@thunderid/nextjs 1.0.4 → 1.0.5

package/dist/cjs/server/actions/getAccessToken.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"getAccessToken.cjs","names":["sessionToken: string | undefined","SessionManager"],"sources":["../../../../src/server/actions/getAccessToken.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {cookies} from 'next/headers';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Get the access token from the session cookie.\n *\n * @returns The access token if it exists, undefined otherwise\n */\nconst getAccessToken = async (): Promise<string | undefined> => {\n  const cookieStore: RequestCookies = await cookies();\n\n  const sessionToken: string | undefined = cookieStore.get(SessionManager.getSessionCookieName())?.value;\n\n  if (sessionToken) {\n    try {\n      const sessionPayload: SessionTokenPayload = await SessionManager.verifySessionToken(sessionToken);\n\n      return sessionPayload['accessToken'] as string;\n    } catch (error) {\n      return undefined;\n    }\n  }\n\n  return undefined;\n};\n\nexport default getAccessToken;\n"],"mappings":";;;;;;;;;;;;;;AAeA,MAAM,iBAAiB,YAAyC;CAG9D,MAAMA,gBAF8B,iCAAe,EAEE,IAAIC,+BAAe,sBAAsB,CAAC,EAAE;AAEjG,KAAI,aACF,KAAI;AAGF,UAF4C,MAAMA,+BAAe,mBAAmB,aAAa,EAE3E;UACf,OAAO;AACd;;;AAON,6BAAe"}
+{"version":3,"file":"getAccessToken.cjs","names":["sessionToken: string | undefined","getChunkedCookie","SessionManager"],"sources":["../../../../src/server/actions/getAccessToken.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {cookies} from 'next/headers';\nimport {getChunkedCookie} from '../../utils/chunkedCookie';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Get the access token from the session cookie.\n *\n * @returns The access token if it exists, undefined otherwise\n */\nconst getAccessToken = async (): Promise<string | undefined> => {\n  const cookieStore: RequestCookies = await cookies();\n\n  const sessionToken: string | undefined = getChunkedCookie(cookieStore, SessionManager.getSessionCookieName());\n\n  if (sessionToken) {\n    try {\n      const sessionPayload: SessionTokenPayload = await SessionManager.verifySessionToken(sessionToken);\n\n      return sessionPayload['accessToken'] as string;\n    } catch (error) {\n      return undefined;\n    }\n  }\n\n  return undefined;\n};\n\nexport default getAccessToken;\n"],"mappings":";;;;;;;;;;;;;;;AAgBA,MAAM,iBAAiB,YAAyC;CAG9D,MAAMA,eAAmCC,uCAFL,iCAAe,EAEoBC,+BAAe,sBAAsB,CAAC;AAE7G,KAAI,aACF,KAAI;AAGF,UAF4C,MAAMA,+BAAe,mBAAmB,aAAa,EAE3E;UACf,OAAO;AACd;;;AAON,6BAAe"}

package/dist/cjs/server/actions/getFlowMetaAction.cjs

@@ -0,0 +1,44 @@
+'use server';
+
+
+const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.cjs');
+const require_getClient = require('../getClient.cjs');
+const require_logger = require('../../utils/logger.cjs');
+let __thunderid_node = require("@thunderid/node");
+__thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
+
+//#region src/server/actions/getFlowMetaAction.ts
+/**
+* Server Action that fetches `GET /flow/meta` server-side.
+*
+* `FlowMetaProvider` (from `@thunderid/react`) otherwise fetches this endpoint directly from the
+* browser against `baseUrl`, which requires the ThunderID server to allow CORS for the app's
+* origin. Routing it through this action instead means the browser never talks to `baseUrl`
+* directly — the request happens server-to-server, same as `signInAction`/`signUpAction`.
+*
+* @param language - Optional language override, used by `FlowMetaProvider.switchLanguage()`.
+*/
+const getFlowMetaAction = async (params) => {
+	const config = await require_getClient.default().getConfiguration();
+	const applicationId = params?.applicationId ?? config?.applicationId;
+	try {
+		return await (0, __thunderid_node.getFlowMeta)({
+			baseUrl: config?.baseUrl,
+			url: (0, __thunderid_node.resolveResourceEndpoint)("flowMeta", config),
+			...applicationId ? {
+				id: applicationId,
+				type: __thunderid_node.FlowMetaType.App
+			} : {},
+			...params?.language ? { language: params.language } : {}
+		});
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		require_logger.default.error(`[getFlowMetaAction] Error fetching flow metadata: ${message}`);
+		throw error;
+	}
+};
+var getFlowMetaAction_default = getFlowMetaAction;
+
+//#endregion
+exports.default = getFlowMetaAction_default;
+//# sourceMappingURL=getFlowMetaAction.cjs.map

package/dist/cjs/server/actions/getFlowMetaAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"getFlowMetaAction.cjs","names":["config: ThunderIDNextConfig","getClient","applicationId: string | undefined","FlowMetaType"],"sources":["../../../../src/server/actions/getFlowMetaAction.ts"],"sourcesContent":["// Copyright 2026 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {FlowMetadataResponse, FlowMetaType, getFlowMeta, resolveResourceEndpoint} from '@thunderid/node';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport logger from '../../utils/logger';\nimport getClient from '../getClient';\n\n/**\n * Server Action that fetches `GET /flow/meta` server-side.\n *\n * `FlowMetaProvider` (from `@thunderid/react`) otherwise fetches this endpoint directly from the\n * browser against `baseUrl`, which requires the ThunderID server to allow CORS for the app's\n * origin. Routing it through this action instead means the browser never talks to `baseUrl`\n * directly — the request happens server-to-server, same as `signInAction`/`signUpAction`.\n *\n * @param language - Optional language override, used by `FlowMetaProvider.switchLanguage()`.\n */\nconst getFlowMetaAction = async (params?: {\n  applicationId?: string;\n  language?: string;\n}): Promise<FlowMetadataResponse> => {\n  const client = getClient();\n  const config: ThunderIDNextConfig = await client.getConfiguration();\n\n  const applicationId: string | undefined = params?.applicationId ?? config?.applicationId;\n\n  try {\n    return await getFlowMeta({\n      baseUrl: config?.baseUrl,\n      url: resolveResourceEndpoint('flowMeta', config),\n      ...(applicationId ? {id: applicationId, type: FlowMetaType.App} : {}),\n      ...(params?.language ? {language: params.language} : {}),\n    });\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    logger.error(`[getFlowMetaAction] Error fetching flow metadata: ${message}`);\n    throw error;\n  }\n};\n\nexport default getFlowMetaAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAoBA,MAAM,oBAAoB,OAAO,WAGI;CAEnC,MAAMA,SAA8B,MADrBC,2BAAW,CACuB,kBAAkB;CAEnE,MAAMC,gBAAoC,QAAQ,iBAAiB,QAAQ;AAE3E,KAAI;AACF,SAAO,wCAAkB;GACvB,SAAS,QAAQ;GACjB,mDAA6B,YAAY,OAAO;GAChD,GAAI,gBAAgB;IAAC,IAAI;IAAe,MAAMC,8BAAa;IAAI,GAAG,EAAE;GACpE,GAAI,QAAQ,WAAW,EAAC,UAAU,OAAO,UAAS,GAAG,EAAE;GACxD,CAAC;UACK,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,yBAAO,MAAM,qDAAqD,UAAU;AAC5E,QAAM;;;AAIV,gCAAe"}

package/dist/cjs/server/actions/getSessionId.cjs

@@ -2,6 +2,7 @@
 
 
 const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.cjs');
+const require_chunkedCookie = require('../../utils/chunkedCookie.cjs');
 const require_SessionManager = require('../../utils/SessionManager.cjs');
 let next_headers = require("next/headers");
 next_headers = require_rolldown_runtime.__toESM(next_headers);
@@ -14,7 +15,7 @@ next_headers = require_rolldown_runtime.__toESM(next_headers);
 * @returns The session ID if it exists, undefined otherwise
 */
 const getSessionId = async () => {
-	const sessionToken = (await (0, next_headers.cookies)()).get(require_SessionManager.default.getSessionCookieName())?.value;
+	const sessionToken = require_chunkedCookie.getChunkedCookie(await (0, next_headers.cookies)(), require_SessionManager.default.getSessionCookieName());
 	if (sessionToken) try {
 		return (await require_SessionManager.default.verifySessionToken(sessionToken)).sessionId;
 	} catch (error) {

package/dist/cjs/server/actions/getSessionId.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"getSessionId.cjs","names":["sessionToken: string | undefined","SessionManager"],"sources":["../../../../src/server/actions/getSessionId.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {cookies} from 'next/headers';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Get the session ID from cookies.\n * Tries JWT session first, then falls back to legacy session ID.\n *\n * @returns The session ID if it exists, undefined otherwise\n */\nconst getSessionId = async (): Promise<string | undefined> => {\n  const cookieStore: RequestCookies = await cookies();\n\n  const sessionToken: string | undefined = cookieStore.get(SessionManager.getSessionCookieName())?.value;\n\n  if (sessionToken) {\n    try {\n      const sessionPayload: SessionTokenPayload = await SessionManager.verifySessionToken(sessionToken);\n\n      return sessionPayload.sessionId;\n    } catch (error) {\n      return undefined;\n    }\n  }\n\n  return undefined;\n};\n\nexport default getSessionId;\n"],"mappings":";;;;;;;;;;;;;;;AAgBA,MAAM,eAAe,YAAyC;CAG5D,MAAMA,gBAF8B,iCAAe,EAEE,IAAIC,+BAAe,sBAAsB,CAAC,EAAE;AAEjG,KAAI,aACF,KAAI;AAGF,UAF4C,MAAMA,+BAAe,mBAAmB,aAAa,EAE3E;UACf,OAAO;AACd;;;AAON,2BAAe"}
+{"version":3,"file":"getSessionId.cjs","names":["sessionToken: string | undefined","getChunkedCookie","SessionManager"],"sources":["../../../../src/server/actions/getSessionId.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {cookies} from 'next/headers';\nimport {getChunkedCookie} from '../../utils/chunkedCookie';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Get the session ID from cookies.\n * Tries JWT session first, then falls back to legacy session ID.\n *\n * @returns The session ID if it exists, undefined otherwise\n */\nconst getSessionId = async (): Promise<string | undefined> => {\n  const cookieStore: RequestCookies = await cookies();\n\n  const sessionToken: string | undefined = getChunkedCookie(cookieStore, SessionManager.getSessionCookieName());\n\n  if (sessionToken) {\n    try {\n      const sessionPayload: SessionTokenPayload = await SessionManager.verifySessionToken(sessionToken);\n\n      return sessionPayload.sessionId;\n    } catch (error) {\n      return undefined;\n    }\n  }\n\n  return undefined;\n};\n\nexport default getSessionId;\n"],"mappings":";;;;;;;;;;;;;;;;AAiBA,MAAM,eAAe,YAAyC;CAG5D,MAAMA,eAAmCC,uCAFL,iCAAe,EAEoBC,+BAAe,sBAAsB,CAAC;AAE7G,KAAI,aACF,KAAI;AAGF,UAF4C,MAAMA,+BAAe,mBAAmB,aAAa,EAE3E;UACf,OAAO;AACd;;;AAON,2BAAe"}

package/dist/cjs/server/actions/getSessionPayload.cjs

@@ -2,6 +2,7 @@
 
 
 const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.cjs');
+const require_chunkedCookie = require('../../utils/chunkedCookie.cjs');
 const require_SessionManager = require('../../utils/SessionManager.cjs');
 let next_headers = require("next/headers");
 next_headers = require_rolldown_runtime.__toESM(next_headers);
@@ -14,7 +15,7 @@ next_headers = require_rolldown_runtime.__toESM(next_headers);
 * @returns The session payload if valid JWT session exists, undefined otherwise
 */
 const getSessionPayload = async () => {
-	const sessionToken = (await (0, next_headers.cookies)()).get(require_SessionManager.default.getSessionCookieName())?.value;
+	const sessionToken = require_chunkedCookie.getChunkedCookie(await (0, next_headers.cookies)(), require_SessionManager.default.getSessionCookieName());
 	if (!sessionToken) return;
 	try {
 		return await require_SessionManager.default.verifySessionToken(sessionToken);

package/dist/cjs/server/actions/getSessionPayload.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"getSessionPayload.cjs","names":["sessionToken: string | undefined","SessionManager"],"sources":["../../../../src/server/actions/getSessionPayload.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {cookies} from 'next/headers';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Get the session payload from JWT session cookie.\n * This includes user ID, session ID, scopes, and organization ID.\n *\n * @returns The session payload if valid JWT session exists, undefined otherwise\n */\nconst getSessionPayload = async (): Promise<SessionTokenPayload | undefined> => {\n  const cookieStore: RequestCookies = await cookies();\n\n  const sessionToken: string | undefined = cookieStore.get(SessionManager.getSessionCookieName())?.value;\n  if (!sessionToken) {\n    return undefined;\n  }\n\n  try {\n    return await SessionManager.verifySessionToken(sessionToken);\n  } catch {\n    return undefined;\n  }\n};\n\nexport default getSessionPayload;\n"],"mappings":";;;;;;;;;;;;;;;AAgBA,MAAM,oBAAoB,YAAsD;CAG9E,MAAMA,gBAF8B,iCAAe,EAEE,IAAIC,+BAAe,sBAAsB,CAAC,EAAE;AACjG,KAAI,CAAC,aACH;AAGF,KAAI;AACF,SAAO,MAAMA,+BAAe,mBAAmB,aAAa;SACtD;AACN;;;AAIJ,gCAAe"}
+{"version":3,"file":"getSessionPayload.cjs","names":["sessionToken: string | undefined","getChunkedCookie","SessionManager"],"sources":["../../../../src/server/actions/getSessionPayload.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {cookies} from 'next/headers';\nimport {getChunkedCookie} from '../../utils/chunkedCookie';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Get the session payload from JWT session cookie.\n * This includes user ID, session ID, scopes, and organization ID.\n *\n * @returns The session payload if valid JWT session exists, undefined otherwise\n */\nconst getSessionPayload = async (): Promise<SessionTokenPayload | undefined> => {\n  const cookieStore: RequestCookies = await cookies();\n\n  const sessionToken: string | undefined = getChunkedCookie(cookieStore, SessionManager.getSessionCookieName());\n  if (!sessionToken) {\n    return undefined;\n  }\n\n  try {\n    return await SessionManager.verifySessionToken(sessionToken);\n  } catch {\n    return undefined;\n  }\n};\n\nexport default getSessionPayload;\n"],"mappings":";;;;;;;;;;;;;;;;AAiBA,MAAM,oBAAoB,YAAsD;CAG9E,MAAMA,eAAmCC,uCAFL,iCAAe,EAEoBC,+BAAe,sBAAsB,CAAC;AAC7G,KAAI,CAAC,aACH;AAGF,KAAI;AACF,SAAO,MAAMA,+BAAe,mBAAmB,aAAa;SACtD;AACN;;;AAIJ,gCAAe"}

package/dist/cjs/server/actions/getUserSchemaAction.cjs

@@ -0,0 +1,31 @@
+'use server';
+
+
+const require_getClient = require('../getClient.cjs');
+
+//#region src/server/actions/getUserSchemaAction.ts
+/**
+* Server action to get the user attribute schema from `/users/me/meta`.
+* Used to render profile fields dynamically (labels, required/regex validation)
+* instead of falling back to raw, unlabeled attribute keys.
+*/
+const getUserSchemaAction = async (sessionId) => {
+	try {
+		return {
+			data: { userSchema: await require_getClient.default().getUserSchema(sessionId) },
+			error: null,
+			success: true
+		};
+	} catch (error) {
+		return {
+			data: { userSchema: null },
+			error: "Failed to get user schema",
+			success: false
+		};
+	}
+};
+var getUserSchemaAction_default = getUserSchemaAction;
+
+//#endregion
+exports.default = getUserSchemaAction_default;
+//# sourceMappingURL=getUserSchemaAction.cjs.map

package/dist/cjs/server/actions/getUserSchemaAction.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUserSchemaAction.cjs","names":["getClient"],"sources":["../../../../src/server/actions/getUserSchemaAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {AttributeSchema} from '@thunderid/node';\nimport getClient from '../getClient';\n\n/**\n * Server action to get the user attribute schema from `/users/me/meta`.\n * Used to render profile fields dynamically (labels, required/regex validation)\n * instead of falling back to raw, unlabeled attribute keys.\n */\nconst getUserSchemaAction = async (\n  sessionId: string,\n): Promise<{data: {userSchema: Record<string, AttributeSchema> | null}; error: string | null; success: boolean}> => {\n  try {\n    const client = getClient();\n    const userSchema: Record<string, AttributeSchema> | null = await client.getUserSchema(sessionId);\n    return {data: {userSchema}, error: null, success: true};\n  } catch (error) {\n    return {\n      data: {userSchema: null},\n      error: 'Failed to get user schema',\n      success: false,\n    };\n  }\n};\n\nexport default getUserSchemaAction;\n"],"mappings":";;;;;;;;;;;AAaA,MAAM,sBAAsB,OAC1B,cACkH;AAClH,KAAI;AAGF,SAAO;GAAC,MAAM,EAAC,YAD4C,MAD5CA,2BAAW,CAC8C,cAAc,UAAU,EACtE;GAAE,OAAO;GAAM,SAAS;GAAK;UAChD,OAAO;AACd,SAAO;GACL,MAAM,EAAC,YAAY,MAAK;GACxB,OAAO;GACP,SAAS;GACV;;;AAIL,kCAAe"}

package/dist/cjs/server/actions/handleOAuthCallbackAction.cjs

@@ -2,6 +2,7 @@
 
 
 const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.cjs');
+const require_chunkedCookie = require('../../utils/chunkedCookie.cjs');
 const require_SessionManager = require('../../utils/SessionManager.cjs');
 const require_getClient = require('../getClient.cjs');
 const require_logger = require('../../utils/logger.cjs');
@@ -61,7 +62,7 @@ const handleOAuthCallbackAction = async (code, state, sessionState) => {
 			const expiresIn = signInResult["expiresIn"];
 			const sessionCookieExpiryTime = require_SessionManager.default.resolveSessionCookieExpiry(config.sessionCookie?.expiryTime);
 			const sessionToken = await require_SessionManager.default.createSessionToken(accessToken, userIdFromToken, sessionId, scopes, expiresIn, refreshToken, organizationId);
-			cookieStore.set(require_SessionManager.default.getSessionCookieName(), sessionToken, require_SessionManager.default.getSessionCookieOptions(sessionCookieExpiryTime));
+			require_chunkedCookie.setChunkedCookie(cookieStore, require_SessionManager.default.getSessionCookieName(), sessionToken, require_SessionManager.default.getSessionCookieOptions(sessionCookieExpiryTime));
 			cookieStore.delete(require_SessionManager.default.getTempSessionCookieName());
 		} catch (error) {
 			require_logger.default.error(`[handleOAuthCallbackAction] Failed to create JWT session, continuing with legacy session:

package/dist/cjs/server/actions/handleOAuthCallbackAction.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"handleOAuthCallbackAction.cjs","names":["getClient","cookieStore: RequestCookies","sessionId: string | undefined","tempSessionToken: string | undefined","SessionManager","signInResult: Record<string, unknown>","config: ThunderIDNextConfig","idToken: IdToken","accessToken: string","refreshToken: string","userIdFromToken: string","scopes: string","organizationId: string | undefined","expiresIn: number","sessionCookieExpiryTime: number","sessionToken: string"],"sources":["../../../../src/server/actions/handleOAuthCallbackAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {IdToken} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport logger from '../../utils/logger';\nimport SessionManager from '../../utils/SessionManager';\nimport getClient from '../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action to handle OAuth callback with authorization code.\n * This action processes the authorization code received from the OAuth provider\n * and exchanges it for tokens to complete the authentication flow.\n *\n * @param code - Authorization code from OAuth provider\n * @param state - State parameter from OAuth provider for CSRF protection\n * @param sessionState - Session state parameter from OAuth provider\n * @returns Promise that resolves with success status and optional error message\n */\nconst handleOAuthCallbackAction = async (\n  code: string,\n  state: string,\n  sessionState?: string,\n): Promise<{\n  error?: string;\n  redirectUrl?: string;\n  success: boolean;\n}> => {\n  try {\n    if (!code || !state) {\n      return {\n        error: 'Missing required OAuth parameters: code and state are required',\n        success: false,\n      };\n    }\n\n    const thunderIDClient = getClient();\n\n    if (!thunderIDClient.isInitialized) {\n      return {\n        error: 'ThunderID client is not initialized',\n        success: false,\n      };\n    }\n\n    const cookieStore: RequestCookies = await cookies();\n    let sessionId: string | undefined;\n\n    const tempSessionToken: string | undefined = cookieStore.get(SessionManager.getTempSessionCookieName())?.value;\n\n    if (tempSessionToken) {\n      try {\n        const tempSession: {sessionId: string} = await SessionManager.verifyTempSession(tempSessionToken);\n        sessionId = tempSession.sessionId;\n      } catch {\n        logger.error(\n          '[handleOAuthCallbackAction] Invalid temporary session token, falling back to session ID from cookies.',\n        );\n      }\n    }\n\n    if (!sessionId) {\n      logger.error('[handleOAuthCallbackAction] No session ID found in cookies or temporary session token.');\n\n      return {\n        error: 'No session found. Please start the authentication flow again.',\n        success: false,\n      };\n    }\n\n    // Exchange the authorization code for tokens\n    const signInResult: Record<string, unknown> = await thunderIDClient.signIn(\n      {\n        code,\n        session_state: sessionState,\n        state,\n      } as any,\n      {},\n      sessionId,\n    );\n\n    const config: ThunderIDNextConfig = await thunderIDClient.getConfiguration();\n\n    if (signInResult) {\n      try {\n        const idToken: IdToken = await thunderIDClient.getDecodedIdToken(\n          sessionId,\n          (signInResult['id_token'] || signInResult['idToken']) as string,\n        );\n        const accessToken: string = (signInResult['accessToken'] || signInResult['access_token']) as string;\n        const refreshToken: string = (signInResult['refreshToken'] as string | undefined) ?? '';\n        const userIdFromToken: string = (idToken.sub || signInResult['sub'] || sessionId) as string;\n        const scopes: string = signInResult['scope'] as string;\n        const organizationId: string | undefined = (idToken['user_org'] || idToken['organization_id']) as\n          | string\n          | undefined;\n        const expiresIn: number = signInResult['expiresIn'] as number;\n        const sessionCookieExpiryTime: number = SessionManager.resolveSessionCookieExpiry(\n          config.sessionCookie?.expiryTime,\n        );\n\n        const sessionToken: string = await SessionManager.createSessionToken(\n          accessToken,\n          userIdFromToken,\n          sessionId,\n          scopes,\n          expiresIn,\n          refreshToken,\n          organizationId,\n        );\n\n        cookieStore.set(\n          SessionManager.getSessionCookieName(),\n          sessionToken,\n          SessionManager.getSessionCookieOptions(sessionCookieExpiryTime),\n        );\n\n        cookieStore.delete(SessionManager.getTempSessionCookieName());\n      } catch (error) {\n        logger.error(\n          `[handleOAuthCallbackAction] Failed to create JWT session, continuing with legacy session:\n          ${typeof error === 'string' ? error : JSON.stringify(error)}`,\n        );\n      }\n    }\n\n    const afterSignInUrl: string = config.afterSignInUrl || '/';\n\n    return {\n      redirectUrl: afterSignInUrl,\n      success: true,\n    };\n  } catch (error) {\n    let errorMessage = 'Authentication failed';\n\n    if (error instanceof Error) {\n      errorMessage = error.message;\n    } else if (error && typeof error === 'object' && 'message' in error) {\n      errorMessage = String((error as {message: unknown}).message);\n    } else if (typeof error === 'string') {\n      errorMessage = error;\n    }\n\n    return {\n      error: errorMessage,\n      success: false,\n    };\n  }\n};\n\nexport default handleOAuthCallbackAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAwBA,MAAM,4BAA4B,OAChC,MACA,OACA,iBAKI;AACJ,KAAI;AACF,MAAI,CAAC,QAAQ,CAAC,MACZ,QAAO;GACL,OAAO;GACP,SAAS;GACV;EAGH,MAAM,kBAAkBA,2BAAW;AAEnC,MAAI,CAAC,gBAAgB,cACnB,QAAO;GACL,OAAO;GACP,SAAS;GACV;EAGH,MAAMC,cAA8B,iCAAe;EACnD,IAAIC;EAEJ,MAAMC,mBAAuC,YAAY,IAAIC,+BAAe,0BAA0B,CAAC,EAAE;AAEzG,MAAI,iBACF,KAAI;AAEF,gBADyC,MAAMA,+BAAe,kBAAkB,iBAAiB,EACzE;UAClB;AACN,0BAAO,MACL,wGACD;;AAIL,MAAI,CAAC,WAAW;AACd,0BAAO,MAAM,yFAAyF;AAEtG,UAAO;IACL,OAAO;IACP,SAAS;IACV;;EAIH,MAAMC,eAAwC,MAAM,gBAAgB,OAClE;GACE;GACA,eAAe;GACf;GACD,EACD,EAAE,EACF,UACD;EAED,MAAMC,SAA8B,MAAM,gBAAgB,kBAAkB;AAE5E,MAAI,aACF,KAAI;GACF,MAAMC,UAAmB,MAAM,gBAAgB,kBAC7C,WACC,aAAa,eAAe,aAAa,WAC3C;GACD,MAAMC,cAAuB,aAAa,kBAAkB,aAAa;GACzE,MAAMC,eAAwB,aAAa,mBAA0C;GACrF,MAAMC,kBAA2B,QAAQ,OAAO,aAAa,UAAU;GACvE,MAAMC,SAAiB,aAAa;GACpC,MAAMC,iBAAsC,QAAQ,eAAe,QAAQ;GAG3E,MAAMC,YAAoB,aAAa;GACvC,MAAMC,0BAAkCV,+BAAe,2BACrD,OAAO,eAAe,WACvB;GAED,MAAMW,eAAuB,MAAMX,+BAAe,mBAChD,aACA,iBACA,WACA,QACA,WACA,cACA,eACD;AAED,eAAY,IACVA,+BAAe,sBAAsB,EACrC,cACAA,+BAAe,wBAAwB,wBAAwB,CAChE;AAED,eAAY,OAAOA,+BAAe,0BAA0B,CAAC;WACtD,OAAO;AACd,0BAAO,MACL;YACE,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,MAAM,GAC5D;;AAML,SAAO;GACL,aAH6B,OAAO,kBAAkB;GAItD,SAAS;GACV;UACM,OAAO;EACd,IAAI,eAAe;AAEnB,MAAI,iBAAiB,MACnB,gBAAe,MAAM;WACZ,SAAS,OAAO,UAAU,YAAY,aAAa,MAC5D,gBAAe,OAAQ,MAA6B,QAAQ;WACnD,OAAO,UAAU,SAC1B,gBAAe;AAGjB,SAAO;GACL,OAAO;GACP,SAAS;GACV;;;AAIL,wCAAe"}
+{"version":3,"file":"handleOAuthCallbackAction.cjs","names":["getClient","cookieStore: RequestCookies","sessionId: string | undefined","tempSessionToken: string | undefined","SessionManager","signInResult: Record<string, unknown>","config: ThunderIDNextConfig","idToken: IdToken","accessToken: string","refreshToken: string","userIdFromToken: string","scopes: string","organizationId: string | undefined","expiresIn: number","sessionCookieExpiryTime: number","sessionToken: string"],"sources":["../../../../src/server/actions/handleOAuthCallbackAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {IdToken} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport {setChunkedCookie} from '../../utils/chunkedCookie';\nimport logger from '../../utils/logger';\nimport SessionManager from '../../utils/SessionManager';\nimport getClient from '../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action to handle OAuth callback with authorization code.\n * This action processes the authorization code received from the OAuth provider\n * and exchanges it for tokens to complete the authentication flow.\n *\n * @param code - Authorization code from OAuth provider\n * @param state - State parameter from OAuth provider for CSRF protection\n * @param sessionState - Session state parameter from OAuth provider\n * @returns Promise that resolves with success status and optional error message\n */\nconst handleOAuthCallbackAction = async (\n  code: string,\n  state: string,\n  sessionState?: string,\n): Promise<{\n  error?: string;\n  redirectUrl?: string;\n  success: boolean;\n}> => {\n  try {\n    if (!code || !state) {\n      return {\n        error: 'Missing required OAuth parameters: code and state are required',\n        success: false,\n      };\n    }\n\n    const thunderIDClient = getClient();\n\n    if (!thunderIDClient.isInitialized) {\n      return {\n        error: 'ThunderID client is not initialized',\n        success: false,\n      };\n    }\n\n    const cookieStore: RequestCookies = await cookies();\n    let sessionId: string | undefined;\n\n    const tempSessionToken: string | undefined = cookieStore.get(SessionManager.getTempSessionCookieName())?.value;\n\n    if (tempSessionToken) {\n      try {\n        const tempSession: {sessionId: string} = await SessionManager.verifyTempSession(tempSessionToken);\n        sessionId = tempSession.sessionId;\n      } catch {\n        logger.error(\n          '[handleOAuthCallbackAction] Invalid temporary session token, falling back to session ID from cookies.',\n        );\n      }\n    }\n\n    if (!sessionId) {\n      logger.error('[handleOAuthCallbackAction] No session ID found in cookies or temporary session token.');\n\n      return {\n        error: 'No session found. Please start the authentication flow again.',\n        success: false,\n      };\n    }\n\n    // Exchange the authorization code for tokens\n    const signInResult: Record<string, unknown> = await thunderIDClient.signIn(\n      {\n        code,\n        session_state: sessionState,\n        state,\n      } as any,\n      {},\n      sessionId,\n    );\n\n    const config: ThunderIDNextConfig = await thunderIDClient.getConfiguration();\n\n    if (signInResult) {\n      try {\n        const idToken: IdToken = await thunderIDClient.getDecodedIdToken(\n          sessionId,\n          (signInResult['id_token'] || signInResult['idToken']) as string,\n        );\n        const accessToken: string = (signInResult['accessToken'] || signInResult['access_token']) as string;\n        const refreshToken: string = (signInResult['refreshToken'] as string | undefined) ?? '';\n        const userIdFromToken: string = (idToken.sub || signInResult['sub'] || sessionId) as string;\n        const scopes: string = signInResult['scope'] as string;\n        const organizationId: string | undefined = (idToken['user_org'] || idToken['organization_id']) as\n          | string\n          | undefined;\n        const expiresIn: number = signInResult['expiresIn'] as number;\n        const sessionCookieExpiryTime: number = SessionManager.resolveSessionCookieExpiry(\n          config.sessionCookie?.expiryTime,\n        );\n\n        const sessionToken: string = await SessionManager.createSessionToken(\n          accessToken,\n          userIdFromToken,\n          sessionId,\n          scopes,\n          expiresIn,\n          refreshToken,\n          organizationId,\n        );\n\n        setChunkedCookie(\n          cookieStore,\n          SessionManager.getSessionCookieName(),\n          sessionToken,\n          SessionManager.getSessionCookieOptions(sessionCookieExpiryTime),\n        );\n\n        cookieStore.delete(SessionManager.getTempSessionCookieName());\n      } catch (error) {\n        logger.error(\n          `[handleOAuthCallbackAction] Failed to create JWT session, continuing with legacy session:\n          ${typeof error === 'string' ? error : JSON.stringify(error)}`,\n        );\n      }\n    }\n\n    const afterSignInUrl: string = config.afterSignInUrl || '/';\n\n    return {\n      redirectUrl: afterSignInUrl,\n      success: true,\n    };\n  } catch (error) {\n    let errorMessage = 'Authentication failed';\n\n    if (error instanceof Error) {\n      errorMessage = error.message;\n    } else if (error && typeof error === 'object' && 'message' in error) {\n      errorMessage = String((error as {message: unknown}).message);\n    } else if (typeof error === 'string') {\n      errorMessage = error;\n    }\n\n    return {\n      error: errorMessage,\n      success: false,\n    };\n  }\n};\n\nexport default handleOAuthCallbackAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAyBA,MAAM,4BAA4B,OAChC,MACA,OACA,iBAKI;AACJ,KAAI;AACF,MAAI,CAAC,QAAQ,CAAC,MACZ,QAAO;GACL,OAAO;GACP,SAAS;GACV;EAGH,MAAM,kBAAkBA,2BAAW;AAEnC,MAAI,CAAC,gBAAgB,cACnB,QAAO;GACL,OAAO;GACP,SAAS;GACV;EAGH,MAAMC,cAA8B,iCAAe;EACnD,IAAIC;EAEJ,MAAMC,mBAAuC,YAAY,IAAIC,+BAAe,0BAA0B,CAAC,EAAE;AAEzG,MAAI,iBACF,KAAI;AAEF,gBADyC,MAAMA,+BAAe,kBAAkB,iBAAiB,EACzE;UAClB;AACN,0BAAO,MACL,wGACD;;AAIL,MAAI,CAAC,WAAW;AACd,0BAAO,MAAM,yFAAyF;AAEtG,UAAO;IACL,OAAO;IACP,SAAS;IACV;;EAIH,MAAMC,eAAwC,MAAM,gBAAgB,OAClE;GACE;GACA,eAAe;GACf;GACD,EACD,EAAE,EACF,UACD;EAED,MAAMC,SAA8B,MAAM,gBAAgB,kBAAkB;AAE5E,MAAI,aACF,KAAI;GACF,MAAMC,UAAmB,MAAM,gBAAgB,kBAC7C,WACC,aAAa,eAAe,aAAa,WAC3C;GACD,MAAMC,cAAuB,aAAa,kBAAkB,aAAa;GACzE,MAAMC,eAAwB,aAAa,mBAA0C;GACrF,MAAMC,kBAA2B,QAAQ,OAAO,aAAa,UAAU;GACvE,MAAMC,SAAiB,aAAa;GACpC,MAAMC,iBAAsC,QAAQ,eAAe,QAAQ;GAG3E,MAAMC,YAAoB,aAAa;GACvC,MAAMC,0BAAkCV,+BAAe,2BACrD,OAAO,eAAe,WACvB;GAED,MAAMW,eAAuB,MAAMX,+BAAe,mBAChD,aACA,iBACA,WACA,QACA,WACA,cACA,eACD;AAED,0CACE,aACAA,+BAAe,sBAAsB,EACrC,cACAA,+BAAe,wBAAwB,wBAAwB,CAChE;AAED,eAAY,OAAOA,+BAAe,0BAA0B,CAAC;WACtD,OAAO;AACd,0BAAO,MACL;YACE,OAAO,UAAU,WAAW,QAAQ,KAAK,UAAU,MAAM,GAC5D;;AAML,SAAO;GACL,aAH6B,OAAO,kBAAkB;GAItD,SAAS;GACV;UACM,OAAO;EACd,IAAI,eAAe;AAEnB,MAAI,iBAAiB,MACnB,gBAAe,MAAM;WACZ,SAAS,OAAO,UAAU,YAAY,aAAa,MAC5D,gBAAe,OAAQ,MAA6B,QAAQ;WACnD,OAAO,UAAU,SAC1B,gBAAe;AAGjB,SAAO;GACL,OAAO;GACP,SAAS;GACV;;;AAIL,wCAAe"}

package/dist/cjs/server/actions/refreshToken.cjs

@@ -2,6 +2,7 @@
 
 
 const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.cjs');
+const require_chunkedCookie = require('../../utils/chunkedCookie.cjs');
 const require_SessionManager = require('../../utils/SessionManager.cjs');
 const require_getClient = require('../getClient.cjs');
 const require_handleRefreshToken = require('../../utils/handleRefreshToken.cjs');
@@ -25,7 +26,7 @@ next_headers = require_rolldown_runtime.__toESM(next_headers);
 const refreshToken = async () => {
 	try {
 		const cookieStore = await (0, next_headers.cookies)();
-		const sessionToken = cookieStore.get(require_SessionManager.default.getSessionCookieName())?.value;
+		const sessionToken = require_chunkedCookie.getChunkedCookie(cookieStore, require_SessionManager.default.getSessionCookieName());
 		if (!sessionToken) throw new __thunderid_node.ThunderIDAPIError("No active session found. User must be signed in to refresh the token.", "refreshToken-ServerActionError-002", "nextjs", 401);
 		const sessionPayload = await require_SessionManager.default.verifySessionTokenForRefresh(sessionToken);
 		const config = await require_getClient.default().getConfiguration();
@@ -36,7 +37,7 @@ const refreshToken = async () => {
 			sessionCookie: config.sessionCookie
 		});
 		try {
-			cookieStore.set(require_SessionManager.default.getSessionCookieName(), result.newSessionToken, require_SessionManager.default.getSessionCookieOptions(result.sessionCookieExpiryTime));
+			require_chunkedCookie.setChunkedCookie(cookieStore, require_SessionManager.default.getSessionCookieName(), result.newSessionToken, require_SessionManager.default.getSessionCookieOptions(result.sessionCookieExpiryTime));
 		} catch {
 			__thunderid_node.logger.warn("[refreshToken] Could not write session cookie — called from SSR rendering context.");
 		}
@@ -48,7 +49,7 @@ const refreshToken = async () => {
 		return { expiresAt };
 	} catch (error) {
 		try {
-			(await (0, next_headers.cookies)()).delete(require_SessionManager.default.getSessionCookieName());
+			require_chunkedCookie.deleteChunkedCookie(await (0, next_headers.cookies)(), require_SessionManager.default.getSessionCookieName());
 			__thunderid_node.logger.debug("[refreshToken] Cleared session cookie after refresh failure.");
 		} catch {}
 		throw new __thunderid_node.ThunderIDAPIError(`Failed to refresh the session: ${error instanceof Error ? error.message : JSON.stringify(error)}`, "refreshToken-ServerActionError-001", "nextjs", error instanceof __thunderid_node.ThunderIDAPIError ? error.statusCode : void 0);

package/dist/cjs/server/actions/refreshToken.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"refreshToken.cjs","names":["cookieStore: RequestCookies","sessionToken: string | undefined","SessionManager","ThunderIDAPIError","sessionPayload: SessionTokenPayload","config: ThunderIDNextConfig","getClient","result: HandleRefreshTokenResult","handleRefreshToken","rawExpiresIn: string | undefined","expiresInSeconds: number","expiresAt: number"],"sources":["../../../../src/server/actions/refreshToken.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {ThunderIDAPIError, logger} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport handleRefreshToken, {HandleRefreshTokenResult} from '../../utils/handleRefreshToken';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\nimport getClient from '../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Client-safe result of a token refresh.\n *\n * Intentionally omits accessToken, refreshToken, idToken, and scopes — those stay\n * server-side in the HttpOnly session cookie. Returning tokens from a Server Action\n * serializes them into browser memory, defeating the HttpOnly boundary and exposing\n * them to XSS, browser extensions, and error-tracking SDKs.\n *\n * `expiresAt` is epoch seconds for the new access token; the client uses it to\n * schedule the next refresh.\n */\nexport interface RefreshResult {\n  expiresAt: number;\n}\n\n/**\n * Server action to refresh the access token using the stored refresh token.\n * Exchanges the refresh token for a new token set and updates the session cookie.\n *\n * Delegates the HTTP exchange to handleRefreshToken so the same logic is shared\n * with the middleware token refresh path.\n *\n * Called from the client side (e.g. ThunderIDClientProvider refreshOnMount) where\n * Next.js allows cookie mutation. When invoked during SSR rendering the cookie\n * write is silently skipped and a warning is logged.\n */\nconst refreshToken = async (): Promise<RefreshResult> => {\n  try {\n    const cookieStore: RequestCookies = await cookies();\n    const sessionToken: string | undefined = cookieStore.get(SessionManager.getSessionCookieName())?.value;\n\n    if (!sessionToken) {\n      throw new ThunderIDAPIError(\n        'No active session found. User must be signed in to refresh the token.',\n        'refreshToken-ServerActionError-002',\n        'nextjs',\n        401,\n      );\n    }\n\n    const sessionPayload: SessionTokenPayload = await SessionManager.verifySessionTokenForRefresh(sessionToken);\n    const client = getClient();\n    const config: ThunderIDNextConfig = await client.getConfiguration();\n\n    const result: HandleRefreshTokenResult = await handleRefreshToken(sessionPayload, {\n      baseUrl: config.baseUrl ?? '',\n      clientId: config.clientId ?? '',\n      clientSecret: config.clientSecret ?? '',\n      sessionCookie: config.sessionCookie,\n    });\n\n    try {\n      cookieStore.set(\n        SessionManager.getSessionCookieName(),\n        result.newSessionToken,\n        SessionManager.getSessionCookieOptions(result.sessionCookieExpiryTime),\n      );\n    } catch {\n      // cookies().set() is only permitted inside a Server Action invoked from the client\n      // or a Route Handler. When this action is called during SSR rendering the write\n      // is blocked by Next.js. The middleware refresh path handles that case instead.\n      logger.warn('[refreshToken] Could not write session cookie — called from SSR rendering context.');\n    }\n\n    const rawExpiresIn: string | undefined = result.tokenResponse.expiresIn;\n    const expiresInSeconds: number = parseInt(rawExpiresIn ?? '', 10);\n    if (Number.isNaN(expiresInSeconds)) {\n      throw new Error(`[refreshToken] Invalid expiresIn value received: ${rawExpiresIn}`);\n    }\n    const expiresAt: number = Math.floor(Date.now() / 1000) + expiresInSeconds;\n\n    logger.debug('[refreshToken] Token refresh succeeded.');\n    return {expiresAt};\n  } catch (error) {\n    // Clear the dead session cookie before throwing so the browser is not left\n    // holding a stale credential. This is best-effort — if called from an SSR\n    // rendering context Next.js blocks cookie mutation; the middleware cleanup\n    // path covers that case on the next request.\n    try {\n      const cookieStore: RequestCookies = await cookies();\n      cookieStore.delete(SessionManager.getSessionCookieName());\n      logger.debug('[refreshToken] Cleared session cookie after refresh failure.');\n    } catch {\n      // Intentionally swallowed — middleware handles cleanup when mutation is blocked.\n    }\n\n    throw new ThunderIDAPIError(\n      `Failed to refresh the session: ${error instanceof Error ? error.message : JSON.stringify(error)}`,\n      'refreshToken-ServerActionError-001',\n      'nextjs',\n      error instanceof ThunderIDAPIError ? error.statusCode : undefined,\n    );\n  }\n};\n\nexport default refreshToken;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwCA,MAAM,eAAe,YAAoC;AACvD,KAAI;EACF,MAAMA,cAA8B,iCAAe;EACnD,MAAMC,eAAmC,YAAY,IAAIC,+BAAe,sBAAsB,CAAC,EAAE;AAEjG,MAAI,CAAC,aACH,OAAM,IAAIC,mCACR,yEACA,sCACA,UACA,IACD;EAGH,MAAMC,iBAAsC,MAAMF,+BAAe,6BAA6B,aAAa;EAE3G,MAAMG,SAA8B,MADrBC,2BAAW,CACuB,kBAAkB;EAEnE,MAAMC,SAAmC,MAAMC,mCAAmB,gBAAgB;GAChF,SAAS,OAAO,WAAW;GAC3B,UAAU,OAAO,YAAY;GAC7B,cAAc,OAAO,gBAAgB;GACrC,eAAe,OAAO;GACvB,CAAC;AAEF,MAAI;AACF,eAAY,IACVN,+BAAe,sBAAsB,EACrC,OAAO,iBACPA,+BAAe,wBAAwB,OAAO,wBAAwB,CACvE;UACK;AAIN,2BAAO,KAAK,qFAAqF;;EAGnG,MAAMO,eAAmC,OAAO,cAAc;EAC9D,MAAMC,mBAA2B,SAAS,gBAAgB,IAAI,GAAG;AACjE,MAAI,OAAO,MAAM,iBAAiB,CAChC,OAAM,IAAI,MAAM,oDAAoD,eAAe;EAErF,MAAMC,YAAoB,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK,GAAG;AAE1D,0BAAO,MAAM,0CAA0C;AACvD,SAAO,EAAC,WAAU;UACX,OAAO;AAKd,MAAI;AAEF,IADoC,iCAAe,EACvC,OAAOT,+BAAe,sBAAsB,CAAC;AACzD,2BAAO,MAAM,+DAA+D;UACtE;AAIR,QAAM,IAAIC,mCACR,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,KAAK,UAAU,MAAM,IAChG,sCACA,UACA,iBAAiBA,qCAAoB,MAAM,aAAa,OACzD;;;AAIL,2BAAe"}
+{"version":3,"file":"refreshToken.cjs","names":["cookieStore: RequestCookies","sessionToken: string | undefined","getChunkedCookie","SessionManager","ThunderIDAPIError","sessionPayload: SessionTokenPayload","config: ThunderIDNextConfig","getClient","result: HandleRefreshTokenResult","handleRefreshToken","rawExpiresIn: string | undefined","expiresInSeconds: number","expiresAt: number"],"sources":["../../../../src/server/actions/refreshToken.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {ThunderIDAPIError, logger} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport {deleteChunkedCookie, getChunkedCookie, setChunkedCookie} from '../../utils/chunkedCookie';\nimport handleRefreshToken, {HandleRefreshTokenResult} from '../../utils/handleRefreshToken';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\nimport getClient from '../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Client-safe result of a token refresh.\n *\n * Intentionally omits accessToken, refreshToken, idToken, and scopes — those stay\n * server-side in the HttpOnly session cookie. Returning tokens from a Server Action\n * serializes them into browser memory, defeating the HttpOnly boundary and exposing\n * them to XSS, browser extensions, and error-tracking SDKs.\n *\n * `expiresAt` is epoch seconds for the new access token; the client uses it to\n * schedule the next refresh.\n */\nexport interface RefreshResult {\n  expiresAt: number;\n}\n\n/**\n * Server action to refresh the access token using the stored refresh token.\n * Exchanges the refresh token for a new token set and updates the session cookie.\n *\n * Delegates the HTTP exchange to handleRefreshToken so the same logic is shared\n * with the middleware token refresh path.\n *\n * Called from the client side (e.g. ThunderIDClientProvider refreshOnMount) where\n * Next.js allows cookie mutation. When invoked during SSR rendering the cookie\n * write is silently skipped and a warning is logged.\n */\nconst refreshToken = async (): Promise<RefreshResult> => {\n  try {\n    const cookieStore: RequestCookies = await cookies();\n    const sessionToken: string | undefined = getChunkedCookie(cookieStore, SessionManager.getSessionCookieName());\n\n    if (!sessionToken) {\n      throw new ThunderIDAPIError(\n        'No active session found. User must be signed in to refresh the token.',\n        'refreshToken-ServerActionError-002',\n        'nextjs',\n        401,\n      );\n    }\n\n    const sessionPayload: SessionTokenPayload = await SessionManager.verifySessionTokenForRefresh(sessionToken);\n    const client = getClient();\n    const config: ThunderIDNextConfig = await client.getConfiguration();\n\n    const result: HandleRefreshTokenResult = await handleRefreshToken(sessionPayload, {\n      baseUrl: config.baseUrl ?? '',\n      clientId: config.clientId ?? '',\n      clientSecret: config.clientSecret ?? '',\n      sessionCookie: config.sessionCookie,\n    });\n\n    try {\n      setChunkedCookie(\n        cookieStore,\n        SessionManager.getSessionCookieName(),\n        result.newSessionToken,\n        SessionManager.getSessionCookieOptions(result.sessionCookieExpiryTime),\n      );\n    } catch {\n      // cookies().set() is only permitted inside a Server Action invoked from the client\n      // or a Route Handler. When this action is called during SSR rendering the write\n      // is blocked by Next.js. The middleware refresh path handles that case instead.\n      logger.warn('[refreshToken] Could not write session cookie — called from SSR rendering context.');\n    }\n\n    const rawExpiresIn: string | undefined = result.tokenResponse.expiresIn;\n    const expiresInSeconds: number = parseInt(rawExpiresIn ?? '', 10);\n    if (Number.isNaN(expiresInSeconds)) {\n      throw new Error(`[refreshToken] Invalid expiresIn value received: ${rawExpiresIn}`);\n    }\n    const expiresAt: number = Math.floor(Date.now() / 1000) + expiresInSeconds;\n\n    logger.debug('[refreshToken] Token refresh succeeded.');\n    return {expiresAt};\n  } catch (error) {\n    // Clear the dead session cookie before throwing so the browser is not left\n    // holding a stale credential. This is best-effort — if called from an SSR\n    // rendering context Next.js blocks cookie mutation; the middleware cleanup\n    // path covers that case on the next request.\n    try {\n      const cookieStore: RequestCookies = await cookies();\n      deleteChunkedCookie(cookieStore, SessionManager.getSessionCookieName());\n      logger.debug('[refreshToken] Cleared session cookie after refresh failure.');\n    } catch {\n      // Intentionally swallowed — middleware handles cleanup when mutation is blocked.\n    }\n\n    throw new ThunderIDAPIError(\n      `Failed to refresh the session: ${error instanceof Error ? error.message : JSON.stringify(error)}`,\n      'refreshToken-ServerActionError-001',\n      'nextjs',\n      error instanceof ThunderIDAPIError ? error.statusCode : undefined,\n    );\n  }\n};\n\nexport default refreshToken;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,MAAM,eAAe,YAAoC;AACvD,KAAI;EACF,MAAMA,cAA8B,iCAAe;EACnD,MAAMC,eAAmCC,uCAAiB,aAAaC,+BAAe,sBAAsB,CAAC;AAE7G,MAAI,CAAC,aACH,OAAM,IAAIC,mCACR,yEACA,sCACA,UACA,IACD;EAGH,MAAMC,iBAAsC,MAAMF,+BAAe,6BAA6B,aAAa;EAE3G,MAAMG,SAA8B,MADrBC,2BAAW,CACuB,kBAAkB;EAEnE,MAAMC,SAAmC,MAAMC,mCAAmB,gBAAgB;GAChF,SAAS,OAAO,WAAW;GAC3B,UAAU,OAAO,YAAY;GAC7B,cAAc,OAAO,gBAAgB;GACrC,eAAe,OAAO;GACvB,CAAC;AAEF,MAAI;AACF,0CACE,aACAN,+BAAe,sBAAsB,EACrC,OAAO,iBACPA,+BAAe,wBAAwB,OAAO,wBAAwB,CACvE;UACK;AAIN,2BAAO,KAAK,qFAAqF;;EAGnG,MAAMO,eAAmC,OAAO,cAAc;EAC9D,MAAMC,mBAA2B,SAAS,gBAAgB,IAAI,GAAG;AACjE,MAAI,OAAO,MAAM,iBAAiB,CAChC,OAAM,IAAI,MAAM,oDAAoD,eAAe;EAErF,MAAMC,YAAoB,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK,GAAG;AAE1D,0BAAO,MAAM,0CAA0C;AACvD,SAAO,EAAC,WAAU;UACX,OAAO;AAKd,MAAI;AAEF,6CADoC,iCAAe,EAClBT,+BAAe,sBAAsB,CAAC;AACvE,2BAAO,MAAM,+DAA+D;UACtE;AAIR,QAAM,IAAIC,mCACR,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,KAAK,UAAU,MAAM,IAChG,sCACA,UACA,iBAAiBA,qCAAoB,MAAM,aAAa,OACzD;;;AAIL,2BAAe"}

package/dist/cjs/server/actions/signInAction.cjs

@@ -2,6 +2,7 @@
 
 
 const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.cjs');
+const require_chunkedCookie = require('../../utils/chunkedCookie.cjs');
 const require_SessionManager = require('../../utils/SessionManager.cjs');
 const require_getClient = require('../getClient.cjs');
 const require_logger = require('../../utils/logger.cjs');
@@ -24,7 +25,7 @@ const signInAction = async (payload, request) => {
 		const client = require_getClient.default();
 		const cookieStore = await (0, next_headers.cookies)();
 		let sessionId;
-		const existingSessionToken = cookieStore.get(require_SessionManager.default.getSessionCookieName())?.value;
+		const existingSessionToken = require_chunkedCookie.getChunkedCookie(cookieStore, require_SessionManager.default.getSessionCookieName());
 		if (existingSessionToken) try {
 			sessionId = (await require_SessionManager.default.verifySessionToken(existingSessionToken)).sessionId;
 		} catch {}
@@ -59,7 +60,7 @@ const signInAction = async (payload, request) => {
 			const config = await client.getConfiguration();
 			const sessionCookieExpiryTime = require_SessionManager.default.resolveSessionCookieExpiry(config.sessionCookie?.expiryTime);
 			const sessionToken = await require_SessionManager.default.createSessionToken(response.assertion, userIdFromToken, sessionId, scopes, expiresIn, "", organizationId);
-			cookieStore.set(require_SessionManager.default.getSessionCookieName(), sessionToken, require_SessionManager.default.getSessionCookieOptions(sessionCookieExpiryTime));
+			require_chunkedCookie.setChunkedCookie(cookieStore, require_SessionManager.default.getSessionCookieName(), sessionToken, require_SessionManager.default.getSessionCookieOptions(sessionCookieExpiryTime));
 			cookieStore.delete(require_SessionManager.default.getTempSessionCookieName());
 			const afterSignInUrl = await (await client.getStorageManager()).getConfigDataParameter("afterSignInUrl");
 			return {

package/dist/cjs/server/actions/signInAction.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"signInAction.cjs","names":["getClient","cookieStore: RequestCookies","sessionId: string | undefined","existingSessionToken: string | undefined","SessionManager","tempSessionToken: string | undefined","tempSessionToken: string","defaultSignInUrl: string","response: any","EmbeddedSignInFlowStatus","idToken: IdToken","userIdFromToken: string","organizationId: string | undefined","scopes: string","iat: number","exp: number","expiresIn: number","config: ThunderIDNextConfig","sessionCookieExpiryTime: number","sessionToken: string","afterSignInUrl: string"],"sources":["../../../../src/server/actions/signInAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {\n  generateSessionId,\n  EmbeddedSignInFlowStatus,\n  EmbeddedFlowExecuteRequestConfig,\n  IdToken,\n  isEmpty,\n} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport logger from '../../utils/logger';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\nimport getClient from '../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action for signing in a user.\n * Handles the embedded sign-in flow and manages session cookies.\n *\n * @param payload - The embedded sign-in flow payload\n * @param request - The embedded flow execute request config\n * @returns Promise that resolves when sign-in is complete\n */\nconst signInAction = async (\n  payload?: any,\n  request?: EmbeddedFlowExecuteRequestConfig,\n): Promise<{\n  data?:\n    | {\n        afterSignInUrl?: string;\n        signInUrl?: string;\n      }\n    | Record<string, unknown>;\n  error?: string;\n  success: boolean;\n}> => {\n  try {\n    const client = getClient();\n    const cookieStore: RequestCookies = await cookies();\n\n    let sessionId: string | undefined;\n\n    const existingSessionToken: string | undefined = cookieStore.get(SessionManager.getSessionCookieName())?.value;\n\n    if (existingSessionToken) {\n      try {\n        const sessionPayload: SessionTokenPayload = await SessionManager.verifySessionToken(existingSessionToken);\n        sessionId = sessionPayload.sessionId;\n      } catch {\n        // Invalid session token, will create new temp session\n      }\n    }\n\n    if (!sessionId) {\n      const tempSessionToken: string | undefined = cookieStore.get(SessionManager.getTempSessionCookieName())?.value;\n\n      if (tempSessionToken) {\n        try {\n          const tempSession: {sessionId: string} = await SessionManager.verifyTempSession(tempSessionToken);\n          sessionId = tempSession.sessionId;\n        } catch {\n          // Invalid temp session, will create new one\n        }\n      }\n    }\n\n    if (!sessionId) {\n      sessionId = generateSessionId();\n\n      const tempSessionToken: string = await SessionManager.createTempSession(sessionId);\n\n      cookieStore.set(\n        SessionManager.getTempSessionCookieName(),\n        tempSessionToken,\n        SessionManager.getTempSessionCookieOptions(),\n      );\n    }\n\n    // If no payload provided, redirect to sign-in URL for redirect-based sign-in.\n    if (!payload || isEmpty(payload)) {\n      const defaultSignInUrl: string = await client.getAuthorizeRequestUrl({}, sessionId);\n      return {data: {signInUrl: String(defaultSignInUrl)}, success: true};\n    }\n\n    // Handle embedded sign-in flow\n    const response: any = await client.signIn(payload, request!, sessionId);\n\n    if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {\n      // On the V2 platform, a completed embedded flow (without a preceding `/authorize` redirect,\n      // i.e. no `authId`) returns a self-contained JWT `assertion` rather than an authorization\n      // code to exchange. This mirrors how @thunderid/react and @thunderid/vue treat it: the\n      // assertion is used directly as the bearer session token.\n      if (!response.assertion) {\n        throw new Error('[signInAction] Flow completed without an assertion.');\n      }\n\n      const idToken: IdToken = await client.getDecodedIdToken(sessionId, response.assertion);\n      const userIdFromToken: string = (idToken.sub as string | undefined) ?? sessionId;\n      const organizationId: string | undefined = (idToken['user_org'] || idToken['organization_id']) as\n        | string\n        | undefined;\n      const scopes: string = (idToken['scope'] as string | undefined) ?? '';\n      const iat: number = (idToken['iat'] as number | undefined) ?? Math.floor(Date.now() / 1000);\n      const exp: number = (idToken['exp'] as number | undefined) ?? iat + 3600;\n      const expiresIn: number = Math.max(exp - iat, 0);\n\n      const config: ThunderIDNextConfig = await client.getConfiguration();\n      const sessionCookieExpiryTime: number = SessionManager.resolveSessionCookieExpiry(\n        config.sessionCookie?.expiryTime,\n      );\n\n      const sessionToken: string = await SessionManager.createSessionToken(\n        response.assertion,\n        userIdFromToken,\n        sessionId,\n        scopes,\n        expiresIn,\n        '',\n        organizationId,\n      );\n\n      cookieStore.set(\n        SessionManager.getSessionCookieName(),\n        sessionToken,\n        SessionManager.getSessionCookieOptions(sessionCookieExpiryTime),\n      );\n\n      cookieStore.delete(SessionManager.getTempSessionCookieName());\n\n      const afterSignInUrl: string = await (await client.getStorageManager()).getConfigDataParameter('afterSignInUrl');\n      return {data: {afterSignInUrl: String(afterSignInUrl)}, success: true};\n    }\n\n    return {data: response as Record<string, unknown>, success: true};\n  } catch (error) {\n    const message =\n      error instanceof Error\n        ? error.message\n        : typeof (error as any)?.message === 'string'\n          ? (error as any).message\n          : String(error);\n    logger.error(`[signInAction] Error during sign-in: ${message}`);\n    return {error: message, success: false};\n  }\n};\n\nexport default signInAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA4BA,MAAM,eAAe,OACnB,SACA,YAUI;AACJ,KAAI;EACF,MAAM,SAASA,2BAAW;EAC1B,MAAMC,cAA8B,iCAAe;EAEnD,IAAIC;EAEJ,MAAMC,uBAA2C,YAAY,IAAIC,+BAAe,sBAAsB,CAAC,EAAE;AAEzG,MAAI,qBACF,KAAI;AAEF,gBAD4C,MAAMA,+BAAe,mBAAmB,qBAAqB,EAC9E;UACrB;AAKV,MAAI,CAAC,WAAW;GACd,MAAMC,mBAAuC,YAAY,IAAID,+BAAe,0BAA0B,CAAC,EAAE;AAEzG,OAAI,iBACF,KAAI;AAEF,iBADyC,MAAMA,+BAAe,kBAAkB,iBAAiB,EACzE;WAClB;;AAMZ,MAAI,CAAC,WAAW;AACd,wDAA+B;GAE/B,MAAME,mBAA2B,MAAMF,+BAAe,kBAAkB,UAAU;AAElF,eAAY,IACVA,+BAAe,0BAA0B,EACzC,kBACAA,+BAAe,6BAA6B,CAC7C;;AAIH,MAAI,CAAC,yCAAmB,QAAQ,EAAE;GAChC,MAAMG,mBAA2B,MAAM,OAAO,uBAAuB,EAAE,EAAE,UAAU;AACnF,UAAO;IAAC,MAAM,EAAC,WAAW,OAAO,iBAAiB,EAAC;IAAE,SAAS;IAAK;;EAIrE,MAAMC,WAAgB,MAAM,OAAO,OAAO,SAAS,SAAU,UAAU;AAEvE,MAAI,SAAS,eAAeC,0CAAyB,UAAU;AAK7D,OAAI,CAAC,SAAS,UACZ,OAAM,IAAI,MAAM,sDAAsD;GAGxE,MAAMC,UAAmB,MAAM,OAAO,kBAAkB,WAAW,SAAS,UAAU;GACtF,MAAMC,kBAA2B,QAAQ,OAA8B;GACvE,MAAMC,iBAAsC,QAAQ,eAAe,QAAQ;GAG3E,MAAMC,SAAkB,QAAQ,YAAmC;GACnE,MAAMC,MAAe,QAAQ,UAAiC,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;GAC3F,MAAMC,MAAe,QAAQ,UAAiC,MAAM;GACpE,MAAMC,YAAoB,KAAK,IAAI,MAAM,KAAK,EAAE;GAEhD,MAAMC,SAA8B,MAAM,OAAO,kBAAkB;GACnE,MAAMC,0BAAkCd,+BAAe,2BACrD,OAAO,eAAe,WACvB;GAED,MAAMe,eAAuB,MAAMf,+BAAe,mBAChD,SAAS,WACT,iBACA,WACA,QACA,WACA,IACA,eACD;AAED,eAAY,IACVA,+BAAe,sBAAsB,EACrC,cACAA,+BAAe,wBAAwB,wBAAwB,CAChE;AAED,eAAY,OAAOA,+BAAe,0BAA0B,CAAC;GAE7D,MAAMgB,iBAAyB,OAAO,MAAM,OAAO,mBAAmB,EAAE,uBAAuB,iBAAiB;AAChH,UAAO;IAAC,MAAM,EAAC,gBAAgB,OAAO,eAAe,EAAC;IAAE,SAAS;IAAK;;AAGxE,SAAO;GAAC,MAAM;GAAqC,SAAS;GAAK;UAC1D,OAAO;EACd,MAAM,UACJ,iBAAiB,QACb,MAAM,UACN,OAAQ,OAAe,YAAY,WAChC,MAAc,UACf,OAAO,MAAM;AACrB,yBAAO,MAAM,wCAAwC,UAAU;AAC/D,SAAO;GAAC,OAAO;GAAS,SAAS;GAAM;;;AAI3C,2BAAe"}
+{"version":3,"file":"signInAction.cjs","names":["getClient","cookieStore: RequestCookies","sessionId: string | undefined","existingSessionToken: string | undefined","getChunkedCookie","SessionManager","tempSessionToken: string | undefined","tempSessionToken: string","defaultSignInUrl: string","response: any","EmbeddedSignInFlowStatus","idToken: IdToken","userIdFromToken: string","organizationId: string | undefined","scopes: string","iat: number","exp: number","expiresIn: number","config: ThunderIDNextConfig","sessionCookieExpiryTime: number","sessionToken: string","afterSignInUrl: string"],"sources":["../../../../src/server/actions/signInAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {\n  generateSessionId,\n  EmbeddedSignInFlowStatus,\n  EmbeddedFlowExecuteRequestConfig,\n  IdToken,\n  isEmpty,\n} from '@thunderid/node';\nimport {cookies} from 'next/headers';\nimport {ThunderIDNextConfig} from '../../models/config';\nimport {getChunkedCookie, setChunkedCookie} from '../../utils/chunkedCookie';\nimport logger from '../../utils/logger';\nimport SessionManager, {SessionTokenPayload} from '../../utils/SessionManager';\nimport getClient from '../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action for signing in a user.\n * Handles the embedded sign-in flow and manages session cookies.\n *\n * @param payload - The embedded sign-in flow payload\n * @param request - The embedded flow execute request config\n * @returns Promise that resolves when sign-in is complete\n */\nconst signInAction = async (\n  payload?: any,\n  request?: EmbeddedFlowExecuteRequestConfig,\n): Promise<{\n  data?:\n    | {\n        afterSignInUrl?: string;\n        signInUrl?: string;\n      }\n    | Record<string, unknown>;\n  error?: string;\n  success: boolean;\n}> => {\n  try {\n    const client = getClient();\n    const cookieStore: RequestCookies = await cookies();\n\n    let sessionId: string | undefined;\n\n    const existingSessionToken: string | undefined = getChunkedCookie(\n      cookieStore,\n      SessionManager.getSessionCookieName(),\n    );\n\n    if (existingSessionToken) {\n      try {\n        const sessionPayload: SessionTokenPayload = await SessionManager.verifySessionToken(existingSessionToken);\n        sessionId = sessionPayload.sessionId;\n      } catch {\n        // Invalid session token, will create new temp session\n      }\n    }\n\n    if (!sessionId) {\n      const tempSessionToken: string | undefined = cookieStore.get(SessionManager.getTempSessionCookieName())?.value;\n\n      if (tempSessionToken) {\n        try {\n          const tempSession: {sessionId: string} = await SessionManager.verifyTempSession(tempSessionToken);\n          sessionId = tempSession.sessionId;\n        } catch {\n          // Invalid temp session, will create new one\n        }\n      }\n    }\n\n    if (!sessionId) {\n      sessionId = generateSessionId();\n\n      const tempSessionToken: string = await SessionManager.createTempSession(sessionId);\n\n      cookieStore.set(\n        SessionManager.getTempSessionCookieName(),\n        tempSessionToken,\n        SessionManager.getTempSessionCookieOptions(),\n      );\n    }\n\n    // If no payload provided, redirect to sign-in URL for redirect-based sign-in.\n    if (!payload || isEmpty(payload)) {\n      const defaultSignInUrl: string = await client.getAuthorizeRequestUrl({}, sessionId);\n      return {data: {signInUrl: String(defaultSignInUrl)}, success: true};\n    }\n\n    // Handle embedded sign-in flow\n    const response: any = await client.signIn(payload, request!, sessionId);\n\n    if (response.flowStatus === EmbeddedSignInFlowStatus.Complete) {\n      // On the V2 platform, a completed embedded flow (without a preceding `/authorize` redirect,\n      // i.e. no `authId`) returns a self-contained JWT `assertion` rather than an authorization\n      // code to exchange. This mirrors how @thunderid/react and @thunderid/vue treat it: the\n      // assertion is used directly as the bearer session token.\n      if (!response.assertion) {\n        throw new Error('[signInAction] Flow completed without an assertion.');\n      }\n\n      const idToken: IdToken = await client.getDecodedIdToken(sessionId, response.assertion);\n      const userIdFromToken: string = (idToken.sub as string | undefined) ?? sessionId;\n      const organizationId: string | undefined = (idToken['user_org'] || idToken['organization_id']) as\n        | string\n        | undefined;\n      const scopes: string = (idToken['scope'] as string | undefined) ?? '';\n      const iat: number = (idToken['iat'] as number | undefined) ?? Math.floor(Date.now() / 1000);\n      const exp: number = (idToken['exp'] as number | undefined) ?? iat + 3600;\n      const expiresIn: number = Math.max(exp - iat, 0);\n\n      const config: ThunderIDNextConfig = await client.getConfiguration();\n      const sessionCookieExpiryTime: number = SessionManager.resolveSessionCookieExpiry(\n        config.sessionCookie?.expiryTime,\n      );\n\n      const sessionToken: string = await SessionManager.createSessionToken(\n        response.assertion,\n        userIdFromToken,\n        sessionId,\n        scopes,\n        expiresIn,\n        '',\n        organizationId,\n      );\n\n      setChunkedCookie(\n        cookieStore,\n        SessionManager.getSessionCookieName(),\n        sessionToken,\n        SessionManager.getSessionCookieOptions(sessionCookieExpiryTime),\n      );\n\n      cookieStore.delete(SessionManager.getTempSessionCookieName());\n\n      const afterSignInUrl: string = await (await client.getStorageManager()).getConfigDataParameter('afterSignInUrl');\n      return {data: {afterSignInUrl: String(afterSignInUrl)}, success: true};\n    }\n\n    return {data: response as Record<string, unknown>, success: true};\n  } catch (error) {\n    const message =\n      error instanceof Error\n        ? error.message\n        : typeof (error as any)?.message === 'string'\n          ? (error as any).message\n          : String(error);\n    logger.error(`[signInAction] Error during sign-in: ${message}`);\n    return {error: message, success: false};\n  }\n};\n\nexport default signInAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA6BA,MAAM,eAAe,OACnB,SACA,YAUI;AACJ,KAAI;EACF,MAAM,SAASA,2BAAW;EAC1B,MAAMC,cAA8B,iCAAe;EAEnD,IAAIC;EAEJ,MAAMC,uBAA2CC,uCAC/C,aACAC,+BAAe,sBAAsB,CACtC;AAED,MAAI,qBACF,KAAI;AAEF,gBAD4C,MAAMA,+BAAe,mBAAmB,qBAAqB,EAC9E;UACrB;AAKV,MAAI,CAAC,WAAW;GACd,MAAMC,mBAAuC,YAAY,IAAID,+BAAe,0BAA0B,CAAC,EAAE;AAEzG,OAAI,iBACF,KAAI;AAEF,iBADyC,MAAMA,+BAAe,kBAAkB,iBAAiB,EACzE;WAClB;;AAMZ,MAAI,CAAC,WAAW;AACd,wDAA+B;GAE/B,MAAME,mBAA2B,MAAMF,+BAAe,kBAAkB,UAAU;AAElF,eAAY,IACVA,+BAAe,0BAA0B,EACzC,kBACAA,+BAAe,6BAA6B,CAC7C;;AAIH,MAAI,CAAC,yCAAmB,QAAQ,EAAE;GAChC,MAAMG,mBAA2B,MAAM,OAAO,uBAAuB,EAAE,EAAE,UAAU;AACnF,UAAO;IAAC,MAAM,EAAC,WAAW,OAAO,iBAAiB,EAAC;IAAE,SAAS;IAAK;;EAIrE,MAAMC,WAAgB,MAAM,OAAO,OAAO,SAAS,SAAU,UAAU;AAEvE,MAAI,SAAS,eAAeC,0CAAyB,UAAU;AAK7D,OAAI,CAAC,SAAS,UACZ,OAAM,IAAI,MAAM,sDAAsD;GAGxE,MAAMC,UAAmB,MAAM,OAAO,kBAAkB,WAAW,SAAS,UAAU;GACtF,MAAMC,kBAA2B,QAAQ,OAA8B;GACvE,MAAMC,iBAAsC,QAAQ,eAAe,QAAQ;GAG3E,MAAMC,SAAkB,QAAQ,YAAmC;GACnE,MAAMC,MAAe,QAAQ,UAAiC,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;GAC3F,MAAMC,MAAe,QAAQ,UAAiC,MAAM;GACpE,MAAMC,YAAoB,KAAK,IAAI,MAAM,KAAK,EAAE;GAEhD,MAAMC,SAA8B,MAAM,OAAO,kBAAkB;GACnE,MAAMC,0BAAkCd,+BAAe,2BACrD,OAAO,eAAe,WACvB;GAED,MAAMe,eAAuB,MAAMf,+BAAe,mBAChD,SAAS,WACT,iBACA,WACA,QACA,WACA,IACA,eACD;AAED,0CACE,aACAA,+BAAe,sBAAsB,EACrC,cACAA,+BAAe,wBAAwB,wBAAwB,CAChE;AAED,eAAY,OAAOA,+BAAe,0BAA0B,CAAC;GAE7D,MAAMgB,iBAAyB,OAAO,MAAM,OAAO,mBAAmB,EAAE,uBAAuB,iBAAiB;AAChH,UAAO;IAAC,MAAM,EAAC,gBAAgB,OAAO,eAAe,EAAC;IAAE,SAAS;IAAK;;AAGxE,SAAO;GAAC,MAAM;GAAqC,SAAS;GAAK;UAC1D,OAAO;EACd,MAAM,UACJ,iBAAiB,QACb,MAAM,UACN,OAAQ,OAAe,YAAY,WAChC,MAAc,UACf,OAAO,MAAM;AACrB,yBAAO,MAAM,wCAAwC,UAAU;AAC/D,SAAO;GAAC,OAAO;GAAS,SAAS;GAAM;;;AAI3C,2BAAe"}

package/dist/cjs/server/actions/signOutAction.cjs

@@ -2,6 +2,7 @@
 
 
 const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.cjs');
+const require_chunkedCookie = require('../../utils/chunkedCookie.cjs');
 const require_SessionManager = require('../../utils/SessionManager.cjs');
 const require_getSessionId = require('./getSessionId.cjs');
 const require_getClient = require('../getClient.cjs');
@@ -20,7 +21,7 @@ const signOutAction = async () => {
 	require_logger.default.debug("[signOutAction] Initiating sign out process from the server action.");
 	const clearSessionCookies = async () => {
 		const cookieStore = await (0, next_headers.cookies)();
-		cookieStore.delete(require_SessionManager.default.getSessionCookieName());
+		require_chunkedCookie.deleteChunkedCookie(cookieStore, require_SessionManager.default.getSessionCookieName());
 		cookieStore.delete(require_SessionManager.default.getTempSessionCookieName());
 	};
 	try {

package/dist/cjs/server/actions/signOutAction.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"signOutAction.cjs","names":["cookieStore: RequestCookies","SessionManager","getClient","sessionId: string | undefined","getSessionId","errorMessage: unknown"],"sources":["../../../../src/server/actions/signOutAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {cookies} from 'next/headers';\nimport getSessionId from './getSessionId';\nimport logger from '../../utils/logger';\nimport SessionManager from '../../utils/SessionManager';\nimport getClient from '../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action for signing out a user.\n * Clears both JWT and legacy session cookies.\n *\n * @returns Promise that resolves with success status and optional after sign-out URL\n */\nconst signOutAction = async (): Promise<{data?: {afterSignOutUrl?: string}; error?: unknown; success: boolean}> => {\n  logger.debug('[signOutAction] Initiating sign out process from the server action.');\n\n  const clearSessionCookies = async (): Promise<void> => {\n    const cookieStore: RequestCookies = await cookies();\n\n    cookieStore.delete(SessionManager.getSessionCookieName());\n    cookieStore.delete(SessionManager.getTempSessionCookieName());\n  };\n\n  try {\n    const client = getClient();\n    const sessionId: string | undefined = await getSessionId();\n\n    let afterSignOutUrl = '/';\n\n    if (sessionId) {\n      logger.debug('[signOutAction] Session ID found, invoking the `signOut` to obtain the `afterSignOutUrl`.');\n\n      afterSignOutUrl = await client.signOut({}, sessionId);\n    }\n\n    await clearSessionCookies();\n\n    return {data: {afterSignOutUrl}, success: true};\n  } catch (error) {\n    logger.error('[signOutAction] Error during sign out from the server action:', error);\n\n    logger.debug('[signOutAction] Clearing session cookies due to error as a fallback.');\n\n    await clearSessionCookies();\n\n    let errorMessage: unknown;\n    if (typeof error === 'string') {\n      errorMessage = error;\n    } else if (error instanceof Error) {\n      errorMessage = error.message;\n    } else {\n      errorMessage = JSON.stringify(error);\n    }\n\n    return {\n      error: errorMessage,\n      success: false,\n    };\n  }\n};\n\nexport default signOutAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAmBA,MAAM,gBAAgB,YAA6F;AACjH,wBAAO,MAAM,sEAAsE;CAEnF,MAAM,sBAAsB,YAA2B;EACrD,MAAMA,cAA8B,iCAAe;AAEnD,cAAY,OAAOC,+BAAe,sBAAsB,CAAC;AACzD,cAAY,OAAOA,+BAAe,0BAA0B,CAAC;;AAG/D,KAAI;EACF,MAAM,SAASC,2BAAW;EAC1B,MAAMC,YAAgC,MAAMC,8BAAc;EAE1D,IAAI,kBAAkB;AAEtB,MAAI,WAAW;AACb,0BAAO,MAAM,4FAA4F;AAEzG,qBAAkB,MAAM,OAAO,QAAQ,EAAE,EAAE,UAAU;;AAGvD,QAAM,qBAAqB;AAE3B,SAAO;GAAC,MAAM,EAAC,iBAAgB;GAAE,SAAS;GAAK;UACxC,OAAO;AACd,yBAAO,MAAM,iEAAiE,MAAM;AAEpF,yBAAO,MAAM,uEAAuE;AAEpF,QAAM,qBAAqB;EAE3B,IAAIC;AACJ,MAAI,OAAO,UAAU,SACnB,gBAAe;WACN,iBAAiB,MAC1B,gBAAe,MAAM;MAErB,gBAAe,KAAK,UAAU,MAAM;AAGtC,SAAO;GACL,OAAO;GACP,SAAS;GACV;;;AAIL,4BAAe"}
+{"version":3,"file":"signOutAction.cjs","names":["cookieStore: RequestCookies","SessionManager","getClient","sessionId: string | undefined","getSessionId","errorMessage: unknown"],"sources":["../../../../src/server/actions/signOutAction.ts"],"sourcesContent":["// Copyright 2025 The ThunderID Authors\n// SPDX-License-Identifier: Apache-2.0\n\n'use server';\n\nimport {cookies} from 'next/headers';\nimport getSessionId from './getSessionId';\nimport {deleteChunkedCookie} from '../../utils/chunkedCookie';\nimport logger from '../../utils/logger';\nimport SessionManager from '../../utils/SessionManager';\nimport getClient from '../getClient';\n\ntype RequestCookies = Awaited<ReturnType<typeof cookies>>;\n\n/**\n * Server action for signing out a user.\n * Clears both JWT and legacy session cookies.\n *\n * @returns Promise that resolves with success status and optional after sign-out URL\n */\nconst signOutAction = async (): Promise<{data?: {afterSignOutUrl?: string}; error?: unknown; success: boolean}> => {\n  logger.debug('[signOutAction] Initiating sign out process from the server action.');\n\n  const clearSessionCookies = async (): Promise<void> => {\n    const cookieStore: RequestCookies = await cookies();\n\n    deleteChunkedCookie(cookieStore, SessionManager.getSessionCookieName());\n    cookieStore.delete(SessionManager.getTempSessionCookieName());\n  };\n\n  try {\n    const client = getClient();\n    const sessionId: string | undefined = await getSessionId();\n\n    let afterSignOutUrl = '/';\n\n    if (sessionId) {\n      logger.debug('[signOutAction] Session ID found, invoking the `signOut` to obtain the `afterSignOutUrl`.');\n\n      afterSignOutUrl = await client.signOut({}, sessionId);\n    }\n\n    await clearSessionCookies();\n\n    return {data: {afterSignOutUrl}, success: true};\n  } catch (error) {\n    logger.error('[signOutAction] Error during sign out from the server action:', error);\n\n    logger.debug('[signOutAction] Clearing session cookies due to error as a fallback.');\n\n    await clearSessionCookies();\n\n    let errorMessage: unknown;\n    if (typeof error === 'string') {\n      errorMessage = error;\n    } else if (error instanceof Error) {\n      errorMessage = error.message;\n    } else {\n      errorMessage = JSON.stringify(error);\n    }\n\n    return {\n      error: errorMessage,\n      success: false,\n    };\n  }\n};\n\nexport default signOutAction;\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAoBA,MAAM,gBAAgB,YAA6F;AACjH,wBAAO,MAAM,sEAAsE;CAEnF,MAAM,sBAAsB,YAA2B;EACrD,MAAMA,cAA8B,iCAAe;AAEnD,4CAAoB,aAAaC,+BAAe,sBAAsB,CAAC;AACvE,cAAY,OAAOA,+BAAe,0BAA0B,CAAC;;AAG/D,KAAI;EACF,MAAM,SAASC,2BAAW;EAC1B,MAAMC,YAAgC,MAAMC,8BAAc;EAE1D,IAAI,kBAAkB;AAEtB,MAAI,WAAW;AACb,0BAAO,MAAM,4FAA4F;AAEzG,qBAAkB,MAAM,OAAO,QAAQ,EAAE,EAAE,UAAU;;AAGvD,QAAM,qBAAqB;AAE3B,SAAO;GAAC,MAAM,EAAC,iBAAgB;GAAE,SAAS;GAAK;UACxC,OAAO;AACd,yBAAO,MAAM,iEAAiE,MAAM;AAEpF,yBAAO,MAAM,uEAAuE;AAEpF,QAAM,qBAAqB;EAE3B,IAAIC;AACJ,MAAI,OAAO,UAAU,SACnB,gBAAe;WACN,iBAAiB,MAC1B,gBAAe,MAAM;MAErB,gBAAe,KAAK,UAAU,MAAM;AAGtC,SAAO;GACL,OAAO;GACP,SAAS;GACV;;;AAIL,4BAAe"}

package/dist/cjs/server/index.cjs

@@ -5,5 +5,7 @@ const require_createRouteMatcher = require('./proxy/createRouteMatcher.cjs');
 
 exports.ThunderIDProvider = require_ThunderIDProvider.default;
 exports.createRouteMatcher = require_createRouteMatcher.default;
+exports.removeChunkedCookieFromHeader = require_thunderIDProxy.removeChunkedCookieFromHeader;
+exports.replaceChunkedCookieInHeader = require_thunderIDProxy.replaceChunkedCookieInHeader;
 exports.thunderIDProxy = require_thunderIDProxy.default;
 exports.thunderid = require_thunderid.default;

package/dist/cjs/server/proxy/thunderIDProxy.cjs

@@ -1,39 +1,63 @@
 const require_rolldown_runtime = require('../../_virtual/rolldown_runtime.cjs');
+const require_chunkedCookie = require('../../utils/chunkedCookie.cjs');
 const require_sessionConstants = require('../../constants/sessionConstants.cjs');
 const require_SessionManager = require('../../utils/SessionManager.cjs');
 const require_decorateConfigWithNextEnv = require('../../utils/decorateConfigWithNextEnv.cjs');
 const require_handleRefreshToken = require('../../utils/handleRefreshToken.cjs');
 const require_sessionUtils = require('../../utils/sessionUtils.cjs');
+let __thunderid_node = require("@thunderid/node");
+__thunderid_node = require_rolldown_runtime.__toESM(__thunderid_node);
 let next_server = require("next/server");
 next_server = require_rolldown_runtime.__toESM(next_server);
 
 //#region src/server/proxy/thunderIDProxy.ts
 /**
-* Removes a named cookie from a raw Cookie header string.
+* Splits a raw Cookie header string into its `{name, part}` entries, where
+* `part` is the original `name=value` text (trimmed, never empty).
 */
-const removeCookieFromHeader = (cookieHeader, name) => cookieHeader.split(";").map((p) => p.trim()).filter((p) => {
-	const eqIdx = p.indexOf("=");
-	return (eqIdx === -1 ? p : p.slice(0, eqIdx).trim()) !== name;
-}).join("; ");
+const parseCookieHeaderParts = (cookieHeader) => cookieHeader.split(";").map((p) => p.trim()).filter(Boolean).map((part) => {
+	const eqIdx = part.indexOf("=");
+	return {
+		name: eqIdx === -1 ? part : part.slice(0, eqIdx).trim(),
+		part
+	};
+});
 /**
-* Replaces the value of a named cookie inside a raw Cookie header string.
-* If the cookie does not already appear in the header it is appended.
+* Removes a cookie from a raw Cookie header string — the unchunked `name`
+* entry and/or any numbered `${name}.0`, `${name}.1`, ... chunk entries.
 */
-const replaceCookieInHeader = (cookieHeader, name, value) => {
-	const parts = cookieHeader.split(";").map((p) => p.trim()).filter(Boolean);
-	let found = false;
-	const updated = parts.map((part) => {
-		const eqIdx = part.indexOf("=");
-		if ((eqIdx === -1 ? part : part.slice(0, eqIdx).trim()) === name) {
-			found = true;
-			return `${name}=${value}`;
-		}
-		return part;
-	});
-	if (!found) updated.push(`${name}=${value}`);
-	return updated.join("; ");
+const removeChunkedCookieFromHeader = (cookieHeader, name) => {
+	const entries = parseCookieHeaderParts(cookieHeader);
+	const toRemove = new Set(__thunderid_node.CookieChunking.filterChunkNames(name, entries.map((e) => e.name)));
+	return entries.filter((e) => !toRemove.has(e.name)).map((e) => e.part).join("; ");
+};
+/**
+* Replaces a cookie's value inside a raw Cookie header string, splitting it
+* across numbered `${name}.0`, `${name}.1`, ... chunk entries once it would
+* exceed the ~4KB per-cookie limit browsers enforce. Any entry the cookie
+* doesn't appear in yet is appended; stale chunk entries a shrunk value no
+* longer needs are dropped.
+*/
+const replaceChunkedCookieInHeader = (cookieHeader, name, value) => {
+	const remaining = parseCookieHeaderParts(removeChunkedCookieFromHeader(cookieHeader, name)).map((e) => e.part);
+	const newParts = Object.entries(__thunderid_node.CookieChunking.split(name, value)).map(([chunkName, chunkValue]) => `${chunkName}=${chunkValue}`);
+	return [...remaining, ...newParts].join("; ");
 };
 /**
+* Adapts a request/response pair into a {@link ChunkedCookieWriter}: existing
+* chunk names are discovered from the incoming request's cookies (what the
+* browser currently holds), while writes/deletes apply to the response.
+*/
+const toChunkedCookieWriter = (request, responseCookies) => ({
+	delete: (name) => {
+		responseCookies.delete(name);
+	},
+	getAll: () => request.cookies.getAll(),
+	set: (name, value, options) => {
+		responseCookies.set(name, value, options);
+	}
+});
+/**
 * ThunderID proxy that integrates authentication into your Next.js application.
 * Similar to Clerk's clerkMiddleware pattern.
 *
@@ -98,7 +122,7 @@ const thunderIDProxy = (handler, options) => async (request) => {
 	const verifiedSession = await require_sessionUtils.getSessionFromRequest(request);
 	let expiredSession;
 	if (!verifiedSession) {
-		const rawToken = request.cookies.get(require_SessionManager.default.getSessionCookieName())?.value;
+		const rawToken = require_chunkedCookie.getChunkedCookie(request.cookies, require_SessionManager.default.getSessionCookieName());
 		if (rawToken) try {
 			const decoded = await require_SessionManager.default.verifySessionTokenForRefresh(rawToken);
 			if (decoded.refreshToken) expiredSession = decoded;
@@ -125,7 +149,7 @@ const thunderIDProxy = (handler, options) => async (request) => {
 	} catch {
 		activeSession = void 0;
 	}
-	const rawSessionCookie = request.cookies.get(require_SessionManager.default.getSessionCookieName())?.value;
+	const rawSessionCookie = require_chunkedCookie.getChunkedCookie(request.cookies, require_SessionManager.default.getSessionCookieName());
 	let shouldClearCookie = false;
 	if (!isValidOAuthCallback && rawSessionCookie && !activeSession && !refreshCookieUpdate) shouldClearCookie = true;
 	const sessionId = activeSession?.sessionId ?? await require_sessionUtils.getSessionIdFromRequest(request);
@@ -152,31 +176,33 @@ const thunderIDProxy = (handler, options) => async (request) => {
 	if (shouldClearCookie) {
 		const cookieName$1 = require_SessionManager.default.getSessionCookieName();
 		if (handlerResponse) {
-			handlerResponse.cookies.delete(cookieName$1);
+			require_chunkedCookie.deleteChunkedCookie(toChunkedCookieWriter(request, handlerResponse.cookies), cookieName$1);
 			return handlerResponse;
 		}
 		const requestHeaders$1 = new Headers(request.headers);
-		requestHeaders$1.set("cookie", removeCookieFromHeader(request.headers.get("cookie") ?? "", cookieName$1));
+		requestHeaders$1.set("cookie", removeChunkedCookieFromHeader(request.headers.get("cookie") ?? "", cookieName$1));
 		const cleanResponse = next_server.NextResponse.next({ request: { headers: requestHeaders$1 } });
-		cleanResponse.cookies.delete(cookieName$1);
+		require_chunkedCookie.deleteChunkedCookie(toChunkedCookieWriter(request, cleanResponse.cookies), cookieName$1);
 		return cleanResponse;
 	}
 	if (!refreshCookieUpdate) return handlerResponse ?? next_server.NextResponse.next();
 	const cookieName = require_SessionManager.default.getSessionCookieName();
 	const cookieOptions = require_SessionManager.default.getSessionCookieOptions(refreshCookieUpdate.expiry);
 	if (handlerResponse) {
-		handlerResponse.cookies.set(cookieName, refreshCookieUpdate.token, cookieOptions);
+		require_chunkedCookie.setChunkedCookie(toChunkedCookieWriter(request, handlerResponse.cookies), cookieName, refreshCookieUpdate.token, cookieOptions);
 		return handlerResponse;
 	}
 	const requestHeaders = new Headers(request.headers);
-	const updatedCookieHeader = replaceCookieInHeader(request.headers.get("cookie") ?? "", cookieName, refreshCookieUpdate.token);
+	const updatedCookieHeader = replaceChunkedCookieInHeader(request.headers.get("cookie") ?? "", cookieName, refreshCookieUpdate.token);
 	requestHeaders.set("cookie", updatedCookieHeader);
 	const response = next_server.NextResponse.next({ request: { headers: requestHeaders } });
-	response.cookies.set(cookieName, refreshCookieUpdate.token, cookieOptions);
+	require_chunkedCookie.setChunkedCookie(toChunkedCookieWriter(request, response.cookies), cookieName, refreshCookieUpdate.token, cookieOptions);
 	return response;
 };
 var thunderIDProxy_default = thunderIDProxy;
 
 //#endregion
 exports.default = thunderIDProxy_default;
+exports.removeChunkedCookieFromHeader = removeChunkedCookieFromHeader;
+exports.replaceChunkedCookieInHeader = replaceChunkedCookieInHeader;
 //# sourceMappingURL=thunderIDProxy.cjs.map