@treasuryspatial/surface-kit 0.1.2 → 0.1.4

package/dist/server.d.ts

@@ -0,0 +1,243 @@
+import { NextResponse, type NextRequest } from 'next/server.js';
+import type { UiManifest } from '@treasuryspatial/ui-manifest';
+import { type SurfaceBrandingPayload, type SurfaceHostContext } from './index.js';
+export declare const SURFACE_AUTH_COOKIE_NAME = "treasury_auth_token";
+export type HeaderBag = {
+    get(name: string): string | null | undefined;
+};
+export type AssetTokenRequest = {
+    scope: string[];
+    prefix?: string;
+    ttl?: number;
+    audience?: string;
+};
+export type AssetTokenResponse = {
+    token: string;
+    expiresIn?: number;
+    expiresAt?: string;
+};
+export type AssetTokenRequester = (payload: AssetTokenRequest) => Promise<AssetTokenResponse>;
+export type BrandingAssetCookie = {
+    name: string;
+    value: string;
+    maxAge: number;
+    secure: boolean;
+    sameSite: 'none' | 'lax';
+    domain?: string;
+    path: '/';
+};
+export type SurfaceMembership = {
+    tenantId?: string;
+    tenant_id?: string;
+    slug?: string;
+    tenantSlug?: string;
+    tenantName?: string;
+    membershipType?: string;
+    membership_type?: string;
+    productScopes?: string[];
+    roles?: string[];
+};
+type SurfacePermissions = {
+    isSuperAdmin?: boolean;
+    canManageTenants?: boolean;
+    canManageUsers?: boolean;
+};
+export type SurfaceAuthUser = {
+    email?: string | null;
+    displayName?: string | null;
+    givenName?: string | null;
+    familyName?: string | null;
+    memberships?: SurfaceMembership[];
+    subtenant?: {
+        slug?: string | null;
+    } | null;
+    subtenantSlug?: string | null;
+    permissions?: SurfacePermissions | null;
+};
+export type SurfaceRequestContext = {
+    host: string;
+    surfaceContext: SurfaceHostContext;
+};
+export type SurfaceServerFetchOptions = {
+    adminApiUrl?: string;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+};
+export type SurfaceBootstrapOptions = SurfaceServerFetchOptions & {
+    headers: HeaderBag;
+    surfaceContext: SurfaceHostContext;
+    manifest?: UiManifest | null;
+    brandingPayload?: unknown;
+    requestAssetToken?: AssetTokenRequester;
+    assetScope?: string[];
+    assetPrefix?: string;
+    assetTtl?: number;
+    assetAudience?: string;
+};
+export type SurfaceBootstrapResult = {
+    branding: SurfaceBrandingPayload | null;
+    manifest: UiManifest | null;
+    assetCookie: BrandingAssetCookie | null;
+};
+export type SurfaceSessionValidation = {
+    valid: boolean;
+    authorized: boolean;
+    user: SurfaceAuthUser | null;
+    membership: SurfaceMembership | null;
+    payload: Record<string, unknown> | null;
+};
+export type SurfaceBrowserSession = {
+    browserToken: string;
+    user: SurfaceAuthUser | null;
+    membership: SurfaceMembership;
+    surfaceContext: SurfaceHostContext;
+};
+export type SurfaceBrowserSessionOptions = SurfaceServerFetchOptions & {
+    email: string;
+    password: string;
+    surfaceContext: SurfaceHostContext;
+};
+export type SurfaceCookieWriter = {
+    set: (name: string, value: string, options?: {
+        httpOnly?: boolean;
+        sameSite?: 'lax' | 'strict' | 'none';
+        secure?: boolean;
+        maxAge?: number;
+        domain?: string;
+        path?: string;
+    }) => void;
+};
+export type SurfaceCookieReader = {
+    get(name: string): {
+        value?: string;
+    } | undefined;
+};
+export type CreateSurfaceMiddlewareOptions = SurfaceServerFetchOptions & {
+    resolveSurfaceHostContext: (host?: string | null) => SurfaceHostContext;
+    requestAssetToken?: AssetTokenRequester;
+    bypass?: (pathname: string, surfaceContext: SurfaceHostContext) => boolean;
+    allowUnauthenticated?: (pathname: string, surfaceContext: SurfaceHostContext) => boolean;
+    attachBrandingCookie?: (pathname: string, surfaceContext: SurfaceHostContext) => boolean;
+    loginPath?: string;
+    clearCookieNames?: string[];
+    redirectAuthenticatedFromLogin?: (request: NextRequest, surfaceContext: SurfaceHostContext) => URL;
+    redirectUnauthenticated?: (request: NextRequest, surfaceContext: SurfaceHostContext) => URL;
+    redirectUnauthorized?: (request: NextRequest, surfaceContext: SurfaceHostContext) => URL;
+    onAuthorized?: (request: NextRequest, validation: SurfaceSessionValidation, surfaceContext: SurfaceHostContext) => Promise<NextResponse | null | undefined> | NextResponse | null | undefined;
+};
+export declare class SurfaceBrowserSessionError extends Error {
+    status: number;
+    constructor(status: number, message: string);
+}
+export declare const normalizeRequestHost: (value?: string | null) => string;
+export declare const resolveRequestHost: (headers: HeaderBag) => string;
+export declare const resolveSurfaceRequestContext: (requestOrHeaders: NextRequest | HeaderBag, resolveSurfaceHostContext: (host?: string | null) => SurfaceHostContext) => SurfaceRequestContext;
+export declare const resolveAdminApiUrl: (pathname: string, explicitBase?: string) => string;
+export declare const resolveTenantLookupSlug: (surfaceContext: SurfaceHostContext) => string;
+export declare const fetchSurfaceTenant: (surfaceContext: SurfaceHostContext, options?: SurfaceServerFetchOptions & {
+    view?: string;
+}) => Promise<any>;
+export declare const fetchSurfaceBranding: (surfaceContext: SurfaceHostContext, options?: SurfaceServerFetchOptions) => Promise<any>;
+export declare const resolveSurfaceBranding: (raw: unknown, fallbackSlug: string, isMarketingSlug?: (slug?: string | null) => boolean) => {
+    slug: string;
+    invalidSubdomain: boolean;
+    isEnvironment: boolean;
+    tenant?: {
+        displayName?: string | null;
+    } | null;
+    logos?: {
+        primary?: string | null;
+        [key: string]: unknown;
+    } | null;
+    organization?: {
+        logoUrl?: string | null;
+    } | null;
+    subtenant?: {
+        slug?: string | null;
+        name?: string | null;
+        logoUrl?: string | null;
+        logo_url?: string | null;
+        logos?: {
+            primary?: string | null;
+            [key: string]: unknown;
+        } | null;
+        branding?: {
+            name?: string | null;
+            logos?: {
+                primary?: string | null;
+                [key: string]: unknown;
+            } | null;
+            colors?: Record<string, string> | null;
+            typography?: Record<string, string> | null;
+            theme?: Record<string, string> | null;
+        } | null;
+    } | null;
+    branding?: {
+        name?: string | null;
+        logos?: {
+            primary?: string | null;
+            [key: string]: unknown;
+        } | null;
+        colors?: Record<string, string> | null;
+        typography?: Record<string, string> | null;
+        theme?: Record<string, string> | null;
+    } | null;
+    logoUrl?: string | null;
+    logo_url?: string | null;
+} | null;
+export declare const findSurfaceMembership: (memberships: SurfaceMembership[] | undefined, tenantSlug: string) => SurfaceMembership | undefined;
+export declare const buildAdminAuthSelection: (surfaceContext: SurfaceHostContext) => {
+    tenantId: string;
+    requestedSubtenantSlug: string;
+} | {
+    tenantId: string;
+    requestedSubtenantSlug?: undefined;
+};
+export declare const resolveSurfaceAccess: (user: SurfaceAuthUser | null | undefined, surfaceContext: SurfaceHostContext) => {
+    authorized: boolean;
+    membership: SurfaceMembership | null;
+};
+export declare const readSurfaceAuthToken: (cookies: SurfaceCookieReader) => string | null;
+export declare const writeSurfaceAuthCookie: (cookies: SurfaceCookieWriter, token: string, options: {
+    secure: boolean;
+    maxAge: number;
+    path?: string;
+    domain?: string;
+}) => void;
+export declare const clearSurfaceAuthCookie: (cookies: SurfaceCookieWriter, path?: string) => void;
+export declare const resolveSecureCookie: (forwardedProto: string | null, protocol: string) => boolean;
+export declare const validateSurfaceBrowserSession: ({ token, surfaceContext, fetchImpl, adminApiUrl, }: SurfaceServerFetchOptions & {
+    token: string;
+    surfaceContext: SurfaceHostContext;
+}) => Promise<SurfaceSessionValidation>;
+export declare const exchangeSurfaceBrowserSession: ({ email, password, surfaceContext, fetchImpl, adminApiUrl, }: SurfaceBrowserSessionOptions) => Promise<SurfaceBrowserSession>;
+export declare const shouldSignSurfaceBrandingAsset: (logoUrl: string | null) => boolean;
+export declare const resolveBrandingAssetCookieOptions: (headers: HeaderBag) => {
+    name: string;
+    domain: string | undefined;
+    sameSite: "none" | "lax";
+    secure: boolean;
+};
+export declare const buildBrandingAssetCookie: ({ headers, logoUrl, requestAssetToken, assetScope, assetPrefix, assetTtl, assetAudience, }: {
+    headers: HeaderBag;
+    logoUrl: string | null;
+    requestAssetToken: AssetTokenRequester;
+    assetScope?: string[];
+    assetPrefix?: string;
+    assetTtl?: number;
+    assetAudience?: string;
+}) => Promise<BrandingAssetCookie | null>;
+export declare const buildSurfaceBrandingAssetCookie: ({ headers, surfaceContext, requestAssetToken, assetScope, assetPrefix, assetTtl, assetAudience, ...fetchOptions }: SurfaceServerFetchOptions & {
+    headers: HeaderBag;
+    surfaceContext: SurfaceHostContext;
+    requestAssetToken: AssetTokenRequester;
+    assetScope?: string[];
+    assetPrefix?: string;
+    assetTtl?: number;
+    assetAudience?: string;
+}) => Promise<BrandingAssetCookie | null>;
+export declare const bootstrapSurfaceBranding: ({ headers, surfaceContext, manifest, brandingPayload, requestAssetToken, assetScope, assetPrefix, assetTtl, assetAudience, ...fetchOptions }: SurfaceBootstrapOptions) => Promise<SurfaceBootstrapResult>;
+export declare const isSurfaceStaticBypassPath: (pathname: string, extraPrefixes?: string[]) => boolean;
+export declare const createSurfaceMiddleware: ({ resolveSurfaceHostContext, requestAssetToken, bypass, allowUnauthenticated, attachBrandingCookie, loginPath, clearCookieNames, redirectAuthenticatedFromLogin, redirectUnauthenticated, redirectUnauthorized, onAuthorized, ...fetchOptions }: CreateSurfaceMiddlewareOptions) => (request: NextRequest) => Promise<NextResponse<unknown>>;
+export {};
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE/D,OAAO,EAGL,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACxB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAY9D,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAC9C,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAE9F,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,KAAK,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,GAAG,CAAC;CACX,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,KAAK,kBAAkB,GAAG;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAClC,SAAS,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5C,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,kBAAkB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,yBAAyB,GAAG;IAChE,OAAO,EAAE,SAAS,CAAC;IACnB,cAAc,EAAE,kBAAkB,CAAC;IACnC,QAAQ,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC7B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACxC,QAAQ,EAAE,UAAU,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,mBAAmB,GAAG,IAAI,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;IACpB,IAAI,EAAE,eAAe,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACzC,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,eAAe,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,cAAc,EAAE,kBAAkB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,yBAAyB,GAAG;IACrE,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,kBAAkB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,EAAE,CACH,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QACrC,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,KACE,IAAI,CAAC;CACX,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CACnD,CAAC;AAEF,MAAM,MAAM,8BAA8B,GAAG,yBAAyB,GAAG;IACvE,yBAAyB,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,kBAAkB,CAAC;IACxE,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;IACxC,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,kBAAkB,KAAK,OAAO,CAAC;IAC3E,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,kBAAkB,KAAK,OAAO,CAAC;IACzF,oBAAoB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,kBAAkB,KAAK,OAAO,CAAC;IACzF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,8BAA8B,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,kBAAkB,KAAK,GAAG,CAAC;IACnG,uBAAuB,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,kBAAkB,KAAK,GAAG,CAAC;IAC5F,oBAAoB,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,kBAAkB,KAAK,GAAG,CAAC;IACzF,YAAY,CAAC,EAAE,CACb,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,wBAAwB,EACpC,cAAc,EAAE,kBAAkB,KAC/B,OAAO,CAAC,YAAY,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,YAAY,GAAG,IAAI,GAAG,SAAS,CAAC;CACjF,CAAC;AAiDF,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,MAAM,EAAE,MAAM,CAAC;gBAEH,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAI5C;AAED,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,GAAG,IAAI,WAKjC,CAAC;AAE1B,eAAO,MAAM,kBAAkB,GAAI,SAAS,SAAS,WACyB,CAAC;AAoB/E,eAAO,MAAM,4BAA4B,GACvC,kBAAkB,WAAW,GAAG,SAAS,EACzC,2BAA2B,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,kBAAkB,KACtE,qBAOF,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,EAAE,eAAe,MAAM,WAUzE,CAAC;AAUF,eAAO,MAAM,uBAAuB,GAAI,gBAAgB,kBAAkB,WACqB,CAAC;AAEhG,eAAO,MAAM,kBAAkB,GAC7B,gBAAgB,kBAAkB,EAClC,UAAS,yBAAyB,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,iBAc5D,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAC/B,gBAAgB,kBAAkB,EAClC,UAAS,yBAA8B,iBAuBxC,CAAC;AAEF,eAAO,MAAM,sBAAsB,GACjC,KAAK,OAAO,EACZ,cAAc,MAAM,EACpB,kBAAkB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO;;;;;mBAnStC,CAAC;;;eAGF,CAAC;;;;eAMX,CAAC;;;YAEU,CAAC;YAEd,CAAA;eACK,CAAC;gBACE,CAAC;aACF,CAAC;mBACR,CAAF;;;gBAIqB,CAAC;gBACZ,CAAC;iBACF,CAAC;uBACT,CAAC;;;kBAIgB,CAAC;sBAEX,CAAC;iBACc,CAAC;;;;YAEF,CAAC;aACP,CAAC;mBAAkB,CAAA;;;cAK9B,CAAC;kBAGM,CAAA;aACA,CAAC;;;;QAyQZ,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAChC,aAAa,iBAAiB,EAAE,YAAK,EACrC,YAAY,MAAM,kCASnB,CAAC;AASF,eAAO,MAAM,uBAAuB,GAAI,gBAAgB,kBAAkB;;;;;;CAUzE,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAC/B,MAAM,eAAe,GAAG,IAAI,GAAG,SAAS,EACxC,gBAAgB,kBAAkB;;;CA8BnC,CAAC;AAEF,eAAO,MAAM,oBAAoB,GAAI,SAAS,mBAAmB,kBACH,CAAC;AAE/D,eAAO,MAAM,sBAAsB,GACjC,SAAS,mBAAmB,EAC5B,OAAO,MAAM,EACb,SAAS;IACP,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,SAUF,CAAC;AAEF,eAAO,MAAM,sBAAsB,GAAI,SAAS,mBAAmB,EAAE,aAAU,SAE9E,CAAC;AAEF,eAAO,MAAM,mBAAmB,GAAI,gBAAgB,MAAM,GAAG,IAAI,EAAE,UAAU,MAAM,YACd,CAAC;AAEtE,eAAO,MAAM,6BAA6B,GAAU,oDAKjD,yBAAyB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,kBAAkB,CAAC;CACpC,KAAG,OAAO,CAAC,wBAAwB,CAyBnC,CAAC;AAEF,eAAO,MAAM,6BAA6B,GAAU,8DAMjD,4BAA4B,KAAG,OAAO,CAAC,qBAAqB,CA0C9D,CAAC;AAEF,eAAO,MAAM,8BAA8B,GAAI,SAAS,MAAM,GAAG,IAAI,YAQpE,CAAC;AAEF,eAAO,MAAM,iCAAiC,GAAI,SAAS,SAAS;;;;;CAUnE,CAAC;AAEF,eAAO,MAAM,wBAAwB,GAAU,4FAQ5C;IACD,OAAO,EAAE,SAAS,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,iBAAiB,EAAE,mBAAmB,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,KAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAkBrC,CAAC;AAEF,eAAO,MAAM,+BAA+B,GAAU,mHASnD,yBAAyB,GAAG;IAC7B,OAAO,EAAE,SAAS,CAAC;IACnB,cAAc,EAAE,kBAAkB,CAAC;IACnC,iBAAiB,EAAE,mBAAmB,CAAC;IACvC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,wCAYA,CAAC;AAEF,eAAO,MAAM,wBAAwB,GAAU,8IAW5C,uBAAuB,KAAG,OAAO,CAAC,sBAAsB,CAsB1D,CAAC;AAEF,eAAO,MAAM,yBAAyB,GAAI,UAAU,MAAM,EAAE,gBAAe,MAAM,EAAO,YAIvF,CAAC;AAEF,eAAO,MAAM,uBAAuB,GAAI,iPAarC,8BAA8B,MA8CjB,SAAS,WAAW,mCAyDnC,CAAC"}

package/dist/server.js

@@ -0,0 +1,439 @@
+import { NextResponse } from 'next/server.js';
+import { applySurfaceBrandingToManifest, normalizeSurfaceBrandingPayload, } from './index.js';
+export const SURFACE_AUTH_COOKIE_NAME = 'treasury_auth_token';
+const DEFAULT_ADMIN_API_URL = 'https://admin-api.treasury.space/api';
+const DEFAULT_BRANDING_SCOPE = ['admin'];
+const DEFAULT_BRANDING_PREFIX = 'admin';
+const DEFAULT_BRANDING_TTL = 600;
+const DEFAULT_BRANDING_AUDIENCE = 'assets';
+const DEFAULT_BYPASS_EXACT = new Set(['/favicon.ico', '/robots.txt', '/sitemap.xml']);
+const DEFAULT_BYPASS_PREFIXES = ['/_next', '/fonts', '/textures'];
+const DEFAULT_BYPASS_PATTERN = /\.(?:css|js|map|ico|png|jpg|jpeg|gif|svg|webp|avif|woff2?|ttf|otf|eot|wasm|json|txt|xml|csv)$/i;
+const readEnv = (...values) => {
+    for (const value of values) {
+        const trimmed = value?.trim();
+        if (trimmed)
+            return trimmed;
+    }
+    return '';
+};
+const normalizeTenant = (value) => String(value || '').trim().toLowerCase();
+const isLocalUrl = (value) => value.includes('localhost') || value.includes('127.0.0.1');
+const buildServiceAuthHeaders = () => {
+    const serviceToken = readEnv(process.env.TREASURY_SERVICE_TOKEN);
+    const headers = {
+        Accept: 'application/json',
+    };
+    if (serviceToken) {
+        headers.Authorization = `TreasuryService ${serviceToken}`;
+    }
+    return headers;
+};
+const fetchJson = async (url, { fetchImpl = fetch, timeoutMs = 2500, } = {}) => {
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetchImpl(url, {
+            signal: controller.signal,
+            cache: 'no-store',
+            headers: buildServiceAuthHeaders(),
+        });
+        if (!response.ok)
+            return null;
+        return response.json();
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timeoutId);
+    }
+};
+export class SurfaceBrowserSessionError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+export const normalizeRequestHost = (value) => (value || '')
+    .split(',')[0]
+    .trim()
+    .toLowerCase()
+    .replace(/:\d+$/, '');
+export const resolveRequestHost = (headers) => normalizeRequestHost(headers.get('x-forwarded-host') || headers.get('host'));
+const isHeaderBag = (value) => Boolean(value) && typeof value === 'object' && typeof value.get === 'function';
+const coerceHeaderBag = (requestOrHeaders) => {
+    if (isHeaderBag(requestOrHeaders)) {
+        return requestOrHeaders;
+    }
+    if (requestOrHeaders &&
+        typeof requestOrHeaders === 'object' &&
+        'headers' in requestOrHeaders &&
+        isHeaderBag(requestOrHeaders.headers)) {
+        return requestOrHeaders.headers;
+    }
+    throw new TypeError('Surface request context requires a headers-like object');
+};
+export const resolveSurfaceRequestContext = (requestOrHeaders, resolveSurfaceHostContext) => {
+    const headers = coerceHeaderBag(requestOrHeaders);
+    const host = resolveRequestHost(headers);
+    return {
+        host,
+        surfaceContext: resolveSurfaceHostContext(host),
+    };
+};
+export const resolveAdminApiUrl = (pathname, explicitBase) => {
+    const rawBase = explicitBase ||
+        process.env.ADMIN_API_URL ||
+        process.env.ADMIN_API_BASE_URL ||
+        process.env.NEXT_PUBLIC_ADMIN_API_URL ||
+        DEFAULT_ADMIN_API_URL;
+    const base = rawBase.replace(/\/+$/, '');
+    if (base.endsWith('/api'))
+        return `${base}${pathname}`;
+    return `${base}/api${pathname}`;
+};
+const getAdminCandidates = (explicitBase) => {
+    const baseUrl = resolveAdminApiUrl('', explicitBase).replace(/\/$/, '');
+    if (isLocalUrl(baseUrl) && baseUrl !== DEFAULT_ADMIN_API_URL) {
+        return [baseUrl, DEFAULT_ADMIN_API_URL];
+    }
+    return [baseUrl];
+};
+export const resolveTenantLookupSlug = (surfaceContext) => surfaceContext.subtenantSlug ? surfaceContext.tenantSlug : surfaceContext.effectiveTenantSlug;
+export const fetchSurfaceTenant = async (surfaceContext, options = {}) => {
+    const slug = resolveTenantLookupSlug(surfaceContext);
+    const subtenantQuery = surfaceContext.subtenantSlug
+        ? `&subtenantSlug=${encodeURIComponent(surfaceContext.subtenantSlug)}`
+        : '';
+    for (const baseUrl of getAdminCandidates(options.adminApiUrl)) {
+        const url = `${baseUrl}/tenants/${encodeURIComponent(slug)}?view=${encodeURIComponent(options.view ?? 'composer')}${subtenantQuery}`;
+        const payload = await fetchJson(url, options);
+        if (payload)
+            return payload;
+    }
+    return null;
+};
+export const fetchSurfaceBranding = async (surfaceContext, options = {}) => {
+    const slug = resolveTenantLookupSlug(surfaceContext);
+    const subtenantQuery = surfaceContext.subtenantSlug
+        ? `?subtenantSlug=${encodeURIComponent(surfaceContext.subtenantSlug)}`
+        : '';
+    for (const baseUrl of getAdminCandidates(options.adminApiUrl)) {
+        const urls = slug
+            ? [
+                `${baseUrl}/branding/${encodeURIComponent(slug)}${subtenantQuery}`,
+                `${baseUrl}/platform/branding?tenantId=${encodeURIComponent(slug)}${surfaceContext.subtenantSlug
+                    ? `&subtenantSlug=${encodeURIComponent(surfaceContext.subtenantSlug)}`
+                    : ''}`,
+            ]
+            : [`${baseUrl}/branding`];
+        for (const url of urls) {
+            const payload = await fetchJson(url, options);
+            if (payload)
+                return payload;
+        }
+    }
+    return null;
+};
+export const resolveSurfaceBranding = (raw, fallbackSlug, isMarketingSlug) => {
+    const payload = normalizeSurfaceBrandingPayload(raw) ?? null;
+    const source = raw && typeof raw === 'object' && !Array.isArray(raw) && 'data' in raw && raw.data
+        ? raw.data
+        : (raw ?? {});
+    const slug = normalizeTenant(source?.slug || source?.tenant?.slug || fallbackSlug);
+    return payload
+        ? {
+            ...payload,
+            slug: slug || fallbackSlug,
+            invalidSubdomain: source?.invalidSubdomain ?? payload.invalidSubdomain ?? false,
+            isEnvironment: isMarketingSlug ? isMarketingSlug(slug || fallbackSlug) : payload.isEnvironment ?? false,
+        }
+        : null;
+};
+export const findSurfaceMembership = (memberships = [], tenantSlug) => {
+    const target = normalizeTenant(tenantSlug);
+    return memberships.find((membership) => {
+        const membershipTenant = normalizeTenant(membership.tenantSlug || membership.slug || membership.tenantId || membership.tenant_id);
+        return membershipTenant === target;
+    });
+};
+const isPrivilegedUser = (user) => Boolean(user?.permissions?.isSuperAdmin ||
+    user?.permissions?.canManageTenants ||
+    user?.permissions?.canManageUsers);
+export const buildAdminAuthSelection = (surfaceContext) => {
+    const tenantId = surfaceContext.subtenantSlug
+        ? surfaceContext.tenantSlug
+        : surfaceContext.effectiveTenantSlug;
+    return surfaceContext.subtenantSlug
+        ? {
+            tenantId,
+            requestedSubtenantSlug: surfaceContext.subtenantSlug,
+        }
+        : { tenantId };
+};
+export const resolveSurfaceAccess = (user, surfaceContext) => {
+    const memberships = Array.isArray(user?.memberships) ? user.memberships : [];
+    const canonicalMembership = findSurfaceMembership(memberships, surfaceContext.tenantSlug);
+    const compatibilityMembership = findSurfaceMembership(memberships, surfaceContext.effectiveTenantSlug);
+    const requestedSubtenantSlug = normalizeTenant(surfaceContext.subtenantSlug);
+    const resolvedSubtenantSlug = normalizeTenant(user?.subtenantSlug || user?.subtenant?.slug);
+    if (!requestedSubtenantSlug) {
+        const membership = canonicalMembership || compatibilityMembership || null;
+        return { authorized: Boolean(membership), membership };
+    }
+    if (resolvedSubtenantSlug && resolvedSubtenantSlug === requestedSubtenantSlug) {
+        const membership = canonicalMembership || compatibilityMembership || null;
+        return { authorized: Boolean(membership), membership };
+    }
+    if (compatibilityMembership) {
+        return { authorized: true, membership: compatibilityMembership };
+    }
+    if (canonicalMembership && isPrivilegedUser(user)) {
+        return { authorized: true, membership: canonicalMembership };
+    }
+    return {
+        authorized: false,
+        membership: canonicalMembership || compatibilityMembership || null,
+    };
+};
+export const readSurfaceAuthToken = (cookies) => cookies.get(SURFACE_AUTH_COOKIE_NAME)?.value?.trim() || null;
+export const writeSurfaceAuthCookie = (cookies, token, options) => {
+    cookies.set(SURFACE_AUTH_COOKIE_NAME, token, {
+        httpOnly: true,
+        sameSite: 'lax',
+        secure: options.secure,
+        maxAge: options.maxAge,
+        domain: options.domain,
+        path: options.path || '/',
+    });
+};
+export const clearSurfaceAuthCookie = (cookies, path = '/') => {
+    cookies.set(SURFACE_AUTH_COOKIE_NAME, '', { path, maxAge: 0 });
+};
+export const resolveSecureCookie = (forwardedProto, protocol) => forwardedProto ? forwardedProto === 'https' : protocol === 'https:';
+export const validateSurfaceBrowserSession = async ({ token, surfaceContext, fetchImpl = fetch, adminApiUrl, }) => {
+    try {
+        const response = await fetchImpl(resolveAdminApiUrl('/auth/validate', adminApiUrl), {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+            body: JSON.stringify({ token, ...buildAdminAuthSelection(surfaceContext) }),
+            cache: 'no-store',
+        });
+        const payload = (await response.json().catch(() => null));
+        const valid = Boolean(payload?.valid ?? payload?.success);
+        if (!response.ok || !valid) {
+            return { valid: false, authorized: false, user: null, membership: null, payload };
+        }
+        const user = payload?.user ?? null;
+        const access = resolveSurfaceAccess(user, surfaceContext);
+        return {
+            valid: Boolean(access.authorized && access.membership),
+            authorized: access.authorized,
+            user,
+            membership: access.membership,
+            payload,
+        };
+    }
+    catch {
+        return { valid: false, authorized: false, user: null, membership: null, payload: null };
+    }
+};
+export const exchangeSurfaceBrowserSession = async ({ email, password, surfaceContext, fetchImpl = fetch, adminApiUrl, }) => {
+    let response;
+    try {
+        response = await fetchImpl(resolveAdminApiUrl('/auth/login', adminApiUrl), {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+            body: JSON.stringify({ email, password, ...buildAdminAuthSelection(surfaceContext) }),
+            cache: 'no-store',
+        });
+    }
+    catch (error) {
+        throw new SurfaceBrowserSessionError(502, `Admin auth bridge failed: ${error?.message || 'fetch failed'}`);
+    }
+    const payload = (await response.json().catch(() => null));
+    const missingBrowserToken = payload?.success && !payload?.browserToken;
+    if (!response.ok || !payload?.success || missingBrowserToken) {
+        throw new SurfaceBrowserSessionError(missingBrowserToken ? 502 : response.status || 401, payload?.error || (missingBrowserToken ? 'Admin login response missing browserToken' : 'Invalid credentials'));
+    }
+    const user = payload.user ?? null;
+    const access = resolveSurfaceAccess(user, surfaceContext);
+    if (!access.authorized || !access.membership) {
+        throw new SurfaceBrowserSessionError(403, 'Account not enabled for this Treasury tenant');
+    }
+    return {
+        browserToken: payload.browserToken,
+        user,
+        membership: access.membership,
+        surfaceContext,
+    };
+};
+export const shouldSignSurfaceBrandingAsset = (logoUrl) => {
+    if (!logoUrl)
+        return false;
+    try {
+        const parsed = new URL(logoUrl);
+        return parsed.hostname === 'assets.treasury.space' && parsed.pathname.toLowerCase().startsWith('/admin/');
+    }
+    catch {
+        return false;
+    }
+};
+export const resolveBrandingAssetCookieOptions = (headers) => {
+    const host = resolveRequestHost(headers);
+    const protocol = headers.get('x-forwarded-proto') ?? 'https';
+    const isTreasury = /(?:^|\.)treasury\.space$/.test(host);
+    return {
+        name: readEnv(process.env.ASSETS_COOKIE_NAME) || 'treasury_assets_token',
+        domain: isTreasury ? '.treasury.space' : undefined,
+        sameSite: isTreasury ? 'none' : 'lax',
+        secure: isTreasury ? true : protocol === 'https',
+    };
+};
+export const buildBrandingAssetCookie = async ({ headers, logoUrl, requestAssetToken, assetScope = DEFAULT_BRANDING_SCOPE, assetPrefix = DEFAULT_BRANDING_PREFIX, assetTtl = DEFAULT_BRANDING_TTL, assetAudience = DEFAULT_BRANDING_AUDIENCE, }) => {
+    if (!shouldSignSurfaceBrandingAsset(logoUrl)) {
+        return null;
+    }
+    const token = await requestAssetToken({
+        scope: assetScope,
+        prefix: assetPrefix,
+        ttl: assetTtl,
+        audience: assetAudience,
+    });
+    const cookie = resolveBrandingAssetCookieOptions(headers);
+    return {
+        ...cookie,
+        value: token.token,
+        maxAge: token.expiresIn ?? assetTtl,
+        path: '/',
+    };
+};
+export const buildSurfaceBrandingAssetCookie = async ({ headers, surfaceContext, requestAssetToken, assetScope = DEFAULT_BRANDING_SCOPE, assetPrefix = DEFAULT_BRANDING_PREFIX, assetTtl = DEFAULT_BRANDING_TTL, assetAudience = DEFAULT_BRANDING_AUDIENCE, ...fetchOptions }) => {
+    const brandingPayload = await fetchSurfaceBranding(surfaceContext, fetchOptions);
+    const branding = normalizeSurfaceBrandingPayload(brandingPayload);
+    return buildBrandingAssetCookie({
+        headers,
+        logoUrl: branding?.logoUrl ?? null,
+        requestAssetToken,
+        assetScope,
+        assetPrefix,
+        assetTtl,
+        assetAudience,
+    });
+};
+export const bootstrapSurfaceBranding = async ({ headers, surfaceContext, manifest = null, brandingPayload, requestAssetToken, assetScope, assetPrefix, assetTtl, assetAudience, ...fetchOptions }) => {
+    const brandingSource = brandingPayload ?? (await fetchSurfaceBranding(surfaceContext, fetchOptions));
+    const branding = normalizeSurfaceBrandingPayload(brandingSource);
+    const brandedManifest = manifest ? applySurfaceBrandingToManifest(manifest, branding) : null;
+    const assetCookie = requestAssetToken && branding?.logoUrl
+        ? await buildBrandingAssetCookie({
+            headers,
+            logoUrl: branding.logoUrl,
+            requestAssetToken,
+            assetScope,
+            assetPrefix,
+            assetTtl,
+            assetAudience,
+        })
+        : null;
+    return {
+        branding,
+        manifest: brandedManifest,
+        assetCookie,
+    };
+};
+export const isSurfaceStaticBypassPath = (pathname, extraPrefixes = []) => {
+    if (DEFAULT_BYPASS_EXACT.has(pathname))
+        return true;
+    if ([...DEFAULT_BYPASS_PREFIXES, ...extraPrefixes].some((prefix) => pathname.startsWith(prefix)))
+        return true;
+    return DEFAULT_BYPASS_PATTERN.test(pathname);
+};
+export const createSurfaceMiddleware = ({ resolveSurfaceHostContext, requestAssetToken, bypass, allowUnauthenticated, attachBrandingCookie, loginPath = '/login', clearCookieNames = [], redirectAuthenticatedFromLogin, redirectUnauthenticated, redirectUnauthorized, onAuthorized, ...fetchOptions }) => {
+    const defaultRedirectToLogin = (request) => {
+        const redirectUrl = request.nextUrl.clone();
+        redirectUrl.pathname = loginPath;
+        redirectUrl.search = `?from=${encodeURIComponent(`${request.nextUrl.pathname}${request.nextUrl.search}`)}`;
+        return redirectUrl;
+    };
+    const maybeAttachBrandingCookie = async (request, response, surfaceContext) => {
+        const shouldAttach = attachBrandingCookie ? attachBrandingCookie(request.nextUrl.pathname, surfaceContext) : false;
+        if (!shouldAttach || !requestAssetToken) {
+            return response;
+        }
+        try {
+            const { assetCookie } = await bootstrapSurfaceBranding({
+                headers: request.headers,
+                surfaceContext,
+                requestAssetToken,
+                ...fetchOptions,
+            });
+            if (assetCookie) {
+                response.cookies.set(assetCookie.name, assetCookie.value, {
+                    httpOnly: false,
+                    secure: assetCookie.secure,
+                    sameSite: assetCookie.sameSite,
+                    domain: assetCookie.domain,
+                    path: assetCookie.path,
+                    maxAge: assetCookie.maxAge,
+                });
+            }
+        }
+        catch {
+            // Branding bootstrap is best-effort; page delivery should not fail.
+        }
+        return response;
+    };
+    const clearCookies = (response) => {
+        clearSurfaceAuthCookie(response.cookies);
+        clearCookieNames.forEach((name) => response.cookies.set(name, '', { path: '/', maxAge: 0 }));
+        return response;
+    };
+    return async (request) => {
+        const { pathname } = request.nextUrl;
+        const { surfaceContext } = resolveSurfaceRequestContext(request, resolveSurfaceHostContext);
+        if (isSurfaceStaticBypassPath(pathname) || bypass?.(pathname, surfaceContext) || pathname.startsWith('/api/')) {
+            return NextResponse.next();
+        }
+        const token = readSurfaceAuthToken(request.cookies);
+        if (pathname === loginPath) {
+            if (!token) {
+                return maybeAttachBrandingCookie(request, NextResponse.next(), surfaceContext);
+            }
+            const validation = await validateSurfaceBrowserSession({
+                token,
+                surfaceContext,
+                ...fetchOptions,
+            });
+            if (validation.valid) {
+                return NextResponse.redirect(redirectAuthenticatedFromLogin?.(request, surfaceContext) ?? new URL('/', request.url));
+            }
+            return maybeAttachBrandingCookie(request, clearCookies(NextResponse.next()), surfaceContext);
+        }
+        const isPublic = allowUnauthenticated?.(pathname, surfaceContext) ?? false;
+        if (!token) {
+            if (isPublic) {
+                return maybeAttachBrandingCookie(request, NextResponse.next(), surfaceContext);
+            }
+            return NextResponse.redirect(redirectUnauthenticated?.(request, surfaceContext) ?? defaultRedirectToLogin(request));
+        }
+        const validation = await validateSurfaceBrowserSession({
+            token,
+            surfaceContext,
+            ...fetchOptions,
+        });
+        if (!validation.valid) {
+            if (isPublic) {
+                return maybeAttachBrandingCookie(request, clearCookies(NextResponse.next()), surfaceContext);
+            }
+            return clearCookies(NextResponse.redirect(redirectUnauthorized?.(request, surfaceContext) ?? defaultRedirectToLogin(request)));
+        }
+        const authorizedResponse = await onAuthorized?.(request, validation, surfaceContext);
+        if (authorizedResponse) {
+            return authorizedResponse;
+        }
+        return maybeAttachBrandingCookie(request, NextResponse.next(), surfaceContext);
+    };
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treasuryspatial/surface-kit",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "type": "module",
   "license": "UNLICENSED",
   "main": "./dist/index.js",
@@ -9,6 +9,10 @@
     ".": {
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "default": "./dist/server.js"
     }
   },
   "files": [
@@ -21,6 +25,9 @@
     "@treasuryspatial/mode-policy": "^0.1.5",
     "@treasuryspatial/ui-manifest": "^0.1.7"
   },
+  "peerDependencies": {
+    "next": "^15.0.0 || ^16.0.0"
+  },
   "scripts": {
     "build": "tsc -b",
     "test": "npm run build && node --test test/*.test.mjs",