@tidecloak/nextjs 0.13.9 → 0.13.13

package/dist/cjs/server/tidecloakProxy.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTideCloakProxy = createTideCloakProxy;
+const server_1 = require("next/server");
+const verify_1 = require("@tidecloak/verify");
+const routerMatcher_1 = require("./routerMatcher");
+const DEFAULTS = {
+    protectedRoutes: {},
+    onRequest: undefined,
+    onSuccess: undefined,
+};
+/**
+ * Returns a Next.js 16+ Proxy function enforcing TideCloak auth.
+ *
+ * This is the recommended approach for Next.js 16+. The proxy runs on Node.js runtime.
+ * For Edge runtime, use `createTideCloakMiddleware` instead (deprecated in Next.js 16).
+ *
+ * Example usage in your `proxy.ts`:
+ *
+ * ```ts
+ * import tidecloakConfig from './tidecloakAdapter.json'
+ * import { createTideCloakProxy } from '@tidecloak/nextjs/server'
+ *
+ * export const proxy = createTideCloakProxy({
+ *   config: tidecloakConfig,
+ *   protectedRoutes: {
+ *     '/admin/*': ['admin'],
+ *     '/api/private/*': ['user']
+ *   },
+ *   onFailure: ({ token }, req) => NextResponse.redirect(new URL('/login', req.url)),
+ * })
+ *
+ * export const config = {
+ *   matcher: ['/((?!_next|.*\\..*).*)'],
+ * }
+ * ```
+ */
+function createTideCloakProxy(opts) {
+    const settings = { ...DEFAULTS, ...opts };
+    // Prepare arrays of test functions for protected routes
+    const protectedTests = (0, routerMatcher_1.normalizeProtectedRoutes)(settings.protectedRoutes);
+    return async function proxy(req) {
+        var _a;
+        const path = req.nextUrl.pathname;
+        try {
+            // Extract the raw JWT from the specified cookie
+            const token = ((_a = req.cookies.get("kcToken")) === null || _a === void 0 ? void 0 : _a.value) || null;
+            // Allow custom logic before auth checks
+            if (settings.onRequest) {
+                const result = settings.onRequest({ token }, req);
+                if (result)
+                    return result;
+            }
+            // Iterate protected routes; the first match enforces a role check
+            for (const { test, roles } of protectedTests) {
+                if (test(path, req)) {
+                    // Verify signature, issuer, and presence of at least one allowed role
+                    const payload = await (0, verify_1.verifyTideCloakToken)(settings.config, token, roles);
+                    if (!payload) {
+                        // Custom onFailure hook or default JSON response
+                        if (settings.onFailure) {
+                            const result = settings.onFailure({ token }, req);
+                            if (result)
+                                return result;
+                        }
+                        return server_1.NextResponse.json({ error: '[TideCloak Proxy] Access forbidden: invalid token' }, { status: 403 });
+                    }
+                    // Custom onSuccess hook if provided
+                    if (settings.onSuccess) {
+                        const result = settings.onSuccess({ payload }, req);
+                        if (result)
+                            return result;
+                    }
+                    // Token valid and role check passed
+                    return server_1.NextResponse.next();
+                }
+            }
+            // No protected route matched; continue
+            return server_1.NextResponse.next();
+        }
+        catch (err) {
+            // Handle unexpected errors
+            if (settings.onError) {
+                return settings.onError(err, req);
+            }
+            console.error("[TideCloak Proxy] ", err);
+            throw err;
+        }
+    };
+}

package/dist/cjs/server/tokenExchange.js

@@ -0,0 +1,166 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exchangeCodeForTokens = exchangeCodeForTokens;
+exports.refreshAccessToken = refreshAccessToken;
+exports.parseAuthCodeData = parseAuthCodeData;
+exports.setSessionCookie = setSessionCookie;
+exports.getSessionFromRequest = getSessionFromRequest;
+exports.clearSessionCookie = clearSessionCookie;
+/**
+ * Exchange an authorization code for tokens.
+ * Use this in your Next.js API route to complete the hybrid mode flow.
+ *
+ * @example
+ * ```ts
+ * // app/api/auth/callback/route.ts
+ * import { exchangeCodeForTokens } from '@tidecloak/nextjs/server';
+ *
+ * export async function POST(req: NextRequest) {
+ *   const body = await req.json();
+ *   const authData = JSON.parse(body.accessToken);
+ *
+ *   const result = await exchangeCodeForTokens({
+ *     authServerUrl: process.env.TIDECLOAK_URL!,
+ *     realm: process.env.TIDECLOAK_REALM!,
+ *     clientId: process.env.TIDECLOAK_CLIENT_ID!,
+ *   }, authData);
+ *
+ *   if (!result.success) {
+ *     return NextResponse.json({ error: result.error }, { status: 401 });
+ *   }
+ *
+ *   // Store tokens server-side and create session
+ *   return NextResponse.json({ success: true });
+ * }
+ * ```
+ */
+async function exchangeCodeForTokens(config, authData) {
+    const tokenEndpoint = `${config.authServerUrl}/realms/${config.realm}/protocol/openid-connect/token`;
+    const params = new URLSearchParams({
+        grant_type: 'authorization_code',
+        client_id: config.clientId,
+        code: authData.code,
+        code_verifier: authData.code_verifier,
+        redirect_uri: authData.redirect_uri,
+    });
+    if (config.clientSecret) {
+        params.set('client_secret', config.clientSecret);
+    }
+    try {
+        const response = await fetch(tokenEndpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: params,
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            return { success: false, error: `Token exchange failed: ${errorText}` };
+        }
+        const tokens = await response.json();
+        return { success: true, tokens };
+    }
+    catch (err) {
+        return { success: false, error: `Token exchange error: ${err.message}` };
+    }
+}
+/**
+ * Refresh an access token using a refresh token.
+ * Use this to get a new access token when the current one expires.
+ *
+ * @example
+ * ```ts
+ * const result = await refreshAccessToken({
+ *   authServerUrl: process.env.TIDECLOAK_URL!,
+ *   realm: process.env.TIDECLOAK_REALM!,
+ *   clientId: process.env.TIDECLOAK_CLIENT_ID!,
+ * }, session.tokens.refresh_token);
+ *
+ * if (result.success) {
+ *   // Update stored tokens
+ *   session.tokens = result.tokens;
+ * }
+ * ```
+ */
+async function refreshAccessToken(config, refreshToken) {
+    const tokenEndpoint = `${config.authServerUrl}/realms/${config.realm}/protocol/openid-connect/token`;
+    const params = new URLSearchParams({
+        grant_type: 'refresh_token',
+        client_id: config.clientId,
+        refresh_token: refreshToken,
+    });
+    if (config.clientSecret) {
+        params.set('client_secret', config.clientSecret);
+    }
+    try {
+        const response = await fetch(tokenEndpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: params,
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            return { success: false, error: `Token refresh failed: ${errorText}` };
+        }
+        const tokens = await response.json();
+        return { success: true, tokens };
+    }
+    catch (err) {
+        return { success: false, error: `Token refresh error: ${err.message}` };
+    }
+}
+/**
+ * Parse the auth data from the client request body.
+ * The client sends the authorization code data as a JSON string in accessToken field.
+ */
+function parseAuthCodeData(requestBody) {
+    if (!requestBody.accessToken)
+        return null;
+    try {
+        const data = JSON.parse(requestBody.accessToken);
+        if (!data.code || !data.code_verifier || !data.redirect_uri) {
+            return null;
+        }
+        return {
+            code: data.code,
+            code_verifier: data.code_verifier,
+            redirect_uri: data.redirect_uri,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Create a session cookie response helper.
+ *
+ * @example
+ * ```ts
+ * const response = NextResponse.json({ success: true });
+ * setSessionCookie(response, sessionId, { maxAge: 86400 });
+ * return response;
+ * ```
+ */
+function setSessionCookie(response, sessionId, options = {}) {
+    const { name = 'session', maxAge = 86400, // 1 day
+    path = '/', secure = true, sameSite = 'lax', httpOnly = true, } = options;
+    response.cookies.set(name, sessionId, {
+        httpOnly,
+        secure,
+        sameSite,
+        path,
+        maxAge,
+    });
+}
+/**
+ * Get session ID from request cookies
+ */
+function getSessionFromRequest(req, cookieName = 'session') {
+    var _a;
+    return ((_a = req.cookies.get(cookieName)) === null || _a === void 0 ? void 0 : _a.value) || null;
+}
+/**
+ * Clear session cookie
+ */
+function clearSessionCookie(response, cookieName = 'session') {
+    response.cookies.delete(cookieName);
+}

package/dist/esm/index.js

@@ -1,4 +1,22 @@
 'use client';
-import { useTideCloak, Authenticated, Unauthenticated, TideCloakContextProvider } from '@tidecloak/react';
+import { useTideCloak, Authenticated, Unauthenticated, TideCloakContextProvider, 
+// Role-based guards
+HasRealmRole, HasClientRole, 
+// Status components
+Offline, Online, WasOffline, NeedsReauth, AuthLoading, 
+// Hybrid mode utilities
+useAuthCallback, parseCallbackUrl, AuthCallback, SimpleAuthCallback, 
+// Re-export RequestEnclave for encryption
+RequestEnclave } from '@tidecloak/react';
+// Core exports
 export { useTideCloak, Authenticated, Unauthenticated, TideCloakContextProvider };
+// Role-based guard components
+export { HasRealmRole, HasClientRole };
+// Status components
+export { Offline, Online, WasOffline, NeedsReauth, AuthLoading };
+// Hybrid mode utilities
+export { useAuthCallback, parseCallbackUrl, AuthCallback, SimpleAuthCallback };
+// Encryption utility
+export { RequestEnclave };
+// Next.js specific provider
 export { TideCloakProvider } from "./contexts/TideCloakProvider";

package/dist/esm/server/index.js

@@ -1,2 +1,8 @@
+// Middleware (for Edge runtime - deprecated in Next.js 16+, but still supported)
 export { createTideCloakMiddleware } from './tidecloakMiddleware';
+// Proxy (for Next.js 16+ - Node.js runtime)
+export { createTideCloakProxy } from './tidecloakProxy';
+// Token verification
 export { verifyTideCloakToken } from '@tidecloak/verify';
+// Hybrid mode token exchange utilities
+export { exchangeCodeForTokens, refreshAccessToken, parseAuthCodeData, setSessionCookie, getSessionFromRequest, clearSessionCookie } from './tokenExchange';

package/dist/esm/server/tidecloakProxy.js

@@ -0,0 +1,87 @@
+import { NextResponse } from 'next/server';
+import { verifyTideCloakToken } from '@tidecloak/verify';
+import { normalizeProtectedRoutes } from './routerMatcher';
+const DEFAULTS = {
+    protectedRoutes: {},
+    onRequest: undefined,
+    onSuccess: undefined,
+};
+/**
+ * Returns a Next.js 16+ Proxy function enforcing TideCloak auth.
+ *
+ * This is the recommended approach for Next.js 16+. The proxy runs on Node.js runtime.
+ * For Edge runtime, use `createTideCloakMiddleware` instead (deprecated in Next.js 16).
+ *
+ * Example usage in your `proxy.ts`:
+ *
+ * ```ts
+ * import tidecloakConfig from './tidecloakAdapter.json'
+ * import { createTideCloakProxy } from '@tidecloak/nextjs/server'
+ *
+ * export const proxy = createTideCloakProxy({
+ *   config: tidecloakConfig,
+ *   protectedRoutes: {
+ *     '/admin/*': ['admin'],
+ *     '/api/private/*': ['user']
+ *   },
+ *   onFailure: ({ token }, req) => NextResponse.redirect(new URL('/login', req.url)),
+ * })
+ *
+ * export const config = {
+ *   matcher: ['/((?!_next|.*\\..*).*)'],
+ * }
+ * ```
+ */
+export function createTideCloakProxy(opts) {
+    const settings = { ...DEFAULTS, ...opts };
+    // Prepare arrays of test functions for protected routes
+    const protectedTests = normalizeProtectedRoutes(settings.protectedRoutes);
+    return async function proxy(req) {
+        var _a;
+        const path = req.nextUrl.pathname;
+        try {
+            // Extract the raw JWT from the specified cookie
+            const token = ((_a = req.cookies.get("kcToken")) === null || _a === void 0 ? void 0 : _a.value) || null;
+            // Allow custom logic before auth checks
+            if (settings.onRequest) {
+                const result = settings.onRequest({ token }, req);
+                if (result)
+                    return result;
+            }
+            // Iterate protected routes; the first match enforces a role check
+            for (const { test, roles } of protectedTests) {
+                if (test(path, req)) {
+                    // Verify signature, issuer, and presence of at least one allowed role
+                    const payload = await verifyTideCloakToken(settings.config, token, roles);
+                    if (!payload) {
+                        // Custom onFailure hook or default JSON response
+                        if (settings.onFailure) {
+                            const result = settings.onFailure({ token }, req);
+                            if (result)
+                                return result;
+                        }
+                        return NextResponse.json({ error: '[TideCloak Proxy] Access forbidden: invalid token' }, { status: 403 });
+                    }
+                    // Custom onSuccess hook if provided
+                    if (settings.onSuccess) {
+                        const result = settings.onSuccess({ payload }, req);
+                        if (result)
+                            return result;
+                    }
+                    // Token valid and role check passed
+                    return NextResponse.next();
+                }
+            }
+            // No protected route matched; continue
+            return NextResponse.next();
+        }
+        catch (err) {
+            // Handle unexpected errors
+            if (settings.onError) {
+                return settings.onError(err, req);
+            }
+            console.error("[TideCloak Proxy] ", err);
+            throw err;
+        }
+    };
+}

package/dist/esm/server/tokenExchange.js

@@ -0,0 +1,158 @@
+/**
+ * Exchange an authorization code for tokens.
+ * Use this in your Next.js API route to complete the hybrid mode flow.
+ *
+ * @example
+ * ```ts
+ * // app/api/auth/callback/route.ts
+ * import { exchangeCodeForTokens } from '@tidecloak/nextjs/server';
+ *
+ * export async function POST(req: NextRequest) {
+ *   const body = await req.json();
+ *   const authData = JSON.parse(body.accessToken);
+ *
+ *   const result = await exchangeCodeForTokens({
+ *     authServerUrl: process.env.TIDECLOAK_URL!,
+ *     realm: process.env.TIDECLOAK_REALM!,
+ *     clientId: process.env.TIDECLOAK_CLIENT_ID!,
+ *   }, authData);
+ *
+ *   if (!result.success) {
+ *     return NextResponse.json({ error: result.error }, { status: 401 });
+ *   }
+ *
+ *   // Store tokens server-side and create session
+ *   return NextResponse.json({ success: true });
+ * }
+ * ```
+ */
+export async function exchangeCodeForTokens(config, authData) {
+    const tokenEndpoint = `${config.authServerUrl}/realms/${config.realm}/protocol/openid-connect/token`;
+    const params = new URLSearchParams({
+        grant_type: 'authorization_code',
+        client_id: config.clientId,
+        code: authData.code,
+        code_verifier: authData.code_verifier,
+        redirect_uri: authData.redirect_uri,
+    });
+    if (config.clientSecret) {
+        params.set('client_secret', config.clientSecret);
+    }
+    try {
+        const response = await fetch(tokenEndpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: params,
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            return { success: false, error: `Token exchange failed: ${errorText}` };
+        }
+        const tokens = await response.json();
+        return { success: true, tokens };
+    }
+    catch (err) {
+        return { success: false, error: `Token exchange error: ${err.message}` };
+    }
+}
+/**
+ * Refresh an access token using a refresh token.
+ * Use this to get a new access token when the current one expires.
+ *
+ * @example
+ * ```ts
+ * const result = await refreshAccessToken({
+ *   authServerUrl: process.env.TIDECLOAK_URL!,
+ *   realm: process.env.TIDECLOAK_REALM!,
+ *   clientId: process.env.TIDECLOAK_CLIENT_ID!,
+ * }, session.tokens.refresh_token);
+ *
+ * if (result.success) {
+ *   // Update stored tokens
+ *   session.tokens = result.tokens;
+ * }
+ * ```
+ */
+export async function refreshAccessToken(config, refreshToken) {
+    const tokenEndpoint = `${config.authServerUrl}/realms/${config.realm}/protocol/openid-connect/token`;
+    const params = new URLSearchParams({
+        grant_type: 'refresh_token',
+        client_id: config.clientId,
+        refresh_token: refreshToken,
+    });
+    if (config.clientSecret) {
+        params.set('client_secret', config.clientSecret);
+    }
+    try {
+        const response = await fetch(tokenEndpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: params,
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            return { success: false, error: `Token refresh failed: ${errorText}` };
+        }
+        const tokens = await response.json();
+        return { success: true, tokens };
+    }
+    catch (err) {
+        return { success: false, error: `Token refresh error: ${err.message}` };
+    }
+}
+/**
+ * Parse the auth data from the client request body.
+ * The client sends the authorization code data as a JSON string in accessToken field.
+ */
+export function parseAuthCodeData(requestBody) {
+    if (!requestBody.accessToken)
+        return null;
+    try {
+        const data = JSON.parse(requestBody.accessToken);
+        if (!data.code || !data.code_verifier || !data.redirect_uri) {
+            return null;
+        }
+        return {
+            code: data.code,
+            code_verifier: data.code_verifier,
+            redirect_uri: data.redirect_uri,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Create a session cookie response helper.
+ *
+ * @example
+ * ```ts
+ * const response = NextResponse.json({ success: true });
+ * setSessionCookie(response, sessionId, { maxAge: 86400 });
+ * return response;
+ * ```
+ */
+export function setSessionCookie(response, sessionId, options = {}) {
+    const { name = 'session', maxAge = 86400, // 1 day
+    path = '/', secure = true, sameSite = 'lax', httpOnly = true, } = options;
+    response.cookies.set(name, sessionId, {
+        httpOnly,
+        secure,
+        sameSite,
+        path,
+        maxAge,
+    });
+}
+/**
+ * Get session ID from request cookies
+ */
+export function getSessionFromRequest(req, cookieName = 'session') {
+    var _a;
+    return ((_a = req.cookies.get(cookieName)) === null || _a === void 0 ? void 0 : _a.value) || null;
+}
+/**
+ * Clear session cookie
+ */
+export function clearSessionCookie(response, cookieName = 'session') {
+    response.cookies.delete(cookieName);
+}

package/dist/types/index.d.ts

@@ -1,4 +1,10 @@
-import { useTideCloak, Authenticated, Unauthenticated, TideCloakContextProvider } from '@tidecloak/react';
+import { useTideCloak, Authenticated, Unauthenticated, TideCloakContextProvider, HasRealmRole, HasClientRole, Offline, Online, WasOffline, NeedsReauth, AuthLoading, useAuthCallback, parseCallbackUrl, AuthCallback, SimpleAuthCallback, RequestEnclave } from '@tidecloak/react';
 export { useTideCloak, Authenticated, Unauthenticated, TideCloakContextProvider };
+export { HasRealmRole, HasClientRole };
+export { Offline, Online, WasOffline, NeedsReauth, AuthLoading };
+export { useAuthCallback, parseCallbackUrl, AuthCallback, SimpleAuthCallback };
+export { RequestEnclave };
+export type { TideCloakContextValue, TideCloakContextProviderProps } from '@tidecloak/react';
+export type { AuthCallbackState, UseAuthCallbackOptions, AuthCallbackProps } from '@tidecloak/react';
 export { TideCloakProvider } from "./contexts/TideCloakProvider";
 //# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,YAAY,EACZ,aAAa,EACb,eAAe,EACf,wBAAwB,EACzB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,YAAY,EACZ,aAAa,EACb,eAAe,EACf,wBAAwB,EACzB,CAAC;AACF,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,YAAY,EACZ,aAAa,EACb,eAAe,EACf,wBAAwB,EAExB,YAAY,EACZ,aAAa,EAEb,OAAO,EACP,MAAM,EACN,UAAU,EACV,WAAW,EACX,WAAW,EAEX,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAElB,cAAc,EACf,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,YAAY,EACZ,aAAa,EACb,eAAe,EACf,wBAAwB,EACzB,CAAC;AAGF,OAAO,EACL,YAAY,EACZ,aAAa,EACd,CAAC;AAGF,OAAO,EACL,OAAO,EACP,MAAM,EACN,UAAU,EACV,WAAW,EACX,WAAW,EACZ,CAAC;AAGF,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EACnB,CAAC;AAGF,OAAO,EAAE,cAAc,EAAE,CAAC;AAG1B,YAAY,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAC7F,YAAY,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAGrG,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA"}

package/dist/types/server/index.d.ts

@@ -1,3 +1,8 @@
 export { createTideCloakMiddleware } from './tidecloakMiddleware';
+export type { TideMiddlewareOptions, TidecloakConfig } from './tidecloakMiddleware';
+export { createTideCloakProxy } from './tidecloakProxy';
+export type { TideProxyOptions } from './tidecloakProxy';
 export { verifyTideCloakToken } from '@tidecloak/verify';
+export { exchangeCodeForTokens, refreshAccessToken, parseAuthCodeData, setSessionCookie, getSessionFromRequest, clearSessionCookie } from './tokenExchange';
+export type { TokenExchangeConfig, TokenResponse, AuthCodeData } from './tokenExchange';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AACjE,YAAY,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAGnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACvD,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAGxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAGxD,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,iBAAiB,CAAA;AAExB,YAAY,EACV,mBAAmB,EACnB,aAAa,EACb,YAAY,EACb,MAAM,iBAAiB,CAAA"}

package/dist/types/server/tidecloakProxy.d.ts

@@ -0,0 +1,35 @@
+import { NextRequest, NextResponse } from 'next/server';
+import type { TidecloakConfig, TideMiddlewareOptions } from './tidecloakMiddleware';
+export type { TidecloakConfig, TideMiddlewareOptions };
+/**
+ * Alias for TideMiddlewareOptions for use with the proxy convention
+ */
+export type TideProxyOptions = TideMiddlewareOptions;
+/**
+ * Returns a Next.js 16+ Proxy function enforcing TideCloak auth.
+ *
+ * This is the recommended approach for Next.js 16+. The proxy runs on Node.js runtime.
+ * For Edge runtime, use `createTideCloakMiddleware` instead (deprecated in Next.js 16).
+ *
+ * Example usage in your `proxy.ts`:
+ *
+ * ```ts
+ * import tidecloakConfig from './tidecloakAdapter.json'
+ * import { createTideCloakProxy } from '@tidecloak/nextjs/server'
+ *
+ * export const proxy = createTideCloakProxy({
+ *   config: tidecloakConfig,
+ *   protectedRoutes: {
+ *     '/admin/*': ['admin'],
+ *     '/api/private/*': ['user']
+ *   },
+ *   onFailure: ({ token }, req) => NextResponse.redirect(new URL('/login', req.url)),
+ * })
+ *
+ * export const config = {
+ *   matcher: ['/((?!_next|.*\\..*).*)'],
+ * }
+ * ```
+ */
+export declare function createTideCloakProxy(opts: TideProxyOptions): (req: NextRequest) => Promise<NextResponse<unknown>>;
+//# sourceMappingURL=tidecloakProxy.d.ts.map

package/dist/types/server/tidecloakProxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tidecloakProxy.d.ts","sourceRoot":"","sources":["../../../src/server/tidecloakProxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAMvD,OAAO,KAAK,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAGnF,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAA;AAEtD;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,CAAA;AAQpD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,IAM7B,KAAK,WAAW,oCAqD7C"}