@thinkingcat/auth-utils 1.0.49 → 2.0.0

package/dist/middleware/config.d.ts

@@ -0,0 +1,15 @@
+import type { MiddlewareConfig } from '../types';
+/**
+ * 기본 미들웨어 설정을 생성하는 함수
+ */
+export declare function createMiddlewareConfig(config: Partial<MiddlewareConfig> & {
+    serviceId: string;
+}, defaults?: {
+    publicPaths?: string[];
+    subscriptionRequiredPaths?: string[];
+    subscriptionExemptApiPaths?: string[];
+    authApiPaths?: string[];
+    rolePaths?: Record<string, string>;
+    systemAdminRole?: string;
+    errorPath?: string;
+}): Required<Omit<MiddlewareConfig, 'serviceId'>> & Pick<MiddlewareConfig, 'serviceId'>;

package/dist/middleware/config.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMiddlewareConfig = createMiddlewareConfig;
+/**
+ * 기본 미들웨어 설정을 생성하는 함수
+ */
+function createMiddlewareConfig(config, defaults) {
+    const defaultPublicPaths = defaults?.publicPaths || [
+        '/robots.txt', '/sitemap.xml', '/ads.txt', '/images', '/login', '/register',
+        '/forgot-password', '/reset-password', '/about', '/pricing', '/support',
+        '/terms', '/privacy', '/refund', '/error'
+    ];
+    const defaultSubscriptionRequiredPaths = defaults?.subscriptionRequiredPaths || [
+        '/admin', '/teacher', '/student', '/personal'
+    ];
+    const defaultSubscriptionExemptApiPaths = defaults?.subscriptionExemptApiPaths || [
+        '/api/auth', '/api/sso', '/api/admin/subscription', '/api/admin/payment-methods'
+    ];
+    const defaultAuthApiPaths = defaults?.authApiPaths || [
+        '/api/auth/send-verification', '/api/auth/verify-code', '/api/auth/verify-user', '/api/auth/select-academy'
+    ];
+    const defaultRolePaths = defaults?.rolePaths || {
+        SYSTEM_ADMIN: '/system', ADMIN: '/admin', TEACHER: '/teacher', STUDENT: '/student'
+    };
+    const defaultSystemAdminRole = defaults?.systemAdminRole || 'SYSTEM_ADMIN';
+    const defaultErrorPath = defaults?.errorPath || '/error';
+    return {
+        publicPaths: config.publicPaths || defaultPublicPaths,
+        subscriptionRequiredPaths: config.subscriptionRequiredPaths || defaultSubscriptionRequiredPaths,
+        subscriptionExemptApiPaths: config.subscriptionExemptApiPaths || defaultSubscriptionExemptApiPaths,
+        authApiPaths: config.authApiPaths || defaultAuthApiPaths,
+        rolePaths: config.rolePaths || defaultRolePaths,
+        roleAccessConfig: config.roleAccessConfig || {},
+        systemAdminRole: config.systemAdminRole || defaultSystemAdminRole,
+        errorPath: config.errorPath || defaultErrorPath,
+        serviceId: config.serviceId,
+    };
+}

package/dist/middleware/handler.d.ts

@@ -0,0 +1,6 @@
+import type { NextRequest, NextResponse } from 'next/server';
+import type { MiddlewareConfig, MiddlewareOptions } from '../types';
+/**
+ * 통합 미들웨어 핸들러 함수
+ */
+export declare function handleMiddleware(req: NextRequest, config: Required<Omit<MiddlewareConfig, 'serviceId'>> & Pick<MiddlewareConfig, 'serviceId'>, options: MiddlewareOptions): Promise<NextResponse | null>;

package/dist/middleware/handler.js

@@ -0,0 +1,228 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleMiddleware = handleMiddleware;
+const server_1 = require("../utils/server");
+const license_1 = require("../utils/license");
+const logger_1 = require("../utils/logger");
+const roles_1 = require("../core/roles");
+const verify_1 = require("../core/verify");
+const jwt_1 = require("../core/jwt");
+const api_1 = require("../sso/api");
+const auth_response_1 = require("../core/auth-response");
+const redirect_1 = require("../utils/redirect");
+const cookies_1 = require("../core/cookies");
+/**
+ * 통합 미들웨어 핸들러 함수
+ */
+async function handleMiddleware(req, config, options) {
+    const { NextResponse: NextResponseClass } = await (0, server_1.getNextServer)();
+    try {
+        const pathname = req.nextUrl.pathname;
+        const { secret, isProduction, cookieDomain, getNextAuthToken, licenseKey } = options;
+        await (0, license_1.checkLicenseKey)(licenseKey);
+        if (!config.serviceId) {
+            throw new Error('serviceId is required in middleware config');
+        }
+        const serviceId = config.serviceId;
+        const cookiePrefix = serviceId;
+        let token = null;
+        if (getNextAuthToken) {
+            token = await getNextAuthToken(req);
+        }
+        else {
+            try {
+                const { getToken } = await Promise.resolve().then(() => __importStar(require('next-auth/jwt')));
+                token = await getToken({ req, secret });
+            }
+            catch (error) {
+                (0, logger_1.debugLog)('handleMiddleware', 'getToken failed', error);
+            }
+        }
+        const effectiveRole = (0, roles_1.getEffectiveRole)(token, serviceId);
+        // 1. API 요청 처리
+        if (pathname.startsWith('/api/')) {
+            if (config.authApiPaths.includes(pathname)) {
+                return NextResponseClass.next();
+            }
+            if (config.subscriptionExemptApiPaths.some((path) => pathname.startsWith(path))) {
+                return NextResponseClass.next();
+            }
+            const authCheck = await (0, verify_1.verifyAndRefreshTokenWithNextAuth)(req, token, secret, {
+                cookiePrefix,
+                serviceId,
+                isProduction,
+                cookieDomain,
+                text: serviceId,
+                ssoBaseURL: options.ssoBaseURL,
+                authServiceKey: options.authServiceKey,
+                licenseKey: options.licenseKey,
+            });
+            if (authCheck.response)
+                return authCheck.response;
+            if (!authCheck.isValid) {
+                const response = await (0, redirect_1.redirectToError)(req, 'UNAUTHORIZED', '인증이 필요합니다.', config.errorPath);
+                (0, cookies_1.clearAuthCookies)(response, cookiePrefix);
+                return response;
+            }
+            return NextResponseClass.next();
+        }
+        // 2. 루트 경로 처리 - SSO 토큰 처리
+        if (pathname === '/') {
+            const tokenParam = req.nextUrl.searchParams.get('token');
+            if (tokenParam) {
+                try {
+                    const tokenResult = await (0, jwt_1.verifyToken)(tokenParam, secret);
+                    if (!tokenResult)
+                        throw new Error('Invalid token');
+                    const { payload } = tokenResult;
+                    const defaultRole = Object.keys(config.rolePaths)[0] || 'ADMIN';
+                    const tokenRole = (0, jwt_1.extractRoleFromPayload)(payload, serviceId, defaultRole);
+                    const userId = payload.id || payload.sub || payload.userId || '';
+                    const ssoBaseURL = options.ssoBaseURL;
+                    const authServiceKey = options.authServiceKey;
+                    let refreshToken = '';
+                    if (authServiceKey && userId) {
+                        try {
+                            const refreshTokenResult = await (0, api_1.getRefreshTokenFromSSO)(userId, tokenParam, { ssoBaseURL, authServiceKey });
+                            refreshToken = refreshTokenResult || '';
+                        }
+                        catch (error) {
+                            (0, logger_1.debugError)('handleMiddleware', 'Failed to get refresh token', error);
+                        }
+                    }
+                    const redirectPath = config.rolePaths[tokenRole] || config.rolePaths[defaultRole] || '/admin';
+                    return await (0, auth_response_1.createAuthResponse)(tokenParam, secret, {
+                        req,
+                        refreshToken: refreshToken || undefined,
+                        redirectPath,
+                        text: serviceId,
+                        cookiePrefix,
+                        isProduction,
+                        cookieDomain,
+                        serviceId,
+                        licenseKey: options.licenseKey,
+                    });
+                }
+                catch (error) {
+                    (0, logger_1.debugError)('handleMiddleware', 'Error processing token', error);
+                    const ssoBaseURL = options.ssoBaseURL;
+                    return await (0, redirect_1.redirectToSSOLogin)(req, serviceId, ssoBaseURL);
+                }
+            }
+            if (token && effectiveRole) {
+                return await (0, redirect_1.redirectToRoleDashboard)(req, effectiveRole, config.rolePaths);
+            }
+            const ssoBaseURL = options.ssoBaseURL;
+            return await (0, redirect_1.redirectToSSOLogin)(req, serviceId, ssoBaseURL);
+        }
+        // 3. 공개 경로 처리
+        if (config.publicPaths.some((path) => pathname === path || pathname.startsWith(path))) {
+            if (pathname === '/error' || pathname === '/verification') {
+                return NextResponseClass.next();
+            }
+            if (token && effectiveRole) {
+                return await (0, redirect_1.redirectToRoleDashboard)(req, effectiveRole, config.rolePaths);
+            }
+            return NextResponseClass.next();
+        }
+        // 4. 인증 체크
+        const authCheck = await (0, verify_1.verifyAndRefreshTokenWithNextAuth)(req, token, secret, {
+            cookiePrefix,
+            serviceId,
+            isProduction,
+            cookieDomain,
+            text: serviceId,
+            ssoBaseURL: options.ssoBaseURL,
+            authServiceKey: options.authServiceKey,
+            licenseKey: options.licenseKey,
+        });
+        if (authCheck.response)
+            return authCheck.response;
+        if (!authCheck.isValid) {
+            const ssoBaseURL = options.ssoBaseURL;
+            return await (0, redirect_1.redirectToSSOLogin)(req, serviceId, ssoBaseURL);
+        }
+        let finalToken = authCheck.token || token;
+        if (!finalToken && authCheck.isValid) {
+            if (getNextAuthToken) {
+                finalToken = await getNextAuthToken(req);
+            }
+            else {
+                try {
+                    const { getToken } = await Promise.resolve().then(() => __importStar(require('next-auth/jwt')));
+                    finalToken = await getToken({ req, secret });
+                }
+                catch {
+                    // Ignored
+                }
+            }
+        }
+        if (!finalToken) {
+            const ssoBaseURL = options.ssoBaseURL;
+            return await (0, redirect_1.redirectToSSOLogin)(req, serviceId, ssoBaseURL);
+        }
+        if (finalToken.error === "RefreshAccessTokenError") {
+            const ssoBaseURL = options.ssoBaseURL;
+            return await (0, redirect_1.redirectToSSOLogin)(req, serviceId, ssoBaseURL);
+        }
+        if (!finalToken.role || !finalToken.email) {
+            const ssoBaseURL = options.ssoBaseURL;
+            return await (0, redirect_1.redirectToSSOLogin)(req, serviceId, ssoBaseURL);
+        }
+        const finalEffectiveRole = finalToken.role || (0, roles_1.getEffectiveRole)(finalToken, serviceId) || effectiveRole || '';
+        if (config.roleAccessConfig && Object.keys(config.roleAccessConfig).length > 0 && finalEffectiveRole) {
+            const roleCheck = (0, roles_1.checkRoleAccess)(pathname, finalEffectiveRole, config.roleAccessConfig);
+            if (!roleCheck.allowed) {
+                return await (0, redirect_1.redirectToError)(req, 'ACCESS_DENIED', roleCheck.message || '접근 권한이 없습니다.', config.errorPath);
+            }
+        }
+        if (finalEffectiveRole && (0, roles_1.requiresSubscription)(pathname, finalEffectiveRole, config.subscriptionRequiredPaths, config.systemAdminRole)) {
+            const services = finalToken.services || [];
+            const ssoBaseURL = options.ssoBaseURL;
+            if (!ssoBaseURL)
+                throw new Error('ssoBaseURL is required');
+            const subscriptionCheck = (0, api_1.validateServiceSubscription)(services, serviceId, ssoBaseURL);
+            if (!subscriptionCheck.isValid) {
+                return NextResponseClass.redirect(subscriptionCheck.redirectUrl);
+            }
+        }
+        return null;
+    }
+    catch (error) {
+        (0, logger_1.debugError)('handleMiddleware', 'Middleware error', error);
+        return await (0, redirect_1.redirectToError)(req, 'INTERNAL_ERROR', '서버 오류가 발생했습니다.', config.errorPath);
+    }
+}

package/dist/nextauth/callbacks.d.ts

@@ -0,0 +1,35 @@
+import type { JWT } from "next-auth/jwt";
+/**
+ * JWT 콜백에서 초기 로그인 시 토큰 생성 헬퍼
+ */
+export declare function createInitialJWTToken(token: JWT, user: {
+    id: string;
+    email?: string | null;
+    emailHash?: string | null;
+    maskedEmail?: string | null;
+    phoneHash?: string | null;
+    maskedPhone?: string | null;
+    role?: string;
+    phone?: string | null;
+    decryptedEmail?: string | null;
+    decryptedPhone?: string | null;
+    refreshToken?: string | null;
+}, account?: {
+    serviceId?: string;
+} | null): JWT;
+/**
+ * 쿠키에서 커스텀 토큰을 읽어서 NextAuth JWT로 변환하는 헬퍼 함수
+ */
+export declare function getJWTFromCustomTokenCookie(cookieName: string, secret: string, serviceId: string, licenseKey: string): Promise<JWT | null>;
+/**
+ * JWT 콜백을 위한 통합 헬퍼 함수
+ */
+export declare function handleJWTCallback(token: JWT, user?: any, account?: any, options?: {
+    secret?: string;
+    licenseKey?: string;
+    serviceId?: string;
+    cookieName?: string;
+    debug?: boolean;
+    ssoBaseURL?: string;
+    authServiceKey?: string;
+}): Promise<JWT>;

package/dist/nextauth/callbacks.js

@@ -0,0 +1,143 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createInitialJWTToken = createInitialJWTToken;
+exports.getJWTFromCustomTokenCookie = getJWTFromCustomTokenCookie;
+exports.handleJWTCallback = handleJWTCallback;
+const jwt_1 = require("../core/jwt");
+const license_1 = require("../utils/license");
+/**
+ * JWT 콜백에서 초기 로그인 시 토큰 생성 헬퍼
+ */
+function createInitialJWTToken(token, user, account) {
+    return {
+        ...token,
+        id: user.id,
+        email: user.email ?? undefined,
+        emailHash: user.emailHash ?? undefined,
+        maskedEmail: user.maskedEmail ?? undefined,
+        phoneHash: user.phoneHash ?? undefined,
+        maskedPhone: user.maskedPhone ?? undefined,
+        role: user.role,
+        phone: user.phone ?? undefined,
+        decryptedEmail: user.decryptedEmail ?? undefined,
+        decryptedPhone: user.decryptedPhone ?? undefined,
+        refreshToken: user.refreshToken ?? undefined,
+        accessTokenExpires: Date.now() + (15 * 60 * 1000),
+        serviceId: account?.serviceId ?? undefined,
+    };
+}
+/**
+ * 쿠키에서 커스텀 토큰을 읽어서 NextAuth JWT로 변환하는 헬퍼 함수
+ */
+async function getJWTFromCustomTokenCookie(cookieName, secret, serviceId, licenseKey) {
+    try {
+        const { cookies } = await Promise.resolve().then(() => __importStar(require('next/headers')));
+        const cookieStore = await cookies();
+        const accessToken = cookieStore.get(cookieName)?.value;
+        if (!accessToken)
+            return null;
+        await (0, license_1.checkLicenseKey)(licenseKey);
+        const tokenResult = await (0, jwt_1.verifyToken)(accessToken, secret);
+        if (!tokenResult)
+            return null;
+        const { payload } = tokenResult;
+        const jwt = (0, jwt_1.createNextAuthJWT)(payload, serviceId);
+        jwt.accessTokenExpires = Date.now() + (15 * 60 * 1000);
+        const refreshTokenCookieName = cookieName.replace('_access_token', '_refresh_token');
+        const refreshToken = cookieStore.get(refreshTokenCookieName)?.value;
+        if (refreshToken) {
+            jwt.refreshToken = refreshToken;
+        }
+        return jwt;
+    }
+    catch (error) {
+        return null;
+    }
+}
+/**
+ * JWT 콜백을 위한 통합 헬퍼 함수
+ */
+async function handleJWTCallback(token, user, account, options) {
+    const { secret, licenseKey, serviceId, cookieName, debug = false, ssoBaseURL, authServiceKey, } = options || {};
+    if (account && user) {
+        return createInitialJWTToken(token, user, account);
+    }
+    if (secret && licenseKey && serviceId) {
+        const cookieNameToUse = cookieName || `${serviceId}_access_token`;
+        const customJwt = await getJWTFromCustomTokenCookie(cookieNameToUse, secret, serviceId, licenseKey);
+        if (customJwt) {
+            if (token.refreshToken)
+                customJwt.refreshToken = token.refreshToken;
+            return customJwt;
+        }
+    }
+    const now = Date.now();
+    const expires = token.accessTokenExpires;
+    const hasValidToken = token.id && expires && expires > now;
+    const refreshToken = token.refreshToken;
+    if (hasValidToken)
+        return token;
+    if (refreshToken && ssoBaseURL && authServiceKey && secret) {
+        try {
+            const response = await fetch(`${ssoBaseURL}/api/sso/refresh`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'x-auth-service-key': authServiceKey,
+                },
+                body: JSON.stringify({ refreshToken }),
+            });
+            if (response.ok) {
+                const result = await response.json();
+                if (result.success && result.accessToken) {
+                    const tokenResult = await (0, jwt_1.verifyToken)(result.accessToken, secret);
+                    if (tokenResult) {
+                        const newJWT = (0, jwt_1.createNextAuthJWT)(tokenResult.payload, serviceId || '');
+                        return {
+                            ...newJWT,
+                            refreshToken,
+                            accessTokenExpires: Date.now() + (15 * 60 * 1000),
+                        };
+                    }
+                }
+            }
+        }
+        catch (error) {
+            console.error('[handleJWTCallback] Error refreshing token:', error);
+        }
+    }
+    return token;
+}

package/dist/nextauth/config.d.ts

@@ -0,0 +1,50 @@
+/**
+ * NextAuth 쿠키 설정 생성
+ */
+export declare function createNextAuthCookies(options: {
+    isProduction?: boolean;
+    cookieDomain?: string;
+}): {
+    sessionToken: {
+        name: string;
+        options: {
+            httpOnly: boolean;
+            sameSite: 'lax' | 'none';
+            path: string;
+            secure: boolean;
+            domain?: string;
+        };
+    };
+    callbackUrl: {
+        name: string;
+        options: {
+            sameSite: 'lax' | 'none';
+            path: string;
+            secure: boolean;
+            domain?: string;
+        };
+    };
+    csrfToken: {
+        name: string;
+        options: {
+            httpOnly: boolean;
+            sameSite: 'lax' | 'none';
+            path: string;
+            secure: boolean;
+            domain?: string;
+        };
+    };
+};
+/**
+ * NextAuth 기본 설정 생성
+ */
+export declare function createNextAuthBaseConfig(options: {
+    secret: string;
+    isProduction?: boolean;
+    cookieDomain?: string;
+    signInPath?: string;
+    errorPath?: string;
+    nextAuthUrl?: string;
+    sessionMaxAge?: number;
+    jwtMaxAge?: number;
+}): any;

package/dist/nextauth/config.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createNextAuthCookies = createNextAuthCookies;
+exports.createNextAuthBaseConfig = createNextAuthBaseConfig;
+/**
+ * NextAuth 쿠키 설정 생성
+ */
+function createNextAuthCookies(options) {
+    const { isProduction = false, cookieDomain } = options;
+    const isSecure = isProduction;
+    const sameSiteValue = cookieDomain ? 'lax' : (isSecure ? 'none' : 'lax');
+    return {
+        sessionToken: {
+            name: isSecure ? `__Secure-next-auth.session-token` : `next-auth.session-token`,
+            options: {
+                httpOnly: true,
+                sameSite: sameSiteValue,
+                path: '/',
+                secure: isSecure,
+                ...(cookieDomain && { domain: cookieDomain }),
+            },
+        },
+        callbackUrl: {
+            name: isSecure ? `__Secure-next-auth.callback-url` : `next-auth.callback-url`,
+            options: {
+                sameSite: sameSiteValue,
+                path: '/',
+                secure: isSecure,
+                ...(cookieDomain && { domain: cookieDomain }),
+            },
+        },
+        csrfToken: {
+            name: isSecure ? `__Secure-next-auth.csrf-token` : `next-auth.csrf-token`,
+            options: {
+                httpOnly: true,
+                sameSite: sameSiteValue,
+                path: '/',
+                secure: isSecure,
+                ...(cookieDomain && { domain: cookieDomain }),
+            },
+        },
+    };
+}
+/**
+ * NextAuth 기본 설정 생성
+ */
+function createNextAuthBaseConfig(options) {
+    const { secret, isProduction = false, cookieDomain, signInPath = '/login', errorPath = '/login', nextAuthUrl, sessionMaxAge = 30 * 24 * 60 * 60, jwtMaxAge = 30 * 24 * 60 * 60, } = options;
+    return {
+        session: {
+            strategy: 'jwt',
+            maxAge: sessionMaxAge,
+        },
+        jwt: {
+            maxAge: jwtMaxAge,
+        },
+        providers: [],
+        ...(nextAuthUrl && { url: nextAuthUrl }),
+        pages: {
+            signIn: signInPath,
+            error: errorPath,
+        },
+        cookies: createNextAuthCookies({ isProduction, cookieDomain }),
+        secret,
+    };
+}

package/dist/nextauth/session.d.ts

@@ -0,0 +1,10 @@
+import type { JWT } from "next-auth/jwt";
+import type { Session } from "next-auth";
+/**
+ * Session 콜백에서 빈 세션 반환 헬퍼
+ */
+export declare function createEmptySession(session: Session): Session;
+/**
+ * Session 콜백에서 토큰 정보를 세션에 매핑하는 헬퍼
+ */
+export declare function mapTokenToSession(session: Session, token: JWT): Session;

package/dist/nextauth/session.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createEmptySession = createEmptySession;
+exports.mapTokenToSession = mapTokenToSession;
+/**
+ * Session 콜백에서 빈 세션 반환 헬퍼
+ */
+function createEmptySession(session) {
+    return {
+        ...session,
+        user: {
+            ...session.user,
+            id: '',
+            email: null,
+            role: 'GUEST',
+        },
+        expires: new Date().toISOString(),
+    };
+}
+/**
+ * Session 콜백에서 토큰 정보를 세션에 매핑하는 헬퍼
+ */
+function mapTokenToSession(session, token) {
+    if (!session.user) {
+        return session;
+    }
+    const user = session.user;
+    user.id = token.id;
+    user.email = token.email;
+    user.name = token.name;
+    user.role = token.role;
+    user.smsVerified = token.smsVerified;
+    user.emailVerified = token.emailVerified;
+    user.phone = token.phone;
+    user.phoneVerified = token.phoneVerified;
+    user.isPasswordReset = token.isPasswordReset || false;
+    user.decryptedEmail = token.decryptedEmail;
+    user.decryptedPhone = token.decryptedPhone;
+    return session;
+}

package/dist/sso/api.d.ts

@@ -0,0 +1,23 @@
+import type { ServiceInfo, SSORefreshTokenResponse } from '../types';
+/**
+ * 서비스 구독 유효성 확인 함수
+ */
+export declare function validateServiceSubscription(services: ServiceInfo[], serviceId: string, ssoBaseURL: string): {
+    isValid: boolean;
+    redirectUrl?: string;
+    service?: ServiceInfo;
+};
+/**
+ * SSO 서버에서 refresh token을 사용하여 새로운 access token을 발급받는 함수
+ */
+export declare function refreshSSOToken(refreshToken: string, options: {
+    ssoBaseURL: string;
+    authServiceKey?: string;
+}): Promise<SSORefreshTokenResponse>;
+/**
+ * SSO 서버에서 사용자의 refresh token을 가져오는 함수
+ */
+export declare function getRefreshTokenFromSSO(userId: string, accessToken: string, options: {
+    ssoBaseURL: string;
+    authServiceKey?: string;
+}): Promise<string | null>;