@tern-secure/nextjs 5.2.0-canary.v20251108045933 → 5.2.0-canary.v20251127221555

package/dist/cjs/app-router/admin/signInCreateHandler.js

@@ -0,0 +1,213 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var signInCreateHandler_exports = {};
+__export(signInCreateHandler_exports, {
+  processEmailCodeStrategy: () => processEmailCodeStrategy,
+  processPasswordStrategy: () => processPasswordStrategy,
+  processPhoneCodeStrategy: () => processPhoneCodeStrategy,
+  processResetPasswordStrategy: () => processResetPasswordStrategy,
+  processSignInCreate: () => processSignInCreate
+});
+module.exports = __toCommonJS(signInCreateHandler_exports);
+var import_actions = require("./actions");
+var import_responses = require("./responses");
+const processSignInCreate = async (context) => {
+  try {
+    const body = await context.request.json();
+    const { strategy, identifier } = body;
+    if (!strategy) {
+      return (0, import_responses.createApiErrorResponse)(
+        "STRATEGY_REQUIRED",
+        "Authentication strategy is required",
+        400
+      );
+    }
+    if (!identifier) {
+      return (0, import_responses.createApiSuccessResponse)({
+        status: "needs_identifier",
+        strategy,
+        message: "Identifier is required to continue"
+      });
+    }
+    if (strategy === "email_code") {
+      return await processEmailCodeStrategy(identifier);
+    }
+    if (strategy === "password") {
+      return await processPasswordStrategy(identifier);
+    }
+    if (strategy === "phone_code") {
+      return processPhoneCodeStrategy(identifier);
+    }
+    if (strategy === "reset_password_email_code" || strategy === "reset_password_phone_code") {
+      return await processResetPasswordStrategy(strategy, identifier);
+    }
+    return (0, import_responses.createApiErrorResponse)(
+      "INVALID_STRATEGY",
+      `Unsupported authentication strategy: ${strategy}`,
+      400
+    );
+  } catch (error) {
+    return (0, import_responses.createApiErrorResponse)(
+      "SIGN_IN_CREATE_ERROR",
+      error instanceof Error ? error.message : "An error occurred while creating sign-in",
+      500
+    );
+  }
+};
+const processEmailCodeStrategy = async (email) => {
+  try {
+    const retrieveUser = (0, import_actions.RetrieveUser)();
+    const { data: user, error } = await retrieveUser.getUserByEmail(email);
+    if (error) {
+      return (0, import_responses.createApiErrorResponse)(
+        error.code,
+        error.message,
+        400
+      );
+    }
+    if (!user.emailVerified) {
+      return (0, import_responses.createApiSuccessResponse)({
+        status: "needs_email_verification",
+        identifier: email,
+        supportedFirstFactors: [{ strategy: "email_code" }],
+        userId: user.uid,
+        message: "Email verification required"
+      });
+    }
+    return (0, import_responses.createApiSuccessResponse)({
+      status: "needs_first_factor",
+      identifier: email,
+      supportedFirstFactors: [{ strategy: "email_code" }],
+      userId: user.uid,
+      message: "User verified. Proceed with first factor authentication"
+    });
+  } catch (error) {
+    if (error instanceof Error && error.message.includes("no user record")) {
+      return (0, import_responses.createApiErrorResponse)(
+        "USER_NOT_FOUND",
+        "No user found with this email address",
+        404
+      );
+    }
+    return (0, import_responses.createApiErrorResponse)(
+      "EMAIL_VERIFICATION_ERROR",
+      error instanceof Error ? error.message : "Failed to verify email",
+      500
+    );
+  }
+};
+const processPasswordStrategy = async (identifier) => {
+  try {
+    const retrieveUser = (0, import_actions.RetrieveUser)();
+    const { data: user, error } = await retrieveUser.getUserByEmail(identifier);
+    if (error) {
+      return (0, import_responses.createApiErrorResponse)(
+        error.code,
+        error.message,
+        400
+      );
+    }
+    return (0, import_responses.createApiSuccessResponse)({
+      status: "needs_first_factor",
+      identifier,
+      supportedFirstFactors: [{ strategy: "password" }],
+      userId: user.uid,
+      message: "User verified. Proceed with password authentication"
+    });
+  } catch (error) {
+    if (error instanceof Error && error.message.includes("no user record")) {
+      return (0, import_responses.createApiErrorResponse)(
+        "USER_NOT_FOUND",
+        "No user found with this identifier",
+        404
+      );
+    }
+    return (0, import_responses.createApiErrorResponse)(
+      "USER_VERIFICATION_ERROR",
+      error instanceof Error ? error.message : "Failed to verify user",
+      500
+    );
+  }
+};
+const processPhoneCodeStrategy = async (phoneNumber) => {
+  try {
+    return (0, import_responses.createApiSuccessResponse)({
+      status: "needs_first_factor",
+      identifier: phoneNumber,
+      supportedFirstFactors: [{ strategy: "phone_code" }],
+      //userId: user.uid,
+      message: "User verified. Proceed with phone authentication"
+    });
+  } catch (error) {
+    if (error instanceof Error && error.message.includes("no user record")) {
+      return (0, import_responses.createApiErrorResponse)(
+        "USER_NOT_FOUND",
+        "No user found with this phone number",
+        404
+      );
+    }
+    return (0, import_responses.createApiErrorResponse)(
+      "PHONE_VERIFICATION_ERROR",
+      error instanceof Error ? error.message : "Failed to verify phone number",
+      500
+    );
+  }
+};
+const processResetPasswordStrategy = async (strategy, identifier) => {
+  try {
+    if (strategy === "reset_password_email_code") {
+      const retrieveUser = (0, import_actions.RetrieveUser)();
+      const { data: user, error } = await retrieveUser.getUserByEmail(identifier);
+      if (error) {
+        return (0, import_responses.createApiErrorResponse)(
+          error.code,
+          error.message,
+          400
+        );
+      }
+      return (0, import_responses.createApiSuccessResponse)({
+        status: "needs_first_factor",
+        identifier,
+        strategy,
+        userId: user.uid,
+        message: "User verified. Proceed with password reset"
+      });
+    }
+    return (0, import_responses.createApiErrorResponse)(
+      "NOT_IMPLEMENTED",
+      "Phone reset password strategy not yet implemented",
+      501
+    );
+  } catch (error) {
+    return (0, import_responses.createApiErrorResponse)(
+      "RESET_PASSWORD_ERROR",
+      error instanceof Error ? error.message : "Failed to process password reset",
+      500
+    );
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  processEmailCodeStrategy,
+  processPasswordStrategy,
+  processPhoneCodeStrategy,
+  processResetPasswordStrategy,
+  processSignInCreate
+});
+//# sourceMappingURL=signInCreateHandler.js.map

package/dist/cjs/app-router/admin/signInCreateHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/app-router/admin/signInCreateHandler.ts"],"sourcesContent":["import type { SignInCreateParams } from '@tern-secure/types';\n\nimport { RetrieveUser } from './actions';\nimport type { RequestProcessorContext } from './c-authenticateRequestProcessor';\nimport {\n  createApiErrorResponse,\n  createApiSuccessResponse,\n} from './responses';\n\n\nexport const processSignInCreate = async (\n  context: RequestProcessorContext\n): Promise<Response> => {\n  try {\n    const body = await context.request.json();\n    const { strategy, identifier } = body as SignInCreateParams & { identifier?: string; password?: string };\n\n    if (!strategy) {\n      return createApiErrorResponse(\n        'STRATEGY_REQUIRED',\n        'Authentication strategy is required',\n        400\n      );\n    }\n\n    if (!identifier) {\n      return createApiSuccessResponse({\n        status: 'needs_identifier',\n        strategy,\n        message: 'Identifier is required to continue',\n      });\n    }\n\n    if (strategy === 'email_code') {\n      return await processEmailCodeStrategy(identifier);\n    }\n\n    if (strategy === 'password') {\n      return await processPasswordStrategy(identifier);\n    }\n\n    if (strategy === 'phone_code') {\n      return processPhoneCodeStrategy(identifier);\n    }\n\n    if (strategy === 'reset_password_email_code' || strategy === 'reset_password_phone_code') {\n      return await processResetPasswordStrategy(strategy, identifier);\n    }\n\n    return createApiErrorResponse(\n      'INVALID_STRATEGY',\n      `Unsupported authentication strategy: ${strategy}`,\n      400\n    );\n  } catch (error) {\n    return createApiErrorResponse(\n      'SIGN_IN_CREATE_ERROR',\n      error instanceof Error\n        ? error.message\n        : 'An error occurred while creating sign-in',\n      500\n    );\n  }\n};\n\n/**\n * Processes email_code strategy\n * Verifies if user exists by email and returns needs_first_factor status\n */\nexport const processEmailCodeStrategy = async (email: string): Promise<Response> => {\n  try {\n    const retrieveUser = RetrieveUser();\n    const { data: user, error } = await retrieveUser.getUserByEmail(email);\n\n    if (error) {\n      return createApiErrorResponse(\n        error.code,\n        error.message,\n        400\n      );\n    }\n\n    if (!user.emailVerified) {\n      return createApiSuccessResponse({\n        status: 'needs_email_verification',\n        identifier: email,\n        supportedFirstFactors: [{ strategy: 'email_code' }],\n        userId: user.uid,\n        message: 'Email verification required',\n      });\n    }\n\n    return createApiSuccessResponse({\n      status: 'needs_first_factor',\n      identifier: email,\n      supportedFirstFactors: [{ strategy: 'email_code' }],\n      userId: user.uid,\n      message: 'User verified. Proceed with first factor authentication',\n    });\n  } catch (error) {\n    if (error instanceof Error && error.message.includes('no user record')) {\n      return createApiErrorResponse(\n        'USER_NOT_FOUND',\n        'No user found with this email address',\n        404\n      );\n    }\n\n    return createApiErrorResponse(\n      'EMAIL_VERIFICATION_ERROR',\n      error instanceof Error ? error.message : 'Failed to verify email',\n      500\n    );\n  }\n};\n\n\nexport const processPasswordStrategy = async (identifier: string): Promise<Response> => {\n  try {\n    const retrieveUser = RetrieveUser();\n    const { data: user, error } = await retrieveUser.getUserByEmail(identifier);\n\n    if (error) {\n      return createApiErrorResponse(\n        error.code,\n        error.message,\n        400\n      );\n    }\n\n    return createApiSuccessResponse({\n      status: 'needs_first_factor',\n      identifier,\n      supportedFirstFactors: [{ strategy: 'password' }],\n      userId: user.uid,\n      message: 'User verified. Proceed with password authentication',\n    });\n  } catch (error) {\n    if (error instanceof Error && error.message.includes('no user record')) {\n      return createApiErrorResponse(\n        'USER_NOT_FOUND',\n        'No user found with this identifier',\n        404\n      );\n    }\n\n    return createApiErrorResponse(\n      'USER_VERIFICATION_ERROR',\n      error instanceof Error ? error.message : 'Failed to verify user',\n      500\n    );\n  }\n};\n\n\nexport const processPhoneCodeStrategy = async (phoneNumber: string): Promise<Response> => {\n  try {\n    //const retrieveUser = RetrieveUser();\n    //const { data: user, error } = await retrieveUser.getUserByPhoneNumber(phoneNumber);\n\n    //if (error) {\n   //   return createApiErrorResponse(\n   //     error.code,\n    //    error.message,\n   //     400\n   //   );\n   // }\n\n    return createApiSuccessResponse({\n      status: 'needs_first_factor',\n      identifier: phoneNumber,\n      supportedFirstFactors: [{ strategy: 'phone_code' }],\n      //userId: user.uid,\n      message: 'User verified. Proceed with phone authentication',\n    });\n  } catch (error) {\n    if (error instanceof Error && error.message.includes('no user record')) {\n      return createApiErrorResponse(\n        'USER_NOT_FOUND',\n        'No user found with this phone number',\n        404\n      );\n    }\n\n    return createApiErrorResponse(\n      'PHONE_VERIFICATION_ERROR',\n      error instanceof Error ? error.message : 'Failed to verify phone number',\n      500\n    );\n  }\n};\n\n\nexport const processResetPasswordStrategy = async (\n  strategy: 'reset_password_email_code' | 'reset_password_phone_code',\n  identifier: string\n): Promise<Response> => {\n  try {\n    if (strategy === 'reset_password_email_code') {\n      const retrieveUser = RetrieveUser();\n      const { data: user, error } = await retrieveUser.getUserByEmail(identifier);\n\n      if (error) {\n        return createApiErrorResponse(\n          error.code,\n          error.message,\n          400\n        );\n      }\n\n      return createApiSuccessResponse({\n        status: 'needs_first_factor',\n        identifier,\n        strategy,\n        userId: user.uid,\n        message: 'User verified. Proceed with password reset',\n      });\n    }\n\n    return createApiErrorResponse(\n      'NOT_IMPLEMENTED',\n      'Phone reset password strategy not yet implemented',\n      501\n    );\n  } catch (error) {\n    return createApiErrorResponse(\n      'RESET_PASSWORD_ERROR',\n      error instanceof Error ? error.message : 'Failed to process password reset',\n      500\n    );\n  }\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,qBAA6B;AAE7B,uBAGO;AAGA,MAAM,sBAAsB,OACjC,YACsB;AACtB,MAAI;AACF,UAAM,OAAO,MAAM,QAAQ,QAAQ,KAAK;AACxC,UAAM,EAAE,UAAU,WAAW,IAAI;AAEjC,QAAI,CAAC,UAAU;AACb,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,YAAY;AACf,iBAAO,2CAAyB;AAAA,QAC9B,QAAQ;AAAA,QACR;AAAA,QACA,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAEA,QAAI,aAAa,cAAc;AAC7B,aAAO,MAAM,yBAAyB,UAAU;AAAA,IAClD;AAEA,QAAI,aAAa,YAAY;AAC3B,aAAO,MAAM,wBAAwB,UAAU;AAAA,IACjD;AAEA,QAAI,aAAa,cAAc;AAC7B,aAAO,yBAAyB,UAAU;AAAA,IAC5C;AAEA,QAAI,aAAa,+BAA+B,aAAa,6BAA6B;AACxF,aAAO,MAAM,6BAA6B,UAAU,UAAU;AAAA,IAChE;AAEA,eAAO;AAAA,MACL;AAAA,MACA,wCAAwC,QAAQ;AAAA,MAChD;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,eAAO;AAAA,MACL;AAAA,MACA,iBAAiB,QACb,MAAM,UACN;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACF;AAMO,MAAM,2BAA2B,OAAO,UAAqC;AAClF,MAAI;AACF,UAAM,mBAAe,6BAAa;AAClC,UAAM,EAAE,MAAM,MAAM,MAAM,IAAI,MAAM,aAAa,eAAe,KAAK;AAErE,QAAI,OAAO;AACT,iBAAO;AAAA,QACL,MAAM;AAAA,QACN,MAAM;AAAA,QACN;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,KAAK,eAAe;AACvB,iBAAO,2CAAyB;AAAA,QAC9B,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,uBAAuB,CAAC,EAAE,UAAU,aAAa,CAAC;AAAA,QAClD,QAAQ,KAAK;AAAA,QACb,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAEA,eAAO,2CAAyB;AAAA,MAC9B,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,uBAAuB,CAAC,EAAE,UAAU,aAAa,CAAC;AAAA,MAClD,QAAQ,KAAK;AAAA,MACb,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,SAAS,MAAM,QAAQ,SAAS,gBAAgB,GAAG;AACtE,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,eAAO;AAAA,MACL;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAGO,MAAM,0BAA0B,OAAO,eAA0C;AACtF,MAAI;AACF,UAAM,mBAAe,6BAAa;AAClC,UAAM,EAAE,MAAM,MAAM,MAAM,IAAI,MAAM,aAAa,eAAe,UAAU;AAE1E,QAAI,OAAO;AACT,iBAAO;AAAA,QACL,MAAM;AAAA,QACN,MAAM;AAAA,QACN;AAAA,MACF;AAAA,IACF;AAEA,eAAO,2CAAyB;AAAA,MAC9B,QAAQ;AAAA,MACR;AAAA,MACA,uBAAuB,CAAC,EAAE,UAAU,WAAW,CAAC;AAAA,MAChD,QAAQ,KAAK;AAAA,MACb,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,SAAS,MAAM,QAAQ,SAAS,gBAAgB,GAAG;AACtE,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,eAAO;AAAA,MACL;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAGO,MAAM,2BAA2B,OAAO,gBAA2C;AACxF,MAAI;AAYF,eAAO,2CAAyB;AAAA,MAC9B,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,uBAAuB,CAAC,EAAE,UAAU,aAAa,CAAC;AAAA;AAAA,MAElD,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,SAAS,MAAM,QAAQ,SAAS,gBAAgB,GAAG;AACtE,iBAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,eAAO;AAAA,MACL;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;AAGO,MAAM,+BAA+B,OAC1C,UACA,eACsB;AACtB,MAAI;AACF,QAAI,aAAa,6BAA6B;AAC5C,YAAM,mBAAe,6BAAa;AAClC,YAAM,EAAE,MAAM,MAAM,MAAM,IAAI,MAAM,aAAa,eAAe,UAAU;AAE1E,UAAI,OAAO;AACT,mBAAO;AAAA,UACL,MAAM;AAAA,UACN,MAAM;AAAA,UACN;AAAA,QACF;AAAA,MACF;AAEA,iBAAO,2CAAyB;AAAA,QAC9B,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA,QAAQ,KAAK;AAAA,QACb,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAEA,eAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,eAAO;AAAA,MACL;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/cjs/app-router/admin/types.js

@@ -27,6 +27,7 @@ __export(types_exports, {
   DEFAULT_SECURITY_OPTIONS: () => DEFAULT_SECURITY_OPTIONS,
   DEFAULT_SESSIONS_CONFIG: () => DEFAULT_SESSIONS_CONFIG,
   DEFAULT_SESSION_COOKIE_OPTIONS: () => DEFAULT_SESSION_COOKIE_OPTIONS,
+  DEFAULT_SIGNINS_CONFIG: () => DEFAULT_SIGNINS_CONFIG,
   FIXED_TOKEN_CONFIGS: () => FIXED_TOKEN_CONFIGS
 });
 module.exports = __toCommonJS(types_exports);
@@ -154,6 +155,16 @@ const DEFAULT_SESSIONS_CONFIG = {
     }
   }
 };
+const DEFAULT_SIGNINS_CONFIG = {
+  ...DEFAULT_ENDPOINT_CONFIG,
+  subEndpoints: {
+    resetPasswordEmail: {
+      enabled: true,
+      methods: ["POST"],
+      requireAuth: false
+    }
+  }
+};
 const DEFAULT_HANDLER_OPTIONS = {
   cors: DEFAULT_CORS_OPTIONS,
   cookies: DEFAULT_SESSION_COOKIE_OPTIONS,
@@ -167,7 +178,8 @@ const DEFAULT_HANDLER_OPTIONS = {
   security: DEFAULT_SECURITY_OPTIONS,
   endpoints: {
     cookies: DEFAULT_COOKIE_REQUEST_CONFIG,
-    sessions: DEFAULT_SESSIONS_CONFIG
+    sessions: DEFAULT_SESSIONS_CONFIG,
+    signIns: DEFAULT_SIGNINS_CONFIG
   },
   tenantId: "",
   revokeRefreshTokensOnSignOut: true,
@@ -223,6 +235,7 @@ class CookieUtils {
   DEFAULT_SECURITY_OPTIONS,
   DEFAULT_SESSIONS_CONFIG,
   DEFAULT_SESSION_COOKIE_OPTIONS,
+  DEFAULT_SIGNINS_CONFIG,
   FIXED_TOKEN_CONFIGS
 });
 //# sourceMappingURL=types.js.map

package/dist/cjs/app-router/admin/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/app-router/admin/types.ts"],"sourcesContent":["import type {\n  AuthEndpoint,\n  CookieEndpointConfig,\n  CookieOpts as CookieOptions,\n  CorsOptions,\n  EndpointConfig,\n  SecurityOptions,\n  SessionEndpointConfig,\n  SessionSubEndpoint,\n  TernSecureHandlerOptions,\n  TokenCookieConfig,\n} from '@tern-secure/types';\nimport { type NextResponse } from 'next/server';\n\nexport const DEFAULT_CORS_OPTIONS: CorsOptions = {\n  allowedOrigins: [],\n  allowedMethods: ['GET', 'POST'],\n  allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With'],\n  allowCredentials: true,\n  maxAge: 86400, // 24 hours\n};\n\nexport const DEFAULT_SESSION_COOKIE_OPTIONS: CookieOptions = {\n  httpOnly: true,\n  path: '/',\n  secure: process.env.NODE_ENV === 'production',\n  sameSite: 'strict',\n  maxAge: 12 * 60 * 60 * 24, // twelve days\n  priority: 'high',\n};\n\nexport const DEFAULT_ID_REFRESH_TOKEN_COOKIE_OPTIONS: CookieOptions = {\n  httpOnly: true,\n  path: '/',\n  secure: process.env.NODE_ENV === 'production',\n  sameSite: 'strict',\n  maxAge: 12 * 60 * 60 * 24, // twelve days\n  priority: 'high',\n};\n\n\nexport const FIXED_TOKEN_CONFIGS = {\n  id: {\n    path: '/',\n    httpOnly: true,\n    sameSite: 'lax' as const,\n    maxAge: 3600, // 1 hour\n  },\n  refresh: {\n    path: '/',\n    httpOnly: true,\n    sameSite: 'lax' as const,\n    maxAge: 3600 * 24 * 30, // 30 days (changes when user events occur)\n  },\n  signature: {\n    path: '/',\n    httpOnly: true,\n    sameSite: 'lax' as const,\n    maxAge: 3600 * 24 * 7, // 1 week (as needed)\n  },\n  custom: {\n    path: '/',\n    httpOnly: true,\n    sameSite: 'lax' as const,\n    maxAge: 3600 * 24 * 7, // 1 week (as needed)\n  },\n} as const;\n\nexport const DEFAULT_SECURITY_OPTIONS: SecurityOptions = {\n  requireCSRF: true,\n  allowedReferers: [],\n  requiredHeaders: {},\n  ipWhitelist: [],\n  userAgent: {\n    block: [],\n    allow: [],\n  },\n};\n\nexport const DEFAULT_ENDPOINT_CONFIG: EndpointConfig = {\n  enabled: true,\n  methods: ['GET', 'POST'],\n  requireAuth: false,\n  security: DEFAULT_SECURITY_OPTIONS,\n};\n\nexport const DEFAULT_COOKIE_REQUEST_CONFIG: CookieEndpointConfig = {\n  ...DEFAULT_ENDPOINT_CONFIG,\n  subEndpoints: {\n    get: {\n      enabled: true,\n      methods: ['GET'],\n      requireAuth: false,\n      security: {\n        requireCSRF: true,\n        allowedReferers: [],\n      },\n    },\n  },\n};\n\nexport const DEFAULT_SESSIONS_CONFIG: SessionEndpointConfig = {\n  ...DEFAULT_ENDPOINT_CONFIG,\n  subEndpoints: {\n    verify: {\n      enabled: true,\n      methods: ['GET'],\n      requireAuth: false,\n      security: {\n        requireCSRF: true,\n        allowedReferers: [],\n      },\n    },\n    createsession: {\n      enabled: true,\n      methods: ['POST'],\n      requireAuth: false,\n      security: {\n        requireCSRF: true,\n      },\n    },\n    refresh: {\n      enabled: true,\n      methods: ['POST'],\n      requireAuth: true,\n      security: {\n        requireCSRF: true,\n      },\n    },\n    revoke: {\n      enabled: true,\n      methods: ['POST'],\n      requireAuth: true,\n      security: {\n        requireCSRF: true,\n      },\n    },\n  },\n};\n\nexport const DEFAULT_HANDLER_OPTIONS: Required<TernSecureHandlerOptions> & {\n  endpoints: Required<NonNullable<TernSecureHandlerOptions['endpoints']>>;\n} = {\n  cors: DEFAULT_CORS_OPTIONS,\n  cookies: DEFAULT_SESSION_COOKIE_OPTIONS,\n  rateLimit: {\n    windowMs: 15 * 60 * 1000, // 15 minutes\n    maxRequests: 100,\n    skipSuccessful: false,\n    skipFailedRequests: false,\n  },\n  security: DEFAULT_SECURITY_OPTIONS,\n  endpoints: {\n    cookies: DEFAULT_COOKIE_REQUEST_CONFIG,\n    sessions: DEFAULT_SESSIONS_CONFIG,\n  },\n  tenantId: '',\n  revokeRefreshTokensOnSignOut: true,\n  enableCustomToken: false,\n  debug: false,\n  environment: 'production',\n  basePath: '/api/auth',\n};\n\nexport interface ValidationResult {\n  error?: NextResponse;\n  data?: any;\n}\n\nexport interface ValidationConfig {\n  cors?: CorsOptions;\n  security?: SecurityOptions;\n  endpoint?: {\n    name: AuthEndpoint;\n    config: EndpointConfig;\n  };\n  subEndpoint?: {\n    name: SessionSubEndpoint;\n    config: EndpointConfig;\n  };\n  requireIdToken?: boolean;\n  requireCsrfToken?: boolean;\n}\n\nexport interface ComprehensiveValidationResult {\n  isValid: boolean;\n  error?: Response;\n  corsResponse?: Response;\n  sessionData?: {\n    body: any;\n    idToken?: string;\n    csrfToken?: string;\n  };\n}\n\nexport type suffix = 'session' | 'id' | 'refresh' | 'signature' | 'custom';\n\nexport class CookieUtils {\n  static getCookieName(namePrefix: string, tokenType: suffix): string {\n    return `${namePrefix}.${tokenType}`;\n  }\n\n  static getCookieNames(namePrefix: string) {\n    return {\n      session: this.getCookieName(namePrefix, 'session'),\n      id: this.getCookieName(namePrefix, 'id'),\n      refresh: this.getCookieName(namePrefix, 'refresh'),\n      signature: this.getCookieName(namePrefix, 'signature'),\n      custom: this.getCookieName(namePrefix, 'custom'),\n    };\n  }\n\n  static getSessionConfig(cookieOptions: CookieOptions): TokenCookieConfig {\n    return {\n      path: cookieOptions.path ?? '/',\n      httpOnly: cookieOptions.httpOnly ?? true,\n      sameSite: cookieOptions.sameSite ?? 'lax',\n      maxAge: cookieOptions.maxAge ?? 3600 * 24 * 7,\n    };\n  }\n\n  static getFixedTokenConfig(\n    tokenType: Exclude<suffix, 'session'>,\n  ): TokenCookieConfig {\n    const fixedConfig = FIXED_TOKEN_CONFIGS[tokenType];\n\n    return {\n      path: fixedConfig.path,\n      httpOnly: fixedConfig.httpOnly,\n      sameSite: fixedConfig.sameSite,\n      maxAge: fixedConfig.maxAge,\n    };\n  }\n\n  static validateSessionMaxAge(maxAge: number): boolean {\n    const minAge = 300; // 5 minutes\n    const maxAgeLimit = 3600 * 24 * 14; // 2 weeks\n    return maxAge >= minAge && maxAge <= maxAgeLimit;\n  }\n}\n\nexport {\n  AuthEndpoint,\n  CookieOptions,\n  CorsOptions,\n  SecurityOptions,\n  SessionSubEndpoint,\n  EndpointConfig,\n  SessionEndpointConfig,\n  TernSecureHandlerOptions,\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAcO,MAAM,uBAAoC;AAAA,EAC/C,gBAAgB,CAAC;AAAA,EACjB,gBAAgB,CAAC,OAAO,MAAM;AAAA,EAC9B,gBAAgB,CAAC,gBAAgB,iBAAiB,kBAAkB;AAAA,EACpE,kBAAkB;AAAA,EAClB,QAAQ;AAAA;AACV;AAEO,MAAM,iCAAgD;AAAA,EAC3D,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ,QAAQ,IAAI,aAAa;AAAA,EACjC,UAAU;AAAA,EACV,QAAQ,KAAK,KAAK,KAAK;AAAA;AAAA,EACvB,UAAU;AACZ;AAEO,MAAM,0CAAyD;AAAA,EACpE,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ,QAAQ,IAAI,aAAa;AAAA,EACjC,UAAU;AAAA,EACV,QAAQ,KAAK,KAAK,KAAK;AAAA;AAAA,EACvB,UAAU;AACZ;AAGO,MAAM,sBAAsB;AAAA,EACjC,IAAI;AAAA,IACF,MAAM;AAAA,IACN,UAAU;AAAA,IACV,UAAU;AAAA,IACV,QAAQ;AAAA;AAAA,EACV;AAAA,EACA,SAAS;AAAA,IACP,MAAM;AAAA,IACN,UAAU;AAAA,IACV,UAAU;AAAA,IACV,QAAQ,OAAO,KAAK;AAAA;AAAA,EACtB;AAAA,EACA,WAAW;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,UAAU;AAAA,IACV,QAAQ,OAAO,KAAK;AAAA;AAAA,EACtB;AAAA,EACA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,UAAU;AAAA,IACV,UAAU;AAAA,IACV,QAAQ,OAAO,KAAK;AAAA;AAAA,EACtB;AACF;AAEO,MAAM,2BAA4C;AAAA,EACvD,aAAa;AAAA,EACb,iBAAiB,CAAC;AAAA,EAClB,iBAAiB,CAAC;AAAA,EAClB,aAAa,CAAC;AAAA,EACd,WAAW;AAAA,IACT,OAAO,CAAC;AAAA,IACR,OAAO,CAAC;AAAA,EACV;AACF;AAEO,MAAM,0BAA0C;AAAA,EACrD,SAAS;AAAA,EACT,SAAS,CAAC,OAAO,MAAM;AAAA,EACvB,aAAa;AAAA,EACb,UAAU;AACZ;AAEO,MAAM,gCAAsD;AAAA,EACjE,GAAG;AAAA,EACH,cAAc;AAAA,IACZ,KAAK;AAAA,MACH,SAAS;AAAA,MACT,SAAS,CAAC,KAAK;AAAA,MACf,aAAa;AAAA,MACb,UAAU;AAAA,QACR,aAAa;AAAA,QACb,iBAAiB,CAAC;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AACF;AAEO,MAAM,0BAAiD;AAAA,EAC5D,GAAG;AAAA,EACH,cAAc;AAAA,IACZ,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,SAAS,CAAC,KAAK;AAAA,MACf,aAAa;AAAA,MACb,UAAU;AAAA,QACR,aAAa;AAAA,QACb,iBAAiB,CAAC;AAAA,MACpB;AAAA,IACF;AAAA,IACA,eAAe;AAAA,MACb,SAAS;AAAA,MACT,SAAS,CAAC,MAAM;AAAA,MAChB,aAAa;AAAA,MACb,UAAU;AAAA,QACR,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP,SAAS;AAAA,MACT,SAAS,CAAC,MAAM;AAAA,MAChB,aAAa;AAAA,MACb,UAAU;AAAA,QACR,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,SAAS,CAAC,MAAM;AAAA,MAChB,aAAa;AAAA,MACb,UAAU;AAAA,QACR,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACF;AAEO,MAAM,0BAET;AAAA,EACF,MAAM;AAAA,EACN,SAAS;AAAA,EACT,WAAW;AAAA,IACT,UAAU,KAAK,KAAK;AAAA;AAAA,IACpB,aAAa;AAAA,IACb,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB;AAAA,EACA,UAAU;AAAA,EACV,WAAW;AAAA,IACT,SAAS;AAAA,IACT,UAAU;AAAA,EACZ;AAAA,EACA,UAAU;AAAA,EACV,8BAA8B;AAAA,EAC9B,mBAAmB;AAAA,EACnB,OAAO;AAAA,EACP,aAAa;AAAA,EACb,UAAU;AACZ;AAmCO,MAAM,YAAY;AAAA,EACvB,OAAO,cAAc,YAAoB,WAA2B;AAClE,WAAO,GAAG,UAAU,IAAI,SAAS;AAAA,EACnC;AAAA,EAEA,OAAO,eAAe,YAAoB;AACxC,WAAO;AAAA,MACL,SAAS,KAAK,cAAc,YAAY,SAAS;AAAA,MACjD,IAAI,KAAK,cAAc,YAAY,IAAI;AAAA,MACvC,SAAS,KAAK,cAAc,YAAY,SAAS;AAAA,MACjD,WAAW,KAAK,cAAc,YAAY,WAAW;AAAA,MACrD,QAAQ,KAAK,cAAc,YAAY,QAAQ;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,OAAO,iBAAiB,eAAiD;AACvE,WAAO;AAAA,MACL,MAAM,cAAc,QAAQ;AAAA,MAC5B,UAAU,cAAc,YAAY;AAAA,MACpC,UAAU,cAAc,YAAY;AAAA,MACpC,QAAQ,cAAc,UAAU,OAAO,KAAK;AAAA,IAC9C;AAAA,EACF;AAAA,EAEA,OAAO,oBACL,WACmB;AACnB,UAAM,cAAc,oBAAoB,SAAS;AAEjD,WAAO;AAAA,MACL,MAAM,YAAY;AAAA,MAClB,UAAU,YAAY;AAAA,MACtB,UAAU,YAAY;AAAA,MACtB,QAAQ,YAAY;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,OAAO,sBAAsB,QAAyB;AACpD,UAAM,SAAS;AACf,UAAM,cAAc,OAAO,KAAK;AAChC,WAAO,UAAU,UAAU,UAAU;AAAA,EACvC;AACF;","names":[]}
+{"version":3,"sources":["../../../../src/app-router/admin/types.ts"],"sourcesContent":["import type {\n  AuthEndpoint,\n  CookieEndpointConfig,\n  CookieOpts as CookieOptions,\n  CorsOptions,\n  EndpointConfig,\n  SecurityOptions,\n  SessionEndpointConfig,\n  SessionSubEndpoint,\n  SignInEndpointConfig,\n  SignInSubEndpoint,\n  TernSecureHandlerOptions,\n  TokenCookieConfig\n} from '@tern-secure/types';\nimport { type NextResponse } from 'next/server';\n\nexport const DEFAULT_CORS_OPTIONS: CorsOptions = {\n  allowedOrigins: [],\n  allowedMethods: ['GET', 'POST'],\n  allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With'],\n  allowCredentials: true,\n  maxAge: 86400, // 24 hours\n};\n\nexport const DEFAULT_SESSION_COOKIE_OPTIONS: CookieOptions = {\n  httpOnly: true,\n  path: '/',\n  secure: process.env.NODE_ENV === 'production',\n  sameSite: 'strict',\n  maxAge: 12 * 60 * 60 * 24, // twelve days\n  priority: 'high',\n};\n\nexport const DEFAULT_ID_REFRESH_TOKEN_COOKIE_OPTIONS: CookieOptions = {\n  httpOnly: true,\n  path: '/',\n  secure: process.env.NODE_ENV === 'production',\n  sameSite: 'strict',\n  maxAge: 12 * 60 * 60 * 24, // twelve days\n  priority: 'high',\n};\n\n\nexport const FIXED_TOKEN_CONFIGS = {\n  id: {\n    path: '/',\n    httpOnly: true,\n    sameSite: 'lax' as const,\n    maxAge: 3600, // 1 hour\n  },\n  refresh: {\n    path: '/',\n    httpOnly: true,\n    sameSite: 'lax' as const,\n    maxAge: 3600 * 24 * 30, // 30 days (changes when user events occur)\n  },\n  signature: {\n    path: '/',\n    httpOnly: true,\n    sameSite: 'lax' as const,\n    maxAge: 3600 * 24 * 7, // 1 week (as needed)\n  },\n  custom: {\n    path: '/',\n    httpOnly: true,\n    sameSite: 'lax' as const,\n    maxAge: 3600 * 24 * 7, // 1 week (as needed)\n  },\n} as const;\n\nexport const DEFAULT_SECURITY_OPTIONS: SecurityOptions = {\n  requireCSRF: true,\n  allowedReferers: [],\n  requiredHeaders: {},\n  ipWhitelist: [],\n  userAgent: {\n    block: [],\n    allow: [],\n  },\n};\n\nexport const DEFAULT_ENDPOINT_CONFIG: EndpointConfig = {\n  enabled: true,\n  methods: ['GET', 'POST'],\n  requireAuth: false,\n  security: DEFAULT_SECURITY_OPTIONS,\n};\n\nexport const DEFAULT_COOKIE_REQUEST_CONFIG: CookieEndpointConfig = {\n  ...DEFAULT_ENDPOINT_CONFIG,\n  subEndpoints: {\n    get: {\n      enabled: true,\n      methods: ['GET'],\n      requireAuth: false,\n      security: {\n        requireCSRF: true,\n        allowedReferers: [],\n      },\n    },\n  },\n};\n\nexport const DEFAULT_SESSIONS_CONFIG: SessionEndpointConfig = {\n  ...DEFAULT_ENDPOINT_CONFIG,\n  subEndpoints: {\n    verify: {\n      enabled: true,\n      methods: ['GET'],\n      requireAuth: false,\n      security: {\n        requireCSRF: true,\n        allowedReferers: [],\n      },\n    },\n    createsession: {\n      enabled: true,\n      methods: ['POST'],\n      requireAuth: false,\n      security: {\n        requireCSRF: true,\n      },\n    },\n    refresh: {\n      enabled: true,\n      methods: ['POST'],\n      requireAuth: true,\n      security: {\n        requireCSRF: true,\n      },\n    },\n    revoke: {\n      enabled: true,\n      methods: ['POST'],\n      requireAuth: true,\n      security: {\n        requireCSRF: true,\n      },\n    },\n  },\n};\n\nexport const DEFAULT_SIGNINS_CONFIG: SignInEndpointConfig = {\n  ...DEFAULT_ENDPOINT_CONFIG,\n  subEndpoints: {\n    resetPasswordEmail: {\n      enabled: true,\n      methods: ['POST'],\n      requireAuth: false\n    },\n  },\n};\n\nexport const DEFAULT_HANDLER_OPTIONS: Required<TernSecureHandlerOptions> & {\n  endpoints: Required<NonNullable<TernSecureHandlerOptions['endpoints']>>;\n} = {\n  cors: DEFAULT_CORS_OPTIONS,\n  cookies: DEFAULT_SESSION_COOKIE_OPTIONS,\n  rateLimit: {\n    windowMs: 15 * 60 * 1000, // 15 minutes\n    maxRequests: 100,\n    skipSuccessful: false,\n    skipFailedRequests: false,\n  },\n  security: DEFAULT_SECURITY_OPTIONS,\n  endpoints: {\n    cookies: DEFAULT_COOKIE_REQUEST_CONFIG,\n    sessions: DEFAULT_SESSIONS_CONFIG,\n    signIns: DEFAULT_SIGNINS_CONFIG,\n  },\n  tenantId: '',\n  revokeRefreshTokensOnSignOut: true,\n  enableCustomToken: false,\n  debug: false,\n  environment: 'production',\n  basePath: '/api/auth',\n};\n\nexport interface ValidationResult {\n  error?: NextResponse;\n  data?: any;\n}\n\nexport interface ValidationConfig {\n  cors?: CorsOptions;\n  security?: SecurityOptions;\n  endpoint?: {\n    name: AuthEndpoint;\n    config: EndpointConfig;\n  };\n  subEndpoint?: {\n    name: SessionSubEndpoint;\n    config: EndpointConfig;\n  };\n  requireIdToken?: boolean;\n  requireCsrfToken?: boolean;\n}\n\nexport interface ComprehensiveValidationResult {\n  isValid: boolean;\n  error?: Response;\n  corsResponse?: Response;\n  sessionData?: {\n    body: any;\n    idToken?: string;\n    csrfToken?: string;\n  };\n}\n\nexport type suffix = 'session' | 'id' | 'refresh' | 'signature' | 'custom';\n\nexport class CookieUtils {\n  static getCookieName(namePrefix: string, tokenType: suffix): string {\n    return `${namePrefix}.${tokenType}`;\n  }\n\n  static getCookieNames(namePrefix: string) {\n    return {\n      session: this.getCookieName(namePrefix, 'session'),\n      id: this.getCookieName(namePrefix, 'id'),\n      refresh: this.getCookieName(namePrefix, 'refresh'),\n      signature: this.getCookieName(namePrefix, 'signature'),\n      custom: this.getCookieName(namePrefix, 'custom'),\n    };\n  }\n\n  static getSessionConfig(cookieOptions: CookieOptions): TokenCookieConfig {\n    return {\n      path: cookieOptions.path ?? '/',\n      httpOnly: cookieOptions.httpOnly ?? true,\n      sameSite: cookieOptions.sameSite ?? 'lax',\n      maxAge: cookieOptions.maxAge ?? 3600 * 24 * 7,\n    };\n  }\n\n  static getFixedTokenConfig(\n    tokenType: Exclude<suffix, 'session'>,\n  ): TokenCookieConfig {\n    const fixedConfig = FIXED_TOKEN_CONFIGS[tokenType];\n\n    return {\n      path: fixedConfig.path,\n      httpOnly: fixedConfig.httpOnly,\n      sameSite: fixedConfig.sameSite,\n      maxAge: fixedConfig.maxAge,\n    };\n  }\n\n  static validateSessionMaxAge(maxAge: number): boolean {\n    const minAge = 300; // 5 minutes\n    const maxAgeLimit = 3600 * 24 * 14; // 2 weeks\n    return maxAge >= minAge && maxAge <= maxAgeLimit;\n  }\n}\n\nexport {\n  AuthEndpoint,\n  CookieOptions,\n  CorsOptions,\n  SecurityOptions,\n  SessionSubEndpoint,\n  EndpointConfig,\n  SessionEndpointConfig,\n  SignInEndpointConfig,\n  SignInSubEndpoint,\n  TernSecureHandlerOptions,\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgBO,MAAM,uBAAoC;AAAA,EAC/C,gBAAgB,CAAC;AAAA,EACjB,gBAAgB,CAAC,OAAO,MAAM;AAAA,EAC9B,gBAAgB,CAAC,gBAAgB,iBAAiB,kBAAkB;AAAA,EACpE,kBAAkB;AAAA,EAClB,QAAQ;AAAA;AACV;AAEO,MAAM,iCAAgD;AAAA,EAC3D,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ,QAAQ,IAAI,aAAa;AAAA,EACjC,UAAU;AAAA,EACV,QAAQ,KAAK,KAAK,KAAK;AAAA;AAAA,EACvB,UAAU;AACZ;AAEO,MAAM,0CAAyD;AAAA,EACpE,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ,QAAQ,IAAI,aAAa;AAAA,EACjC,UAAU;AAAA,EACV,QAAQ,KAAK,KAAK,KAAK;AAAA;AAAA,EACvB,UAAU;AACZ;AAGO,MAAM,sBAAsB;AAAA,EACjC,IAAI;AAAA,IACF,MAAM;AAAA,IACN,UAAU;AAAA,IACV,UAAU;AAAA,IACV,QAAQ;AAAA;AAAA,EACV;AAAA,EACA,SAAS;AAAA,IACP,MAAM;AAAA,IACN,UAAU;AAAA,IACV,UAAU;AAAA,IACV,QAAQ,OAAO,KAAK;AAAA;AAAA,EACtB;AAAA,EACA,WAAW;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,UAAU;AAAA,IACV,QAAQ,OAAO,KAAK;AAAA;AAAA,EACtB;AAAA,EACA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,UAAU;AAAA,IACV,UAAU;AAAA,IACV,QAAQ,OAAO,KAAK;AAAA;AAAA,EACtB;AACF;AAEO,MAAM,2BAA4C;AAAA,EACvD,aAAa;AAAA,EACb,iBAAiB,CAAC;AAAA,EAClB,iBAAiB,CAAC;AAAA,EAClB,aAAa,CAAC;AAAA,EACd,WAAW;AAAA,IACT,OAAO,CAAC;AAAA,IACR,OAAO,CAAC;AAAA,EACV;AACF;AAEO,MAAM,0BAA0C;AAAA,EACrD,SAAS;AAAA,EACT,SAAS,CAAC,OAAO,MAAM;AAAA,EACvB,aAAa;AAAA,EACb,UAAU;AACZ;AAEO,MAAM,gCAAsD;AAAA,EACjE,GAAG;AAAA,EACH,cAAc;AAAA,IACZ,KAAK;AAAA,MACH,SAAS;AAAA,MACT,SAAS,CAAC,KAAK;AAAA,MACf,aAAa;AAAA,MACb,UAAU;AAAA,QACR,aAAa;AAAA,QACb,iBAAiB,CAAC;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AACF;AAEO,MAAM,0BAAiD;AAAA,EAC5D,GAAG;AAAA,EACH,cAAc;AAAA,IACZ,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,SAAS,CAAC,KAAK;AAAA,MACf,aAAa;AAAA,MACb,UAAU;AAAA,QACR,aAAa;AAAA,QACb,iBAAiB,CAAC;AAAA,MACpB;AAAA,IACF;AAAA,IACA,eAAe;AAAA,MACb,SAAS;AAAA,MACT,SAAS,CAAC,MAAM;AAAA,MAChB,aAAa;AAAA,MACb,UAAU;AAAA,QACR,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP,SAAS;AAAA,MACT,SAAS,CAAC,MAAM;AAAA,MAChB,aAAa;AAAA,MACb,UAAU;AAAA,QACR,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,SAAS,CAAC,MAAM;AAAA,MAChB,aAAa;AAAA,MACb,UAAU;AAAA,QACR,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACF;AAEO,MAAM,yBAA+C;AAAA,EAC1D,GAAG;AAAA,EACH,cAAc;AAAA,IACZ,oBAAoB;AAAA,MAClB,SAAS;AAAA,MACT,SAAS,CAAC,MAAM;AAAA,MAChB,aAAa;AAAA,IACf;AAAA,EACF;AACF;AAEO,MAAM,0BAET;AAAA,EACF,MAAM;AAAA,EACN,SAAS;AAAA,EACT,WAAW;AAAA,IACT,UAAU,KAAK,KAAK;AAAA;AAAA,IACpB,aAAa;AAAA,IACb,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB;AAAA,EACA,UAAU;AAAA,EACV,WAAW;AAAA,IACT,SAAS;AAAA,IACT,UAAU;AAAA,IACV,SAAS;AAAA,EACX;AAAA,EACA,UAAU;AAAA,EACV,8BAA8B;AAAA,EAC9B,mBAAmB;AAAA,EACnB,OAAO;AAAA,EACP,aAAa;AAAA,EACb,UAAU;AACZ;AAmCO,MAAM,YAAY;AAAA,EACvB,OAAO,cAAc,YAAoB,WAA2B;AAClE,WAAO,GAAG,UAAU,IAAI,SAAS;AAAA,EACnC;AAAA,EAEA,OAAO,eAAe,YAAoB;AACxC,WAAO;AAAA,MACL,SAAS,KAAK,cAAc,YAAY,SAAS;AAAA,MACjD,IAAI,KAAK,cAAc,YAAY,IAAI;AAAA,MACvC,SAAS,KAAK,cAAc,YAAY,SAAS;AAAA,MACjD,WAAW,KAAK,cAAc,YAAY,WAAW;AAAA,MACrD,QAAQ,KAAK,cAAc,YAAY,QAAQ;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,OAAO,iBAAiB,eAAiD;AACvE,WAAO;AAAA,MACL,MAAM,cAAc,QAAQ;AAAA,MAC5B,UAAU,cAAc,YAAY;AAAA,MACpC,UAAU,cAAc,YAAY;AAAA,MACpC,QAAQ,cAAc,UAAU,OAAO,KAAK;AAAA,IAC9C;AAAA,EACF;AAAA,EAEA,OAAO,oBACL,WACmB;AACnB,UAAM,cAAc,oBAAoB,SAAS;AAEjD,WAAO;AAAA,MACL,MAAM,YAAY;AAAA,MAClB,UAAU,YAAY;AAAA,MACtB,UAAU,YAAY;AAAA,MACtB,QAAQ,YAAY;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,OAAO,sBAAsB,QAAyB;AACpD,UAAM,SAAS;AACf,UAAM,cAAc,OAAO,KAAK;AAChC,WAAO,UAAU,UAAU,UAAU;AAAA,EACvC;AACF;","names":[]}

package/dist/cjs/app-router/client/TernSecureProvider.js

@@ -26,6 +26,7 @@ var import_jsx_runtime = require("react/jsx-runtime");
 var import_react = require("@tern-secure/react");
 var import_NextOptionsCtx = require("../../boundary/NextOptionsCtx");
 var import_allNextProviderProps = require("../../utils/allNextProviderProps");
+var import_tern_ui_script = require("../../utils/tern-ui-script");
 var import_useAwaitablePush = require("./useAwaitablePush");
 var import_useAwaitableReplace = require("./useAwaitableReplace");
 const NextClientProvider = (props) => {
@@ -43,7 +44,10 @@ const NextClientProvider = (props) => {
     // @ts-expect-error Error because of the stricter types of internal `replace`
     routerReplace: replace
   });
-  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_NextOptionsCtx.TernNextOptionsProvider, { options: providerProps, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react.TernSecureProvider, { ...providerProps, children }) });
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_NextOptionsCtx.TernNextOptionsProvider, { options: providerProps, children: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_react.TernSecureProvider, { ...providerProps, children: [
+    children,
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_tern_ui_script.TernUIScript, { router: "app" })
+  ] }) });
 };
 const ClientTernSecureProvider = (props) => {
   const { children, ...rest } = props;

package/dist/cjs/app-router/client/TernSecureProvider.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/app-router/client/TernSecureProvider.tsx"],"sourcesContent":["'use client';\r\n\r\nimport { TernSecureProvider as TernSecureReactProvider } from '@tern-secure/react';\r\n\r\nimport { TernNextOptionsProvider, useTernNextOptions } from '../../boundary/NextOptionsCtx';\r\nimport type { TernSecureNextProps } from '../../types';\r\nimport { allNextProviderPropsWithEnv } from '../../utils/allNextProviderProps';\r\nimport { useAwaitablePush } from './useAwaitablePush';\r\nimport { useAwaitableReplace } from './useAwaitableReplace';\r\n\r\nconst NextClientProvider = (props: TernSecureNextProps) => {\r\n  const { children } = props;\r\n\r\n  const push = useAwaitablePush();\r\n  const replace = useAwaitableReplace();\r\n\r\n  const isNested = Boolean(useTernNextOptions());\r\n  if (isNested) {\r\n    return props.children;\r\n  }\r\n\r\n  const providerProps = allNextProviderPropsWithEnv({\r\n    ...props,\r\n    // @ts-expect-error Error because of the stricter types of internal `push`\r\n    routerPush: push,\r\n    // @ts-expect-error Error because of the stricter types of internal `replace`\r\n    routerReplace: replace,\r\n  });\r\n  return (\r\n    <TernNextOptionsProvider options={providerProps}>\r\n      <TernSecureReactProvider {...providerProps}>{children}</TernSecureReactProvider>\r\n    </TernNextOptionsProvider>\r\n  );\r\n};\r\n\r\nexport const ClientTernSecureProvider = (props: TernSecureNextProps) => {\r\n  const { children, ...rest } = props;\r\n  return <NextClientProvider {...rest}>{children}</NextClientProvider>;\r\n};\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AA8BM;AA5BN,mBAA8D;AAE9D,4BAA4D;AAE5D,kCAA4C;AAC5C,8BAAiC;AACjC,iCAAoC;AAEpC,MAAM,qBAAqB,CAAC,UAA+B;AACzD,QAAM,EAAE,SAAS,IAAI;AAErB,QAAM,WAAO,0CAAiB;AAC9B,QAAM,cAAU,gDAAoB;AAEpC,QAAM,WAAW,YAAQ,0CAAmB,CAAC;AAC7C,MAAI,UAAU;AACZ,WAAO,MAAM;AAAA,EACf;AAEA,QAAM,oBAAgB,yDAA4B;AAAA,IAChD,GAAG;AAAA;AAAA,IAEH,YAAY;AAAA;AAAA,IAEZ,eAAe;AAAA,EACjB,CAAC;AACD,SACE,4CAAC,iDAAwB,SAAS,eAChC,sDAAC,aAAAA,oBAAA,EAAyB,GAAG,eAAgB,UAAS,GACxD;AAEJ;AAEO,MAAM,2BAA2B,CAAC,UAA+B;AACtE,QAAM,EAAE,UAAU,GAAG,KAAK,IAAI;AAC9B,SAAO,4CAAC,sBAAoB,GAAG,MAAO,UAAS;AACjD;","names":["TernSecureReactProvider"]}
+{"version":3,"sources":["../../../../src/app-router/client/TernSecureProvider.tsx"],"sourcesContent":["'use client';\r\n\r\nimport { TernSecureProvider as TernSecureReactProvider } from '@tern-secure/react';\r\n\r\nimport { TernNextOptionsProvider, useTernNextOptions } from '../../boundary/NextOptionsCtx';\r\nimport type { TernSecureNextProps } from '../../types';\r\nimport { allNextProviderPropsWithEnv } from '../../utils/allNextProviderProps';\r\nimport { TernUIScript } from '../../utils/tern-ui-script';\r\nimport { useAwaitablePush } from './useAwaitablePush';\r\nimport { useAwaitableReplace } from './useAwaitableReplace';\r\n\r\nconst NextClientProvider = (props: TernSecureNextProps) => {\r\n  const { children } = props;\r\n\r\n  const push = useAwaitablePush();\r\n  const replace = useAwaitableReplace();\r\n\r\n  const isNested = Boolean(useTernNextOptions());\r\n  if (isNested) {\r\n    return props.children;\r\n  }\r\n\r\n  const providerProps = allNextProviderPropsWithEnv({\r\n    ...props,\r\n    // @ts-expect-error Error because of the stricter types of internal `push`\r\n    routerPush: push,\r\n    // @ts-expect-error Error because of the stricter types of internal `replace`\r\n    routerReplace: replace,\r\n  });\r\n  return (\r\n    <TernNextOptionsProvider options={providerProps}>\r\n      <TernSecureReactProvider {...providerProps}>\r\n        {children}\r\n        <TernUIScript router=\"app\" />\r\n      </TernSecureReactProvider>\r\n    </TernNextOptionsProvider>\r\n  );\r\n};\r\n\r\nexport const ClientTernSecureProvider = (props: TernSecureNextProps) => {\r\n  const { children, ...rest } = props;\r\n  return <NextClientProvider {...rest}>{children}</NextClientProvider>;\r\n};\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AA+BM;AA7BN,mBAA8D;AAE9D,4BAA4D;AAE5D,kCAA4C;AAC5C,4BAA6B;AAC7B,8BAAiC;AACjC,iCAAoC;AAEpC,MAAM,qBAAqB,CAAC,UAA+B;AACzD,QAAM,EAAE,SAAS,IAAI;AAErB,QAAM,WAAO,0CAAiB;AAC9B,QAAM,cAAU,gDAAoB;AAEpC,QAAM,WAAW,YAAQ,0CAAmB,CAAC;AAC7C,MAAI,UAAU;AACZ,WAAO,MAAM;AAAA,EACf;AAEA,QAAM,oBAAgB,yDAA4B;AAAA,IAChD,GAAG;AAAA;AAAA,IAEH,YAAY;AAAA;AAAA,IAEZ,eAAe;AAAA,EACjB,CAAC;AACD,SACE,4CAAC,iDAAwB,SAAS,eAChC,uDAAC,aAAAA,oBAAA,EAAyB,GAAG,eAC1B;AAAA;AAAA,IACD,4CAAC,sCAAa,QAAO,OAAM;AAAA,KAC7B,GACF;AAEJ;AAEO,MAAM,2BAA2B,CAAC,UAA+B;AACtE,QAAM,EAAE,UAAU,GAAG,KAAK,IAAI;AAC9B,SAAO,4CAAC,sBAAoB,GAAG,MAAO,UAAS;AACjD;","names":["TernSecureReactProvider"]}

package/dist/cjs/boundary/components.js

@@ -18,33 +18,23 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var components_exports = {};
 __export(components_exports, {
-  SignInProvider: () => import_react.SignInProvider,
-  SignUpProvider: () => import_react.SignUpProvider,
   signIn: () => import_react.signIn,
   useAuth: () => import_PromiseAuthProvider.usePromiseAuth,
   useIdToken: () => import_react.useIdToken,
   useSession: () => import_react.useSession,
   useSignIn: () => import_react.useSignIn,
-  useSignInContext: () => import_react.useSignInContext,
-  useSignUp: () => import_react.useSignUp,
-  useSignUpContext: () => import_react.useSignUpContext,
-  useTernSecure: () => import_react.useTernSecure
+  useSignUp: () => import_react.useSignUp
 });
 module.exports = __toCommonJS(components_exports);
 var import_react = require("@tern-secure/react");
 var import_PromiseAuthProvider = require("./PromiseAuthProvider");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  SignInProvider,
-  SignUpProvider,
   signIn,
   useAuth,
   useIdToken,
   useSession,
   useSignIn,
-  useSignInContext,
-  useSignUp,
-  useSignUpContext,
-  useTernSecure
+  useSignUp
 });
 //# sourceMappingURL=components.js.map

package/dist/cjs/boundary/components.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/boundary/components.ts"],"sourcesContent":["export { \n    useIdToken,\n    useSession,\n    useSignIn,\n    useSignUp,\n    useSignInContext,\n    useSignUpContext,\n    useTernSecure,\n    SignInProvider,\n    SignUpProvider,\n    signIn,\n} from '@tern-secure/react';\n\nexport { usePromiseAuth as useAuth } from './PromiseAuthProvider';"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAWO;AAEP,iCAA0C;","names":[]}
+{"version":3,"sources":["../../../src/boundary/components.ts"],"sourcesContent":["export { \n    useIdToken,\n    useSession,\n    useSignIn,\n    useSignUp,\n    signIn,\n} from '@tern-secure/react';\n\nexport { usePromiseAuth as useAuth } from './PromiseAuthProvider';"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAMO;AAEP,iCAA0C;","names":[]}

package/dist/cjs/components/uiComponents.js

@@ -0,0 +1,42 @@
+"use strict";
+"use client";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var uiComponents_exports = {};
+__export(uiComponents_exports, {
+  SignIn: () => SignIn,
+  SignUp: () => SignUp,
+  UserButton: () => import_react2.UserButton
+});
+module.exports = __toCommonJS(uiComponents_exports);
+var import_jsx_runtime = require("react/jsx-runtime");
+var import_react = require("@tern-secure/react");
+var import_react2 = require("@tern-secure/react");
+const SignIn = (props) => {
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react.SignIn, { ...props });
+};
+const SignUp = (props) => {
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_react.SignUp, { ...props });
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SignIn,
+  SignUp,
+  UserButton
+});
+//# sourceMappingURL=uiComponents.js.map

package/dist/cjs/components/uiComponents.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/components/uiComponents.tsx"],"sourcesContent":["'use client'\n\nimport  { \n    SignIn as BaseSignIn,\n    SignUp as BaseSignUp,\n} from '@tern-secure/react'\nimport type { ComponentProps } from 'react';\n\nexport {\n  UserButton\n} from '@tern-secure/react';\n\nexport const SignIn = (props: ComponentProps<typeof BaseSignIn>) => {\n  return <BaseSignIn {...props} />;\n};\n\nexport const SignUp = (props: ComponentProps<typeof BaseSignUp>) => {\n  return <BaseSignUp {...props} />; \n};"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAaS;AAXT,mBAGO;AAGP,IAAAA,gBAEO;AAEA,MAAM,SAAS,CAAC,UAA6C;AAClE,SAAO,4CAAC,aAAAC,QAAA,EAAY,GAAG,OAAO;AAChC;AAEO,MAAM,SAAS,CAAC,UAA6C;AAClE,SAAO,4CAAC,aAAAC,QAAA,EAAY,GAAG,OAAO;AAChC;","names":["import_react","BaseSignIn","BaseSignUp"]}

package/dist/cjs/index.js

@@ -18,35 +18,32 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var index_exports = {};
 __export(index_exports, {
-  SignInProvider: () => import_components.SignInProvider,
-  SignUpProvider: () => import_components.SignUpProvider,
+  SignIn: () => import_uiComponents.SignIn,
+  SignUp: () => import_uiComponents.SignUp,
   TernSecureProvider: () => import_TernSecureProvider.TernSecureProvider,
+  UserButton: () => import_uiComponents.UserButton,
   signIn: () => import_components.signIn,
   useAuth: () => import_components.useAuth,
   useIdToken: () => import_components.useIdToken,
   useSession: () => import_components.useSession,
   useSignIn: () => import_components.useSignIn,
-  useSignInContext: () => import_components.useSignInContext,
-  useSignUp: () => import_components.useSignUp,
-  useSignUpContext: () => import_components.useSignUpContext,
-  useTernSecure: () => import_components.useTernSecure
+  useSignUp: () => import_components.useSignUp
 });
 module.exports = __toCommonJS(index_exports);
 var import_TernSecureProvider = require("./app-router/server/TernSecureProvider");
 var import_components = require("./boundary/components");
+var import_uiComponents = require("./components/uiComponents");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  SignInProvider,
-  SignUpProvider,
+  SignIn,
+  SignUp,
   TernSecureProvider,
+  UserButton,
   signIn,
   useAuth,
   useIdToken,
   useSession,
   useSignIn,
-  useSignInContext,
-  useSignUp,
-  useSignUpContext,
-  useTernSecure
+  useSignUp
 });
 //# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/index.ts"],"sourcesContent":["export { TernSecureProvider } from './app-router/server/TernSecureProvider';\r\nexport {\r\n  useAuth,\r\n  useIdToken,\r\n  useSession,\r\n  useSignIn,\r\n  useSignUp,\r\n  signIn,\r\n  useSignInContext,\r\n  useSignUpContext,\r\n  useTernSecure,\r\n  SignInProvider,\r\n  SignUpProvider,\r\n} from './boundary/components';\r\n\r\nexport type {\r\n  TernSecureUser,\r\n  SignInResponse,\r\n  SignUpResponse,\r\n  SocialProviderOptions,\r\n} from '@tern-secure/types';\r\n\r\nexport type { UserInfo, SessionResult } from './types';\r\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gCAAmC;AACnC,wBAYO;","names":[]}
+{"version":3,"sources":["../../src/index.ts"],"sourcesContent":["export { TernSecureProvider } from './app-router/server/TernSecureProvider';\r\nexport {\r\n  useAuth,\r\n  useIdToken,\r\n  useSession,\r\n  useSignIn,\r\n  useSignUp,\r\n  signIn,\r\n} from './boundary/components';\r\n\r\nexport {\r\n  SignIn,\r\n  SignUp,\r\n  UserButton,\r\n} from './components/uiComponents'\r\n\r\nexport type {\r\n  TernSecureUser,\r\n  SignInResponse,\r\n  SignUpResponse,\r\n  SocialProviderOptions,\r\n} from '@tern-secure/types';\r\n\r\nexport type { UserInfo, SessionResult } from './types';\r\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gCAAmC;AACnC,wBAOO;AAEP,0BAIO;","names":[]}

package/dist/cjs/server/data/getAuthDataFromRequest.js

@@ -65,6 +65,7 @@ async function getTernSecureAuthData(req, initialState = {}) {
 async function getAuthDataFromRequest(req) {
   const authStatus = (0, import_headers_utils.getAuthKeyFromRequest)(req, "AuthStatus");
   const authToken = (0, import_headers_utils.getAuthKeyFromRequest)(req, "AuthToken");
+  const appCheckToken = (0, import_headers_utils.getHeader)(req, "X-Firebase-AppCheck");
   if (!authStatus || authStatus !== import_backend.AuthStatus.SignedIn) {
     return {
       ...(0, import_backend.signedOutAuthObject)(),
@@ -72,7 +73,11 @@ async function getAuthDataFromRequest(req) {
       userId: null
     };
   }
-  const firebaseUser = await authenticateRequest(authToken, req);
+  const firebaseUser = await authenticateRequest(
+    authToken,
+    req,
+    appCheckToken
+  );
   if (!firebaseUser || !firebaseUser.claims) {
     return {
       ...(0, import_backend.signedOutAuthObject)(),
@@ -87,7 +92,7 @@ async function getAuthDataFromRequest(req) {
     user: user || null
   };
 }
-const authenticateRequest = async (token, request) => {
+const authenticateRequest = async (token, request, appCheckToken) => {
   try {
     const origin = new URL(request.url).origin;
     const requestHeaders = new Headers(request.headers);
@@ -109,6 +114,7 @@ const authenticateRequest = async (token, request) => {
       config,
       {
         authIdToken: token,
+        appCheckToken,
         releaseOnDeref: mockRequest
       }
     );

package/dist/cjs/server/data/getAuthDataFromRequest.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/server/data/getAuthDataFromRequest.ts"],"sourcesContent":["import type { AuthObject } from '@tern-secure/backend';\nimport { AuthStatus, signedInAuthObject, signedOutAuthObject } from '@tern-secure/backend';\nimport { ternDecodeJwt } from '@tern-secure/backend/jwt';\nimport type { ParsedToken, TernSecureConfig, TernSecureUser } from '@tern-secure/types';\nimport type { FirebaseServerApp } from \"firebase/app\";\nimport { initializeServerApp } from \"firebase/app\";\nimport type { Auth } from \"firebase/auth\";\nimport { getAuth } from \"firebase/auth\";\n\nimport { getAuthKeyFromRequest } from '../../server/headers-utils';\nimport type { RequestLike } from '../../server/types';\nimport {\n  FIREBASE_API_KEY,\n  FIREBASE_APP_ID,\n  FIREBASE_AUTH_DOMAIN,\n  FIREBASE_MEASUREMENT_ID,\n  FIREBASE_MESSAGING_SENDER_ID,\n  FIREBASE_PROJECT_ID,\n  FIREBASE_STORAGE_BUCKET\n} from \"../constant\";\n\n\n/**\n * Auth objects moving through the server -> client boundary need to be serializable\n * as we need to ensure that they can be transferred via the network as pure strings.\n * Some frameworks like Remix or Next (/pages dir only) handle this serialization by simply\n * ignoring any non-serializable keys, however Nextjs /app directory is stricter and\n * throws an error if a non-serializable value is found.\n * @internal\n */\nexport const authObjectToSerializableJwt = <T extends Record<string, unknown>>(obj: T): T => {\n  // remove any non-serializable props from the returned object\n\n  const { require, ...rest } = obj as unknown as AuthObject;\n  return rest as unknown as T;\n};\n\nexport function getTernSecureAuthDataJwt(req: RequestLike, initialState = {}) {\n  const authObject = getAuthDataFromRequestJwt(req);\n  return authObjectToSerializable({ ...initialState, ...authObject });\n}\n\nexport function getAuthDataFromRequestJwt(req: RequestLike): AuthObject {\n  const authStatus = getAuthKeyFromRequest(req, 'AuthStatus');\n  const authToken = getAuthKeyFromRequest(req, 'AuthToken');\n  const authSignature = getAuthKeyFromRequest(req, 'AuthSignature');\n  const authReason = getAuthKeyFromRequest(req, 'AuthReason');\n\n  let authObject;\n  if (!authStatus || authStatus !== AuthStatus.SignedIn) {\n    authObject = signedOutAuthObject();\n  } else {\n    const jwt = ternDecodeJwt(authToken as string);\n\n    authObject = signedInAuthObject(jwt.raw.text, jwt.payload);\n  }\n  return authObject;\n}\n\n\nexport type SerializableTernSecureUser = Omit<TernSecureUser, 'delete' | 'getIdToken' | 'getIdTokenResult' | 'reload' | 'toJSON'>;\n\nexport type Aobj = {\n  user: SerializableTernSecureUser | null\n  userId: string | null\n}\n\n\n// Serializable auth object type\n/**\n * Auth objects moving through the server -> client boundary need to be serializable\n * as we need to ensure that they can be transferred via the network as pure strings.\n * Some frameworks like Remix or Next (/pages dir only) handle this serialization by simply\n * ignoring any non-serializable keys, however Nextjs /app directory is stricter and\n * throws an error if a non-serializable value is found.\n * @internal\n */\nexport const authObjectToSerializable = <T extends Record<string, unknown>>(\n  obj: T\n): T => {\n  // remove any non-serializable props from the returned object\n\n  const { require, ...rest } = obj as unknown as AuthObject;\n  return rest as unknown as T;\n};\n\nexport async function getTernSecureAuthData(\n  req: RequestLike,\n  initialState = {}\n) {\n  const authObject = await getAuthDataFromRequest(req);\n  return authObjectToSerializable({ ...initialState, ...authObject });\n}\n\nexport async function getAuthDataFromRequest(req: RequestLike): Promise<AuthObject & Aobj> {\n  const authStatus = getAuthKeyFromRequest(req, \"AuthStatus\");\n  const authToken = getAuthKeyFromRequest(req, \"AuthToken\");\n\n  if (!authStatus || authStatus !== AuthStatus.SignedIn) {\n    return {\n      ...signedOutAuthObject(),\n      user: null,\n      userId: null\n    }\n  }\n\n  const firebaseUser = await authenticateRequest(authToken as string, req as any);\n  if (!firebaseUser || !firebaseUser.claims) {\n    return {\n      ...signedOutAuthObject(),\n      user: null,\n      userId: null\n    }\n  }\n  const { user, claims } = firebaseUser;\n  const authObject = signedInAuthObject(authToken as string, claims as any);\n  return {\n    ...authObject,\n    user: user || null,\n  };\n}\n\nconst authenticateRequest = async (\n  token: string,\n  request: Request\n): Promise<{ user: SerializableTernSecureUser; claims: ParsedToken } | null> => {\n  try {\n    const origin = new URL(request.url).origin;\n\n    const requestHeaders = new Headers(request.headers);\n    requestHeaders.set(\"referer\", origin);\n    requestHeaders.set(\"Referer\", origin);\n\n    const mockRequest = {\n      headers: requestHeaders,\n    };\n\n    const config: TernSecureConfig = {\n      apiKey: FIREBASE_API_KEY,\n      authDomain: FIREBASE_AUTH_DOMAIN,\n      projectId: FIREBASE_PROJECT_ID,\n      storageBucket: FIREBASE_STORAGE_BUCKET,\n      messagingSenderId: FIREBASE_MESSAGING_SENDER_ID,\n      appId: FIREBASE_APP_ID,\n      measurementId: FIREBASE_MEASUREMENT_ID,\n    };\n\n    const firebaseServerApp: FirebaseServerApp = initializeServerApp(\n      config,\n      {\n        authIdToken: token,\n        releaseOnDeref: mockRequest,\n      }\n    );\n\n    const auth: Auth = getAuth(firebaseServerApp);\n    await auth.authStateReady();\n\n    if (auth.currentUser) {\n      const idTokenResult = await auth.currentUser.getIdTokenResult();\n      const claims = idTokenResult.claims;\n\n      const userObj: SerializableTernSecureUser = {\n        uid: auth.currentUser.uid,\n        email: auth.currentUser.email,\n        emailVerified: auth.currentUser.emailVerified,\n        displayName: auth.currentUser.displayName,\n        isAnonymous: auth.currentUser.isAnonymous,\n        phoneNumber: auth.currentUser.phoneNumber,\n        photoURL: auth.currentUser.photoURL,\n        providerId: auth.currentUser.providerId,\n        tenantId: auth.currentUser.tenantId,\n        refreshToken: auth.currentUser.refreshToken,\n        metadata: {\n          creationTime: auth.currentUser.metadata.creationTime,\n          lastSignInTime: auth.currentUser.metadata.lastSignInTime,\n        },\n        providerData: auth.currentUser.providerData.map((provider) => ({\n          uid: provider.uid,\n          displayName: provider.displayName,\n          email: provider.email,\n          phoneNumber: provider.phoneNumber,\n          photoURL: provider.photoURL,\n          providerId: provider.providerId,\n        })),\n      };\n\n      return { user: userObj, claims };\n    }\n\n    return null;\n  } catch (error) {\n    return null;\n  }\n};\n\nexport { TernSecureUser }\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,qBAAoE;AACpE,iBAA8B;AAG9B,iBAAoC;AAEpC,kBAAwB;AAExB,2BAAsC;AAEtC,sBAQO;AAWA,MAAM,8BAA8B,CAAoC,QAAc;AAG3F,QAAM,EAAE,SAAAA,UAAS,GAAG,KAAK,IAAI;AAC7B,SAAO;AACT;AAEO,SAAS,yBAAyB,KAAkB,eAAe,CAAC,GAAG;AAC5E,QAAM,aAAa,0BAA0B,GAAG;AAChD,SAAO,yBAAyB,EAAE,GAAG,cAAc,GAAG,WAAW,CAAC;AACpE;AAEO,SAAS,0BAA0B,KAA8B;AACtE,QAAM,iBAAa,4CAAsB,KAAK,YAAY;AAC1D,QAAM,gBAAY,4CAAsB,KAAK,WAAW;AACxD,QAAM,oBAAgB,4CAAsB,KAAK,eAAe;AAChE,QAAM,iBAAa,4CAAsB,KAAK,YAAY;AAE1D,MAAI;AACJ,MAAI,CAAC,cAAc,eAAe,0BAAW,UAAU;AACrD,qBAAa,oCAAoB;AAAA,EACnC,OAAO;AACL,UAAM,UAAM,0BAAc,SAAmB;AAE7C,qBAAa,mCAAmB,IAAI,IAAI,MAAM,IAAI,OAAO;AAAA,EAC3D;AACA,SAAO;AACT;AAoBO,MAAM,2BAA2B,CACtC,QACM;AAGN,QAAM,EAAE,SAAAA,UAAS,GAAG,KAAK,IAAI;AAC7B,SAAO;AACT;AAEA,eAAsB,sBACpB,KACA,eAAe,CAAC,GAChB;AACA,QAAM,aAAa,MAAM,uBAAuB,GAAG;AACnD,SAAO,yBAAyB,EAAE,GAAG,cAAc,GAAG,WAAW,CAAC;AACpE;AAEA,eAAsB,uBAAuB,KAA8C;AACzF,QAAM,iBAAa,4CAAsB,KAAK,YAAY;AAC1D,QAAM,gBAAY,4CAAsB,KAAK,WAAW;AAExD,MAAI,CAAC,cAAc,eAAe,0BAAW,UAAU;AACrD,WAAO;AAAA,MACL,OAAG,oCAAoB;AAAA,MACvB,MAAM;AAAA,MACN,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,QAAM,eAAe,MAAM,oBAAoB,WAAqB,GAAU;AAC9E,MAAI,CAAC,gBAAgB,CAAC,aAAa,QAAQ;AACzC,WAAO;AAAA,MACL,OAAG,oCAAoB;AAAA,MACvB,MAAM;AAAA,MACN,QAAQ;AAAA,IACV;AAAA,EACF;AACA,QAAM,EAAE,MAAM,OAAO,IAAI;AACzB,QAAM,iBAAa,mCAAmB,WAAqB,MAAa;AACxE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,MAAM,QAAQ;AAAA,EAChB;AACF;AAEA,MAAM,sBAAsB,OAC1B,OACA,YAC8E;AAC9E,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,QAAQ,GAAG,EAAE;AAEpC,UAAM,iBAAiB,IAAI,QAAQ,QAAQ,OAAO;AAClD,mBAAe,IAAI,WAAW,MAAM;AACpC,mBAAe,IAAI,WAAW,MAAM;AAEpC,UAAM,cAAc;AAAA,MAClB,SAAS;AAAA,IACX;AAEA,UAAM,SAA2B;AAAA,MAC/B,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe;AAAA,MACf,mBAAmB;AAAA,MACnB,OAAO;AAAA,MACP,eAAe;AAAA,IACjB;AAEA,UAAM,wBAAuC;AAAA,MAC3C;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb,gBAAgB;AAAA,MAClB;AAAA,IACF;AAEA,UAAM,WAAa,qBAAQ,iBAAiB;AAC5C,UAAM,KAAK,eAAe;AAE1B,QAAI,KAAK,aAAa;AACpB,YAAM,gBAAgB,MAAM,KAAK,YAAY,iBAAiB;AAC9D,YAAM,SAAS,cAAc;AAE7B,YAAM,UAAsC;AAAA,QAC1C,KAAK,KAAK,YAAY;AAAA,QACtB,OAAO,KAAK,YAAY;AAAA,QACxB,eAAe,KAAK,YAAY;AAAA,QAChC,aAAa,KAAK,YAAY;AAAA,QAC9B,aAAa,KAAK,YAAY;AAAA,QAC9B,aAAa,KAAK,YAAY;AAAA,QAC9B,UAAU,KAAK,YAAY;AAAA,QAC3B,YAAY,KAAK,YAAY;AAAA,QAC7B,UAAU,KAAK,YAAY;AAAA,QAC3B,cAAc,KAAK,YAAY;AAAA,QAC/B,UAAU;AAAA,UACR,cAAc,KAAK,YAAY,SAAS;AAAA,UACxC,gBAAgB,KAAK,YAAY,SAAS;AAAA,QAC5C;AAAA,QACA,cAAc,KAAK,YAAY,aAAa,IAAI,CAAC,cAAc;AAAA,UAC7D,KAAK,SAAS;AAAA,UACd,aAAa,SAAS;AAAA,UACtB,OAAO,SAAS;AAAA,UAChB,aAAa,SAAS;AAAA,UACtB,UAAU,SAAS;AAAA,UACnB,YAAY,SAAS;AAAA,QACvB,EAAE;AAAA,MACJ;AAEA,aAAO,EAAE,MAAM,SAAS,OAAO;AAAA,IACjC;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,WAAO;AAAA,EACT;AACF;","names":["require"]}
+{"version":3,"sources":["../../../../src/server/data/getAuthDataFromRequest.ts"],"sourcesContent":["import type { AuthObject } from '@tern-secure/backend';\nimport { AuthStatus, signedInAuthObject, signedOutAuthObject } from '@tern-secure/backend';\nimport { ternDecodeJwt } from '@tern-secure/backend/jwt';\nimport type { ParsedToken, TernSecureConfig, TernSecureUser } from '@tern-secure/types';\nimport type { FirebaseServerApp } from \"firebase/app\";\nimport { initializeServerApp } from \"firebase/app\";\nimport type { Auth } from \"firebase/auth\";\nimport { getAuth } from \"firebase/auth\";\n\nimport { getAuthKeyFromRequest, getHeader } from '../../server/headers-utils';\nimport type { RequestLike } from '../../server/types';\nimport {\n  FIREBASE_API_KEY,\n  FIREBASE_APP_ID,\n  FIREBASE_AUTH_DOMAIN,\n  FIREBASE_MEASUREMENT_ID,\n  FIREBASE_MESSAGING_SENDER_ID,\n  FIREBASE_PROJECT_ID,\n  FIREBASE_STORAGE_BUCKET\n} from \"../constant\";\n\n\n/**\n * Auth objects moving through the server -> client boundary need to be serializable\n * as we need to ensure that they can be transferred via the network as pure strings.\n * Some frameworks like Remix or Next (/pages dir only) handle this serialization by simply\n * ignoring any non-serializable keys, however Nextjs /app directory is stricter and\n * throws an error if a non-serializable value is found.\n * @internal\n */\nexport const authObjectToSerializableJwt = <T extends Record<string, unknown>>(obj: T): T => {\n  // remove any non-serializable props from the returned object\n\n  const { require, ...rest } = obj as unknown as AuthObject;\n  return rest as unknown as T;\n};\n\nexport function getTernSecureAuthDataJwt(req: RequestLike, initialState = {}) {\n  const authObject = getAuthDataFromRequestJwt(req);\n  return authObjectToSerializable({ ...initialState, ...authObject });\n}\n\nexport function getAuthDataFromRequestJwt(req: RequestLike): AuthObject {\n  const authStatus = getAuthKeyFromRequest(req, 'AuthStatus');\n  const authToken = getAuthKeyFromRequest(req, 'AuthToken');\n  const authSignature = getAuthKeyFromRequest(req, 'AuthSignature');\n  const authReason = getAuthKeyFromRequest(req, 'AuthReason');\n\n  let authObject;\n  if (!authStatus || authStatus !== AuthStatus.SignedIn) {\n    authObject = signedOutAuthObject();\n  } else {\n    const jwt = ternDecodeJwt(authToken as string);\n\n    authObject = signedInAuthObject(jwt.raw.text, jwt.payload);\n  }\n  return authObject;\n}\n\n\nexport type SerializableTernSecureUser = Omit<TernSecureUser, 'delete' | 'getIdToken' | 'getIdTokenResult' | 'reload' | 'toJSON'>;\n\nexport type Aobj = {\n  user: SerializableTernSecureUser | null\n  userId: string | null\n}\n\n\n// Serializable auth object type\n/**\n * Auth objects moving through the server -> client boundary need to be serializable\n * as we need to ensure that they can be transferred via the network as pure strings.\n * Some frameworks like Remix or Next (/pages dir only) handle this serialization by simply\n * ignoring any non-serializable keys, however Nextjs /app directory is stricter and\n * throws an error if a non-serializable value is found.\n * @internal\n */\nexport const authObjectToSerializable = <T extends Record<string, unknown>>(\n  obj: T\n): T => {\n  // remove any non-serializable props from the returned object\n\n  const { require, ...rest } = obj as unknown as AuthObject;\n  return rest as unknown as T;\n};\n\nexport async function getTernSecureAuthData(\n  req: RequestLike,\n  initialState = {}\n) {\n  const authObject = await getAuthDataFromRequest(req);\n  return authObjectToSerializable({ ...initialState, ...authObject });\n}\n\nexport async function getAuthDataFromRequest(req: RequestLike): Promise<AuthObject & Aobj> {\n  const authStatus = getAuthKeyFromRequest(req, \"AuthStatus\");\n  const authToken = getAuthKeyFromRequest(req, \"AuthToken\");\n  const appCheckToken = getHeader(req, \"X-Firebase-AppCheck\");\n\n  if (!authStatus || authStatus !== AuthStatus.SignedIn) {\n    return {\n      ...signedOutAuthObject(),\n      user: null,\n      userId: null\n    }\n  }\n\n  const firebaseUser = await authenticateRequest(\n    authToken as string, \n    req as any, \n    appCheckToken as string | undefined\n  );\n  if (!firebaseUser || !firebaseUser.claims) {\n    return {\n      ...signedOutAuthObject(),\n      user: null,\n      userId: null\n    }\n  }\n  const { user, claims } = firebaseUser;\n  const authObject = signedInAuthObject(authToken as string, claims as any);\n  return {\n    ...authObject,\n    user: user || null,\n  };\n}\n\nconst authenticateRequest = async (\n  token: string,\n  request: Request,\n  appCheckToken?: string\n): Promise<{ user: SerializableTernSecureUser; claims: ParsedToken } | null> => {\n  try {\n    //console.log(\"[getAuthDataFromRequest] App Check Token:\", appCheckToken);\n    const origin = new URL(request.url).origin;\n\n    const requestHeaders = new Headers(request.headers);\n    requestHeaders.set(\"referer\", origin);\n    requestHeaders.set(\"Referer\", origin);\n\n    const mockRequest = {\n      headers: requestHeaders,\n    };\n\n    const config: TernSecureConfig = {\n      apiKey: FIREBASE_API_KEY,\n      authDomain: FIREBASE_AUTH_DOMAIN,\n      projectId: FIREBASE_PROJECT_ID,\n      storageBucket: FIREBASE_STORAGE_BUCKET,\n      messagingSenderId: FIREBASE_MESSAGING_SENDER_ID,\n      appId: FIREBASE_APP_ID,\n      measurementId: FIREBASE_MEASUREMENT_ID,\n    };\n\n    const firebaseServerApp: FirebaseServerApp = initializeServerApp(\n      config,\n      {\n        authIdToken: token,\n        appCheckToken: appCheckToken,\n        releaseOnDeref: mockRequest,\n      }\n    );\n\n    const auth: Auth = getAuth(firebaseServerApp);\n    await auth.authStateReady();\n\n    if (auth.currentUser) {\n      const idTokenResult = await auth.currentUser.getIdTokenResult();\n      const claims = idTokenResult.claims;\n\n      const userObj: SerializableTernSecureUser = {\n        uid: auth.currentUser.uid,\n        email: auth.currentUser.email,\n        emailVerified: auth.currentUser.emailVerified,\n        displayName: auth.currentUser.displayName,\n        isAnonymous: auth.currentUser.isAnonymous,\n        phoneNumber: auth.currentUser.phoneNumber,\n        photoURL: auth.currentUser.photoURL,\n        providerId: auth.currentUser.providerId,\n        tenantId: auth.currentUser.tenantId,\n        refreshToken: auth.currentUser.refreshToken,\n        metadata: {\n          creationTime: auth.currentUser.metadata.creationTime,\n          lastSignInTime: auth.currentUser.metadata.lastSignInTime,\n        },\n        providerData: auth.currentUser.providerData.map((provider) => ({\n          uid: provider.uid,\n          displayName: provider.displayName,\n          email: provider.email,\n          phoneNumber: provider.phoneNumber,\n          photoURL: provider.photoURL,\n          providerId: provider.providerId,\n        })),\n      };\n\n      return { user: userObj, claims };\n    }\n\n    return null;\n  } catch (error) {\n    return null;\n  }\n};\n\nexport { TernSecureUser }\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,qBAAoE;AACpE,iBAA8B;AAG9B,iBAAoC;AAEpC,kBAAwB;AAExB,2BAAiD;AAEjD,sBAQO;AAWA,MAAM,8BAA8B,CAAoC,QAAc;AAG3F,QAAM,EAAE,SAAAA,UAAS,GAAG,KAAK,IAAI;AAC7B,SAAO;AACT;AAEO,SAAS,yBAAyB,KAAkB,eAAe,CAAC,GAAG;AAC5E,QAAM,aAAa,0BAA0B,GAAG;AAChD,SAAO,yBAAyB,EAAE,GAAG,cAAc,GAAG,WAAW,CAAC;AACpE;AAEO,SAAS,0BAA0B,KAA8B;AACtE,QAAM,iBAAa,4CAAsB,KAAK,YAAY;AAC1D,QAAM,gBAAY,4CAAsB,KAAK,WAAW;AACxD,QAAM,oBAAgB,4CAAsB,KAAK,eAAe;AAChE,QAAM,iBAAa,4CAAsB,KAAK,YAAY;AAE1D,MAAI;AACJ,MAAI,CAAC,cAAc,eAAe,0BAAW,UAAU;AACrD,qBAAa,oCAAoB;AAAA,EACnC,OAAO;AACL,UAAM,UAAM,0BAAc,SAAmB;AAE7C,qBAAa,mCAAmB,IAAI,IAAI,MAAM,IAAI,OAAO;AAAA,EAC3D;AACA,SAAO;AACT;AAoBO,MAAM,2BAA2B,CACtC,QACM;AAGN,QAAM,EAAE,SAAAA,UAAS,GAAG,KAAK,IAAI;AAC7B,SAAO;AACT;AAEA,eAAsB,sBACpB,KACA,eAAe,CAAC,GAChB;AACA,QAAM,aAAa,MAAM,uBAAuB,GAAG;AACnD,SAAO,yBAAyB,EAAE,GAAG,cAAc,GAAG,WAAW,CAAC;AACpE;AAEA,eAAsB,uBAAuB,KAA8C;AACzF,QAAM,iBAAa,4CAAsB,KAAK,YAAY;AAC1D,QAAM,gBAAY,4CAAsB,KAAK,WAAW;AACxD,QAAM,oBAAgB,gCAAU,KAAK,qBAAqB;AAE1D,MAAI,CAAC,cAAc,eAAe,0BAAW,UAAU;AACrD,WAAO;AAAA,MACL,OAAG,oCAAoB;AAAA,MACvB,MAAM;AAAA,MACN,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,gBAAgB,CAAC,aAAa,QAAQ;AACzC,WAAO;AAAA,MACL,OAAG,oCAAoB;AAAA,MACvB,MAAM;AAAA,MACN,QAAQ;AAAA,IACV;AAAA,EACF;AACA,QAAM,EAAE,MAAM,OAAO,IAAI;AACzB,QAAM,iBAAa,mCAAmB,WAAqB,MAAa;AACxE,SAAO;AAAA,IACL,GAAG;AAAA,IACH,MAAM,QAAQ;AAAA,EAChB;AACF;AAEA,MAAM,sBAAsB,OAC1B,OACA,SACA,kBAC8E;AAC9E,MAAI;AAEF,UAAM,SAAS,IAAI,IAAI,QAAQ,GAAG,EAAE;AAEpC,UAAM,iBAAiB,IAAI,QAAQ,QAAQ,OAAO;AAClD,mBAAe,IAAI,WAAW,MAAM;AACpC,mBAAe,IAAI,WAAW,MAAM;AAEpC,UAAM,cAAc;AAAA,MAClB,SAAS;AAAA,IACX;AAEA,UAAM,SAA2B;AAAA,MAC/B,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe;AAAA,MACf,mBAAmB;AAAA,MACnB,OAAO;AAAA,MACP,eAAe;AAAA,IACjB;AAEA,UAAM,wBAAuC;AAAA,MAC3C;AAAA,MACA;AAAA,QACE,aAAa;AAAA,QACb;AAAA,QACA,gBAAgB;AAAA,MAClB;AAAA,IACF;AAEA,UAAM,WAAa,qBAAQ,iBAAiB;AAC5C,UAAM,KAAK,eAAe;AAE1B,QAAI,KAAK,aAAa;AACpB,YAAM,gBAAgB,MAAM,KAAK,YAAY,iBAAiB;AAC9D,YAAM,SAAS,cAAc;AAE7B,YAAM,UAAsC;AAAA,QAC1C,KAAK,KAAK,YAAY;AAAA,QACtB,OAAO,KAAK,YAAY;AAAA,QACxB,eAAe,KAAK,YAAY;AAAA,QAChC,aAAa,KAAK,YAAY;AAAA,QAC9B,aAAa,KAAK,YAAY;AAAA,QAC9B,aAAa,KAAK,YAAY;AAAA,QAC9B,UAAU,KAAK,YAAY;AAAA,QAC3B,YAAY,KAAK,YAAY;AAAA,QAC7B,UAAU,KAAK,YAAY;AAAA,QAC3B,cAAc,KAAK,YAAY;AAAA,QAC/B,UAAU;AAAA,UACR,cAAc,KAAK,YAAY,SAAS;AAAA,UACxC,gBAAgB,KAAK,YAAY,SAAS;AAAA,QAC5C;AAAA,QACA,cAAc,KAAK,YAAY,aAAa,IAAI,CAAC,cAAc;AAAA,UAC7D,KAAK,SAAS;AAAA,UACd,aAAa,SAAS;AAAA,UACtB,OAAO,SAAS;AAAA,UAChB,aAAa,SAAS;AAAA,UACtB,UAAU,SAAS;AAAA,UACnB,YAAY,SAAS;AAAA,QACvB,EAAE;AAAA,MACJ;AAEA,aAAO,EAAE,MAAM,SAAS,OAAO;AAAA,IACjC;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,WAAO;AAAA,EACT;AACF;","names":["require"]}

package/dist/cjs/server/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/server/index.ts"],"sourcesContent":["export {\r\n  ternSecureProxy,\r\n} from \"./ternSecureProxy\";\r\nexport { ternSecureInstrumentation } from \"./instrumentation\";\r\nexport { createRouteMatcher } from \"./routeMatcher\";\r\nexport { ternSecureBackendClient } from \"./ternsecureClient\";\r\nexport {\r\n  auth\r\n} from \"../app-router/server/auth\";\r\nexport type { AuthResult } from \"../app-router/server/auth\";\r\nexport type { BaseUser, SessionResult } from \"./types\";\r\nexport { NextCookieStore } from \"../utils/NextCookieAdapter\";\r\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,6BAEO;AACP,6BAA0C;AAC1C,0BAAmC;AACnC,8BAAwC;AACxC,kBAEO;AAGP,+BAAgC;","names":[]}
+{"version":3,"sources":["../../../src/server/index.ts"],"sourcesContent":["export { ternSecureProxy } from \"./ternSecureProxy\";\r\nexport { ternSecureInstrumentation } from \"./instrumentation\";\r\nexport { createRouteMatcher } from \"./routeMatcher\";\r\nexport { ternSecureBackendClient } from \"./ternsecureClient\";\r\nexport {\r\n  auth\r\n} from \"../app-router/server/auth\";\r\nexport type { AuthResult } from \"../app-router/server/auth\";\r\nexport type { BaseUser, SessionResult } from \"./types\";\r\nexport { NextCookieStore } from \"../utils/NextCookieAdapter\";\r\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,6BAAgC;AAChC,6BAA0C;AAC1C,0BAAmC;AACnC,8BAAwC;AACxC,kBAEO;AAGP,+BAAgC;","names":[]}