@tern-secure/nextjs 5.2.0-canary.v20251030165007 → 5.2.0-canary.v20251125170702

package/dist/cjs/app-router/admin/actions.js

@@ -19,6 +19,7 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var actions_exports = {};
 __export(actions_exports, {
+  RetrieveUser: () => RetrieveUser,
   clearNextSessionCookie: () => clearNextSessionCookie,
   clearSessionCookieServer: () => clearSessionCookieServer,
   createNextSessionCookie: () => createNextSessionCookie,
@@ -56,8 +57,12 @@ async function createNextSessionCookie(idToken) {
 async function verifyNextTernIdToken(idToken) {
   return (0, import_admin.VerifyNextTernIdToken)(idToken);
 }
+function RetrieveUser() {
+  return (0, import_admin.RetrieveUser)(import_constants.TENANT_ID);
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  RetrieveUser,
   clearNextSessionCookie,
   clearSessionCookieServer,
   createNextSessionCookie,

package/dist/cjs/app-router/admin/actions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/app-router/admin/actions.ts"],"sourcesContent":["'use server';\n\nimport {\n  ClearNextSessionCookie,\n  clearSessionCookie,\n  CreateNextSessionCookie,\n  createSessionCookie,\n  SetNextServerSession,\n  SetNextServerToken,\n  VerifyNextTernIdToken\n} from '@tern-secure/backend/admin';\n\nimport { NextCookieStore } from '../../utils/NextCookieAdapter';\nimport { TENANT_ID } from './constants';\nimport { getDeleteOptions } from './cookieOptionsHelper';\nimport type { TernSecureHandlerOptions } from './types';\n\nexport async function createSessionCookieServer(idToken: string) {\n  const cookieStore = new NextCookieStore();\n  return createSessionCookie(idToken, cookieStore);\n}\n\nexport async function clearSessionCookieServer() {\n  const cookieStore = new NextCookieStore();\n  return clearSessionCookie(cookieStore);\n}\n\nexport async function clearNextSessionCookie(options?: {\n  cookies?: TernSecureHandlerOptions['cookies'];\n  revokeRefreshTokensOnSignOut?: boolean;\n}) {\n  const deleteOptions = getDeleteOptions(options);\n  return ClearNextSessionCookie(TENANT_ID, deleteOptions);\n}\n\nexport async function setNextServerSession(idToken: string) {\n  return SetNextServerSession(idToken);\n}\n\nexport async function setNextServerToken(token: string) {\n  return SetNextServerToken(token);\n}\n\nexport async function createNextSessionCookie(idToken: string) {\n  return CreateNextSessionCookie(idToken);\n}\n\nexport async function verifyNextTernIdToken(idToken: string) {\n  return VerifyNextTernIdToken(idToken);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,mBAQO;AAEP,+BAAgC;AAChC,uBAA0B;AAC1B,iCAAiC;AAGjC,eAAsB,0BAA0B,SAAiB;AAC/D,QAAM,cAAc,IAAI,yCAAgB;AACxC,aAAO,kCAAoB,SAAS,WAAW;AACjD;AAEA,eAAsB,2BAA2B;AAC/C,QAAM,cAAc,IAAI,yCAAgB;AACxC,aAAO,iCAAmB,WAAW;AACvC;AAEA,eAAsB,uBAAuB,SAG1C;AACD,QAAM,oBAAgB,6CAAiB,OAAO;AAC9C,aAAO,qCAAuB,4BAAW,aAAa;AACxD;AAEA,eAAsB,qBAAqB,SAAiB;AAC1D,aAAO,mCAAqB,OAAO;AACrC;AAEA,eAAsB,mBAAmB,OAAe;AACtD,aAAO,iCAAmB,KAAK;AACjC;AAEA,eAAsB,wBAAwB,SAAiB;AAC7D,aAAO,sCAAwB,OAAO;AACxC;AAEA,eAAsB,sBAAsB,SAAiB;AAC3D,aAAO,oCAAsB,OAAO;AACtC;","names":[]}
+{"version":3,"sources":["../../../../src/app-router/admin/actions.ts"],"sourcesContent":["'use server';\n\nimport {\n  ClearNextSessionCookie,\n  clearSessionCookie,\n  CreateNextSessionCookie,\n  createSessionCookie,\n  RetrieveUser as RetrieveUserBackend,\n  SetNextServerSession,\n  SetNextServerToken,\n  VerifyNextTernIdToken,\n} from '@tern-secure/backend/admin';\n\nimport { NextCookieStore } from '../../utils/NextCookieAdapter';\nimport { TENANT_ID } from './constants';\nimport { getDeleteOptions } from './cookieOptionsHelper';\nimport type { TernSecureHandlerOptions } from './types';\n\nexport async function createSessionCookieServer(idToken: string) {\n  const cookieStore = new NextCookieStore();\n  return createSessionCookie(idToken, cookieStore);\n}\n\nexport async function clearSessionCookieServer() {\n  const cookieStore = new NextCookieStore();\n  return clearSessionCookie(cookieStore);\n}\n\nexport async function clearNextSessionCookie(options?: {\n  cookies?: TernSecureHandlerOptions['cookies'];\n  revokeRefreshTokensOnSignOut?: boolean;\n}) {\n  const deleteOptions = getDeleteOptions(options);\n  return ClearNextSessionCookie(TENANT_ID, deleteOptions);\n}\n\nexport async function setNextServerSession(idToken: string) {\n  return SetNextServerSession(idToken);\n}\n\nexport async function setNextServerToken(token: string) {\n  return SetNextServerToken(token);\n}\n\nexport async function createNextSessionCookie(idToken: string) {\n  return CreateNextSessionCookie(idToken);\n}\n\nexport async function verifyNextTernIdToken(idToken: string) {\n  return VerifyNextTernIdToken(idToken);\n}\n\nexport function RetrieveUser() {\n  return RetrieveUserBackend(TENANT_ID);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,mBASO;AAEP,+BAAgC;AAChC,uBAA0B;AAC1B,iCAAiC;AAGjC,eAAsB,0BAA0B,SAAiB;AAC/D,QAAM,cAAc,IAAI,yCAAgB;AACxC,aAAO,kCAAoB,SAAS,WAAW;AACjD;AAEA,eAAsB,2BAA2B;AAC/C,QAAM,cAAc,IAAI,yCAAgB;AACxC,aAAO,iCAAmB,WAAW;AACvC;AAEA,eAAsB,uBAAuB,SAG1C;AACD,QAAM,oBAAgB,6CAAiB,OAAO;AAC9C,aAAO,qCAAuB,4BAAW,aAAa;AACxD;AAEA,eAAsB,qBAAqB,SAAiB;AAC1D,aAAO,mCAAqB,OAAO;AACrC;AAEA,eAAsB,mBAAmB,OAAe;AACtD,aAAO,iCAAmB,KAAK;AACjC;AAEA,eAAsB,wBAAwB,SAAiB;AAC7D,aAAO,sCAAwB,OAAO;AACxC;AAEA,eAAsB,sBAAsB,SAAiB;AAC3D,aAAO,oCAAsB,OAAO;AACtC;AAEO,SAAS,eAAe;AAC7B,aAAO,aAAAA,cAAoB,0BAAS;AACtC;","names":["RetrieveUserBackend"]}

package/dist/cjs/app-router/admin/cookieOptionsHelper.js

@@ -18,34 +18,46 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var cookieOptionsHelper_exports = {};
 __export(cookieOptionsHelper_exports, {
-  getCookieOptions: () => getCookieOptions,
-  getDeleteOptions: () => getDeleteOptions
+  getDeleteOptions: () => getDeleteOptions,
+  getIdTokenCookieOptions: () => getIdTokenCookieOptions,
+  getSessionCookieOptions: () => getSessionCookieOptions
 });
 module.exports = __toCommonJS(cookieOptionsHelper_exports);
 var import_types = require("./types");
-function getCookieOptions(config) {
+const ONE_YEAR_IN_SECONDS = 365 * 24 * 60 * 60;
+function getIdTokenCookieOptions() {
   return {
-    path: config?.cookies?.path ?? import_types.DEFAULT_COOKIE_OPTIONS.path ?? "/",
-    httpOnly: config?.cookies?.httpOnly ?? import_types.DEFAULT_COOKIE_OPTIONS.httpOnly ?? true,
-    secure: config?.cookies?.secure ?? import_types.DEFAULT_COOKIE_OPTIONS.secure ?? process.env.NODE_ENV === "production",
-    sameSite: config?.cookies?.sameSite ?? import_types.DEFAULT_COOKIE_OPTIONS.sameSite ?? "strict",
-    maxAge: config?.cookies?.maxAge ?? import_types.DEFAULT_COOKIE_OPTIONS.maxAge,
-    priority: config?.cookies?.priority ?? import_types.DEFAULT_COOKIE_OPTIONS.priority
+    path: "/",
+    httpOnly: true,
+    secure: process.env.NODE_ENV === "production",
+    sameSite: "strict",
+    maxAge: ONE_YEAR_IN_SECONDS,
+    priority: "high"
+  };
+}
+function getSessionCookieOptions(config) {
+  return {
+    path: config?.cookies?.path ?? import_types.DEFAULT_SESSION_COOKIE_OPTIONS.path ?? "/",
+    httpOnly: config?.cookies?.httpOnly ?? import_types.DEFAULT_SESSION_COOKIE_OPTIONS.httpOnly ?? true,
+    secure: config?.cookies?.secure ?? import_types.DEFAULT_SESSION_COOKIE_OPTIONS.secure ?? process.env.NODE_ENV === "production",
+    sameSite: config?.cookies?.sameSite ?? import_types.DEFAULT_SESSION_COOKIE_OPTIONS.sameSite ?? "strict",
+    maxAge: config?.cookies?.maxAge ?? import_types.DEFAULT_SESSION_COOKIE_OPTIONS.maxAge,
+    priority: config?.cookies?.priority ?? import_types.DEFAULT_SESSION_COOKIE_OPTIONS.priority
   };
 }
 function getDeleteOptions(options) {
   return {
-    path: options?.cookies?.path ?? import_types.DEFAULT_COOKIE_OPTIONS.path ?? "/",
-    httpOnly: options?.cookies?.httpOnly ?? import_types.DEFAULT_COOKIE_OPTIONS.httpOnly ?? true,
-    secure: options?.cookies?.secure ?? import_types.DEFAULT_COOKIE_OPTIONS.secure ?? process.env.NODE_ENV === "production",
-    sameSite: options?.cookies?.sameSite ?? import_types.DEFAULT_COOKIE_OPTIONS.sameSite ?? "strict",
+    path: options?.cookies?.path ?? import_types.DEFAULT_ID_REFRESH_TOKEN_COOKIE_OPTIONS.path ?? "/",
+    httpOnly: options?.cookies?.httpOnly ?? import_types.DEFAULT_ID_REFRESH_TOKEN_COOKIE_OPTIONS.httpOnly ?? true,
+    secure: options?.cookies?.secure ?? import_types.DEFAULT_ID_REFRESH_TOKEN_COOKIE_OPTIONS.secure ?? process.env.NODE_ENV === "production",
+    sameSite: options?.cookies?.sameSite ?? import_types.DEFAULT_ID_REFRESH_TOKEN_COOKIE_OPTIONS.sameSite ?? "strict",
     revokeRefreshTokensOnSignOut: options?.revokeRefreshTokensOnSignOut ?? true
-    // Domain is intentionally omitted to use current domain
   };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  getCookieOptions,
-  getDeleteOptions
+  getDeleteOptions,
+  getIdTokenCookieOptions,
+  getSessionCookieOptions
 });
 //# sourceMappingURL=cookieOptionsHelper.js.map

package/dist/cjs/app-router/admin/cookieOptionsHelper.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/app-router/admin/cookieOptionsHelper.ts"],"sourcesContent":["import type { CookieOptions, TernSecureHandlerOptions } from '@tern-secure/types';\n\nimport { DEFAULT_COOKIE_OPTIONS } from './types';\n\n/**\n * Creates complete cookie options by merging config with defaults\n * Used for both setting and deleting cookies to ensure consistency\n */\nexport function getCookieOptions(\n  config?: TernSecureHandlerOptions,\n): Required<Pick<CookieOptions, 'path' | 'httpOnly' | 'secure' | 'sameSite'>> &\n  Pick<CookieOptions, 'maxAge' | 'priority'> {\n  return {\n    path: config?.cookies?.path ?? DEFAULT_COOKIE_OPTIONS.path ?? '/',\n    httpOnly: config?.cookies?.httpOnly ?? DEFAULT_COOKIE_OPTIONS.httpOnly ?? true,\n    secure:\n      config?.cookies?.secure ?? DEFAULT_COOKIE_OPTIONS.secure ?? process.env.NODE_ENV === 'production',\n    sameSite: config?.cookies?.sameSite ?? DEFAULT_COOKIE_OPTIONS.sameSite ?? 'strict',\n    maxAge: config?.cookies?.maxAge ?? DEFAULT_COOKIE_OPTIONS.maxAge,\n    priority: config?.cookies?.priority ?? DEFAULT_COOKIE_OPTIONS.priority,\n  };\n}\n\n/**\n * Extracts options needed for cookie deletion\n * For __HOST- prefixed cookies, all security attributes must match\n * @param options - Object containing cookies config and revokeRefreshTokensOnSignOut flag\n */\nexport function getDeleteOptions(options?: {\n  cookies?: TernSecureHandlerOptions['cookies'];\n  revokeRefreshTokensOnSignOut?: boolean;\n}): {\n  path: string;\n  httpOnly?: boolean;\n  secure?: boolean;\n  domain?: string;\n  sameSite?: 'lax' | 'strict' | 'none';\n  revokeRefreshTokensOnSignOut?: boolean;\n} {\n  return {\n    path: options?.cookies?.path ?? DEFAULT_COOKIE_OPTIONS.path ?? '/',\n    httpOnly: options?.cookies?.httpOnly ?? DEFAULT_COOKIE_OPTIONS.httpOnly ?? true,\n    secure:\n      options?.cookies?.secure ?? DEFAULT_COOKIE_OPTIONS.secure ?? process.env.NODE_ENV === 'production',\n    sameSite: options?.cookies?.sameSite ?? DEFAULT_COOKIE_OPTIONS.sameSite ?? 'strict',\n    revokeRefreshTokensOnSignOut: options?.revokeRefreshTokensOnSignOut ?? true,\n    // Domain is intentionally omitted to use current domain\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,mBAAuC;AAMhC,SAAS,iBACd,QAE2C;AAC3C,SAAO;AAAA,IACL,MAAM,QAAQ,SAAS,QAAQ,oCAAuB,QAAQ;AAAA,IAC9D,UAAU,QAAQ,SAAS,YAAY,oCAAuB,YAAY;AAAA,IAC1E,QACE,QAAQ,SAAS,UAAU,oCAAuB,UAAU,QAAQ,IAAI,aAAa;AAAA,IACvF,UAAU,QAAQ,SAAS,YAAY,oCAAuB,YAAY;AAAA,IAC1E,QAAQ,QAAQ,SAAS,UAAU,oCAAuB;AAAA,IAC1D,UAAU,QAAQ,SAAS,YAAY,oCAAuB;AAAA,EAChE;AACF;AAOO,SAAS,iBAAiB,SAU/B;AACA,SAAO;AAAA,IACL,MAAM,SAAS,SAAS,QAAQ,oCAAuB,QAAQ;AAAA,IAC/D,UAAU,SAAS,SAAS,YAAY,oCAAuB,YAAY;AAAA,IAC3E,QACE,SAAS,SAAS,UAAU,oCAAuB,UAAU,QAAQ,IAAI,aAAa;AAAA,IACxF,UAAU,SAAS,SAAS,YAAY,oCAAuB,YAAY;AAAA,IAC3E,8BAA8B,SAAS,gCAAgC;AAAA;AAAA,EAEzE;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/app-router/admin/cookieOptionsHelper.ts"],"sourcesContent":["import type { CookieOptions, TernSecureHandlerOptions } from '@tern-secure/types';\n\nimport { DEFAULT_ID_REFRESH_TOKEN_COOKIE_OPTIONS, DEFAULT_SESSION_COOKIE_OPTIONS } from './types';\n\nconst ONE_YEAR_IN_SECONDS = 365 * 24 * 60 * 60;\n\n\nexport function getIdTokenCookieOptions(\n): Required<Pick<CookieOptions, 'path' | 'httpOnly' | 'secure' | 'sameSite'>> &\n  Pick<CookieOptions, 'maxAge' | 'priority'> {\n  return {\n    path: '/',\n    httpOnly: true,\n    secure: process.env.NODE_ENV === 'production',\n    sameSite: 'strict',\n    maxAge: ONE_YEAR_IN_SECONDS,\n    priority: 'high',\n  };\n}\n\nexport function getSessionCookieOptions(\n  config?: TernSecureHandlerOptions,\n): Required<Pick<CookieOptions, 'path' | 'httpOnly' | 'secure' | 'sameSite'>> &\n  Pick<CookieOptions, 'maxAge' | 'priority'> {\n  return {\n    path: config?.cookies?.path ?? DEFAULT_SESSION_COOKIE_OPTIONS.path ?? '/',\n    httpOnly: config?.cookies?.httpOnly ?? DEFAULT_SESSION_COOKIE_OPTIONS.httpOnly ?? true,\n    secure:\n      config?.cookies?.secure ?? DEFAULT_SESSION_COOKIE_OPTIONS.secure ?? process.env.NODE_ENV === 'production',\n    sameSite: config?.cookies?.sameSite ?? DEFAULT_SESSION_COOKIE_OPTIONS.sameSite ?? 'strict',\n    maxAge: config?.cookies?.maxAge ?? DEFAULT_SESSION_COOKIE_OPTIONS.maxAge,\n    priority: config?.cookies?.priority ?? DEFAULT_SESSION_COOKIE_OPTIONS.priority,\n  };\n}\n\n\nexport function getDeleteOptions(options?: {\n  cookies?: TernSecureHandlerOptions['cookies'];\n  revokeRefreshTokensOnSignOut?: boolean;\n}): {\n  path: string;\n  httpOnly?: boolean;\n  secure?: boolean;\n  domain?: string;\n  sameSite?: 'lax' | 'strict' | 'none';\n  revokeRefreshTokensOnSignOut?: boolean;\n} {\n  return {\n    path: options?.cookies?.path ?? DEFAULT_ID_REFRESH_TOKEN_COOKIE_OPTIONS.path ?? '/',\n    httpOnly: options?.cookies?.httpOnly ?? DEFAULT_ID_REFRESH_TOKEN_COOKIE_OPTIONS.httpOnly ?? true,\n    secure:\n      options?.cookies?.secure ?? DEFAULT_ID_REFRESH_TOKEN_COOKIE_OPTIONS.secure ?? process.env.NODE_ENV === 'production',\n    sameSite: options?.cookies?.sameSite ?? DEFAULT_ID_REFRESH_TOKEN_COOKIE_OPTIONS.sameSite ?? 'strict',\n    revokeRefreshTokensOnSignOut: options?.revokeRefreshTokensOnSignOut ?? true,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,mBAAwF;AAExF,MAAM,sBAAsB,MAAM,KAAK,KAAK;AAGrC,SAAS,0BAE6B;AAC3C,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AACF;AAEO,SAAS,wBACd,QAE2C;AAC3C,SAAO;AAAA,IACL,MAAM,QAAQ,SAAS,QAAQ,4CAA+B,QAAQ;AAAA,IACtE,UAAU,QAAQ,SAAS,YAAY,4CAA+B,YAAY;AAAA,IAClF,QACE,QAAQ,SAAS,UAAU,4CAA+B,UAAU,QAAQ,IAAI,aAAa;AAAA,IAC/F,UAAU,QAAQ,SAAS,YAAY,4CAA+B,YAAY;AAAA,IAClF,QAAQ,QAAQ,SAAS,UAAU,4CAA+B;AAAA,IAClE,UAAU,QAAQ,SAAS,YAAY,4CAA+B;AAAA,EACxE;AACF;AAGO,SAAS,iBAAiB,SAU/B;AACA,SAAO;AAAA,IACL,MAAM,SAAS,SAAS,QAAQ,qDAAwC,QAAQ;AAAA,IAChF,UAAU,SAAS,SAAS,YAAY,qDAAwC,YAAY;AAAA,IAC5F,QACE,SAAS,SAAS,UAAU,qDAAwC,UAAU,QAAQ,IAAI,aAAa;AAAA,IACzG,UAAU,SAAS,SAAS,YAAY,qDAAwC,YAAY;AAAA,IAC5F,8BAA8B,SAAS,gCAAgC;AAAA,EACzE;AACF;","names":[]}

package/dist/cjs/app-router/admin/endpointRouter.js

@@ -49,11 +49,20 @@ class CookieHandler {
     return await (0, import_sessionHandlers.cookieEndpointHandler)(context, config);
   }
 }
+class SignInsHandler {
+  canHandle(endpoint) {
+    return endpoint === "sign_ins";
+  }
+  async handle(context, config) {
+    return await (0, import_sessionHandlers.signInEndpointHandler)(context, config);
+  }
+}
 class EndpointRouter {
   static handlers = [
     new SessionsHandler(),
     new UsersHandler(),
-    new CookieHandler()
+    new CookieHandler(),
+    new SignInsHandler()
   ];
   static async route(context, config) {
     const { endpoint } = context;

package/dist/cjs/app-router/admin/endpointRouter.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/app-router/admin/endpointRouter.ts"],"sourcesContent":["import type { RequestProcessorContext } from './c-authenticateRequestProcessor';\nimport { createApiErrorResponse } from './responses';\nimport { cookieEndpointHandler, sessionEndpointHandler } from './sessionHandlers';\nimport type { AuthEndpoint, TernSecureHandlerOptions } from './types';\n\nexport interface EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean;\n  handle(context: RequestProcessorContext, config: TernSecureHandlerOptions): Promise<Response>;\n}\n\nclass SessionsHandler implements EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean {\n    return endpoint === 'sessions';\n  }\n\n  async handle(\n    context: RequestProcessorContext,\n    config: TernSecureHandlerOptions,\n  ): Promise<Response> {\n    return await sessionEndpointHandler(context, config);\n  }\n}\n\nclass UsersHandler implements EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean {\n    return endpoint === 'users';\n  }\n\n  handle(_context: RequestProcessorContext, _config: TernSecureHandlerOptions): Promise<Response> {\n    return Promise.resolve(\n      createApiErrorResponse('ENDPOINT_NOT_IMPLEMENTED', 'Users endpoint not implemented', 501),\n    );\n  }\n}\n\nclass CookieHandler implements EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean {\n    return endpoint === 'cookies';\n  }\n\n  async handle(\n    context: RequestProcessorContext,\n    config: TernSecureHandlerOptions,\n  ): Promise<Response> {\n    return await cookieEndpointHandler(context, config);\n  }\n}\n\nexport class EndpointRouter {\n  private static readonly handlers: EndpointHandler[] = [\n    new SessionsHandler(),\n    new UsersHandler(),\n    new CookieHandler(),\n  ];\n\n  static async route(\n    context: RequestProcessorContext,\n    config: TernSecureHandlerOptions,\n  ): Promise<Response> {\n    const { endpoint } = context;\n\n    if (!endpoint) {\n      return createApiErrorResponse('ENDPOINT_REQUIRED', 'Endpoint is required', 400);\n    }\n\n    const handler = this.handlers.find(h => h.canHandle(endpoint));\n\n    if (!handler) {\n      return createApiErrorResponse('ENDPOINT_NOT_FOUND', 'Endpoint not found', 404);\n    }\n\n    return handler.handle(context, config);\n  }\n\n  static addHandler(handler: EndpointHandler): void {\n    this.handlers.push(handler);\n  }\n\n  static removeHandler(predicate: (handler: EndpointHandler) => boolean): void {\n    const index = this.handlers.findIndex(predicate);\n    if (index > -1) {\n      this.handlers.splice(index, 1);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,uBAAuC;AACvC,6BAA8D;AAQ9D,MAAM,gBAA2C;AAAA,EAC/C,UAAU,UAAiC;AACzC,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,MAAM,OACJ,SACA,QACmB;AACnB,WAAO,UAAM,+CAAuB,SAAS,MAAM;AAAA,EACrD;AACF;AAEA,MAAM,aAAwC;AAAA,EAC5C,UAAU,UAAiC;AACzC,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,OAAO,UAAmC,SAAsD;AAC9F,WAAO,QAAQ;AAAA,UACb,yCAAuB,4BAA4B,kCAAkC,GAAG;AAAA,IAC1F;AAAA,EACF;AACF;AAEA,MAAM,cAAyC;AAAA,EAC7C,UAAU,UAAiC;AACzC,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,MAAM,OACJ,SACA,QACmB;AACnB,WAAO,UAAM,8CAAsB,SAAS,MAAM;AAAA,EACpD;AACF;AAEO,MAAM,eAAe;AAAA,EAC1B,OAAwB,WAA8B;AAAA,IACpD,IAAI,gBAAgB;AAAA,IACpB,IAAI,aAAa;AAAA,IACjB,IAAI,cAAc;AAAA,EACpB;AAAA,EAEA,aAAa,MACX,SACA,QACmB;AACnB,UAAM,EAAE,SAAS,IAAI;AAErB,QAAI,CAAC,UAAU;AACb,iBAAO,yCAAuB,qBAAqB,wBAAwB,GAAG;AAAA,IAChF;AAEA,UAAM,UAAU,KAAK,SAAS,KAAK,OAAK,EAAE,UAAU,QAAQ,CAAC;AAE7D,QAAI,CAAC,SAAS;AACZ,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,WAAO,QAAQ,OAAO,SAAS,MAAM;AAAA,EACvC;AAAA,EAEA,OAAO,WAAW,SAAgC;AAChD,SAAK,SAAS,KAAK,OAAO;AAAA,EAC5B;AAAA,EAEA,OAAO,cAAc,WAAwD;AAC3E,UAAM,QAAQ,KAAK,SAAS,UAAU,SAAS;AAC/C,QAAI,QAAQ,IAAI;AACd,WAAK,SAAS,OAAO,OAAO,CAAC;AAAA,IAC/B;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/app-router/admin/endpointRouter.ts"],"sourcesContent":["import type { RequestProcessorContext } from './c-authenticateRequestProcessor';\nimport { createApiErrorResponse } from './responses';\nimport { cookieEndpointHandler, sessionEndpointHandler, signInEndpointHandler } from './sessionHandlers';\nimport type { AuthEndpoint, TernSecureHandlerOptions } from './types';\n\nexport interface EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean;\n  handle(context: RequestProcessorContext, config: TernSecureHandlerOptions): Promise<Response>;\n}\n\nclass SessionsHandler implements EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean {\n    return endpoint === 'sessions';\n  }\n\n  async handle(\n    context: RequestProcessorContext,\n    config: TernSecureHandlerOptions,\n  ): Promise<Response> {\n    return await sessionEndpointHandler(context, config);\n  }\n}\n\nclass UsersHandler implements EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean {\n    return endpoint === 'users';\n  }\n\n  handle(_context: RequestProcessorContext, _config: TernSecureHandlerOptions): Promise<Response> {\n    return Promise.resolve(\n      createApiErrorResponse('ENDPOINT_NOT_IMPLEMENTED', 'Users endpoint not implemented', 501),\n    );\n  }\n}\n\nclass CookieHandler implements EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean {\n    return endpoint === 'cookies';\n  }\n\n  async handle(\n    context: RequestProcessorContext,\n    config: TernSecureHandlerOptions,\n  ): Promise<Response> {\n    return await cookieEndpointHandler(context, config);\n  }\n}\n\nclass SignInsHandler implements EndpointHandler {\n  canHandle(endpoint: AuthEndpoint): boolean {\n    return endpoint === 'sign_ins';\n  }\n\n  async handle(context: RequestProcessorContext, config: TernSecureHandlerOptions): Promise<Response> {\n    return await signInEndpointHandler(context, config);\n  }\n}\n\nexport class EndpointRouter {\n  private static readonly handlers: EndpointHandler[] = [\n    new SessionsHandler(),\n    new UsersHandler(),\n    new CookieHandler(),\n    new SignInsHandler(),\n  ];\n\n  static async route(\n    context: RequestProcessorContext,\n    config: TernSecureHandlerOptions,\n  ): Promise<Response> {\n    const { endpoint } = context;\n\n    if (!endpoint) {\n      return createApiErrorResponse('ENDPOINT_REQUIRED', 'Endpoint is required', 400);\n    }\n\n    const handler = this.handlers.find(h => h.canHandle(endpoint));\n\n    if (!handler) {\n      return createApiErrorResponse('ENDPOINT_NOT_FOUND', 'Endpoint not found', 404);\n    }\n\n    return handler.handle(context, config);\n  }\n\n  static addHandler(handler: EndpointHandler): void {\n    this.handlers.push(handler);\n  }\n\n  static removeHandler(predicate: (handler: EndpointHandler) => boolean): void {\n    const index = this.handlers.findIndex(predicate);\n    if (index > -1) {\n      this.handlers.splice(index, 1);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,uBAAuC;AACvC,6BAAqF;AAQrF,MAAM,gBAA2C;AAAA,EAC/C,UAAU,UAAiC;AACzC,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,MAAM,OACJ,SACA,QACmB;AACnB,WAAO,UAAM,+CAAuB,SAAS,MAAM;AAAA,EACrD;AACF;AAEA,MAAM,aAAwC;AAAA,EAC5C,UAAU,UAAiC;AACzC,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,OAAO,UAAmC,SAAsD;AAC9F,WAAO,QAAQ;AAAA,UACb,yCAAuB,4BAA4B,kCAAkC,GAAG;AAAA,IAC1F;AAAA,EACF;AACF;AAEA,MAAM,cAAyC;AAAA,EAC7C,UAAU,UAAiC;AACzC,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,MAAM,OACJ,SACA,QACmB;AACnB,WAAO,UAAM,8CAAsB,SAAS,MAAM;AAAA,EACpD;AACF;AAEA,MAAM,eAA0C;AAAA,EAC9C,UAAU,UAAiC;AACzC,WAAO,aAAa;AAAA,EACtB;AAAA,EAEA,MAAM,OAAO,SAAkC,QAAqD;AAClG,WAAO,UAAM,8CAAsB,SAAS,MAAM;AAAA,EACpD;AACF;AAEO,MAAM,eAAe;AAAA,EAC1B,OAAwB,WAA8B;AAAA,IACpD,IAAI,gBAAgB;AAAA,IACpB,IAAI,aAAa;AAAA,IACjB,IAAI,cAAc;AAAA,IAClB,IAAI,eAAe;AAAA,EACrB;AAAA,EAEA,aAAa,MACX,SACA,QACmB;AACnB,UAAM,EAAE,SAAS,IAAI;AAErB,QAAI,CAAC,UAAU;AACb,iBAAO,yCAAuB,qBAAqB,wBAAwB,GAAG;AAAA,IAChF;AAEA,UAAM,UAAU,KAAK,SAAS,KAAK,OAAK,EAAE,UAAU,QAAQ,CAAC;AAE7D,QAAI,CAAC,SAAS;AACZ,iBAAO,yCAAuB,sBAAsB,sBAAsB,GAAG;AAAA,IAC/E;AAEA,WAAO,QAAQ,OAAO,SAAS,MAAM;AAAA,EACvC;AAAA,EAEA,OAAO,WAAW,SAAgC;AAChD,SAAK,SAAS,KAAK,OAAO;AAAA,EAC5B;AAAA,EAEA,OAAO,cAAc,WAAwD;AAC3E,UAAM,QAAQ,KAAK,SAAS,UAAU,SAAS;AAC/C,QAAI,QAAQ,IAAI;AACd,WAAK,SAAS,OAAO,OAAO,CAAC;AAAA,IAC/B;AAAA,EACF;AACF;","names":[]}

package/dist/cjs/app-router/admin/request.js

@@ -41,7 +41,7 @@ async function refreshCookieWithIdToken(idToken, cookieStore, config, referrer)
     },
     apiClient: backendClient
   };
-  const COOKIE_OPTIONS = (0, import_cookieOptionsHelper.getCookieOptions)(config);
+  const COOKIE_OPTIONS = (0, import_cookieOptionsHelper.getIdTokenCookieOptions)();
   const { createCustomIdAndRefreshToken } = (0, import_auth.getAuth)(authOptions);
   const customTokens = await createCustomIdAndRefreshToken(idToken, { referer: referrer });
   const cookiePrefix = (0, import_cookie.getCookiePrefix)();
@@ -55,6 +55,11 @@ async function refreshCookieWithIdToken(idToken, cookieStore, config, referrer)
       (0, import_cookie.getCookieName)(import_backend.constants.Cookies.Refresh, cookiePrefix),
       customTokens.refreshToken,
       COOKIE_OPTIONS
+    ),
+    cookieStore.set(
+      import_backend.constants.Cookies.TernAut,
+      customTokens.auth_time.toString(),
+      { secure: true, maxAge: 365 * 24 * 60 * 60 }
     )
   ];
   if (config?.enableCustomToken) {

package/dist/cjs/app-router/admin/request.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/app-router/admin/request.ts"],"sourcesContent":["import type { AuthenticateRequestOptions } from '@tern-secure/backend';\nimport { constants } from '@tern-secure/backend';\nimport { getAuth } from '@tern-secure/backend/auth';\nimport { getCookieName, getCookiePrefix } from '@tern-secure/shared/cookie';\n\nimport { ternSecureBackendClient } from '../../server/ternsecureClient';\nimport type { NextCookieStore } from '../../utils/NextCookieAdapter';\nimport {\n  FIREBASE_API_KEY,\n  FIREBASE_APP_ID,\n  FIREBASE_AUTH_DOMAIN,\n  FIREBASE_MESSAGING_SENDER_ID,\n  FIREBASE_PROJECT_ID,\n  FIREBASE_STORAGE_BUCKET,\n} from './constants';\nimport { getCookieOptions } from './cookieOptionsHelper';\nimport type { TernSecureHandlerOptions } from './types';\n\nexport async function refreshCookieWithIdToken(\n  idToken: string,\n  cookieStore: NextCookieStore,\n  config?: TernSecureHandlerOptions,\n  referrer?: string,\n): Promise<void> {\n  const backendClient = await ternSecureBackendClient();\n\n  const authOptions: AuthenticateRequestOptions = {\n    tenantId: config?.tenantId || undefined,\n    firebaseConfig: {\n      apiKey: FIREBASE_API_KEY,\n      authDomain: FIREBASE_AUTH_DOMAIN,\n      projectId: FIREBASE_PROJECT_ID,\n      storageBucket: FIREBASE_STORAGE_BUCKET,\n      messagingSenderId: FIREBASE_MESSAGING_SENDER_ID,\n      appId: FIREBASE_APP_ID,\n    },\n    apiClient: backendClient,\n  };\n\n  const COOKIE_OPTIONS = getCookieOptions(config);\n\n  const { createCustomIdAndRefreshToken } = getAuth(authOptions);\n\n  const customTokens = await createCustomIdAndRefreshToken(idToken, { referer: referrer });\n\n  const cookiePrefix = getCookiePrefix();\n\n  const cookiePromises = [\n    cookieStore.set(\n      getCookieName(constants.Cookies.IdToken, cookiePrefix),\n      customTokens.idToken,\n      COOKIE_OPTIONS,\n    ),\n    cookieStore.set(\n      getCookieName(constants.Cookies.Refresh, cookiePrefix),\n      customTokens.refreshToken,\n      COOKIE_OPTIONS,\n    ),\n  ];\n\n  if (config?.enableCustomToken) {\n    cookiePromises.push(\n      cookieStore.set(constants.Cookies.Custom, customTokens.customToken, COOKIE_OPTIONS),\n    );\n  }\n\n  await Promise.all(cookiePromises);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,qBAA0B;AAC1B,kBAAwB;AACxB,oBAA+C;AAE/C,8BAAwC;AAExC,uBAOO;AACP,iCAAiC;AAGjC,eAAsB,yBACpB,SACA,aACA,QACA,UACe;AACf,QAAM,gBAAgB,UAAM,iDAAwB;AAEpD,QAAM,cAA0C;AAAA,IAC9C,UAAU,QAAQ,YAAY;AAAA,IAC9B,gBAAgB;AAAA,MACd,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe;AAAA,MACf,mBAAmB;AAAA,MACnB,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,EACb;AAEA,QAAM,qBAAiB,6CAAiB,MAAM;AAE9C,QAAM,EAAE,8BAA8B,QAAI,qBAAQ,WAAW;AAE7D,QAAM,eAAe,MAAM,8BAA8B,SAAS,EAAE,SAAS,SAAS,CAAC;AAEvF,QAAM,mBAAe,+BAAgB;AAErC,QAAM,iBAAiB;AAAA,IACrB,YAAY;AAAA,UACV,6BAAc,yBAAU,QAAQ,SAAS,YAAY;AAAA,MACrD,aAAa;AAAA,MACb;AAAA,IACF;AAAA,IACA,YAAY;AAAA,UACV,6BAAc,yBAAU,QAAQ,SAAS,YAAY;AAAA,MACrD,aAAa;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAEA,MAAI,QAAQ,mBAAmB;AAC7B,mBAAe;AAAA,MACb,YAAY,IAAI,yBAAU,QAAQ,QAAQ,aAAa,aAAa,cAAc;AAAA,IACpF;AAAA,EACF;AAEA,QAAM,QAAQ,IAAI,cAAc;AAClC;","names":[]}
+{"version":3,"sources":["../../../../src/app-router/admin/request.ts"],"sourcesContent":["import type { AuthenticateRequestOptions } from '@tern-secure/backend';\nimport { constants } from '@tern-secure/backend';\nimport { getAuth } from '@tern-secure/backend/auth';\nimport { getCookieName, getCookiePrefix } from '@tern-secure/shared/cookie';\n\nimport { ternSecureBackendClient } from '../../server/ternsecureClient';\nimport type { NextCookieStore } from '../../utils/NextCookieAdapter';\nimport {\n  FIREBASE_API_KEY,\n  FIREBASE_APP_ID,\n  FIREBASE_AUTH_DOMAIN,\n  FIREBASE_MESSAGING_SENDER_ID,\n  FIREBASE_PROJECT_ID,\n  FIREBASE_STORAGE_BUCKET,\n} from './constants';\nimport { getIdTokenCookieOptions } from './cookieOptionsHelper';\nimport type { TernSecureHandlerOptions } from './types';\n\nexport async function refreshCookieWithIdToken(\n  idToken: string,\n  cookieStore: NextCookieStore,\n  config?: TernSecureHandlerOptions,\n  referrer?: string,\n): Promise<void> {\n  const backendClient = await ternSecureBackendClient();\n\n  const authOptions: AuthenticateRequestOptions = {\n    tenantId: config?.tenantId || undefined,\n    firebaseConfig: {\n      apiKey: FIREBASE_API_KEY,\n      authDomain: FIREBASE_AUTH_DOMAIN,\n      projectId: FIREBASE_PROJECT_ID,\n      storageBucket: FIREBASE_STORAGE_BUCKET,\n      messagingSenderId: FIREBASE_MESSAGING_SENDER_ID,\n      appId: FIREBASE_APP_ID,\n    },\n    apiClient: backendClient,\n  };\n\n  const COOKIE_OPTIONS = getIdTokenCookieOptions();\n\n  const { createCustomIdAndRefreshToken } = getAuth(authOptions);\n\n  const customTokens = await createCustomIdAndRefreshToken(idToken, { referer: referrer });\n\n  const cookiePrefix = getCookiePrefix();\n\n  const cookiePromises = [\n    cookieStore.set(\n      getCookieName(constants.Cookies.IdToken, cookiePrefix),\n      customTokens.idToken,\n      COOKIE_OPTIONS,\n    ),\n    cookieStore.set(\n      getCookieName(constants.Cookies.Refresh, cookiePrefix),\n      customTokens.refreshToken,\n      COOKIE_OPTIONS,\n    ),\n\n    cookieStore.set(\n      constants.Cookies.TernAut,\n      customTokens.auth_time.toString(),\n      { secure: true, maxAge: 365 * 24 * 60 * 60 }\n    ),\n  ];\n\n  if (config?.enableCustomToken) {\n    cookiePromises.push(\n      cookieStore.set(constants.Cookies.Custom, customTokens.customToken, COOKIE_OPTIONS),\n    );\n  }\n\n  await Promise.all(cookiePromises);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,qBAA0B;AAC1B,kBAAwB;AACxB,oBAA+C;AAE/C,8BAAwC;AAExC,uBAOO;AACP,iCAAwC;AAGxC,eAAsB,yBACpB,SACA,aACA,QACA,UACe;AACf,QAAM,gBAAgB,UAAM,iDAAwB;AAEpD,QAAM,cAA0C;AAAA,IAC9C,UAAU,QAAQ,YAAY;AAAA,IAC9B,gBAAgB;AAAA,MACd,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe;AAAA,MACf,mBAAmB;AAAA,MACnB,OAAO;AAAA,IACT;AAAA,IACA,WAAW;AAAA,EACb;AAEA,QAAM,qBAAiB,oDAAwB;AAE/C,QAAM,EAAE,8BAA8B,QAAI,qBAAQ,WAAW;AAE7D,QAAM,eAAe,MAAM,8BAA8B,SAAS,EAAE,SAAS,SAAS,CAAC;AAEvF,QAAM,mBAAe,+BAAgB;AAErC,QAAM,iBAAiB;AAAA,IACrB,YAAY;AAAA,UACV,6BAAc,yBAAU,QAAQ,SAAS,YAAY;AAAA,MACrD,aAAa;AAAA,MACb;AAAA,IACF;AAAA,IACA,YAAY;AAAA,UACV,6BAAc,yBAAU,QAAQ,SAAS,YAAY;AAAA,MACrD,aAAa;AAAA,MACb;AAAA,IACF;AAAA,IAEA,YAAY;AAAA,MACV,yBAAU,QAAQ;AAAA,MAClB,aAAa,UAAU,SAAS;AAAA,MAChC,EAAE,QAAQ,MAAM,QAAQ,MAAM,KAAK,KAAK,GAAG;AAAA,IAC7C;AAAA,EACF;AAEA,MAAI,QAAQ,mBAAmB;AAC7B,mBAAe;AAAA,MACb,YAAY,IAAI,yBAAU,QAAQ,QAAQ,aAAa,aAAa,cAAc;AAAA,IACpF;AAAA,EACF;AAEA,QAAM,QAAQ,IAAI,cAAc;AAClC;","names":[]}

package/dist/cjs/app-router/admin/sessionHandlers.js

@@ -19,16 +19,21 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var sessionHandlers_exports = {};
 __export(sessionHandlers_exports, {
   cookieEndpointHandler: () => cookieEndpointHandler,
-  sessionEndpointHandler: () => sessionEndpointHandler
+  sessionEndpointHandler: () => sessionEndpointHandler,
+  signInEndpointHandler: () => signInEndpointHandler
 });
 module.exports = __toCommonJS(sessionHandlers_exports);
+var import_backend = require("@tern-secure/backend");
 var import_admin = require("@tern-secure/backend/admin");
 var import_jwt = require("@tern-secure/backend/jwt");
+var import_ternsecureClient = require("../../server/ternsecureClient");
 var import_NextCookieAdapter = require("../../utils/NextCookieAdapter");
+var import_constants = require("./constants");
 var import_fnValidators = require("./fnValidators");
 var import_request = require("./request");
 var import_responses = require("./responses");
-async function sessionEndpointHandler(context, config) {
+var import_signInCreateHandler = require("./signInCreateHandler");
+const sessionEndpointHandler = async (context, config) => {
   const { subEndpoint, method, referrer } = context;
   const validators = (0, import_fnValidators.createValidators)(context);
   const {
@@ -74,7 +79,7 @@ async function sessionEndpointHandler(context, config) {
     const cookieStore = new import_NextCookieAdapter.NextCookieStore();
     const { idToken, csrfToken, error } = await validateSessionRequest();
     if (error) return error;
-    const csrfCookieValue = await cookieStore.get("_session_terncf");
+    const csrfCookieValue = await cookieStore.get(import_backend.constants.Cookies.CsrfToken);
     validateCsrfToken(csrfToken || "", csrfCookieValue.value);
     const handleCreateSession = async (cookieStore2, idToken2) => {
       try {
@@ -124,8 +129,8 @@ async function sessionEndpointHandler(context, config) {
     default:
       return import_responses.HttpResponseHelper.createMethodNotAllowedResponse();
   }
-}
-async function cookieEndpointHandler(context, config) {
+};
+const cookieEndpointHandler = async (context, config) => {
   const { subEndpoint, method } = context;
   const validators = (0, import_fnValidators.createValidators)(context);
   const { validateSecurity } = validators;
@@ -192,10 +197,77 @@ async function cookieEndpointHandler(context, config) {
     default:
       return import_responses.HttpResponseHelper.createMethodNotAllowedResponse();
   }
-}
+};
+const signInEndpointHandler = async (context, config) => {
+  const { subEndpoint, method } = context;
+  const validators = (0, import_fnValidators.createValidators)(context);
+  const {
+    validateSubEndpoint,
+    validateSecurity
+  } = validators;
+  if (!subEndpoint) {
+    return (0, import_responses.createApiErrorResponse)("SUB_ENDPOINT_REQUIRED", "Sign_ins sub-endpoint required", 400);
+  }
+  const signInsConfig = config.endpoints?.signIns;
+  const subEndpointConfig = signInsConfig?.subEndpoints?.[subEndpoint];
+  validateSubEndpoint(subEndpoint, subEndpointConfig);
+  if (subEndpointConfig?.security) {
+    await validateSecurity(subEndpointConfig.security);
+  }
+  const PostHandler = async (subEndpoint2) => {
+    const create = async () => {
+      return await (0, import_signInCreateHandler.processSignInCreate)(context);
+    };
+    const passwordResetEmail = async () => {
+      try {
+        const body = await context.request.json();
+        const { email } = body;
+        if (!email || typeof email !== "string") {
+          return (0, import_responses.createApiErrorResponse)("EMAIL_REQUIRED", "Email is required", 400);
+        }
+        const backendClient = await (0, import_ternsecureClient.ternSecureBackendClient)();
+        const response = await backendClient.signIn.resetPasswordEmail(import_constants.FIREBASE_API_KEY, {
+          email,
+          requestType: "PASSWORD_RESET"
+        });
+        if (!response) {
+          return (0, import_responses.createApiErrorResponse)(
+            "PASSWORD_RESET_FAILED",
+            "Failed to send password reset email",
+            500
+          );
+        }
+        return (0, import_responses.createApiSuccessResponse)({
+          email
+        });
+      } catch (error) {
+        return (0, import_responses.createApiErrorResponse)(
+          "PASSWORD_RESET_ERROR",
+          error instanceof Error ? error.message : "An error occurred while sending password reset email",
+          500
+        );
+      }
+    };
+    switch (subEndpoint2) {
+      case "create":
+        return create();
+      case "resetPasswordEmail":
+        return passwordResetEmail();
+      default:
+        return import_responses.HttpResponseHelper.createSubEndpointNotSupportedResponse();
+    }
+  };
+  switch (method) {
+    case "POST":
+      return PostHandler(subEndpoint);
+    default:
+      return import_responses.HttpResponseHelper.createMethodNotAllowedResponse();
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   cookieEndpointHandler,
-  sessionEndpointHandler
+  sessionEndpointHandler,
+  signInEndpointHandler
 });
 //# sourceMappingURL=sessionHandlers.js.map

package/dist/cjs/app-router/admin/sessionHandlers.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/app-router/admin/sessionHandlers.ts"],"sourcesContent":["import { clearSessionCookie } from '@tern-secure/backend/admin';\nimport { ternDecodeJwtUnguarded } from '@tern-secure/backend/jwt';\nimport type { CookieSubEndpoint } from '@tern-secure/types';\n\nimport { NextCookieStore } from '../../utils/NextCookieAdapter';\nimport { type RequestProcessorContext } from './c-authenticateRequestProcessor';\nimport { createValidators } from './fnValidators';\nimport { refreshCookieWithIdToken } from './request';\nimport { createApiErrorResponse, createApiSuccessResponse, HttpResponseHelper, SessionResponseHelper } from './responses';\nimport type { SessionSubEndpoint, TernSecureHandlerOptions } from './types';\n\nasync function sessionEndpointHandler(\n  context: RequestProcessorContext,\n  config: TernSecureHandlerOptions,\n): Promise<Response> {\n  const { subEndpoint, method, referrer } = context;\n\n  const validators = createValidators(context);\n\n  const {\n    validateSubEndpoint,\n    validateSecurity,\n    validateSessionRequest,\n    validateCsrfToken,\n    validateIdToken,\n  } = validators;\n\n  if (!subEndpoint) {\n    return createApiErrorResponse('SUB_ENDPOINT_REQUIRED', 'Session sub-endpoint required', 400);\n  }\n\n  const sessionsConfig = config.endpoints?.sessions;\n  const subEndpointConfig = sessionsConfig?.subEndpoints?.[subEndpoint];\n\n  validateSubEndpoint(subEndpoint, subEndpointConfig);\n\n  if (subEndpointConfig?.security) {\n    await validateSecurity(subEndpointConfig.security);\n  }\n\n  const SessionGetHandler = async (subEndpoint: SessionSubEndpoint): Promise<Response> => {\n    const handleSessionVerify = async (): Promise<Response> => {\n      try {\n        const sessionCookie = context.sessionTokenInCookie;\n        if (!sessionCookie) {\n          return SessionResponseHelper.createUnauthorizedResponse();\n        }\n\n        const { data: decodedSession, errors } = ternDecodeJwtUnguarded(sessionCookie);\n        if (errors) {\n          return SessionResponseHelper.createUnauthorizedResponse();\n        }\n\n        return SessionResponseHelper.createVerificationResponse(decodedSession);\n      } catch (error) {\n        return SessionResponseHelper.createUnauthorizedResponse();\n      }\n    };\n\n    switch (subEndpoint) {\n      case 'verify':\n        return handleSessionVerify();\n      default:\n        return HttpResponseHelper.createNotFoundResponse();\n    }\n  };\n\n  const SessionPostHandler = async (subEndpoint: SessionSubEndpoint): Promise<Response> => {\n    const cookieStore = new NextCookieStore();\n\n    const { idToken, csrfToken, error } = await validateSessionRequest();\n    if (error) return error;\n\n    const csrfCookieValue = await cookieStore.get('_session_terncf');\n    validateCsrfToken(csrfToken || '', csrfCookieValue.value);\n\n    const handleCreateSession = async (\n      cookieStore: NextCookieStore,\n      idToken: string,\n    ): Promise<Response> => {\n      try {\n        await refreshCookieWithIdToken(idToken, cookieStore, config, referrer);\n        return SessionResponseHelper.createSessionCreationResponse({\n          success: true,\n          message: 'Session created successfully',\n        });\n      } catch (error) {\n        return createApiErrorResponse('SESSION_CREATION_FAILED', 'Session creation failed', 500);\n      }\n    };\n\n    const handleRefreshSession = async (\n      cookieStore: NextCookieStore,\n      idToken: string,\n    ): Promise<Response> => {\n      try {\n        const decodedSession = ternDecodeJwtUnguarded(idToken);\n        if (decodedSession.errors) {\n          return createApiErrorResponse('INVALID_SESSION', 'Invalid session for refresh', 401);\n        }\n\n        const refreshRes = await refreshCookieWithIdToken(idToken, cookieStore, config);\n        return SessionResponseHelper.createRefreshResponse(refreshRes);\n      } catch (error) {\n        return createApiErrorResponse('REFRESH_FAILED', 'Session refresh failed', 500);\n      }\n    };\n\n    const handleRevokeSession = async (cookieStore: NextCookieStore): Promise<Response> => {\n      const res = await clearSessionCookie(cookieStore);\n      return SessionResponseHelper.createRevokeResponse(res);\n    };\n\n    switch (subEndpoint) {\n      case 'createsession': {\n        validateIdToken(idToken);\n        //eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n        return handleCreateSession(cookieStore, idToken!);\n      }\n\n      case 'refresh':\n        //eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n        return handleRefreshSession(cookieStore, idToken!);\n\n      case 'revoke':\n        return handleRevokeSession(cookieStore);\n\n      default:\n        return HttpResponseHelper.createSubEndpointNotSupportedResponse();\n    }\n  };\n\n  switch (method) {\n    case 'GET':\n      return SessionGetHandler(subEndpoint);\n\n    case 'POST':\n      return SessionPostHandler(subEndpoint);\n\n    default:\n      return HttpResponseHelper.createMethodNotAllowedResponse();\n  }\n}\n\nasync function cookieEndpointHandler(\n  context: RequestProcessorContext,\n  config: TernSecureHandlerOptions,\n): Promise<Response> {\n  const { subEndpoint, method } = context;\n\n  const validators = createValidators(context);\n  const { validateSecurity } = validators;\n\n  if (!subEndpoint) {\n    return createApiErrorResponse('SUB_ENDPOINT_REQUIRED', 'Cookie sub-endpoint required', 400);\n  }\n\n  const cookiesConfig = config.endpoints?.cookies;\n  const subEndpointConfig = cookiesConfig?.subEndpoints?.[subEndpoint as CookieSubEndpoint];\n\n  if (!subEndpointConfig || !subEndpointConfig.enabled) {\n    return createApiErrorResponse('ENDPOINT_NOT_FOUND', 'Cookie endpoint not found or disabled', 404);\n  }\n\n  if (subEndpointConfig?.security) {\n    await validateSecurity(subEndpointConfig.security);\n  }\n\n  const CookieGetHandler = async (subEndpoint: CookieSubEndpoint): Promise<Response> => {\n    const handleGetCookie = async (): Promise<Response> => {\n      try {\n        const url = new URL(context.ternUrl);\n        const tokenName = url.searchParams.get('tokenName');\n\n        if (!tokenName) {\n          return createApiErrorResponse('TOKEN_NAME_REQUIRED', 'tokenName query parameter is required', 400);\n        }\n\n        let cookieValue: string | undefined;\n\n        switch (tokenName) {\n          case 'idToken':\n            cookieValue = context.idTokenInCookie;\n            break;\n          case 'sessionToken':\n            cookieValue = context.sessionTokenInCookie;\n            break;\n          case 'refreshToken':\n            cookieValue = context.refreshTokenInCookie;\n            break;\n          case 'customToken':\n            cookieValue = context.customTokenInCookie;\n            break;\n          default:\n            return createApiErrorResponse('INVALID_TOKEN_NAME', 'Invalid token name. Must be one of: idToken, sessionToken, refreshToken, customToken', 400);\n        }\n\n        if (!cookieValue) {\n          return createApiErrorResponse(\n            'TOKEN_NOT_FOUND',\n            `${tokenName} not found in httpOnly cookies`,\n            404\n          );\n        }\n\n        return createApiSuccessResponse({\n          token: cookieValue,\n        });\n      } catch (error) {\n        return createApiErrorResponse('COOKIE_RETRIEVAL_FAILED', 'Failed to retrieve cookie', 500);\n      }\n    };\n\n    switch (subEndpoint) {\n      case 'get':\n        return handleGetCookie();\n      default:\n        return HttpResponseHelper.createNotFoundResponse();\n    }\n  };\n\n  switch (method) {\n    case 'GET':\n      return CookieGetHandler(subEndpoint as CookieSubEndpoint);\n    default:\n      return HttpResponseHelper.createMethodNotAllowedResponse();\n  }\n}\n\nexport { sessionEndpointHandler, cookieEndpointHandler };\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAAmC;AACnC,iBAAuC;AAGvC,+BAAgC;AAEhC,0BAAiC;AACjC,qBAAyC;AACzC,uBAA4G;AAG5G,eAAe,uBACb,SACA,QACmB;AACnB,QAAM,EAAE,aAAa,QAAQ,SAAS,IAAI;AAE1C,QAAM,iBAAa,sCAAiB,OAAO;AAE3C,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,MAAI,CAAC,aAAa;AAChB,eAAO,yCAAuB,yBAAyB,iCAAiC,GAAG;AAAA,EAC7F;AAEA,QAAM,iBAAiB,OAAO,WAAW;AACzC,QAAM,oBAAoB,gBAAgB,eAAe,WAAW;AAEpE,sBAAoB,aAAa,iBAAiB;AAElD,MAAI,mBAAmB,UAAU;AAC/B,UAAM,iBAAiB,kBAAkB,QAAQ;AAAA,EACnD;AAEA,QAAM,oBAAoB,OAAOA,iBAAuD;AACtF,UAAM,sBAAsB,YAA+B;AACzD,UAAI;AACF,cAAM,gBAAgB,QAAQ;AAC9B,YAAI,CAAC,eAAe;AAClB,iBAAO,uCAAsB,2BAA2B;AAAA,QAC1D;AAEA,cAAM,EAAE,MAAM,gBAAgB,OAAO,QAAI,mCAAuB,aAAa;AAC7E,YAAI,QAAQ;AACV,iBAAO,uCAAsB,2BAA2B;AAAA,QAC1D;AAEA,eAAO,uCAAsB,2BAA2B,cAAc;AAAA,MACxE,SAAS,OAAO;AACd,eAAO,uCAAsB,2BAA2B;AAAA,MAC1D;AAAA,IACF;AAEA,YAAQA,cAAa;AAAA,MACnB,KAAK;AACH,eAAO,oBAAoB;AAAA,MAC7B;AACE,eAAO,oCAAmB,uBAAuB;AAAA,IACrD;AAAA,EACF;AAEA,QAAM,qBAAqB,OAAOA,iBAAuD;AACvF,UAAM,cAAc,IAAI,yCAAgB;AAExC,UAAM,EAAE,SAAS,WAAW,MAAM,IAAI,MAAM,uBAAuB;AACnE,QAAI,MAAO,QAAO;AAElB,UAAM,kBAAkB,MAAM,YAAY,IAAI,iBAAiB;AAC/D,sBAAkB,aAAa,IAAI,gBAAgB,KAAK;AAExD,UAAM,sBAAsB,OAC1BC,cACAC,aACsB;AACtB,UAAI;AACF,kBAAM,yCAAyBA,UAASD,cAAa,QAAQ,QAAQ;AACrE,eAAO,uCAAsB,8BAA8B;AAAA,UACzD,SAAS;AAAA,UACT,SAAS;AAAA,QACX,CAAC;AAAA,MACH,SAASE,QAAO;AACd,mBAAO,yCAAuB,2BAA2B,2BAA2B,GAAG;AAAA,MACzF;AAAA,IACF;AAEA,UAAM,uBAAuB,OAC3BF,cACAC,aACsB;AACtB,UAAI;AACF,cAAM,qBAAiB,mCAAuBA,QAAO;AACrD,YAAI,eAAe,QAAQ;AACzB,qBAAO,yCAAuB,mBAAmB,+BAA+B,GAAG;AAAA,QACrF;AAEA,cAAM,aAAa,UAAM,yCAAyBA,UAASD,cAAa,MAAM;AAC9E,eAAO,uCAAsB,sBAAsB,UAAU;AAAA,MAC/D,SAASE,QAAO;AACd,mBAAO,yCAAuB,kBAAkB,0BAA0B,GAAG;AAAA,MAC/E;AAAA,IACF;AAEA,UAAM,sBAAsB,OAAOF,iBAAoD;AACrF,YAAM,MAAM,UAAM,iCAAmBA,YAAW;AAChD,aAAO,uCAAsB,qBAAqB,GAAG;AAAA,IACvD;AAEA,YAAQD,cAAa;AAAA,MACnB,KAAK,iBAAiB;AACpB,wBAAgB,OAAO;AAEvB,eAAO,oBAAoB,aAAa,OAAQ;AAAA,MAClD;AAAA,MAEA,KAAK;AAEH,eAAO,qBAAqB,aAAa,OAAQ;AAAA,MAEnD,KAAK;AACH,eAAO,oBAAoB,WAAW;AAAA,MAExC;AACE,eAAO,oCAAmB,sCAAsC;AAAA,IACpE;AAAA,EACF;AAEA,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,kBAAkB,WAAW;AAAA,IAEtC,KAAK;AACH,aAAO,mBAAmB,WAAW;AAAA,IAEvC;AACE,aAAO,oCAAmB,+BAA+B;AAAA,EAC7D;AACF;AAEA,eAAe,sBACb,SACA,QACmB;AACnB,QAAM,EAAE,aAAa,OAAO,IAAI;AAEhC,QAAM,iBAAa,sCAAiB,OAAO;AAC3C,QAAM,EAAE,iBAAiB,IAAI;AAE7B,MAAI,CAAC,aAAa;AAChB,eAAO,yCAAuB,yBAAyB,gCAAgC,GAAG;AAAA,EAC5F;AAEA,QAAM,gBAAgB,OAAO,WAAW;AACxC,QAAM,oBAAoB,eAAe,eAAe,WAAgC;AAExF,MAAI,CAAC,qBAAqB,CAAC,kBAAkB,SAAS;AACpD,eAAO,yCAAuB,sBAAsB,yCAAyC,GAAG;AAAA,EAClG;AAEA,MAAI,mBAAmB,UAAU;AAC/B,UAAM,iBAAiB,kBAAkB,QAAQ;AAAA,EACnD;AAEA,QAAM,mBAAmB,OAAOA,iBAAsD;AACpF,UAAM,kBAAkB,YAA+B;AACrD,UAAI;AACF,cAAM,MAAM,IAAI,IAAI,QAAQ,OAAO;AACnC,cAAM,YAAY,IAAI,aAAa,IAAI,WAAW;AAElD,YAAI,CAAC,WAAW;AACd,qBAAO,yCAAuB,uBAAuB,yCAAyC,GAAG;AAAA,QACnG;AAEA,YAAI;AAEJ,gBAAQ,WAAW;AAAA,UACjB,KAAK;AACH,0BAAc,QAAQ;AACtB;AAAA,UACF,KAAK;AACH,0BAAc,QAAQ;AACtB;AAAA,UACF,KAAK;AACH,0BAAc,QAAQ;AACtB;AAAA,UACF,KAAK;AACH,0BAAc,QAAQ;AACtB;AAAA,UACF;AACE,uBAAO,yCAAuB,sBAAsB,wFAAwF,GAAG;AAAA,QACnJ;AAEA,YAAI,CAAC,aAAa;AAChB,qBAAO;AAAA,YACL;AAAA,YACA,GAAG,SAAS;AAAA,YACZ;AAAA,UACF;AAAA,QACF;AAEA,mBAAO,2CAAyB;AAAA,UAC9B,OAAO;AAAA,QACT,CAAC;AAAA,MACH,SAAS,OAAO;AACd,mBAAO,yCAAuB,2BAA2B,6BAA6B,GAAG;AAAA,MAC3F;AAAA,IACF;AAEA,YAAQA,cAAa;AAAA,MACnB,KAAK;AACH,eAAO,gBAAgB;AAAA,MACzB;AACE,eAAO,oCAAmB,uBAAuB;AAAA,IACrD;AAAA,EACF;AAEA,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,iBAAiB,WAAgC;AAAA,IAC1D;AACE,aAAO,oCAAmB,+BAA+B;AAAA,EAC7D;AACF;","names":["subEndpoint","cookieStore","idToken","error"]}
+{"version":3,"sources":["../../../../src/app-router/admin/sessionHandlers.ts"],"sourcesContent":["import { constants } from '@tern-secure/backend';\nimport { clearSessionCookie } from '@tern-secure/backend/admin';\nimport { ternDecodeJwtUnguarded } from '@tern-secure/backend/jwt';\nimport type { CookieSubEndpoint } from '@tern-secure/types';\n\nimport { ternSecureBackendClient } from '../../server/ternsecureClient';\nimport { NextCookieStore } from '../../utils/NextCookieAdapter';\nimport { type RequestProcessorContext } from './c-authenticateRequestProcessor';\nimport { FIREBASE_API_KEY } from './constants';\nimport { createValidators } from './fnValidators';\nimport { refreshCookieWithIdToken } from './request';\nimport {\n  createApiErrorResponse,\n  createApiSuccessResponse,\n  HttpResponseHelper,\n  SessionResponseHelper,\n} from './responses';\nimport { processSignInCreate } from './signInCreateHandler';\nimport type { SessionSubEndpoint, SignInSubEndpoint, TernSecureHandlerOptions } from './types';\n\nconst sessionEndpointHandler = async (\n  context: RequestProcessorContext,\n  config: TernSecureHandlerOptions,\n): Promise<Response> => {\n  const { subEndpoint, method, referrer } = context;\n\n  const validators = createValidators(context);\n\n  const {\n    validateSubEndpoint,\n    validateSecurity,\n    validateSessionRequest,\n    validateCsrfToken,\n    validateIdToken,\n  } = validators;\n\n  if (!subEndpoint) {\n    return createApiErrorResponse('SUB_ENDPOINT_REQUIRED', 'Session sub-endpoint required', 400);\n  }\n\n  const sessionsConfig = config.endpoints?.sessions;\n  const subEndpointConfig = sessionsConfig?.subEndpoints?.[subEndpoint];\n\n  validateSubEndpoint(subEndpoint, subEndpointConfig);\n\n  if (subEndpointConfig?.security) {\n    await validateSecurity(subEndpointConfig.security);\n  }\n\n  const SessionGetHandler = async (subEndpoint: SessionSubEndpoint): Promise<Response> => {\n    const handleSessionVerify = async (): Promise<Response> => {\n      try {\n        const sessionCookie = context.sessionTokenInCookie;\n        if (!sessionCookie) {\n          return SessionResponseHelper.createUnauthorizedResponse();\n        }\n\n        const { data: decodedSession, errors } = ternDecodeJwtUnguarded(sessionCookie);\n        if (errors) {\n          return SessionResponseHelper.createUnauthorizedResponse();\n        }\n\n        return SessionResponseHelper.createVerificationResponse(decodedSession);\n      } catch (error) {\n        return SessionResponseHelper.createUnauthorizedResponse();\n      }\n    };\n\n    switch (subEndpoint) {\n      case 'verify':\n        return handleSessionVerify();\n      default:\n        return HttpResponseHelper.createNotFoundResponse();\n    }\n  };\n\n  const SessionPostHandler = async (subEndpoint: SessionSubEndpoint): Promise<Response> => {\n    const cookieStore = new NextCookieStore();\n\n    const { idToken, csrfToken, error } = await validateSessionRequest();\n    if (error) return error;\n\n    const csrfCookieValue = await cookieStore.get(constants.Cookies.CsrfToken);\n    validateCsrfToken(csrfToken || '', csrfCookieValue.value);\n\n    const handleCreateSession = async (\n      cookieStore: NextCookieStore,\n      idToken: string,\n    ): Promise<Response> => {\n      try {\n        await refreshCookieWithIdToken(idToken, cookieStore, config, referrer);\n        return SessionResponseHelper.createSessionCreationResponse({\n          success: true,\n          message: 'Session created successfully',\n        });\n      } catch (error) {\n        return createApiErrorResponse('SESSION_CREATION_FAILED', 'Session creation failed', 500);\n      }\n    };\n\n    const handleRefreshSession = async (\n      cookieStore: NextCookieStore,\n      idToken: string,\n    ): Promise<Response> => {\n      try {\n        const decodedSession = ternDecodeJwtUnguarded(idToken);\n        if (decodedSession.errors) {\n          return createApiErrorResponse('INVALID_SESSION', 'Invalid session for refresh', 401);\n        }\n\n        const refreshRes = await refreshCookieWithIdToken(idToken, cookieStore, config);\n        return SessionResponseHelper.createRefreshResponse(refreshRes);\n      } catch (error) {\n        return createApiErrorResponse('REFRESH_FAILED', 'Session refresh failed', 500);\n      }\n    };\n\n    const handleRevokeSession = async (cookieStore: NextCookieStore): Promise<Response> => {\n      const res = await clearSessionCookie(cookieStore);\n      return SessionResponseHelper.createRevokeResponse(res);\n    };\n\n    switch (subEndpoint) {\n      case 'createsession': {\n        validateIdToken(idToken);\n        //eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n        return handleCreateSession(cookieStore, idToken!);\n      }\n\n      case 'refresh':\n        //eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n        return handleRefreshSession(cookieStore, idToken!);\n\n      case 'revoke':\n        return handleRevokeSession(cookieStore);\n\n      default:\n        return HttpResponseHelper.createSubEndpointNotSupportedResponse();\n    }\n  };\n\n  switch (method) {\n    case 'GET':\n      return SessionGetHandler(subEndpoint);\n\n    case 'POST':\n      return SessionPostHandler(subEndpoint);\n\n    default:\n      return HttpResponseHelper.createMethodNotAllowedResponse();\n  }\n}\n\nconst cookieEndpointHandler = async (\n  context: RequestProcessorContext,\n  config: TernSecureHandlerOptions,\n): Promise<Response> => {\n  const { subEndpoint, method } = context;\n\n  const validators = createValidators(context);\n  const { validateSecurity } = validators;\n\n  if (!subEndpoint) {\n    return createApiErrorResponse('SUB_ENDPOINT_REQUIRED', 'Cookie sub-endpoint required', 400);\n  }\n\n  const cookiesConfig = config.endpoints?.cookies;\n  const subEndpointConfig = cookiesConfig?.subEndpoints?.[subEndpoint as CookieSubEndpoint];\n\n  if (!subEndpointConfig || !subEndpointConfig.enabled) {\n    return createApiErrorResponse('ENDPOINT_NOT_FOUND', 'Cookie endpoint not found or disabled', 404);\n  }\n\n  if (subEndpointConfig?.security) {\n    await validateSecurity(subEndpointConfig.security);\n  }\n\n  const CookieGetHandler = async (subEndpoint: CookieSubEndpoint): Promise<Response> => {\n    const handleGetCookie = async (): Promise<Response> => {\n      try {\n        const url = new URL(context.ternUrl);\n        const tokenName = url.searchParams.get('tokenName');\n\n        if (!tokenName) {\n          return createApiErrorResponse('TOKEN_NAME_REQUIRED', 'tokenName query parameter is required', 400);\n        }\n\n        let cookieValue: string | undefined;\n\n        switch (tokenName) {\n          case 'idToken':\n            cookieValue = context.idTokenInCookie;\n            break;\n          case 'sessionToken':\n            cookieValue = context.sessionTokenInCookie;\n            break;\n          case 'refreshToken':\n            cookieValue = context.refreshTokenInCookie;\n            break;\n          case 'customToken':\n            cookieValue = context.customTokenInCookie;\n            break;\n          default:\n            return createApiErrorResponse('INVALID_TOKEN_NAME', 'Invalid token name. Must be one of: idToken, sessionToken, refreshToken, customToken', 400);\n        }\n\n        if (!cookieValue) {\n          return createApiErrorResponse(\n            'TOKEN_NOT_FOUND',\n            `${tokenName} not found in httpOnly cookies`,\n            404\n          );\n        }\n\n        return createApiSuccessResponse({\n          token: cookieValue,\n        });\n      } catch (error) {\n        return createApiErrorResponse('COOKIE_RETRIEVAL_FAILED', 'Failed to retrieve cookie', 500);\n      }\n    };\n\n    switch (subEndpoint) {\n      case 'get':\n        return handleGetCookie();\n      default:\n        return HttpResponseHelper.createNotFoundResponse();\n    }\n  };\n\n  switch (method) {\n    case 'GET':\n      return CookieGetHandler(subEndpoint as CookieSubEndpoint);\n    default:\n      return HttpResponseHelper.createMethodNotAllowedResponse();\n  }\n}\n\nconst signInEndpointHandler = async (\n  context: RequestProcessorContext,\n  config: TernSecureHandlerOptions\n): Promise<Response> => {\n  const { subEndpoint, method } = context;\n\n  const validators = createValidators(context);\n\n  const {\n    validateSubEndpoint,\n    validateSecurity,\n  } = validators;\n\n  if (!subEndpoint) {\n    return createApiErrorResponse('SUB_ENDPOINT_REQUIRED', 'Sign_ins sub-endpoint required', 400);\n  }\n\n  const signInsConfig = config.endpoints?.signIns;\n  const subEndpointConfig = signInsConfig?.subEndpoints?.[subEndpoint as SignInSubEndpoint];\n\n  validateSubEndpoint(subEndpoint, subEndpointConfig);\n\n  if (subEndpointConfig?.security) {\n    await validateSecurity(subEndpointConfig.security);\n  }\n\n  const PostHandler = async (subEndpoint: SignInSubEndpoint): Promise<Response> => {\n    const create = async (): Promise<Response> => {\n      return await processSignInCreate(context);\n    };\n\n    const passwordResetEmail = async (): Promise<Response> => {\n      try {\n        const body = await context.request.json();\n        const { email } = body;\n\n        if (!email || typeof email !== 'string') {\n          return createApiErrorResponse('EMAIL_REQUIRED', 'Email is required', 400);\n        }\n\n        const backendClient = await ternSecureBackendClient();\n\n        const response = await backendClient.signIn.resetPasswordEmail(FIREBASE_API_KEY, {\n          email,\n          requestType: 'PASSWORD_RESET',\n        });\n\n        if (!response) {\n          return createApiErrorResponse(\n            'PASSWORD_RESET_FAILED',\n            'Failed to send password reset email',\n            500,\n          );\n        }\n\n        return createApiSuccessResponse({\n          email,\n        });\n      } catch (error) {\n        return createApiErrorResponse(\n          'PASSWORD_RESET_ERROR',\n          error instanceof Error\n            ? error.message\n            : 'An error occurred while sending password reset email',\n          500,\n        );\n      }\n    };\n\n    switch (subEndpoint) {\n      case 'create':\n        return create();\n      case 'resetPasswordEmail':\n        return passwordResetEmail();\n      default:\n        return HttpResponseHelper.createSubEndpointNotSupportedResponse();\n    }\n  };\n\n  switch (method) {\n    case 'POST':\n      return PostHandler(subEndpoint as SignInSubEndpoint);\n\n    default:\n      return HttpResponseHelper.createMethodNotAllowedResponse();\n  }\n\n}\n\nexport { cookieEndpointHandler, sessionEndpointHandler, signInEndpointHandler };\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAA0B;AAC1B,mBAAmC;AACnC,iBAAuC;AAGvC,8BAAwC;AACxC,+BAAgC;AAEhC,uBAAiC;AACjC,0BAAiC;AACjC,qBAAyC;AACzC,uBAKO;AACP,iCAAoC;AAGpC,MAAM,yBAAyB,OAC7B,SACA,WACsB;AACtB,QAAM,EAAE,aAAa,QAAQ,SAAS,IAAI;AAE1C,QAAM,iBAAa,sCAAiB,OAAO;AAE3C,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,MAAI,CAAC,aAAa;AAChB,eAAO,yCAAuB,yBAAyB,iCAAiC,GAAG;AAAA,EAC7F;AAEA,QAAM,iBAAiB,OAAO,WAAW;AACzC,QAAM,oBAAoB,gBAAgB,eAAe,WAAW;AAEpE,sBAAoB,aAAa,iBAAiB;AAElD,MAAI,mBAAmB,UAAU;AAC/B,UAAM,iBAAiB,kBAAkB,QAAQ;AAAA,EACnD;AAEA,QAAM,oBAAoB,OAAOA,iBAAuD;AACtF,UAAM,sBAAsB,YAA+B;AACzD,UAAI;AACF,cAAM,gBAAgB,QAAQ;AAC9B,YAAI,CAAC,eAAe;AAClB,iBAAO,uCAAsB,2BAA2B;AAAA,QAC1D;AAEA,cAAM,EAAE,MAAM,gBAAgB,OAAO,QAAI,mCAAuB,aAAa;AAC7E,YAAI,QAAQ;AACV,iBAAO,uCAAsB,2BAA2B;AAAA,QAC1D;AAEA,eAAO,uCAAsB,2BAA2B,cAAc;AAAA,MACxE,SAAS,OAAO;AACd,eAAO,uCAAsB,2BAA2B;AAAA,MAC1D;AAAA,IACF;AAEA,YAAQA,cAAa;AAAA,MACnB,KAAK;AACH,eAAO,oBAAoB;AAAA,MAC7B;AACE,eAAO,oCAAmB,uBAAuB;AAAA,IACrD;AAAA,EACF;AAEA,QAAM,qBAAqB,OAAOA,iBAAuD;AACvF,UAAM,cAAc,IAAI,yCAAgB;AAExC,UAAM,EAAE,SAAS,WAAW,MAAM,IAAI,MAAM,uBAAuB;AACnE,QAAI,MAAO,QAAO;AAElB,UAAM,kBAAkB,MAAM,YAAY,IAAI,yBAAU,QAAQ,SAAS;AACzE,sBAAkB,aAAa,IAAI,gBAAgB,KAAK;AAExD,UAAM,sBAAsB,OAC1BC,cACAC,aACsB;AACtB,UAAI;AACF,kBAAM,yCAAyBA,UAASD,cAAa,QAAQ,QAAQ;AACrE,eAAO,uCAAsB,8BAA8B;AAAA,UACzD,SAAS;AAAA,UACT,SAAS;AAAA,QACX,CAAC;AAAA,MACH,SAASE,QAAO;AACd,mBAAO,yCAAuB,2BAA2B,2BAA2B,GAAG;AAAA,MACzF;AAAA,IACF;AAEA,UAAM,uBAAuB,OAC3BF,cACAC,aACsB;AACtB,UAAI;AACF,cAAM,qBAAiB,mCAAuBA,QAAO;AACrD,YAAI,eAAe,QAAQ;AACzB,qBAAO,yCAAuB,mBAAmB,+BAA+B,GAAG;AAAA,QACrF;AAEA,cAAM,aAAa,UAAM,yCAAyBA,UAASD,cAAa,MAAM;AAC9E,eAAO,uCAAsB,sBAAsB,UAAU;AAAA,MAC/D,SAASE,QAAO;AACd,mBAAO,yCAAuB,kBAAkB,0BAA0B,GAAG;AAAA,MAC/E;AAAA,IACF;AAEA,UAAM,sBAAsB,OAAOF,iBAAoD;AACrF,YAAM,MAAM,UAAM,iCAAmBA,YAAW;AAChD,aAAO,uCAAsB,qBAAqB,GAAG;AAAA,IACvD;AAEA,YAAQD,cAAa;AAAA,MACnB,KAAK,iBAAiB;AACpB,wBAAgB,OAAO;AAEvB,eAAO,oBAAoB,aAAa,OAAQ;AAAA,MAClD;AAAA,MAEA,KAAK;AAEH,eAAO,qBAAqB,aAAa,OAAQ;AAAA,MAEnD,KAAK;AACH,eAAO,oBAAoB,WAAW;AAAA,MAExC;AACE,eAAO,oCAAmB,sCAAsC;AAAA,IACpE;AAAA,EACF;AAEA,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,kBAAkB,WAAW;AAAA,IAEtC,KAAK;AACH,aAAO,mBAAmB,WAAW;AAAA,IAEvC;AACE,aAAO,oCAAmB,+BAA+B;AAAA,EAC7D;AACF;AAEA,MAAM,wBAAwB,OAC5B,SACA,WACsB;AACtB,QAAM,EAAE,aAAa,OAAO,IAAI;AAEhC,QAAM,iBAAa,sCAAiB,OAAO;AAC3C,QAAM,EAAE,iBAAiB,IAAI;AAE7B,MAAI,CAAC,aAAa;AAChB,eAAO,yCAAuB,yBAAyB,gCAAgC,GAAG;AAAA,EAC5F;AAEA,QAAM,gBAAgB,OAAO,WAAW;AACxC,QAAM,oBAAoB,eAAe,eAAe,WAAgC;AAExF,MAAI,CAAC,qBAAqB,CAAC,kBAAkB,SAAS;AACpD,eAAO,yCAAuB,sBAAsB,yCAAyC,GAAG;AAAA,EAClG;AAEA,MAAI,mBAAmB,UAAU;AAC/B,UAAM,iBAAiB,kBAAkB,QAAQ;AAAA,EACnD;AAEA,QAAM,mBAAmB,OAAOA,iBAAsD;AACpF,UAAM,kBAAkB,YAA+B;AACrD,UAAI;AACF,cAAM,MAAM,IAAI,IAAI,QAAQ,OAAO;AACnC,cAAM,YAAY,IAAI,aAAa,IAAI,WAAW;AAElD,YAAI,CAAC,WAAW;AACd,qBAAO,yCAAuB,uBAAuB,yCAAyC,GAAG;AAAA,QACnG;AAEA,YAAI;AAEJ,gBAAQ,WAAW;AAAA,UACjB,KAAK;AACH,0BAAc,QAAQ;AACtB;AAAA,UACF,KAAK;AACH,0BAAc,QAAQ;AACtB;AAAA,UACF,KAAK;AACH,0BAAc,QAAQ;AACtB;AAAA,UACF,KAAK;AACH,0BAAc,QAAQ;AACtB;AAAA,UACF;AACE,uBAAO,yCAAuB,sBAAsB,wFAAwF,GAAG;AAAA,QACnJ;AAEA,YAAI,CAAC,aAAa;AAChB,qBAAO;AAAA,YACL;AAAA,YACA,GAAG,SAAS;AAAA,YACZ;AAAA,UACF;AAAA,QACF;AAEA,mBAAO,2CAAyB;AAAA,UAC9B,OAAO;AAAA,QACT,CAAC;AAAA,MACH,SAAS,OAAO;AACd,mBAAO,yCAAuB,2BAA2B,6BAA6B,GAAG;AAAA,MAC3F;AAAA,IACF;AAEA,YAAQA,cAAa;AAAA,MACnB,KAAK;AACH,eAAO,gBAAgB;AAAA,MACzB;AACE,eAAO,oCAAmB,uBAAuB;AAAA,IACrD;AAAA,EACF;AAEA,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,iBAAiB,WAAgC;AAAA,IAC1D;AACE,aAAO,oCAAmB,+BAA+B;AAAA,EAC7D;AACF;AAEA,MAAM,wBAAwB,OAC5B,SACA,WACsB;AACtB,QAAM,EAAE,aAAa,OAAO,IAAI;AAEhC,QAAM,iBAAa,sCAAiB,OAAO;AAE3C,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,MAAI,CAAC,aAAa;AAChB,eAAO,yCAAuB,yBAAyB,kCAAkC,GAAG;AAAA,EAC9F;AAEA,QAAM,gBAAgB,OAAO,WAAW;AACxC,QAAM,oBAAoB,eAAe,eAAe,WAAgC;AAExF,sBAAoB,aAAa,iBAAiB;AAElD,MAAI,mBAAmB,UAAU;AAC/B,UAAM,iBAAiB,kBAAkB,QAAQ;AAAA,EACnD;AAEA,QAAM,cAAc,OAAOA,iBAAsD;AAC/E,UAAM,SAAS,YAA+B;AAC5C,aAAO,UAAM,gDAAoB,OAAO;AAAA,IAC1C;AAEA,UAAM,qBAAqB,YAA+B;AACxD,UAAI;AACF,cAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK;AACxC,cAAM,EAAE,MAAM,IAAI;AAElB,YAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,qBAAO,yCAAuB,kBAAkB,qBAAqB,GAAG;AAAA,QAC1E;AAEA,cAAM,gBAAgB,UAAM,iDAAwB;AAEpD,cAAM,WAAW,MAAM,cAAc,OAAO,mBAAmB,mCAAkB;AAAA,UAC/E;AAAA,UACA,aAAa;AAAA,QACf,CAAC;AAED,YAAI,CAAC,UAAU;AACb,qBAAO;AAAA,YACL;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAEA,mBAAO,2CAAyB;AAAA,UAC9B;AAAA,QACF,CAAC;AAAA,MACH,SAAS,OAAO;AACd,mBAAO;AAAA,UACL;AAAA,UACA,iBAAiB,QACb,MAAM,UACN;AAAA,UACJ;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,YAAQA,cAAa;AAAA,MACnB,KAAK;AACH,eAAO,OAAO;AAAA,MAChB,KAAK;AACH,eAAO,mBAAmB;AAAA,MAC5B;AACE,eAAO,oCAAmB,sCAAsC;AAAA,IACpE;AAAA,EACF;AAEA,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,YAAY,WAAgC;AAAA,IAErD;AACE,aAAO,oCAAmB,+BAA+B;AAAA,EAC7D;AAEF;","names":["subEndpoint","cookieStore","idToken","error"]}

package/dist/cjs/app-router/admin/signInCreateHandler.js

@@ -0,0 +1,213 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var signInCreateHandler_exports = {};
+__export(signInCreateHandler_exports, {
+  processEmailCodeStrategy: () => processEmailCodeStrategy,
+  processPasswordStrategy: () => processPasswordStrategy,
+  processPhoneCodeStrategy: () => processPhoneCodeStrategy,
+  processResetPasswordStrategy: () => processResetPasswordStrategy,
+  processSignInCreate: () => processSignInCreate
+});
+module.exports = __toCommonJS(signInCreateHandler_exports);
+var import_actions = require("./actions");
+var import_responses = require("./responses");
+const processSignInCreate = async (context) => {
+  try {
+    const body = await context.request.json();
+    const { strategy, identifier } = body;
+    if (!strategy) {
+      return (0, import_responses.createApiErrorResponse)(
+        "STRATEGY_REQUIRED",
+        "Authentication strategy is required",
+        400
+      );
+    }
+    if (!identifier) {
+      return (0, import_responses.createApiSuccessResponse)({
+        status: "needs_identifier",
+        strategy,
+        message: "Identifier is required to continue"
+      });
+    }
+    if (strategy === "email_code") {
+      return await processEmailCodeStrategy(identifier);
+    }
+    if (strategy === "password") {
+      return await processPasswordStrategy(identifier);
+    }
+    if (strategy === "phone_code") {
+      return processPhoneCodeStrategy(identifier);
+    }
+    if (strategy === "reset_password_email_code" || strategy === "reset_password_phone_code") {
+      return await processResetPasswordStrategy(strategy, identifier);
+    }
+    return (0, import_responses.createApiErrorResponse)(
+      "INVALID_STRATEGY",
+      `Unsupported authentication strategy: ${strategy}`,
+      400
+    );
+  } catch (error) {
+    return (0, import_responses.createApiErrorResponse)(
+      "SIGN_IN_CREATE_ERROR",
+      error instanceof Error ? error.message : "An error occurred while creating sign-in",
+      500
+    );
+  }
+};
+const processEmailCodeStrategy = async (email) => {
+  try {
+    const retrieveUser = (0, import_actions.RetrieveUser)();
+    const { data: user, error } = await retrieveUser.getUserByEmail(email);
+    if (error) {
+      return (0, import_responses.createApiErrorResponse)(
+        error.code,
+        error.message,
+        400
+      );
+    }
+    if (!user.emailVerified) {
+      return (0, import_responses.createApiSuccessResponse)({
+        status: "needs_email_verification",
+        identifier: email,
+        supportedFirstFactors: [{ strategy: "email_code" }],
+        userId: user.uid,
+        message: "Email verification required"
+      });
+    }
+    return (0, import_responses.createApiSuccessResponse)({
+      status: "needs_first_factor",
+      identifier: email,
+      supportedFirstFactors: [{ strategy: "email_code" }],
+      userId: user.uid,
+      message: "User verified. Proceed with first factor authentication"
+    });
+  } catch (error) {
+    if (error instanceof Error && error.message.includes("no user record")) {
+      return (0, import_responses.createApiErrorResponse)(
+        "USER_NOT_FOUND",
+        "No user found with this email address",
+        404
+      );
+    }
+    return (0, import_responses.createApiErrorResponse)(
+      "EMAIL_VERIFICATION_ERROR",
+      error instanceof Error ? error.message : "Failed to verify email",
+      500
+    );
+  }
+};
+const processPasswordStrategy = async (identifier) => {
+  try {
+    const retrieveUser = (0, import_actions.RetrieveUser)();
+    const { data: user, error } = await retrieveUser.getUserByEmail(identifier);
+    if (error) {
+      return (0, import_responses.createApiErrorResponse)(
+        error.code,
+        error.message,
+        400
+      );
+    }
+    return (0, import_responses.createApiSuccessResponse)({
+      status: "needs_first_factor",
+      identifier,
+      supportedFirstFactors: [{ strategy: "password" }],
+      userId: user.uid,
+      message: "User verified. Proceed with password authentication"
+    });
+  } catch (error) {
+    if (error instanceof Error && error.message.includes("no user record")) {
+      return (0, import_responses.createApiErrorResponse)(
+        "USER_NOT_FOUND",
+        "No user found with this identifier",
+        404
+      );
+    }
+    return (0, import_responses.createApiErrorResponse)(
+      "USER_VERIFICATION_ERROR",
+      error instanceof Error ? error.message : "Failed to verify user",
+      500
+    );
+  }
+};
+const processPhoneCodeStrategy = async (phoneNumber) => {
+  try {
+    return (0, import_responses.createApiSuccessResponse)({
+      status: "needs_first_factor",
+      identifier: phoneNumber,
+      supportedFirstFactors: [{ strategy: "phone_code" }],
+      //userId: user.uid,
+      message: "User verified. Proceed with phone authentication"
+    });
+  } catch (error) {
+    if (error instanceof Error && error.message.includes("no user record")) {
+      return (0, import_responses.createApiErrorResponse)(
+        "USER_NOT_FOUND",
+        "No user found with this phone number",
+        404
+      );
+    }
+    return (0, import_responses.createApiErrorResponse)(
+      "PHONE_VERIFICATION_ERROR",
+      error instanceof Error ? error.message : "Failed to verify phone number",
+      500
+    );
+  }
+};
+const processResetPasswordStrategy = async (strategy, identifier) => {
+  try {
+    if (strategy === "reset_password_email_code") {
+      const retrieveUser = (0, import_actions.RetrieveUser)();
+      const { data: user, error } = await retrieveUser.getUserByEmail(identifier);
+      if (error) {
+        return (0, import_responses.createApiErrorResponse)(
+          error.code,
+          error.message,
+          400
+        );
+      }
+      return (0, import_responses.createApiSuccessResponse)({
+        status: "needs_first_factor",
+        identifier,
+        strategy,
+        userId: user.uid,
+        message: "User verified. Proceed with password reset"
+      });
+    }
+    return (0, import_responses.createApiErrorResponse)(
+      "NOT_IMPLEMENTED",
+      "Phone reset password strategy not yet implemented",
+      501
+    );
+  } catch (error) {
+    return (0, import_responses.createApiErrorResponse)(
+      "RESET_PASSWORD_ERROR",
+      error instanceof Error ? error.message : "Failed to process password reset",
+      500
+    );
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  processEmailCodeStrategy,
+  processPasswordStrategy,
+  processPhoneCodeStrategy,
+  processResetPasswordStrategy,
+  processSignInCreate
+});
+//# sourceMappingURL=signInCreateHandler.js.map

package/dist/cjs/app-router/admin/signInCreateHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/app-router/admin/signInCreateHandler.ts"],"sourcesContent":["import type { SignInCreateParams } from '@tern-secure/types';\n\nimport { RetrieveUser } from './actions';\nimport type { RequestProcessorContext } from './c-authenticateRequestProcessor';\nimport {\n  createApiErrorResponse,\n  createApiSuccessResponse,\n} from './responses';\n\n\nexport const processSignInCreate = async (\n  context: RequestProcessorContext\n): Promise<Response> => {\n  try {\n    const body = await context.request.json();\n    const { strategy, identifier } = body as SignInCreateParams & { identifier?: string; password?: string };\n\n    if (!strategy) {\n      return createApiErrorResponse(\n        'STRATEGY_REQUIRED',\n        'Authentication strategy is required',\n        400\n      );\n    }\n\n    if (!identifier) {\n      return createApiSuccessResponse({\n        status: 'needs_identifier',\n        strategy,\n        message: 'Identifier is required to continue',\n      });\n    }\n\n    if (strategy === 'email_code') {\n      return await processEmailCodeStrategy(identifier);\n    }\n\n    if (strategy === 'password') {\n      return await processPasswordStrategy(identifier);\n    }\n\n    if (strategy === 'phone_code') {\n      return processPhoneCodeStrategy(identifier);\n    }\n\n    if (strategy === 'reset_password_email_code' || strategy === 'reset_password_phone_code') {\n      return await processResetPasswordStrategy(strategy, identifier);\n    }\n\n    return createApiErrorResponse(\n      'INVALID_STRATEGY',\n      `Unsupported authentication strategy: ${strategy}`,\n      400\n    );\n  } catch (error) {\n    return createApiErrorResponse(\n      'SIGN_IN_CREATE_ERROR',\n      error instanceof Error\n        ? error.message\n        : 'An error occurred while creating sign-in',\n      500\n    );\n  }\n};\n\n/**\n * Processes email_code strategy\n * Verifies if user exists by email and returns needs_first_factor status\n */\nexport const processEmailCodeStrategy = async (email: string): Promise<Response> => {\n  try {\n    const retrieveUser = RetrieveUser();\n    const { data: user, error } = await retrieveUser.getUserByEmail(email);\n\n    if (error) {\n      return createApiErrorResponse(\n        error.code,\n        error.message,\n        400\n      );\n    }\n\n    if (!user.emailVerified) {\n      return createApiSuccessResponse({\n        status: 'needs_email_verification',\n        identifier: email,\n        supportedFirstFactors: [{ strategy: 'email_code' }],\n        userId: user.uid,\n        message: 'Email verification required',\n      });\n    }\n\n    return createApiSuccessResponse({\n      status: 'needs_first_factor',\n      identifier: email,\n      supportedFirstFactors: [{ strategy: 'email_code' }],\n      userId: user.uid,\n      message: 'User verified. Proceed with first factor authentication',\n    });\n  } catch (error) {\n    if (error instanceof Error && error.message.includes('no user record')) {\n      return createApiErrorResponse(\n        'USER_NOT_FOUND',\n        'No user found with this email address',\n        404\n      );\n    }\n\n    return createApiErrorResponse(\n      'EMAIL_VERIFICATION_ERROR',\n      error instanceof Error ? error.message : 'Failed to verify email',\n      500\n    );\n  }\n};\n\n\nexport const processPasswordStrategy = async (identifier: string): Promise<Response> => {\n  try {\n    const retrieveUser = RetrieveUser();\n    const { data: user, error } = await retrieveUser.getUserByEmail(identifier);\n\n    if (error) {\n      return createApiErrorResponse(\n        error.code,\n        error.message,\n        400\n      );\n    }\n\n    return createApiSuccessResponse({\n      status: 'needs_first_factor',\n      identifier,\n      supportedFirstFactors: [{ strategy: 'password' }],\n      userId: user.uid,\n      message: 'User verified. Proceed with password authentication',\n    });\n  } catch (error) {\n    if (error instanceof Error && error.message.includes('no user record')) {\n      return createApiErrorResponse(\n        'USER_NOT_FOUND',\n        'No user found with this identifier',\n        404\n      );\n    }\n\n    return createApiErrorResponse(\n      'USER_VERIFICATION_ERROR',\n      error instanceof Error ? error.message : 'Failed to verify user',\n      500\n    );\n  }\n};\n\n\nexport const processPhoneCodeStrategy = async (phoneNumber: string): Promise<Response> => {\n  try {\n    //const retrieveUser = RetrieveUser();\n    //const { data: user, error } = await retrieveUser.getUserByPhoneNumber(phoneNumber);\n\n    //if (error) {\n   //   return createApiErrorResponse(\n   //     error.code,\n    //    error.message,\n   //     400\n   //   );\n   // }\n\n    return createApiSuccessResponse({\n      status: 'needs_first_factor',\n      identifier: phoneNumber,\n      supportedFirstFactors: [{ strategy: 'phone_code' }],\n      //userId: user.uid,\n      message: 'User verified. Proceed with phone authentication',\n    });\n  } catch (error) {\n    if (error instanceof Error && error.message.includes('no user record')) {\n      return createApiErrorResponse(\n        'USER_NOT_FOUND',\n        'No user found with this phone number',\n        404\n      );\n    }\n\n    return createApiErrorResponse(\n      'PHONE_VERIFICATION_ERROR',\n      error instanceof Error ? error.message : 'Failed to verify phone number',\n      500\n    );\n  }\n};\n\n\nexport const processResetPasswordStrategy = async (\n  strategy: 'reset_password_email_code' | 'reset_password_phone_code',\n  identifier: string\n): Promise<Response> => {\n  try {\n    if (strategy === 'reset_password_email_code') {\n      const retrieveUser = RetrieveUser();\n      const { data: user, error } = await retrieveUser.getUserByEmail(identifier);\n\n      if (error) {\n        return createApiErrorResponse(\n          error.code,\n          error.message,\n          400\n        );\n      }\n\n      return createApiSuccessResponse({\n        status: 'needs_first_factor',\n        identifier,\n        strategy,\n        userId: user.uid,\n        message: 'User verified. Proceed with password reset',\n      });\n    }\n\n    return createApiErrorResponse(\n      'NOT_IMPLEMENTED',\n      'Phone reset password strategy not yet implemented',\n      501\n    );\n  } catch (error) {\n    return createApiErrorResponse(\n      'RESET_PASSWORD_ERROR',\n      error instanceof Error ? error.message : 'Failed to process password reset',\n      500\n    );\n  }\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,qBAA6B;AAE7B,uBAGO;AAGA,MAAM,sBAAsB,OACjC,YACsB;AACtB,MAAI;AACF,UAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK;AACxC,UAAM,EAAE,UAAU,WAAW,IAAI;AAEjC,QAAI,CAAC,UAAU;AACb,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,YAAY;AACf,iBAAO,2CAAyB;AAAA,QAC9B,QAAQ;AAAA,QACR;AAAA,QACA,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAEA,QAAI,aAAa,cAAc;AAC7B,aAAO,MAAM,yBAAyB,UAAU;AAAA,IAClD;AAEA,QAAI,aAAa,YAAY;AAC3B,aAAO,MAAM,wBAAwB,UAAU;AAAA,IACjD;AAEA,QAAI,aAAa,cAAc;AAC7B,aAAO,yBAAyB,UAAU;AAAA,IAC5C;AAEA,QAAI,aAAa,+BAA+B,aAAa,6BAA6B;AACxF,aAAO,MAAM,6BAA6B,UAAU,UAAU;AAAA,IAChE;AAEA,eAAO;AAAA,MACL;AAAA,MACA,wCAAwC,QAAQ;AAAA,MAChD;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,eAAO;AAAA,MACL;AAAA,MACA,iBAAiB,QACb,MAAM,UACN;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACF;AAMO,MAAM,2BAA2B,OAAO,UAAqC;AAClF,MAAI;AACF,UAAM,mBAAe,6BAAa;AAClC,UAAM,EAAE,MAAM,MAAM,MAAM,IAAI,MAAM,aAAa,eAAe,KAAK;AAErE,QAAI,OAAO;AACT,iBAAO;AAAA,QACL,MAAM;AAAA,QACN,MAAM;AAAA,QACN;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,KAAK,eAAe;AACvB,iBAAO,2CAAyB;AAAA,QAC9B,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,uBAAuB,CAAC,EAAE,UAAU,aAAa,CAAC;AAAA,QAClD,QAAQ,KAAK;AAAA,QACb,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAEA,eAAO,2CAAyB;AAAA,MAC9B,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,uBAAuB,CAAC,EAAE,UAAU,aAAa,CAAC;AAAA,MAClD,QAAQ,KAAK;AAAA,MACb,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,SAAS,MAAM,QAAQ,SAAS,gBAAgB,GAAG;AACtE,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,eAAO;AAAA,MACL;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAGO,MAAM,0BAA0B,OAAO,eAA0C;AACtF,MAAI;AACF,UAAM,mBAAe,6BAAa;AAClC,UAAM,EAAE,MAAM,MAAM,MAAM,IAAI,MAAM,aAAa,eAAe,UAAU;AAE1E,QAAI,OAAO;AACT,iBAAO;AAAA,QACL,MAAM;AAAA,QACN,MAAM;AAAA,QACN;AAAA,MACF;AAAA,IACF;AAEA,eAAO,2CAAyB;AAAA,MAC9B,QAAQ;AAAA,MACR;AAAA,MACA,uBAAuB,CAAC,EAAE,UAAU,WAAW,CAAC;AAAA,MAChD,QAAQ,KAAK;AAAA,MACb,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,SAAS,MAAM,QAAQ,SAAS,gBAAgB,GAAG;AACtE,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,eAAO;AAAA,MACL;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAGO,MAAM,2BAA2B,OAAO,gBAA2C;AACxF,MAAI;AAYF,eAAO,2CAAyB;AAAA,MAC9B,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,uBAAuB,CAAC,EAAE,UAAU,aAAa,CAAC;AAAA;AAAA,MAElD,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,SAAS,MAAM,QAAQ,SAAS,gBAAgB,GAAG;AACtE,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,eAAO;AAAA,MACL;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAGO,MAAM,+BAA+B,OAC1C,UACA,eACsB;AACtB,MAAI;AACF,QAAI,aAAa,6BAA6B;AAC5C,YAAM,mBAAe,6BAAa;AAClC,YAAM,EAAE,MAAM,MAAM,MAAM,IAAI,MAAM,aAAa,eAAe,UAAU;AAE1E,UAAI,OAAO;AACT,mBAAO;AAAA,UACL,MAAM;AAAA,UACN,MAAM;AAAA,UACN;AAAA,QACF;AAAA,MACF;AAEA,iBAAO,2CAAyB;AAAA,QAC9B,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,QAAQ,KAAK;AAAA,QACb,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAEA,eAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,eAAO;AAAA,MACL;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;","names":[]}