CAAC,QAAQ,CAAC;IAEpB,SAAS,CAAC,cAAc,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAI3E,SAAS,CAAC,mBAAmB,CAC3B,WAAW,EAAE,kBAAkB,GAAG,SAAS,EAC3C,mBAAmB,CAAC,EAAE,OAAO,GAC5B,OAAO;CAMX"}
+{"version":3,"file":"abstract.d.ts","sourceRoot":"","sources":["../../../../../../src/app-router/admin/api/endpoints/abstract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,wBAAwB,EACzB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE,YAAY,CAAC;IACvB,WAAW,EAAE,kBAAkB,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB,EAAE,uBAAuB,CAAC;CAClD;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC;IAC3C,MAAM,CACJ,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,QAAQ,CAAC,CAAC;CACtB;AAED,8BAAsB,mBAAoB,YAAW,eAAe;IAClE,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO;IACnD,QAAQ,CAAC,MAAM,CACb,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,QAAQ,CAAC;IAEpB,SAAS,CAAC,cAAc,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO;IAI3E,SAAS,CAAC,mBAAmB,CAC3B,WAAW,EAAE,kBAAkB,GAAG,SAAS,EAC3C,mBAAmB,CAAC,EAAE,OAAO,GAC5B,OAAO;CAMX"}

package/dist/types/app-router/admin/{claude-authenticateRequestProcessor.d.ts → c-authenticateRequestProcessor.d.ts}

@@ -1,5 +1,5 @@
 import type { TernSecureRequest } from '@tern-secure/backend';
-import type { TernSecureHandlerOptions } from './types';
+import type { AuthEndpoint, SessionSubEndpoint, TernSecureHandlerOptions } from './types';
 /**
  * Request context for better type safety and clarity
  */
@@ -13,10 +13,17 @@ interface RequestProcessorContext extends TernSecureHandlerOptions {
     userAgent: string | undefined;
     secFetchDest: string | undefined;
     accept: string | undefined;
-    sessionTokenInCookie: string | undefined;
+    idTokenInCookie: string | undefined;
     refreshTokenInCookie: string | undefined;
     csrfTokenInCookie: string | undefined;
+    sessionTokenInCookie?: string | undefined;
+    customTokenInCookie?: string | undefined;
+    method: string;
+    pathSegments: string[];
+    endpoint?: AuthEndpoint;
+    subEndpoint?: SessionSubEndpoint;
     ternUrl: URL;
+    instanceType: string;
 }
 /**
  * Request processor utility class for common operations
@@ -25,13 +32,14 @@ declare class RequestProcessorContext implements RequestProcessorContext {
     private ternSecureRequest;
     private options;
     constructor(ternSecureRequest: TernSecureRequest, options: TernSecureHandlerOptions);
+    get request(): TernSecureRequest;
     private initHeaderValues;
     private initCookieValues;
-    private getQueryParam;
+    private initUrlValues;
     private getHeader;
     private getCookie;
     private parseAuthorizationHeader;
 }
 export type { RequestProcessorContext };
-export declare const createRequestProcessor: (ternSecureRequest: TernSecureRequest, options: TernSecureHandlerOptions) => Promise<RequestProcessorContext>;
-//# sourceMappingURL=claude-authenticateRequestProcessor.d.ts.map
+export declare const createRequestProcessor: (ternSecureRequest: TernSecureRequest, options: TernSecureHandlerOptions) => RequestProcessorContext;
+//# sourceMappingURL=c-authenticateRequestProcessor.d.ts.map

package/dist/types/app-router/admin/c-authenticateRequestProcessor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"c-authenticateRequestProcessor.d.ts","sourceRoot":"","sources":["../../../../src/app-router/admin/c-authenticateRequestProcessor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAG9D,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAC;AAE1F;;GAEG;AACH,UAAU,uBAAwB,SAAQ,wBAAwB;IAEhE,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAG3B,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,oBAAoB,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAEjC,OAAO,EAAE,GAAG,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,cAAM,uBAAwB,YAAW,uBAAuB;IAE5D,OAAO,CAAC,iBAAiB;IACzB,OAAO,CAAC,OAAO;gBADP,iBAAiB,EAAE,iBAAiB,EACpC,OAAO,EAAE,wBAAwB;IAS3C,IAAW,OAAO,IAAI,iBAAiB,CAEtC;IAED,OAAO,CAAC,gBAAgB;IAgBxB,OAAO,CAAC,gBAAgB;IAYxB,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,wBAAwB;CAqBjC;AAED,YAAY,EAAE,uBAAuB,EAAE,CAAC;AAExC,eAAO,MAAM,sBAAsB,GACjC,mBAAmB,iBAAiB,EACpC,SAAS,wBAAwB,KAChC,uBAEF,CAAC"}

package/dist/types/app-router/admin/constants.d.ts

@@ -1,2 +1,8 @@
 export declare const TENANT_ID: string;
+export declare const FIREBASE_API_KEY: string;
+export declare const FIREBASE_AUTH_DOMAIN: string;
+export declare const FIREBASE_PROJECT_ID: string;
+export declare const FIREBASE_STORAGE_BUCKET: string;
+export declare const FIREBASE_MESSAGING_SENDER_ID: string;
+export declare const FIREBASE_APP_ID: string;
 //# sourceMappingURL=constants.d.ts.map

package/dist/types/app-router/admin/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app-router/admin/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,SAAS,QAAmD,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/app-router/admin/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,SAAS,QAAmD,CAAC;AAC1E,eAAO,MAAM,gBAAgB,QAAiD,CAAC;AAC/E,eAAO,MAAM,oBAAoB,QAAqD,CAAC;AACvF,eAAO,MAAM,mBAAmB,QAAoD,CAAC;AACrF,eAAO,MAAM,uBAAuB,QAAwD,CAAC;AAC7F,eAAO,MAAM,4BAA4B,QAA6D,CAAC;AACvG,eAAO,MAAM,eAAe,QAAgD,CAAC"}

package/dist/types/app-router/admin/endpointRouter.d.ts

@@ -1,9 +1,12 @@
-import type { EndpointHandler } from './api/endpoints/abstract';
-import type { HandlerContext } from './handlerUtils';
-import type { TernSecureInternalHandlerConfig } from './types';
+import type { RequestProcessorContext } from './c-authenticateRequestProcessor';
+import type { AuthEndpoint, TernSecureHandlerOptions } from './types';
+export interface EndpointHandler {
+    canHandle(endpoint: AuthEndpoint): boolean;
+    handle(context: RequestProcessorContext, config: TernSecureHandlerOptions): Promise<Response>;
+}
 export declare class EndpointRouter {
     private static readonly handlers;
-    static route(handlerContext: HandlerContext, config: TernSecureInternalHandlerConfig): Promise<Response>;
+    static route(context: RequestProcessorContext, config: TernSecureHandlerOptions): Promise<Response>;
     static addHandler(handler: EndpointHandler): void;
     static removeHandler(predicate: (handler: EndpointHandler) => boolean): void;
 }

package/dist/types/app-router/admin/endpointRouter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"endpointRouter.d.ts","sourceRoot":"","sources":["../../../../src/app-router/admin/endpointRouter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAC,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGrD,OAAO,KAAK,EAAgB,+BAA+B,EAAE,MAAM,SAAS,CAAC;AA+B7E,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAG9B;WAEW,KAAK,CAChB,cAAc,EAAE,cAAc,EAC9B,MAAM,EAAE,+BAA+B,GACtC,OAAO,CAAC,QAAQ,CAAC;IAYpB,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI;IAIjD,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,GAAG,IAAI;CAM7E"}
+{"version":3,"file":"endpointRouter.d.ts","sourceRoot":"","sources":["../../../../src/app-router/admin/endpointRouter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAGhF,OAAO,KAAK,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAC;AAEtE,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC;IAC3C,MAAM,CAAC,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC/F;AA2BD,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAkE;WAErF,KAAK,CAChB,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,QAAQ,CAAC;IAgBpB,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI;IAIjD,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,GAAG,IAAI;CAM7E"}

package/dist/types/app-router/admin/fnValidators.d.ts

@@ -1,19 +1,10 @@
+import type { RequestProcessorContext } from './c-authenticateRequestProcessor';
 import type { AuthEndpoint, ComprehensiveValidationResult, CorsOptions, EndpointConfig, SecurityOptions, SessionSubEndpoint, ValidationConfig } from './types';
-export interface RequestContext {
-    request: Request;
-    origin: string | null;
-    host: string | null;
-    referer: string | null;
-    userAgent: string;
-    method: string;
-    pathSegments: string[];
-}
-export declare function createRequestContext(request: Request): RequestContext;
 /**
  * Main validators factory function
  * Returns an object containing all validator functions and utilities
  */
-export declare function createValidators(context: RequestContext): {
+export declare function createValidators(context: RequestProcessorContext): {
     createValidationConfig: (overrides?: Partial<ValidationConfig>) => ValidationConfig;
     validateRequest: (config: ValidationConfig) => Promise<ComprehensiveValidationResult>;
     validateCors: (corsOptions: CorsOptions) => Promise<Response | null>;

package/dist/types/app-router/admin/fnValidators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fnValidators.d.ts","sourceRoot":"","sources":["../../../../src/app-router/admin/fnValidators.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,YAAY,EACZ,6BAA6B,EAC7B,WAAW,EACX,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAGjB,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,cAAc,CAarE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc;yCA6SX,OAAO,CAAC,gBAAgB,CAAC,KAAQ,gBAAgB;8BA9ErD,gBAAgB,KAAG,OAAO,CAAC,6BAA6B,CAAC;gCA5NvD,WAAW,KAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;wCAqD9B,eAAe,KAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;iCA0FzD,QAAQ,GAAG,IAAI;kCAYpC,YAAY,kBACP,cAAc,KAC7B,QAAQ,GAAG,IAAI;uCAaH,kBAAkB,GAAG,SAAS,qBACxB,GAAG,KACrB,QAAQ,GAAG,IAAI;kCAgBuB,OAAO,CAAC;QAC/C,IAAI,EAAE,GAAG,CAAC;QACV,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,QAAQ,CAAC;KAClB,CAAC;+BAYgC,MAAM,GAAG,SAAS,KAAG,QAAQ,GAAG,IAAI;mCAhFzD,MAAM,mBACA,MAAM,GAAG,SAAS,KAClC,QAAQ,GAAG,IAAI;6CAvG8B,WAAW,KAAG,QAAQ;EAwSvE"}
+{"version":3,"file":"fnValidators.d.ts","sourceRoot":"","sources":["../../../../src/app-router/admin/fnValidators.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAEhF,OAAO,KAAK,EACV,YAAY,EACZ,6BAA6B,EAC7B,WAAW,EACX,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAEjB;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB;yCA8SpB,OAAO,CAAC,gBAAgB,CAAC,KAAQ,gBAAgB;8BA9ErD,gBAAgB,KAAG,OAAO,CAAC,6BAA6B,CAAC;gCA5NvD,WAAW,KAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;wCAqD9B,eAAe,KAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;iCA0FzD,QAAQ,GAAG,IAAI;kCAYpC,YAAY,kBACP,cAAc,KAC7B,QAAQ,GAAG,IAAI;uCAaH,kBAAkB,GAAG,SAAS,qBACxB,GAAG,KACrB,QAAQ,GAAG,IAAI;kCAgBuB,OAAO,CAAC;QAC/C,IAAI,EAAE,GAAG,CAAC;QACV,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,QAAQ,CAAC;KAClB,CAAC;+BAYgC,MAAM,GAAG,SAAS,KAAG,QAAQ,GAAG,IAAI;mCAhFzD,MAAM,mBACA,MAAM,GAAG,SAAS,KAClC,QAAQ,GAAG,IAAI;6CAvG8B,WAAW,KAAG,QAAQ;EAwSvE"}

package/dist/types/app-router/admin/index.d.ts

@@ -1,7 +1,5 @@
 export { createTernSecureNextJsHandler } from './ternsecureNextjsHandler';
 export { clearSessionCookieServer, clearNextSessionCookie, createSessionCookieServer, createNextSessionCookie, setNextServerSession, setNextServerToken } from './actions';
 export { EndpointRouter } from './endpointRouter';
-export { RequestContextBuilder, ValidationPipeline } from './handlerUtils';
-export type { HandlerContext } from './handlerUtils';
-export type { TernSecureHandlerOptions, TernSecureInternalHandlerConfig } from './types';
+export type { TernSecureHandlerOptions } from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/app-router/admin/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/app-router/admin/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAA;AAEzE,OAAO,EACH,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EACrB,MAAM,WAAW,CAAA;AAElB,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AAC1E,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpD,YAAY,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/app-router/admin/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAA;AAEzE,OAAO,EACH,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EACrB,MAAM,WAAW,CAAA;AAElB,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEjD,YAAY,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA"}

package/dist/types/app-router/admin/request.d.ts

@@ -0,0 +1,4 @@
+import type { NextCookieStore } from '../../utils/NextCookieAdapter';
+import type { TernSecureHandlerOptions } from './types';
+export declare function refreshCookieWithIdToken(idToken: string, cookieStore: NextCookieStore, options?: TernSecureHandlerOptions): Promise<void>;
+//# sourceMappingURL=request.d.ts.map

package/dist/types/app-router/admin/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../../src/app-router/admin/request.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AASrE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAC;AAQxD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,eAAe,EAC5B,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,IAAI,CAAC,CAsCf"}

package/dist/types/app-router/admin/sessionHandlers.d.ts

@@ -1,25 +1,4 @@
-import type { SessionSubEndpoint, TernSecureHandlerOptions, TernSecureInternalHandlerConfig } from './types';
-/**
- * Session GET request handlers
- */
-export declare class SessionGetHandler {
-    static handle(subEndpoint: SessionSubEndpoint, _config: Required<TernSecureHandlerOptions>): Promise<Response>;
-    private static handleVerify;
-}
-/**
- * Session POST request handlers
- */
-export declare class SessionPostHandler {
-    static handle(request: Request, subEndpoint: SessionSubEndpoint, _config: TernSecureInternalHandlerConfig): Promise<Response>;
-    private static handleCreateSession;
-    private static handleRefreshSession;
-    private static handleRevokeSession;
-}
-/**
- * Main session endpoint orchestrator
- */
-export declare class SessionEndpointHandler {
-    static handle(request: Request, method: string, subEndpoint: SessionSubEndpoint | undefined, config: Required<TernSecureHandlerOptions>): Promise<Response>;
-    private static validateSubEndpoint;
-}
+import { type RequestProcessorContext } from './c-authenticateRequestProcessor';
+import type { TernSecureHandlerOptions } from './types';
+export declare function sessionEndpointHandler(context: RequestProcessorContext, options: TernSecureHandlerOptions): Promise<Response>;
 //# sourceMappingURL=sessionHandlers.d.ts.map

package/dist/types/app-router/admin/sessionHandlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessionHandlers.d.ts","sourceRoot":"","sources":["../../../../src/app-router/admin/sessionHandlers.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,kBAAkB,EAClB,wBAAwB,EACxB,+BAA+B,EAChC,MAAM,SAAS,CAAC;AAGjB;;GAEG;AACH,qBAAa,iBAAiB;WACf,MAAM,CACjB,WAAW,EAAE,kBAAkB,EAC/B,OAAO,EAAE,QAAQ,CAAC,wBAAwB,CAAC,GAC1C,OAAO,CAAC,QAAQ,CAAC;mBASC,YAAY;CAkBlC;AAED;;GAEG;AACH,qBAAa,kBAAkB;WAChB,MAAM,CACjB,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,kBAAkB,EAC/B,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,QAAQ,CAAC;mBA0BC,mBAAmB;mBAmBnB,oBAAoB;mBAyBpB,mBAAmB;CAIzC;AAED;;GAEG;AACH,qBAAa,sBAAsB;WACpB,MAAM,CACjB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,kBAAkB,GAAG,SAAS,EAC3C,MAAM,EAAE,QAAQ,CAAC,wBAAwB,CAAC,GACzC,OAAO,CAAC,QAAQ,CAAC;IA4BpB,OAAO,CAAC,MAAM,CAAC,mBAAmB;CAmBnC"}
+{"version":3,"file":"sessionHandlers.d.ts","sourceRoot":"","sources":["../../../../src/app-router/admin/sessionHandlers.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAIhF,OAAO,KAAK,EAAsB,wBAAwB,EAAE,MAAM,SAAS,CAAC;AAE5E,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,QAAQ,CAAC,CA8HnB"}

package/dist/types/app-router/admin/ternsecureNextjsHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ternsecureNextjsHandler.d.ts","sourceRoot":"","sources":["../../../../src/app-router/admin/ternsecureNextjsHandler.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,wBAAwB,EAAmC,MAAM,SAAS,CAAC;AA+CzF,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,wBAAwB;4BAI7C,OAAO;6BAAP,OAAO;EAaxC"}
+{"version":3,"file":"ternsecureNextjsHandler.d.ts","sourceRoot":"","sources":["../../../../src/app-router/admin/ternsecureNextjsHandler.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAC;AAgBxD,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,wBAAwB;4BAG7C,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;6BAA3B,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;EAqB5D"}

package/dist/types/app-router/admin/types.d.ts

@@ -1,72 +1,33 @@
+import type { AuthEndpoint, CookieOpts as CookieOptions, CorsOptions, EndpointConfig, SecurityOptions, SessionEndpointConfig, SessionSubEndpoint, TernSecureHandlerOptions, TokenCookieConfig } from '@tern-secure/types';
 import { type NextResponse } from 'next/server';
-export interface CorsOptions {
-    allowedOrigins: string[] | '*';
-    allowedMethods?: string[];
-    allowedHeaders?: string[];
-    allowCredentials?: boolean;
-    maxAge?: number;
-    skipSameOrigin?: boolean;
-}
-export interface CookieOptions {
-    name?: string;
-    domain?: string;
-    path?: string;
-    httpOnly?: boolean;
-    sameSite?: 'strict' | 'lax' | 'none';
-    maxAge?: number;
-}
-export interface RateLimitOptions {
-    windowMs?: number;
-    maxRequests?: number;
-    skipSuccessful?: boolean;
-    skipFailedRequests?: boolean;
-}
-export interface SecurityOptions {
-    requireCSRF?: boolean;
-    allowedReferers?: string[];
-    requiredHeaders?: Record<string, string>;
-    ipWhitelist?: string[];
-    userAgent?: {
-        block?: string[];
-        allow?: string[];
+export declare const DEFAULT_CORS_OPTIONS: CorsOptions;
+export declare const DEFAULT_COOKIE_OPTIONS: CookieOptions;
+export declare const FIXED_TOKEN_CONFIGS: {
+    readonly id: {
+        readonly path: "/";
+        readonly httpOnly: true;
+        readonly sameSite: "lax";
+        readonly maxAge: 3600;
     };
-}
-export interface EndpointConfig {
-    enabled: boolean;
-    methods: ('GET' | 'POST' | 'PUT' | 'DELETE')[];
-    requireAuth?: boolean;
-    rateLimit?: RateLimitOptions;
-    security?: SecurityOptions;
-    cors?: Partial<CorsOptions>;
-}
-export interface SessionEndpointConfig extends EndpointConfig {
-    subEndpoints?: {
-        [K in SessionSubEndpoint]?: Partial<EndpointConfig>;
+    readonly refresh: {
+        readonly path: "/";
+        readonly httpOnly: true;
+        readonly sameSite: "lax";
+        readonly maxAge: number;
     };
-}
-export interface TernSecureHandlerOptions {
-    cors?: CorsOptions;
-    cookies?: CookieOptions;
-    rateLimit?: RateLimitOptions;
-    security?: SecurityOptions;
-    endpoints?: {
-        sessions?: SessionEndpointConfig;
+    readonly signature: {
+        readonly path: "/";
+        readonly httpOnly: true;
+        readonly sameSite: "lax";
+        readonly maxAge: number;
+    };
+    readonly custom: {
+        readonly path: "/";
+        readonly httpOnly: true;
+        readonly sameSite: "lax";
+        readonly maxAge: number;
     };
-    debug?: boolean;
-    environment?: 'development' | 'production' | 'test';
-    basePath?: string;
-}
-/**
- * Define an internal config type that extends the public options
- * with server-side only values like tenantId.
- */
-export type TernSecureInternalHandlerConfig = Required<TernSecureHandlerOptions> & {
-    tenantId?: string;
 };
-export type AuthEndpoint = 'sessions' | 'users';
-export type SessionSubEndpoint = 'verify' | 'createsession' | 'refresh' | 'revoke';
-export declare const DEFAULT_CORS_OPTIONS: CorsOptions;
-export declare const DEFAULT_COOKIE_OPTIONS: CookieOptions;
 export declare const DEFAULT_SECURITY_OPTIONS: SecurityOptions;
 export declare const DEFAULT_ENDPOINT_CONFIG: EndpointConfig;
 export declare const DEFAULT_SESSIONS_CONFIG: SessionEndpointConfig;
@@ -101,4 +62,19 @@ export interface ComprehensiveValidationResult {
         csrfToken?: string;
     };
 }
+export type suffix = 'session' | 'id' | 'refresh' | 'signature' | 'custom';
+export declare class CookieUtils {
+    static getCookieName(namePrefix: string, tokenType: suffix): string;
+    static getCookieNames(namePrefix: string): {
+        session: string;
+        id: string;
+        refresh: string;
+        signature: string;
+        custom: string;
+    };
+    static getSessionConfig(cookieOptions: CookieOptions): TokenCookieConfig;
+    static getFixedTokenConfig(cookieOptions: CookieOptions, tokenType: Exclude<suffix, 'session'>): TokenCookieConfig;
+    static validateSessionMaxAge(maxAge: number): boolean;
+}
+export { AuthEndpoint, CookieOptions, CorsOptions, SecurityOptions, SessionSubEndpoint, EndpointConfig, SessionEndpointConfig, TernSecureHandlerOptions, };
 //# sourceMappingURL=types.d.ts.map

package/dist/types/app-router/admin/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app-router/admin/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE;QACV,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,CAAC,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC;IAC/C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,IAAI,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAsB,SAAQ,cAAc;IAC3D,YAAY,CAAC,EAAE;SACZ,CAAC,IAAI,kBAAkB,CAAC,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC;KACpD,CAAC;CACH;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,SAAS,CAAC,EAAE;QACV,QAAQ,CAAC,EAAE,qBAAqB,CAAC;KAClC,CAAC;IAEF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,aAAa,GAAG,YAAY,GAAG,MAAM,CAAC;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,MAAM,+BAA+B,GAAG,QAAQ,CAAC,wBAAwB,CAAC,GAAG;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,OAAO,CAAC;AAChD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,eAAe,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEnF,eAAO,MAAM,oBAAoB,EAAE,WAMlC,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,aAMpC,CAAC;AAEF,eAAO,MAAM,wBAAwB,EAAE,eAStC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,cAKrC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,qBAqCrC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,wBAAwB,CAAC,GAAG;IACzE,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,wBAAwB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;CAiBzE,CAAC;AAGF,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,MAAM,EAAE,cAAc,CAAC;KACxB,CAAC;IACF,WAAW,CAAC,EAAE;QACZ,IAAI,EAAE,kBAAkB,CAAC;QACzB,MAAM,EAAE,cAAc,CAAC;KACxB,CAAC;IACF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,YAAY,CAAC,EAAE,QAAQ,CAAC;IACxB,WAAW,CAAC,EAAE;QACZ,IAAI,EAAE,GAAG,CAAC;QACV,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/app-router/admin/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,IAAI,aAAa,EAC3B,WAAW,EACX,cAAc,EACd,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,eAAO,MAAM,oBAAoB,EAAE,WAMlC,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,aAQpC,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;CAyBtB,CAAC;AAEX,eAAO,MAAM,wBAAwB,EAAE,eAStC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,cAKrC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,qBAqCrC,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,wBAAwB,CAAC,GAAG;IACzE,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,wBAAwB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;CAmBzE,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE;QACT,IAAI,EAAE,YAAY,CAAC;QACnB,MAAM,EAAE,cAAc,CAAC;KACxB,CAAC;IACF,WAAW,CAAC,EAAE;QACZ,IAAI,EAAE,kBAAkB,CAAC;QACzB,MAAM,EAAE,cAAc,CAAC;KACxB,CAAC;IACF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,YAAY,CAAC,EAAE,QAAQ,CAAC;IACxB,WAAW,CAAC,EAAE;QACZ,IAAI,EAAE,GAAG,CAAC;QACV,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,MAAM,MAAM,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;AAE3E,qBAAa,WAAW;IACtB,MAAM,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAInE,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM;;;;;;;IAUxC,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,aAAa,GAAG,iBAAiB;IAaxE,MAAM,CAAC,mBAAmB,CACxB,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,GACpC,iBAAiB;IAYpB,MAAM,CAAC,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;CAKtD;AAED,OAAO,EACL,YAAY,EACZ,aAAa,EACb,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,qBAAqB,EACrB,wBAAwB,GACzB,CAAC"}

package/dist/types/server/constant.d.ts

@@ -1,4 +1,5 @@
-export declare const API_URL: string | undefined;
+export declare const API_KEY: string;
+export declare const API_URL: string;
 export declare const API_VERSION: string;
 export declare const SIGN_IN_URL: string;
 export declare const SIGN_UP_URL: string;

package/dist/types/server/constant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constant.d.ts","sourceRoot":"","sources":["../../../src/server/constant.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,OAAO,oBAAiC,CAAA;AACrD,eAAO,MAAM,WAAW,QAA6C,CAAC;AACtE,eAAO,MAAM,WAAW,QAA4C,CAAC;AACrE,eAAO,MAAM,WAAW,QAA4C,CAAC"}
+{"version":3,"file":"constant.d.ts","sourceRoot":"","sources":["../../../src/server/constant.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,OAAO,QAAiD,CAAC;AACtE,eAAO,MAAM,OAAO,QAAuC,CAAC;AAC5D,eAAO,MAAM,WAAW,QAA6C,CAAC;AACtE,eAAO,MAAM,WAAW,QAA4C,CAAC;AACrE,eAAO,MAAM,WAAW,QAA4C,CAAC"}

package/dist/types/server/ternSecureEdgeMiddleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ternSecureEdgeMiddleware.d.ts","sourceRoot":"","sources":["../../../src/server/ternSecureEdgeMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,cAAc,EAEf,MAAM,sBAAsB,CAAC;AAO9B,OAAO,KAAK,EACV,gBAAgB,EACjB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,cAAc,EAAC,WAAW,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAe3C,OAAO,EAAE,KAAK,WAAW,EAAgB,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EACV,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,EACrB,MAAM,SAAS,CAAC;AAGjB,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG;IAC9C,gBAAgB,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxC,gBAAgB,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;CACzC,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAElC,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,KAAK,iBAAiB,GAAG,CACvB,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,0BAA0B,EACnC,KAAK,EAAE,sBAAsB,KAC1B,oBAAoB,CAAC;AAE1B,MAAM,WAAW,iBAAkB,SAAQ,cAAc;IACvD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,eAAe,CAAC,EAAE,gBAAgB,CAAC;CACpC;AACD,KAAK,yBAAyB,GAAG,CAC/B,GAAG,EAAE,WAAW,KACb,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEpD,UAAU,oBAAoB;IAC5B;;;OAGG;IACH,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,cAAc,CAAC;IAE1E;;;OAGG;IACH,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,cAAc,CAAC;IAElF;;;OAGG;IACH,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,cAAc,CAAC;IAC9C;;;OAGG;IACH,CAAC,OAAO,EAAE,0BAA0B,EAAE,KAAK,EAAE,sBAAsB,GAAG,oBAAoB,CAAC;CAC5F;AAkBD,eAAO,MAAM,oBAAoB,EA0G3B,oBAAoB,CAAC;AA0E3B,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,GAAG,GAAG,0BAIhD,CAAC"}
+{"version":3,"file":"ternSecureEdgeMiddleware.d.ts","sourceRoot":"","sources":["../../../src/server/ternSecureEdgeMiddleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,cAAc,EAEf,MAAM,sBAAsB,CAAC;AAM9B,OAAO,KAAK,EACV,gBAAgB,EACjB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,cAAc,EAAC,WAAW,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAe3C,OAAO,EAAE,KAAK,WAAW,EAAgB,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9D,OAAO,KAAK,EACV,sBAAsB,EACtB,0BAA0B,EAC1B,oBAAoB,EACrB,MAAM,SAAS,CAAC;AAGjB,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG;IAC9C,gBAAgB,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxC,gBAAgB,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;CACzC,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAElC,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,KAAK,iBAAiB,GAAG,CACvB,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,0BAA0B,EACnC,KAAK,EAAE,sBAAsB,KAC1B,oBAAoB,CAAC;AAE1B,MAAM,WAAW,iBAAkB,SAAQ,cAAc;IACvD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,eAAe,CAAC,EAAE,gBAAgB,CAAC;CACpC;AACD,KAAK,yBAAyB,GAAG,CAC/B,GAAG,EAAE,WAAW,KACb,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEpD,UAAU,oBAAoB;IAC5B;;;OAGG;IACH,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,cAAc,CAAC;IAE1E;;;OAGG;IACH,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,cAAc,CAAC;IAElF;;;OAGG;IACH,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,cAAc,CAAC;IAC9C;;;OAGG;IACH,CAAC,OAAO,EAAE,0BAA0B,EAAE,KAAK,EAAE,sBAAsB,GAAG,oBAAoB,CAAC;CAC5F;AAED,eAAO,MAAM,oBAAoB,EAkG3B,oBAAoB,CAAC;AA0E3B,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,GAAG,GAAG,0BAIhD,CAAC"}

package/dist/types/server/ternsecureClient.d.ts

@@ -0,0 +1,3 @@
+declare const ternSecureBackendClient: () => Promise<import("node_modules/@tern-secure/backend/dist/instance/backendInstanceEdge").TernSecureBackendClient>;
+export { ternSecureBackendClient };
+//# sourceMappingURL=ternsecureClient.d.ts.map

package/dist/types/server/ternsecureClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ternsecureClient.d.ts","sourceRoot":"","sources":["../../../src/server/ternsecureClient.ts"],"names":[],"mappings":"AAYA,QAAA,MAAM,uBAAuB,sHAE5B,CAAC;AASF,OAAO,EAAE,uBAAuB,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tern-secure/nextjs",
-  "version": "5.2.0-canary.v20250919134427",
+  "version": "5.2.0-canary.v20251002175916",
   "publishConfig": {
     "access": "public"
   },
@@ -63,10 +63,10 @@
     "jose": "^5.9.6",
     "server-only": "^0.0.1",
     "tslib": "2.4.1",
-    "@tern-secure/backend": "1.2.0-canary.v20250919134427",
-    "@tern-secure/react": "1.2.0-canary.v20250919134427",
-    "@tern-secure/shared": "1.3.0-canary.v20250919134427",
-    "@tern-secure/types": "1.1.0-canary.v20250919134427"
+    "@tern-secure/backend": "1.2.0-canary.v20251002175916",
+    "@tern-secure/react": "1.2.0-canary.v20251002175916",
+    "@tern-secure/shared": "1.3.0-canary.v20251002175916",
+    "@tern-secure/types": "1.1.0-canary.v20251002175916"
   },
   "peerDependencies": {
     "next": "^13.0.0 || ^14.0.0 || ^15.0.0",

package/dist/cjs/app-router/admin/claude-authenticateRequestProcessor.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../src/app-router/admin/claude-authenticateRequestProcessor.ts"],"sourcesContent":["import type { TernSecureRequest } from '@tern-secure/backend';\nimport { constants } from '@tern-secure/backend';\n\nimport type { TernSecureHandlerOptions} from './types';\n\n/**\n * Request context for better type safety and clarity\n */\ninterface RequestProcessorContext extends TernSecureHandlerOptions {\n  // header-based values\n  sessionTokenInHeader: string | undefined;\n  origin: string | undefined;\n  host: string | undefined;\n  forwardedHost: string | undefined;\n  forwardedProto: string | undefined;\n  referrer: string | undefined;\n  userAgent: string | undefined;\n  secFetchDest: string | undefined;\n  accept: string | undefined;\n\n  // cookie-based values\n  sessionTokenInCookie: string | undefined;\n  refreshTokenInCookie: string | undefined;\n  csrfTokenInCookie: string | undefined;\n\n  ternUrl: URL;\n}\n\n/**\n * Request processor utility class for common operations\n */\nclass RequestProcessorContext implements RequestProcessorContext {\n  public constructor(\n    private ternSecureRequest: TernSecureRequest,\n    private options: TernSecureHandlerOptions,\n  ) {\n    this.initHeaderValues();\n    this.initCookieValues();\n    this.ternUrl = this.ternSecureRequest.ternUrl;\n  }\n\n  private initHeaderValues() {\n    this.sessionTokenInHeader = this.parseAuthorizationHeader(\n      this.getHeader(constants.Headers.Authorization),\n    );\n    this.origin = this.getHeader(constants.Headers.Origin);\n    this.host = this.getHeader(constants.Headers.Host);\n    this.forwardedHost = this.getHeader(constants.Headers.ForwardedHost);\n    this.forwardedProto =\n      this.getHeader(constants.Headers.CloudFrontForwardedProto) ||\n      this.getHeader(constants.Headers.ForwardedProto);\n    this.referrer = this.getHeader(constants.Headers.Referrer);\n    this.userAgent = this.getHeader(constants.Headers.UserAgent);\n    this.secFetchDest = this.getHeader(constants.Headers.SecFetchDest);\n    this.accept = this.getHeader(constants.Headers.Accept);\n  }\n\n  private initCookieValues() {\n    //this.sessionTokenInCookie = this.getCookie(this.options.cookies.name);\n    this.csrfTokenInCookie = this.getCookie(constants.Cookies.CsrfToken);\n  }\n\n  private getQueryParam(name: string) {\n    return this.ternSecureRequest.ternUrl.searchParams.get(name);\n  }\n\n  private getHeader(name: string) {\n    return this.ternSecureRequest.headers.get(name) || undefined;\n  }\n\n  private getCookie(name: string) {\n    return this.ternSecureRequest.cookies.get(name) || undefined;\n  }\n\n  private parseAuthorizationHeader(\n    authorizationHeader: string | undefined | null,\n  ): string | undefined {\n    if (!authorizationHeader) {\n      return undefined;\n    }\n\n    const [scheme, token] = authorizationHeader.split(' ', 2);\n\n    if (!token) {\n      // No scheme specified, treat the entire value as the token\n      return scheme;\n    }\n\n    if (scheme === 'Bearer') {\n      return token;\n    }\n\n    // Skip all other schemes\n    return undefined;\n  }\n}\n\nexport type { RequestProcessorContext };\n\nexport const createRequestProcessor = async (\n  ternSecureRequest: TernSecureRequest,\n  options: TernSecureHandlerOptions,\n): Promise<RequestProcessorContext> => {\n  return new RequestProcessorContext(ternSecureRequest, options);\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,qBAA0B;AA8B1B,MAAM,wBAA2D;AAAA,EACxD,YACG,mBACA,SACR;AAFQ;AACA;AAER,SAAK,iBAAiB;AACtB,SAAK,iBAAiB;AACtB,SAAK,UAAU,KAAK,kBAAkB;AAAA,EACxC;AAAA,EAEQ,mBAAmB;AACzB,SAAK,uBAAuB,KAAK;AAAA,MAC/B,KAAK,UAAU,yBAAU,QAAQ,aAAa;AAAA,IAChD;AACA,SAAK,SAAS,KAAK,UAAU,yBAAU,QAAQ,MAAM;AACrD,SAAK,OAAO,KAAK,UAAU,yBAAU,QAAQ,IAAI;AACjD,SAAK,gBAAgB,KAAK,UAAU,yBAAU,QAAQ,aAAa;AACnE,SAAK,iBACH,KAAK,UAAU,yBAAU,QAAQ,wBAAwB,KACzD,KAAK,UAAU,yBAAU,QAAQ,cAAc;AACjD,SAAK,WAAW,KAAK,UAAU,yBAAU,QAAQ,QAAQ;AACzD,SAAK,YAAY,KAAK,UAAU,yBAAU,QAAQ,SAAS;AAC3D,SAAK,eAAe,KAAK,UAAU,yBAAU,QAAQ,YAAY;AACjE,SAAK,SAAS,KAAK,UAAU,yBAAU,QAAQ,MAAM;AAAA,EACvD;AAAA,EAEQ,mBAAmB;AAEzB,SAAK,oBAAoB,KAAK,UAAU,yBAAU,QAAQ,SAAS;AAAA,EACrE;AAAA,EAEQ,cAAc,MAAc;AAClC,WAAO,KAAK,kBAAkB,QAAQ,aAAa,IAAI,IAAI;AAAA,EAC7D;AAAA,EAEQ,UAAU,MAAc;AAC9B,WAAO,KAAK,kBAAkB,QAAQ,IAAI,IAAI,KAAK;AAAA,EACrD;AAAA,EAEQ,UAAU,MAAc;AAC9B,WAAO,KAAK,kBAAkB,QAAQ,IAAI,IAAI,KAAK;AAAA,EACrD;AAAA,EAEQ,yBACN,qBACoB;AACpB,QAAI,CAAC,qBAAqB;AACxB,aAAO;AAAA,IACT;AAEA,UAAM,CAAC,QAAQ,KAAK,IAAI,oBAAoB,MAAM,KAAK,CAAC;AAExD,QAAI,CAAC,OAAO;AAEV,aAAO;AAAA,IACT;AAEA,QAAI,WAAW,UAAU;AACvB,aAAO;AAAA,IACT;AAGA,WAAO;AAAA,EACT;AACF;AAIO,MAAM,yBAAyB,OACpC,mBACA,YACqC;AACrC,SAAO,IAAI,wBAAwB,mBAAmB,OAAO;AAC/D;","names":[]}