@unidir/unidir-nextjs 1.0.2 → 1.0.3

package/dist/index.cjs

@@ -0,0 +1,2 @@
+"use strict";var K=Object.create;var h=Object.defineProperty;var M=Object.getOwnPropertyDescriptor;var z=Object.getOwnPropertyNames;var Y=Object.getPrototypeOf,F=Object.prototype.hasOwnProperty;var G=(e,r)=>{for(var n in r)h(e,n,{get:r[n],enumerable:!0})},x=(e,r,n,a)=>{if(r&&typeof r=="object"||typeof r=="function")for(let t of z(r))!F.call(e,t)&&t!==n&&h(e,t,{get:()=>r[t],enumerable:!(a=M(r,t))||a.enumerable});return e};var B=(e,r,n)=>(n=e!=null?K(Y(e)):{},x(r||!e||!e.__esModule?h(n,"default",{value:e,enumerable:!0}):n,e)),Q=e=>x(h({},"__esModule",{value:!0}),e);var q={};G(q,{UserProvider:()=>A,initUniDir:()=>Z,useUser:()=>D});module.exports=Q(q);var N=require("cookie");var y=require("jose"),I=e=>new TextEncoder().encode(e.padEnd(32,"0").slice(0,32));async function P(e,r){return new y.EncryptJWT(e).setProtectedHeader({alg:"dir",enc:"A256GCM"}).setIssuedAt().setExpirationTime("24h").encrypt(I(r))}async function w(e,r){try{let{payload:n}=await(0,y.jwtDecrypt)(e,I(r));return n}catch{return null}}var u=require("next/server"),b=require("next/navigation");function T(){let e=new Uint8Array(32);return crypto.getRandomValues(e),btoa(String.fromCharCode(...e)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async function C(e){let n=new TextEncoder().encode(e),a=await crypto.subtle.digest("SHA-256",n);return btoa(String.fromCharCode(...new Uint8Array(a))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}var i=require("react");var _=require("jose");async function R(e,r,n={}){let a=(0,_.createRemoteJWKSet)(new URL(r)),{payload:t}=await(0,_.jwtVerify)(e,a,{issuer:n.issuer,audience:n.audience});return t}var E=require("react/jsx-runtime"),S=(0,i.createContext)({user:null,isLoading:!0,config:null});function A({children:e,config:r}){let[n,a]=(0,i.useState)(null),[t,s]=(0,i.useState)(!0),[p,o]=(0,i.useState)(null),[c,l]=(0,i.useState)(null),[k,d]=(0,i.useState)(null),[g,m]=(0,i.useState)(null),[U,v]=(0,i.useState)(null),[f,ee]=(0,i.useState)(null);return(0,i.useEffect)(()=>{async function L(){try{let O=await(await fetch("/api/auth/me")).json(),{companyId:J,domainId:W,email:V,email_verified:$,name:H}=await R(O.id_token,r.jwks||"https://oauth.igoodworks.com/jwks.json",{issuer:r.issuer||"http://oauth.unidir.igoodworks.com/",audience:r.clientId});a({companyId:J,domainId:W,email:V,email_verified:$,name:H})}finally{s(!1)}}L()},[]),(0,E.jsx)(S.Provider,{value:{user:n,isLoading:t,config:r},children:e})}var D=()=>(0,i.useContext)(S);var j=require("react/jsx-runtime"),X={login:"login",loginPath:"/api/auth/login",logout:"logout",callback:"callback",me:"me"};function Z(e,r){let n={...X,...r},a=async t=>{let s=t.headers.get("cookie")||"",o=(0,N.parse)(s).unidir_session;return o?await w(o,e.secret):null};return{handleAuth:()=>async t=>{let s=t.nextUrl.pathname.split("/").pop(),o=t.nextUrl.searchParams.get("device_id")||e.deviceId||"unknown-device";if(s===n.login){let c=t.nextUrl.searchParams.get("returnTo")||"/",l=T(),k=await C(l),d=new URL(`${e.domain}/authorize`);d.searchParams.set("client_id",e.clientId),d.searchParams.set("response_type","code"),d.searchParams.set("redirect_uri",e.redirectUri),d.searchParams.set("scope","openid profile email"),d.searchParams.set("code_challenge",k),d.searchParams.set("code_challenge_method","S256"),o&&d.searchParams.set("device_id",o);let g=u.NextResponse.redirect(d.toString());return g.cookies.set("unidir_pkce_verifier",l,{httpOnly:!0,secure:!0,sameSite:"lax",maxAge:300}),g.cookies.set("unidir_device_id",o,{httpOnly:!0,secure:!0,maxAge:600}),g.cookies.set("unidir_return_to",c,{httpOnly:!0,maxAge:300}),g}if(s===n.me){let c=await a(t);return c?u.NextResponse.json(c):new u.NextResponse(JSON.stringify({user:null}),{status:401})}if(s===n.logout){let c=u.NextResponse.redirect(new URL("/",t.url));return c.cookies.delete("unidir_session"),c}if(s==="callback"){let c=t.nextUrl.searchParams.get("code"),l=t.cookies.get("unidir_pkce_verifier")?.value;if(!c||!l)return new u.NextResponse("Missing code or verifier",{status:400});let d=t.cookies.get("unidir_device_id")?.value||o,m=await(await fetch(`${e.domain}/token`,{method:"POST",headers:{"Content-Type":"application/json","x-device-id":d},body:JSON.stringify({grant_type:"authorization_code",client_id:e.clientId,client_secret:e.clientSecret,code:c,code_verifier:l,redirect_uri:e.redirectUri,device_id:d})})).json();if(m.error)return u.NextResponse.json(m,{status:400});let U=await P(m,e.secret),v=t.cookies.get("unidir_return_to")?.value||"/",f=u.NextResponse.redirect(new URL(v,t.url));return f.cookies.delete("unidir_pkce_verifier"),f.cookies.set("unidir_session",U,{httpOnly:!0,secure:!0,sameSite:"lax",maxAge:3600*24}),f}return new u.NextResponse("Not Found",{status:404})},getSession:a,withPageAuthRequired:t=>async s=>{let{headers:p}=await import("next/headers"),o=await a({headers:await p()});return o||(0,b.redirect)(n.loginPath),(0,j.jsx)(t,{...s,user:o})},withMiddlewareAuth:()=>async t=>{let s=t.cookies.get("unidir_session")?.value;if(!(s?await w(s,e.secret):null)){let{pathname:o,search:c}=t.nextUrl,l=new URL(n.loginPath,t.url);return l.searchParams.set("returnTo",`${o}${c}`),u.NextResponse.redirect(l)}return u.NextResponse.next()}}}0&&(module.exports={UserProvider,initUniDir,useUser});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.tsx","../src/session.ts","../src/pkce.ts","../src/client.tsx","../src/jwks.ts"],"sourcesContent":["import { parse } from \"cookie\";\r\nimport { encrypt, decrypt } from \"./session\";\r\nimport { NextRequest, NextResponse } from \"next/server\";\r\nimport { redirect } from \"next/navigation\";\r\nimport { generateCodeVerifier, generateCodeChallenge } from \"./pkce\";\r\n\r\nexport interface UniDirConfig {\r\n  domain: string;\r\n  clientId: string;\r\n  clientSecret: string;\r\n  secret: string;\r\n  redirectUri: string;\r\n  logoutRedirectUri?: string;\r\n  deviceId?: string;\r\n  scope?: string;\r\n  audience?: string;\r\n  jwks?: string;\r\n  issuer?: string;\r\n}\r\n\r\ninterface UniDirAction {\r\n  login: string;\r\n  loginPath: string;\r\n  logout: string;\r\n  callback: string;\r\n  me: string;\r\n}\r\nconst defaultActions: UniDirAction = {\r\n  login: \"login\",\r\n  loginPath: \"/api/auth/login\",\r\n  logout: \"logout\",\r\n  callback: \"callback\",\r\n  me: \"me\",\r\n};\r\n\r\nexport function initUniDir(config: UniDirConfig, actions?: UniDirAction) {\r\n  const uniDirActions = { ...defaultActions, ...actions };\r\n\r\n  const getSession = async (req: Request | NextRequest) => {\r\n    const cookieHeader = req.headers.get(\"cookie\") || \"\";\r\n    const cookies = parse(cookieHeader);\r\n    const sessionToken = cookies[\"unidir_session\"];\r\n    if (!sessionToken) return null;\r\n    return await decrypt(sessionToken, config.secret);\r\n  };\r\n\r\n  return {\r\n    handleAuth: () => async (req: NextRequest) => {\r\n      const action = req.nextUrl.pathname.split(\"/\").pop();\r\n      // Capture the deviceId from the query param sent by the LoginButton\r\n      const queryDeviceId = req.nextUrl.searchParams.get(\"device_id\");\r\n      const effectiveDeviceId =\r\n        queryDeviceId || config.deviceId || \"unknown-device\";\r\n      //const deviceId = req.headers.get(\"x-device-id\");\r\n\r\n      if (action === uniDirActions.login) {\r\n        const returnTo = req.nextUrl.searchParams.get(\"returnTo\") || \"/\";\r\n        const verifier = generateCodeVerifier();\r\n        const challenge = await generateCodeChallenge(verifier);\r\n\r\n        const url = new URL(`${config.domain}/authorize`);\r\n        url.searchParams.set(\"client_id\", config.clientId);\r\n        url.searchParams.set(\"response_type\", \"code\");\r\n        url.searchParams.set(\"redirect_uri\", config.redirectUri);\r\n        url.searchParams.set(\"scope\", \"openid profile email\");\r\n        url.searchParams.set(\"code_challenge\", challenge);\r\n        url.searchParams.set(\"code_challenge_method\", \"S256\");\r\n        if (effectiveDeviceId) {\r\n          url.searchParams.set(\"device_id\", effectiveDeviceId);\r\n        }\r\n        const response = NextResponse.redirect(url.toString());\r\n\r\n        // Store verifier in a short-lived, secure cookie\r\n        response.cookies.set(\"unidir_pkce_verifier\", verifier, {\r\n          httpOnly: true,\r\n          secure: true,\r\n          sameSite: \"lax\",\r\n          maxAge: 60 * 5, // 5 minutes\r\n        });\r\n        response.cookies.set(\"unidir_device_id\", effectiveDeviceId, {\r\n          httpOnly: true,\r\n          secure: true,\r\n          maxAge: 60 * 10, // 10 minutes\r\n        });\r\n        response.cookies.set(\"unidir_return_to\", returnTo, {\r\n          httpOnly: true,\r\n          maxAge: 60 * 5,\r\n        });\r\n        return response;\r\n      }\r\n      // Profile Handler (for useUser hook)\r\n      if (action === uniDirActions.me) {\r\n        const session = await getSession(req);\r\n        if (!session)\r\n          return new NextResponse(JSON.stringify({ user: null }), {\r\n            status: 401,\r\n          });\r\n        return NextResponse.json(session);\r\n      }\r\n\r\n      // Logout Handler\r\n      if (action === uniDirActions.logout) {\r\n        const response = NextResponse.redirect(new URL(\"/\", req.url));\r\n        response.cookies.delete(\"unidir_session\");\r\n        return response;\r\n      }\r\n      if (action === \"callback\") {\r\n        const code = req.nextUrl.searchParams.get(\"code\");\r\n        const verifier = req.cookies.get(\"unidir_pkce_verifier\")?.value;\r\n\r\n        if (!code || !verifier) {\r\n          return new NextResponse(\"Missing code or verifier\", { status: 400 });\r\n        }\r\n\r\n        const storedDeviceId = req.cookies.get(\"unidir_device_id\")?.value;\r\n        const deviceIdToUse = storedDeviceId || effectiveDeviceId;\r\n\r\n        const res = await fetch(`${config.domain}/token`, {\r\n          method: \"POST\",\r\n          headers: {\r\n            \"Content-Type\": \"application/json\",\r\n            \"x-device-id\": deviceIdToUse, // Added to header\r\n          },\r\n          body: JSON.stringify({\r\n            grant_type: \"authorization_code\",\r\n            client_id: config.clientId,\r\n            client_secret: config.clientSecret,\r\n            code,\r\n            code_verifier: verifier, // Pass the verifier back\r\n            redirect_uri: config.redirectUri,\r\n            device_id: deviceIdToUse,\r\n          }),\r\n        });\r\n\r\n        const tokens = await res.json();\r\n        if (tokens.error) return NextResponse.json(tokens, { status: 400 });\r\n\r\n        const encryptedSession = await encrypt(tokens, config.secret);\r\n        // const response = NextResponse.redirect(new URL(\"/\", req.url));\r\n        const returnTo = req.cookies.get(\"unidir_return_to\")?.value || \"/\";\r\n        const response = NextResponse.redirect(new URL(returnTo, req.url));\r\n\r\n        // Clean up PKCE cookie and set session\r\n        response.cookies.delete(\"unidir_pkce_verifier\");\r\n        response.cookies.set(\"unidir_session\", encryptedSession, {\r\n          httpOnly: true,\r\n          secure: true,\r\n          sameSite: \"lax\",\r\n          maxAge: 60 * 60 * 24,\r\n        });\r\n\r\n        return response;\r\n      }\r\n\r\n      return new NextResponse(\"Not Found\", { status: 404 });\r\n    },\r\n\r\n    getSession,\r\n\r\n    withPageAuthRequired: <P extends object>(\r\n      Component: React.ComponentType<P>\r\n    ) => {\r\n      return async (props: P) => {\r\n        // Import headers dynamically to avoid issues in non-server environments\r\n        const { headers } = await import(\"next/headers\");\r\n        const session = await getSession({ headers: await headers() } as any);\r\n\r\n        if (!session) {\r\n          redirect(uniDirActions.loginPath);\r\n        }\r\n\r\n        // Return the component as JSX\r\n        return <Component {...props} user={session} />;\r\n      };\r\n    },\r\n\r\n    withMiddlewareAuth: () => {\r\n      return async (req: NextRequest) => {\r\n        const sessionToken = req.cookies.get(\"unidir_session\")?.value;\r\n        const session = sessionToken\r\n          ? await decrypt(sessionToken, config.secret)\r\n          : null;\r\n\r\n        if (!session) {\r\n          // Redirect to login but save the current URL to return back later\r\n          const { pathname, search } = req.nextUrl;\r\n          const url = new URL(uniDirActions.loginPath, req.url);\r\n          url.searchParams.set(\"returnTo\", `${pathname}${search}`);\r\n          return NextResponse.redirect(url);\r\n        }\r\n\r\n        return NextResponse.next();\r\n      };\r\n    },\r\n  };\r\n}\r\n\r\nexport { UserProvider, useUser } from \"./client\";\r\n","import { EncryptJWT, jwtDecrypt } from \"jose\";\r\n\r\nconst getSecretKey = (secret: string) =>\r\n  new TextEncoder().encode(secret.padEnd(32, \"0\").slice(0, 32));\r\n\r\nexport async function encrypt(payload: any, secret: string) {\r\n  return new EncryptJWT(payload)\r\n    .setProtectedHeader({ alg: \"dir\", enc: \"A256GCM\" })\r\n    .setIssuedAt()\r\n    .setExpirationTime(\"24h\")\r\n    .encrypt(getSecretKey(secret));\r\n}\r\n\r\nexport async function decrypt(token: string, secret: string) {\r\n  try {\r\n    const { payload } = await jwtDecrypt(token, getSecretKey(secret));\r\n    return payload;\r\n  } catch (e) {\r\n    return null;\r\n  }\r\n}\r\n","export function generateCodeVerifier(): string {\r\n  const array = new Uint8Array(32);\r\n  crypto.getRandomValues(array);\r\n  return btoa(String.fromCharCode(...array))\r\n    .replace(/\\+/g, \"-\")\r\n    .replace(/\\//g, \"_\")\r\n    .replace(/=/g, \"\");\r\n}\r\n\r\nexport async function generateCodeChallenge(verifier: string): Promise<string> {\r\n  const encoder = new TextEncoder();\r\n  const data = encoder.encode(verifier);\r\n  const digest = await crypto.subtle.digest(\"SHA-256\", data);\r\n  return btoa(String.fromCharCode(...new Uint8Array(digest)))\r\n    .replace(/\\+/g, \"-\")\r\n    .replace(/\\//g, \"_\")\r\n    .replace(/=/g, \"\");\r\n}\r\n","\"use client\";\r\nimport React, { createContext, useContext, useState, useEffect } from \"react\";\r\nimport { UniDirConfig } from \".\";\r\nimport { verifyAccessToken } from \"./jwks\";\r\nimport { JWTPayload } from \"jose\";\r\n\r\nconst UserContext = createContext<{\r\n  user: any;\r\n  isLoading: boolean;\r\n  config: UniDirConfig | null;\r\n}>({ user: null, isLoading: true, config: null });\r\n\r\nexport function UserProvider({\r\n  children,\r\n  config,\r\n}: {\r\n  children: React.ReactNode;\r\n  config: UniDirConfig;\r\n}) {\r\n  const [user, setUser] = useState<JWTPayload | null>(null);\r\n  const [isLoading, setIsLoading] = useState(true);\r\n  const [token, setToken] = useState(null);\r\n  const [accessToken, setAccessToken] = useState(null);\r\n  const [refreshToken, setRefreshToken] = useState(null);\r\n  const [idToken, setIdToken] = useState(null);\r\n  const [client, setClient] = useState(null);\r\n  const [expiresIn, setExpiresIn] = useState(null);\r\n\r\n  //   useEffect(() => {\r\n  //     fetch(\"/api/auth/me\")\r\n  //       .then((res) => res.json())\r\n  //       .then((data) => {\r\n  //         if (data) {\r\n  //           setUser(data.client);\r\n  //           setToken(data);\r\n  //           setAccessToken(data.access_token);\r\n  //           setRefreshToken(data.refresh_token);\r\n  //           const idTokenAll = await jwtVerify(\r\n  //             data.id_token,\r\n  //             config.jwks || \"https://oauth.biocloud.pro/jwks.json\"\r\n  //           );\r\n  //           setIdToken(data.id_token);\r\n  //           setClient(data.client);\r\n  //           setExpiresIn(data.expres_in);\r\n  //         }\r\n  //       })\r\n  //       .catch(() => setUser(null));\r\n  //   }, []);\r\n  useEffect(() => {\r\n    async function loadUser() {\r\n      try {\r\n        const res = await fetch(\"/api/auth/me\");\r\n        const data = await res.json();\r\n        //setUser(data.user);\r\n        const { companyId, domainId, email, email_verified, name } =\r\n          await verifyAccessToken(\r\n            data.id_token,\r\n            config.jwks || \"https://oauth.igoodworks.com/jwks.json\",\r\n            {\r\n              issuer: config.issuer || \"http://oauth.unidir.igoodworks.com/\",\r\n              audience: config.clientId,\r\n            }\r\n          );\r\n        setUser({ companyId, domainId, email, email_verified, name });\r\n      } finally {\r\n        setIsLoading(false);\r\n      }\r\n    }\r\n    loadUser();\r\n  }, []);\r\n  return (\r\n    <UserContext.Provider\r\n      value={{\r\n        user,\r\n        isLoading,\r\n        config,\r\n        // token,\r\n        // expiresIn,\r\n        // accessToken,\r\n        // refreshToken,\r\n        // client,\r\n        // idToken,\r\n      }}\r\n    >\r\n      {children}\r\n    </UserContext.Provider>\r\n  );\r\n}\r\n\r\nexport function getDeviceId(): string {\r\n  if (typeof window === \"undefined\") return \"server-default\";\r\n\r\n  let id = localStorage.getItem(\"unidir_device_id\");\r\n  if (!id) {\r\n    id = crypto.randomUUID();\r\n    localStorage.setItem(\"unidir_device_id\", id);\r\n  }\r\n  return id;\r\n}\r\n\r\nexport const useUser = () => useContext(UserContext);\r\n","import { jwtVerify, createRemoteJWKSet } from \"jose\";\r\n\r\n// Replace with your IdP issuer and audience\r\nconst ISSUER = \"https://YOUR_ISSUER/\";\r\nconst AUDIENCE = \"YOUR_CLIENT_ID\";\r\n\r\nexport async function verifyAccessToken(\r\n  token: string,\r\n  jwksUrl: string,\r\n  options: Record<string, any> = {}\r\n) {\r\n  const JWKS = createRemoteJWKSet(new URL(jwksUrl));\r\n  const { payload } = await jwtVerify(token, JWKS, {\r\n    issuer: options.issuer,\r\n    audience: options.audience,\r\n  });\r\n  // Optionally apply custom claims checks here (e.g., roles, scopes)\r\n  return payload;\r\n}\r\n"],"mappings":"0jBAAA,IAAAA,EAAA,GAAAC,EAAAD,EAAA,kBAAAE,EAAA,eAAAC,EAAA,YAAAC,IAAA,eAAAC,EAAAL,GAAA,IAAAM,EAAsB,kBCAtB,IAAAC,EAAuC,gBAEjCC,EAAgBC,GACpB,IAAI,YAAY,EAAE,OAAOA,EAAO,OAAO,GAAI,GAAG,EAAE,MAAM,EAAG,EAAE,CAAC,EAE9D,eAAsBC,EAAQC,EAAcF,EAAgB,CAC1D,OAAO,IAAI,aAAWE,CAAO,EAC1B,mBAAmB,CAAE,IAAK,MAAO,IAAK,SAAU,CAAC,EACjD,YAAY,EACZ,kBAAkB,KAAK,EACvB,QAAQH,EAAaC,CAAM,CAAC,CACjC,CAEA,eAAsBG,EAAQC,EAAeJ,EAAgB,CAC3D,GAAI,CACF,GAAM,CAAE,QAAAE,CAAQ,EAAI,QAAM,cAAWE,EAAOL,EAAaC,CAAM,CAAC,EAChE,OAAOE,CACT,MAAY,CACV,OAAO,IACT,CACF,CDlBA,IAAAG,EAA0C,uBAC1CC,EAAyB,2BEHlB,SAASC,GAA+B,CAC7C,IAAMC,EAAQ,IAAI,WAAW,EAAE,EAC/B,cAAO,gBAAgBA,CAAK,EACrB,KAAK,OAAO,aAAa,GAAGA,CAAK,CAAC,EACtC,QAAQ,MAAO,GAAG,EAClB,QAAQ,MAAO,GAAG,EAClB,QAAQ,KAAM,EAAE,CACrB,CAEA,eAAsBC,EAAsBC,EAAmC,CAE7E,IAAMC,EADU,IAAI,YAAY,EACX,OAAOD,CAAQ,EAC9BE,EAAS,MAAM,OAAO,OAAO,OAAO,UAAWD,CAAI,EACzD,OAAO,KAAK,OAAO,aAAa,GAAG,IAAI,WAAWC,CAAM,CAAC,CAAC,EACvD,QAAQ,MAAO,GAAG,EAClB,QAAQ,MAAO,GAAG,EAClB,QAAQ,KAAM,EAAE,CACrB,CChBA,IAAAC,EAAsE,iBCDtE,IAAAC,EAA8C,gBAM9C,eAAsBC,EACpBC,EACAC,EACAC,EAA+B,CAAC,EAChC,CACA,IAAMC,KAAO,sBAAmB,IAAI,IAAIF,CAAO,CAAC,EAC1C,CAAE,QAAAG,CAAQ,EAAI,QAAM,aAAUJ,EAAOG,EAAM,CAC/C,OAAQD,EAAQ,OAChB,SAAUA,EAAQ,QACpB,CAAC,EAED,OAAOE,CACT,CDqDI,IAAAC,EAAA,6BAjEEC,KAAc,iBAIjB,CAAE,KAAM,KAAM,UAAW,GAAM,OAAQ,IAAK,CAAC,EAEzC,SAASC,EAAa,CAC3B,SAAAC,EACA,OAAAC,CACF,EAGG,CACD,GAAM,CAACC,EAAMC,CAAO,KAAI,YAA4B,IAAI,EAClD,CAACC,EAAWC,CAAY,KAAI,YAAS,EAAI,EACzC,CAACC,EAAOC,CAAQ,KAAI,YAAS,IAAI,EACjC,CAACC,EAAaC,CAAc,KAAI,YAAS,IAAI,EAC7C,CAACC,EAAcC,CAAe,KAAI,YAAS,IAAI,EAC/C,CAACC,EAASC,CAAU,KAAI,YAAS,IAAI,EACrC,CAACC,EAAQC,CAAS,KAAI,YAAS,IAAI,EACnC,CAACC,EAAWC,EAAY,KAAI,YAAS,IAAI,EAsB/C,sBAAU,IAAM,CACd,eAAeC,GAAW,CACxB,GAAI,CAEF,IAAMC,EAAO,MADD,MAAM,MAAM,cAAc,GACf,KAAK,EAEtB,CAAE,UAAAC,EAAW,SAAAC,EAAU,MAAAC,EAAO,eAAAC,EAAgB,KAAAC,CAAK,EACvD,MAAMC,EACJN,EAAK,SACLlB,EAAO,MAAQ,yCACf,CACE,OAAQA,EAAO,QAAU,sCACzB,SAAUA,EAAO,QACnB,CACF,EACFE,EAAQ,CAAE,UAAAiB,EAAW,SAAAC,EAAU,MAAAC,EAAO,eAAAC,EAAgB,KAAAC,CAAK,CAAC,CAC9D,QAAE,CACAnB,EAAa,EAAK,CACpB,CACF,CACAa,EAAS,CACX,EAAG,CAAC,CAAC,KAEH,OAACpB,EAAY,SAAZ,CACC,MAAO,CACL,KAAAI,EACA,UAAAE,EACA,OAAAH,CAOF,EAEC,SAAAD,EACH,CAEJ,CAaO,IAAM0B,EAAU,OAAM,cAAWC,CAAW,EHwEpC,IAAAC,EAAA,6BAjJTC,EAA+B,CACnC,MAAO,QACP,UAAW,kBACX,OAAQ,SACR,SAAU,WACV,GAAI,IACN,EAEO,SAASC,EAAWC,EAAsBC,EAAwB,CACvE,IAAMC,EAAgB,CAAE,GAAGJ,EAAgB,GAAGG,CAAQ,EAEhDE,EAAa,MAAOC,GAA+B,CACvD,IAAMC,EAAeD,EAAI,QAAQ,IAAI,QAAQ,GAAK,GAE5CE,KADU,SAAMD,CAAY,EACL,eAC7B,OAAKC,EACE,MAAMC,EAAQD,EAAcN,EAAO,MAAM,EADtB,IAE5B,EAEA,MAAO,CACL,WAAY,IAAM,MAAOI,GAAqB,CAC5C,IAAMI,EAASJ,EAAI,QAAQ,SAAS,MAAM,GAAG,EAAE,IAAI,EAG7CK,EADgBL,EAAI,QAAQ,aAAa,IAAI,WAAW,GAE3CJ,EAAO,UAAY,iBAGtC,GAAIQ,IAAWN,EAAc,MAAO,CAClC,IAAMQ,EAAWN,EAAI,QAAQ,aAAa,IAAI,UAAU,GAAK,IACvDO,EAAWC,EAAqB,EAChCC,EAAY,MAAMC,EAAsBH,CAAQ,EAEhDI,EAAM,IAAI,IAAI,GAAGf,EAAO,MAAM,YAAY,EAChDe,EAAI,aAAa,IAAI,YAAaf,EAAO,QAAQ,EACjDe,EAAI,aAAa,IAAI,gBAAiB,MAAM,EAC5CA,EAAI,aAAa,IAAI,eAAgBf,EAAO,WAAW,EACvDe,EAAI,aAAa,IAAI,QAAS,sBAAsB,EACpDA,EAAI,aAAa,IAAI,iBAAkBF,CAAS,EAChDE,EAAI,aAAa,IAAI,wBAAyB,MAAM,EAChDN,GACFM,EAAI,aAAa,IAAI,YAAaN,CAAiB,EAErD,IAAMO,EAAW,eAAa,SAASD,EAAI,SAAS,CAAC,EAGrD,OAAAC,EAAS,QAAQ,IAAI,uBAAwBL,EAAU,CACrD,SAAU,GACV,OAAQ,GACR,SAAU,MACV,OAAQ,GACV,CAAC,EACDK,EAAS,QAAQ,IAAI,mBAAoBP,EAAmB,CAC1D,SAAU,GACV,OAAQ,GACR,OAAQ,GACV,CAAC,EACDO,EAAS,QAAQ,IAAI,mBAAoBN,EAAU,CACjD,SAAU,GACV,OAAQ,GACV,CAAC,EACMM,CACT,CAEA,GAAIR,IAAWN,EAAc,GAAI,CAC/B,IAAMe,EAAU,MAAMd,EAAWC,CAAG,EACpC,OAAKa,EAIE,eAAa,KAAKA,CAAO,EAHvB,IAAI,eAAa,KAAK,UAAU,CAAE,KAAM,IAAK,CAAC,EAAG,CACtD,OAAQ,GACV,CAAC,CAEL,CAGA,GAAIT,IAAWN,EAAc,OAAQ,CACnC,IAAMc,EAAW,eAAa,SAAS,IAAI,IAAI,IAAKZ,EAAI,GAAG,CAAC,EAC5D,OAAAY,EAAS,QAAQ,OAAO,gBAAgB,EACjCA,CACT,CACA,GAAIR,IAAW,WAAY,CACzB,IAAMU,EAAOd,EAAI,QAAQ,aAAa,IAAI,MAAM,EAC1CO,EAAWP,EAAI,QAAQ,IAAI,sBAAsB,GAAG,MAE1D,GAAI,CAACc,GAAQ,CAACP,EACZ,OAAO,IAAI,eAAa,2BAA4B,CAAE,OAAQ,GAAI,CAAC,EAIrE,IAAMQ,EADiBf,EAAI,QAAQ,IAAI,kBAAkB,GAAG,OACpBK,EAmBlCW,EAAS,MAjBH,MAAM,MAAM,GAAGpB,EAAO,MAAM,SAAU,CAChD,OAAQ,OACR,QAAS,CACP,eAAgB,mBAChB,cAAemB,CACjB,EACA,KAAM,KAAK,UAAU,CACnB,WAAY,qBACZ,UAAWnB,EAAO,SAClB,cAAeA,EAAO,aACtB,KAAAkB,EACA,cAAeP,EACf,aAAcX,EAAO,YACrB,UAAWmB,CACb,CAAC,CACH,CAAC,GAEwB,KAAK,EAC9B,GAAIC,EAAO,MAAO,OAAO,eAAa,KAAKA,EAAQ,CAAE,OAAQ,GAAI,CAAC,EAElE,IAAMC,EAAmB,MAAMC,EAAQF,EAAQpB,EAAO,MAAM,EAEtDU,EAAWN,EAAI,QAAQ,IAAI,kBAAkB,GAAG,OAAS,IACzDY,EAAW,eAAa,SAAS,IAAI,IAAIN,EAAUN,EAAI,GAAG,CAAC,EAGjE,OAAAY,EAAS,QAAQ,OAAO,sBAAsB,EAC9CA,EAAS,QAAQ,IAAI,iBAAkBK,EAAkB,CACvD,SAAU,GACV,OAAQ,GACR,SAAU,MACV,OAAQ,KAAU,EACpB,CAAC,EAEML,CACT,CAEA,OAAO,IAAI,eAAa,YAAa,CAAE,OAAQ,GAAI,CAAC,CACtD,EAEA,WAAAb,EAEA,qBACEoB,GAEO,MAAOC,GAAa,CAEzB,GAAM,CAAE,QAAAC,CAAQ,EAAI,KAAM,QAAO,cAAc,EACzCR,EAAU,MAAMd,EAAW,CAAE,QAAS,MAAMsB,EAAQ,CAAE,CAAQ,EAEpE,OAAKR,MACH,YAASf,EAAc,SAAS,KAI3B,OAACqB,EAAA,CAAW,GAAGC,EAAO,KAAMP,EAAS,CAC9C,EAGF,mBAAoB,IACX,MAAOb,GAAqB,CACjC,IAAME,EAAeF,EAAI,QAAQ,IAAI,gBAAgB,GAAG,MAKxD,GAAI,EAJYE,EACZ,MAAMC,EAAQD,EAAcN,EAAO,MAAM,EACzC,MAEU,CAEZ,GAAM,CAAE,SAAA0B,EAAU,OAAAC,CAAO,EAAIvB,EAAI,QAC3BW,EAAM,IAAI,IAAIb,EAAc,UAAWE,EAAI,GAAG,EACpD,OAAAW,EAAI,aAAa,IAAI,WAAY,GAAGW,CAAQ,GAAGC,CAAM,EAAE,EAChD,eAAa,SAASZ,CAAG,CAClC,CAEA,OAAO,eAAa,KAAK,CAC3B,CAEJ,CACF","names":["index_exports","__export","UserProvider","initUniDir","useUser","__toCommonJS","import_cookie","import_jose","getSecretKey","secret","encrypt","payload","decrypt","token","import_server","import_navigation","generateCodeVerifier","array","generateCodeChallenge","verifier","data","digest","import_react","import_jose","verifyAccessToken","token","jwksUrl","options","JWKS","payload","import_jsx_runtime","UserContext","UserProvider","children","config","user","setUser","isLoading","setIsLoading","token","setToken","accessToken","setAccessToken","refreshToken","setRefreshToken","idToken","setIdToken","client","setClient","expiresIn","setExpiresIn","loadUser","data","companyId","domainId","email","email_verified","name","verifyAccessToken","useUser","UserContext","import_jsx_runtime","defaultActions","initUniDir","config","actions","uniDirActions","getSession","req","cookieHeader","sessionToken","decrypt","action","effectiveDeviceId","returnTo","verifier","generateCodeVerifier","challenge","generateCodeChallenge","url","response","session","code","deviceIdToUse","tokens","encryptedSession","encrypt","Component","props","headers","pathname","search"]}

package/dist/index.d.cts

@@ -0,0 +1,43 @@
+import * as react_jsx_runtime from 'react/jsx-runtime';
+import * as jose from 'jose';
+import { NextRequest, NextResponse } from 'next/server';
+import React$1 from 'react';
+
+declare function UserProvider({ children, config, }: {
+    children: React$1.ReactNode;
+    config: UniDirConfig;
+}): react_jsx_runtime.JSX.Element;
+declare const useUser: () => {
+    user: any;
+    isLoading: boolean;
+    config: UniDirConfig | null;
+};
+
+interface UniDirConfig {
+    domain: string;
+    clientId: string;
+    clientSecret: string;
+    secret: string;
+    redirectUri: string;
+    logoutRedirectUri?: string;
+    deviceId?: string;
+    scope?: string;
+    audience?: string;
+    jwks?: string;
+    issuer?: string;
+}
+interface UniDirAction {
+    login: string;
+    loginPath: string;
+    logout: string;
+    callback: string;
+    me: string;
+}
+declare function initUniDir(config: UniDirConfig, actions?: UniDirAction): {
+    handleAuth: () => (req: NextRequest) => Promise<NextResponse<any>>;
+    getSession: (req: Request | NextRequest) => Promise<jose.JWTPayload | null>;
+    withPageAuthRequired: <P extends object>(Component: React.ComponentType<P>) => (props: P) => Promise<react_jsx_runtime.JSX.Element>;
+    withMiddlewareAuth: () => (req: NextRequest) => Promise<NextResponse<unknown>>;
+};
+
+export { type UniDirConfig, UserProvider, initUniDir, useUser };

package/dist/index.d.ts

@@ -0,0 +1,43 @@
+import * as react_jsx_runtime from 'react/jsx-runtime';
+import * as jose from 'jose';
+import { NextRequest, NextResponse } from 'next/server';
+import React$1 from 'react';
+
+declare function UserProvider({ children, config, }: {
+    children: React$1.ReactNode;
+    config: UniDirConfig;
+}): react_jsx_runtime.JSX.Element;
+declare const useUser: () => {
+    user: any;
+    isLoading: boolean;
+    config: UniDirConfig | null;
+};
+
+interface UniDirConfig {
+    domain: string;
+    clientId: string;
+    clientSecret: string;
+    secret: string;
+    redirectUri: string;
+    logoutRedirectUri?: string;
+    deviceId?: string;
+    scope?: string;
+    audience?: string;
+    jwks?: string;
+    issuer?: string;
+}
+interface UniDirAction {
+    login: string;
+    loginPath: string;
+    logout: string;
+    callback: string;
+    me: string;
+}
+declare function initUniDir(config: UniDirConfig, actions?: UniDirAction): {
+    handleAuth: () => (req: NextRequest) => Promise<NextResponse<any>>;
+    getSession: (req: Request | NextRequest) => Promise<jose.JWTPayload | null>;
+    withPageAuthRequired: <P extends object>(Component: React.ComponentType<P>) => (props: P) => Promise<react_jsx_runtime.JSX.Element>;
+    withMiddlewareAuth: () => (req: NextRequest) => Promise<NextResponse<unknown>>;
+};
+
+export { type UniDirConfig, UserProvider, initUniDir, useUser };

package/dist/index.mjs

@@ -0,0 +1,2 @@
+import{parse as K}from"cookie";import{EncryptJWT as N,jwtDecrypt as b}from"jose";var w=e=>new TextEncoder().encode(e.padEnd(32,"0").slice(0,32));async function U(e,n){return new N(e).setProtectedHeader({alg:"dir",enc:"A256GCM"}).setIssuedAt().setExpirationTime("24h").encrypt(w(n))}async function y(e,n){try{let{payload:r}=await b(e,w(n));return r}catch{return null}}import{NextResponse as a}from"next/server";import{redirect as M}from"next/navigation";function v(){let e=new Uint8Array(32);return crypto.getRandomValues(e),btoa(String.fromCharCode(...e)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}async function x(e){let r=new TextEncoder().encode(e),d=await crypto.subtle.digest("SHA-256",r);return btoa(String.fromCharCode(...new Uint8Array(d))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=/g,"")}import{createContext as O,useContext as J,useState as l,useEffect as W}from"react";import{jwtVerify as j,createRemoteJWKSet as L}from"jose";async function I(e,n,r={}){let d=L(new URL(n)),{payload:t}=await j(e,d,{issuer:r.issuer,audience:r.audience});return t}import{jsx as H}from"react/jsx-runtime";var P=O({user:null,isLoading:!0,config:null});function V({children:e,config:n}){let[r,d]=l(null),[t,i]=l(!0),[p,s]=l(null),[o,u]=l(null),[h,c]=l(null),[g,m]=l(null),[_,k]=l(null),[f,F]=l(null);return W(()=>{async function T(){try{let C=await(await fetch("/api/auth/me")).json(),{companyId:R,domainId:S,email:A,email_verified:D,name:E}=await I(C.id_token,n.jwks||"https://oauth.igoodworks.com/jwks.json",{issuer:n.issuer||"http://oauth.unidir.igoodworks.com/",audience:n.clientId});d({companyId:R,domainId:S,email:A,email_verified:D,name:E})}finally{i(!1)}}T()},[]),H(P.Provider,{value:{user:r,isLoading:t,config:n},children:e})}var $=()=>J(P);import{jsx as Y}from"react/jsx-runtime";var z={login:"login",loginPath:"/api/auth/login",logout:"logout",callback:"callback",me:"me"};function le(e,n){let r={...z,...n},d=async t=>{let i=t.headers.get("cookie")||"",s=K(i).unidir_session;return s?await y(s,e.secret):null};return{handleAuth:()=>async t=>{let i=t.nextUrl.pathname.split("/").pop(),s=t.nextUrl.searchParams.get("device_id")||e.deviceId||"unknown-device";if(i===r.login){let o=t.nextUrl.searchParams.get("returnTo")||"/",u=v(),h=await x(u),c=new URL(`${e.domain}/authorize`);c.searchParams.set("client_id",e.clientId),c.searchParams.set("response_type","code"),c.searchParams.set("redirect_uri",e.redirectUri),c.searchParams.set("scope","openid profile email"),c.searchParams.set("code_challenge",h),c.searchParams.set("code_challenge_method","S256"),s&&c.searchParams.set("device_id",s);let g=a.redirect(c.toString());return g.cookies.set("unidir_pkce_verifier",u,{httpOnly:!0,secure:!0,sameSite:"lax",maxAge:300}),g.cookies.set("unidir_device_id",s,{httpOnly:!0,secure:!0,maxAge:600}),g.cookies.set("unidir_return_to",o,{httpOnly:!0,maxAge:300}),g}if(i===r.me){let o=await d(t);return o?a.json(o):new a(JSON.stringify({user:null}),{status:401})}if(i===r.logout){let o=a.redirect(new URL("/",t.url));return o.cookies.delete("unidir_session"),o}if(i==="callback"){let o=t.nextUrl.searchParams.get("code"),u=t.cookies.get("unidir_pkce_verifier")?.value;if(!o||!u)return new a("Missing code or verifier",{status:400});let c=t.cookies.get("unidir_device_id")?.value||s,m=await(await fetch(`${e.domain}/token`,{method:"POST",headers:{"Content-Type":"application/json","x-device-id":c},body:JSON.stringify({grant_type:"authorization_code",client_id:e.clientId,client_secret:e.clientSecret,code:o,code_verifier:u,redirect_uri:e.redirectUri,device_id:c})})).json();if(m.error)return a.json(m,{status:400});let _=await U(m,e.secret),k=t.cookies.get("unidir_return_to")?.value||"/",f=a.redirect(new URL(k,t.url));return f.cookies.delete("unidir_pkce_verifier"),f.cookies.set("unidir_session",_,{httpOnly:!0,secure:!0,sameSite:"lax",maxAge:3600*24}),f}return new a("Not Found",{status:404})},getSession:d,withPageAuthRequired:t=>async i=>{let{headers:p}=await import("next/headers"),s=await d({headers:await p()});return s||M(r.loginPath),Y(t,{...i,user:s})},withMiddlewareAuth:()=>async t=>{let i=t.cookies.get("unidir_session")?.value;if(!(i?await y(i,e.secret):null)){let{pathname:s,search:o}=t.nextUrl,u=new URL(r.loginPath,t.url);return u.searchParams.set("returnTo",`${s}${o}`),a.redirect(u)}return a.next()}}}export{V as UserProvider,le as initUniDir,$ as useUser};
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.tsx","../src/session.ts","../src/pkce.ts","../src/client.tsx","../src/jwks.ts"],"sourcesContent":["import { parse } from \"cookie\";\r\nimport { encrypt, decrypt } from \"./session\";\r\nimport { NextRequest, NextResponse } from \"next/server\";\r\nimport { redirect } from \"next/navigation\";\r\nimport { generateCodeVerifier, generateCodeChallenge } from \"./pkce\";\r\n\r\nexport interface UniDirConfig {\r\n  domain: string;\r\n  clientId: string;\r\n  clientSecret: string;\r\n  secret: string;\r\n  redirectUri: string;\r\n  logoutRedirectUri?: string;\r\n  deviceId?: string;\r\n  scope?: string;\r\n  audience?: string;\r\n  jwks?: string;\r\n  issuer?: string;\r\n}\r\n\r\ninterface UniDirAction {\r\n  login: string;\r\n  loginPath: string;\r\n  logout: string;\r\n  callback: string;\r\n  me: string;\r\n}\r\nconst defaultActions: UniDirAction = {\r\n  login: \"login\",\r\n  loginPath: \"/api/auth/login\",\r\n  logout: \"logout\",\r\n  callback: \"callback\",\r\n  me: \"me\",\r\n};\r\n\r\nexport function initUniDir(config: UniDirConfig, actions?: UniDirAction) {\r\n  const uniDirActions = { ...defaultActions, ...actions };\r\n\r\n  const getSession = async (req: Request | NextRequest) => {\r\n    const cookieHeader = req.headers.get(\"cookie\") || \"\";\r\n    const cookies = parse(cookieHeader);\r\n    const sessionToken = cookies[\"unidir_session\"];\r\n    if (!sessionToken) return null;\r\n    return await decrypt(sessionToken, config.secret);\r\n  };\r\n\r\n  return {\r\n    handleAuth: () => async (req: NextRequest) => {\r\n      const action = req.nextUrl.pathname.split(\"/\").pop();\r\n      // Capture the deviceId from the query param sent by the LoginButton\r\n      const queryDeviceId = req.nextUrl.searchParams.get(\"device_id\");\r\n      const effectiveDeviceId =\r\n        queryDeviceId || config.deviceId || \"unknown-device\";\r\n      //const deviceId = req.headers.get(\"x-device-id\");\r\n\r\n      if (action === uniDirActions.login) {\r\n        const returnTo = req.nextUrl.searchParams.get(\"returnTo\") || \"/\";\r\n        const verifier = generateCodeVerifier();\r\n        const challenge = await generateCodeChallenge(verifier);\r\n\r\n        const url = new URL(`${config.domain}/authorize`);\r\n        url.searchParams.set(\"client_id\", config.clientId);\r\n        url.searchParams.set(\"response_type\", \"code\");\r\n        url.searchParams.set(\"redirect_uri\", config.redirectUri);\r\n        url.searchParams.set(\"scope\", \"openid profile email\");\r\n        url.searchParams.set(\"code_challenge\", challenge);\r\n        url.searchParams.set(\"code_challenge_method\", \"S256\");\r\n        if (effectiveDeviceId) {\r\n          url.searchParams.set(\"device_id\", effectiveDeviceId);\r\n        }\r\n        const response = NextResponse.redirect(url.toString());\r\n\r\n        // Store verifier in a short-lived, secure cookie\r\n        response.cookies.set(\"unidir_pkce_verifier\", verifier, {\r\n          httpOnly: true,\r\n          secure: true,\r\n          sameSite: \"lax\",\r\n          maxAge: 60 * 5, // 5 minutes\r\n        });\r\n        response.cookies.set(\"unidir_device_id\", effectiveDeviceId, {\r\n          httpOnly: true,\r\n          secure: true,\r\n          maxAge: 60 * 10, // 10 minutes\r\n        });\r\n        response.cookies.set(\"unidir_return_to\", returnTo, {\r\n          httpOnly: true,\r\n          maxAge: 60 * 5,\r\n        });\r\n        return response;\r\n      }\r\n      // Profile Handler (for useUser hook)\r\n      if (action === uniDirActions.me) {\r\n        const session = await getSession(req);\r\n        if (!session)\r\n          return new NextResponse(JSON.stringify({ user: null }), {\r\n            status: 401,\r\n          });\r\n        return NextResponse.json(session);\r\n      }\r\n\r\n      // Logout Handler\r\n      if (action === uniDirActions.logout) {\r\n        const response = NextResponse.redirect(new URL(\"/\", req.url));\r\n        response.cookies.delete(\"unidir_session\");\r\n        return response;\r\n      }\r\n      if (action === \"callback\") {\r\n        const code = req.nextUrl.searchParams.get(\"code\");\r\n        const verifier = req.cookies.get(\"unidir_pkce_verifier\")?.value;\r\n\r\n        if (!code || !verifier) {\r\n          return new NextResponse(\"Missing code or verifier\", { status: 400 });\r\n        }\r\n\r\n        const storedDeviceId = req.cookies.get(\"unidir_device_id\")?.value;\r\n        const deviceIdToUse = storedDeviceId || effectiveDeviceId;\r\n\r\n        const res = await fetch(`${config.domain}/token`, {\r\n          method: \"POST\",\r\n          headers: {\r\n            \"Content-Type\": \"application/json\",\r\n            \"x-device-id\": deviceIdToUse, // Added to header\r\n          },\r\n          body: JSON.stringify({\r\n            grant_type: \"authorization_code\",\r\n            client_id: config.clientId,\r\n            client_secret: config.clientSecret,\r\n            code,\r\n            code_verifier: verifier, // Pass the verifier back\r\n            redirect_uri: config.redirectUri,\r\n            device_id: deviceIdToUse,\r\n          }),\r\n        });\r\n\r\n        const tokens = await res.json();\r\n        if (tokens.error) return NextResponse.json(tokens, { status: 400 });\r\n\r\n        const encryptedSession = await encrypt(tokens, config.secret);\r\n        // const response = NextResponse.redirect(new URL(\"/\", req.url));\r\n        const returnTo = req.cookies.get(\"unidir_return_to\")?.value || \"/\";\r\n        const response = NextResponse.redirect(new URL(returnTo, req.url));\r\n\r\n        // Clean up PKCE cookie and set session\r\n        response.cookies.delete(\"unidir_pkce_verifier\");\r\n        response.cookies.set(\"unidir_session\", encryptedSession, {\r\n          httpOnly: true,\r\n          secure: true,\r\n          sameSite: \"lax\",\r\n          maxAge: 60 * 60 * 24,\r\n        });\r\n\r\n        return response;\r\n      }\r\n\r\n      return new NextResponse(\"Not Found\", { status: 404 });\r\n    },\r\n\r\n    getSession,\r\n\r\n    withPageAuthRequired: <P extends object>(\r\n      Component: React.ComponentType<P>\r\n    ) => {\r\n      return async (props: P) => {\r\n        // Import headers dynamically to avoid issues in non-server environments\r\n        const { headers } = await import(\"next/headers\");\r\n        const session = await getSession({ headers: await headers() } as any);\r\n\r\n        if (!session) {\r\n          redirect(uniDirActions.loginPath);\r\n        }\r\n\r\n        // Return the component as JSX\r\n        return <Component {...props} user={session} />;\r\n      };\r\n    },\r\n\r\n    withMiddlewareAuth: () => {\r\n      return async (req: NextRequest) => {\r\n        const sessionToken = req.cookies.get(\"unidir_session\")?.value;\r\n        const session = sessionToken\r\n          ? await decrypt(sessionToken, config.secret)\r\n          : null;\r\n\r\n        if (!session) {\r\n          // Redirect to login but save the current URL to return back later\r\n          const { pathname, search } = req.nextUrl;\r\n          const url = new URL(uniDirActions.loginPath, req.url);\r\n          url.searchParams.set(\"returnTo\", `${pathname}${search}`);\r\n          return NextResponse.redirect(url);\r\n        }\r\n\r\n        return NextResponse.next();\r\n      };\r\n    },\r\n  };\r\n}\r\n\r\nexport { UserProvider, useUser } from \"./client\";\r\n","import { EncryptJWT, jwtDecrypt } from \"jose\";\r\n\r\nconst getSecretKey = (secret: string) =>\r\n  new TextEncoder().encode(secret.padEnd(32, \"0\").slice(0, 32));\r\n\r\nexport async function encrypt(payload: any, secret: string) {\r\n  return new EncryptJWT(payload)\r\n    .setProtectedHeader({ alg: \"dir\", enc: \"A256GCM\" })\r\n    .setIssuedAt()\r\n    .setExpirationTime(\"24h\")\r\n    .encrypt(getSecretKey(secret));\r\n}\r\n\r\nexport async function decrypt(token: string, secret: string) {\r\n  try {\r\n    const { payload } = await jwtDecrypt(token, getSecretKey(secret));\r\n    return payload;\r\n  } catch (e) {\r\n    return null;\r\n  }\r\n}\r\n","export function generateCodeVerifier(): string {\r\n  const array = new Uint8Array(32);\r\n  crypto.getRandomValues(array);\r\n  return btoa(String.fromCharCode(...array))\r\n    .replace(/\\+/g, \"-\")\r\n    .replace(/\\//g, \"_\")\r\n    .replace(/=/g, \"\");\r\n}\r\n\r\nexport async function generateCodeChallenge(verifier: string): Promise<string> {\r\n  const encoder = new TextEncoder();\r\n  const data = encoder.encode(verifier);\r\n  const digest = await crypto.subtle.digest(\"SHA-256\", data);\r\n  return btoa(String.fromCharCode(...new Uint8Array(digest)))\r\n    .replace(/\\+/g, \"-\")\r\n    .replace(/\\//g, \"_\")\r\n    .replace(/=/g, \"\");\r\n}\r\n","\"use client\";\r\nimport React, { createContext, useContext, useState, useEffect } from \"react\";\r\nimport { UniDirConfig } from \".\";\r\nimport { verifyAccessToken } from \"./jwks\";\r\nimport { JWTPayload } from \"jose\";\r\n\r\nconst UserContext = createContext<{\r\n  user: any;\r\n  isLoading: boolean;\r\n  config: UniDirConfig | null;\r\n}>({ user: null, isLoading: true, config: null });\r\n\r\nexport function UserProvider({\r\n  children,\r\n  config,\r\n}: {\r\n  children: React.ReactNode;\r\n  config: UniDirConfig;\r\n}) {\r\n  const [user, setUser] = useState<JWTPayload | null>(null);\r\n  const [isLoading, setIsLoading] = useState(true);\r\n  const [token, setToken] = useState(null);\r\n  const [accessToken, setAccessToken] = useState(null);\r\n  const [refreshToken, setRefreshToken] = useState(null);\r\n  const [idToken, setIdToken] = useState(null);\r\n  const [client, setClient] = useState(null);\r\n  const [expiresIn, setExpiresIn] = useState(null);\r\n\r\n  //   useEffect(() => {\r\n  //     fetch(\"/api/auth/me\")\r\n  //       .then((res) => res.json())\r\n  //       .then((data) => {\r\n  //         if (data) {\r\n  //           setUser(data.client);\r\n  //           setToken(data);\r\n  //           setAccessToken(data.access_token);\r\n  //           setRefreshToken(data.refresh_token);\r\n  //           const idTokenAll = await jwtVerify(\r\n  //             data.id_token,\r\n  //             config.jwks || \"https://oauth.biocloud.pro/jwks.json\"\r\n  //           );\r\n  //           setIdToken(data.id_token);\r\n  //           setClient(data.client);\r\n  //           setExpiresIn(data.expres_in);\r\n  //         }\r\n  //       })\r\n  //       .catch(() => setUser(null));\r\n  //   }, []);\r\n  useEffect(() => {\r\n    async function loadUser() {\r\n      try {\r\n        const res = await fetch(\"/api/auth/me\");\r\n        const data = await res.json();\r\n        //setUser(data.user);\r\n        const { companyId, domainId, email, email_verified, name } =\r\n          await verifyAccessToken(\r\n            data.id_token,\r\n            config.jwks || \"https://oauth.igoodworks.com/jwks.json\",\r\n            {\r\n              issuer: config.issuer || \"http://oauth.unidir.igoodworks.com/\",\r\n              audience: config.clientId,\r\n            }\r\n          );\r\n        setUser({ companyId, domainId, email, email_verified, name });\r\n      } finally {\r\n        setIsLoading(false);\r\n      }\r\n    }\r\n    loadUser();\r\n  }, []);\r\n  return (\r\n    <UserContext.Provider\r\n      value={{\r\n        user,\r\n        isLoading,\r\n        config,\r\n        // token,\r\n        // expiresIn,\r\n        // accessToken,\r\n        // refreshToken,\r\n        // client,\r\n        // idToken,\r\n      }}\r\n    >\r\n      {children}\r\n    </UserContext.Provider>\r\n  );\r\n}\r\n\r\nexport function getDeviceId(): string {\r\n  if (typeof window === \"undefined\") return \"server-default\";\r\n\r\n  let id = localStorage.getItem(\"unidir_device_id\");\r\n  if (!id) {\r\n    id = crypto.randomUUID();\r\n    localStorage.setItem(\"unidir_device_id\", id);\r\n  }\r\n  return id;\r\n}\r\n\r\nexport const useUser = () => useContext(UserContext);\r\n","import { jwtVerify, createRemoteJWKSet } from \"jose\";\r\n\r\n// Replace with your IdP issuer and audience\r\nconst ISSUER = \"https://YOUR_ISSUER/\";\r\nconst AUDIENCE = \"YOUR_CLIENT_ID\";\r\n\r\nexport async function verifyAccessToken(\r\n  token: string,\r\n  jwksUrl: string,\r\n  options: Record<string, any> = {}\r\n) {\r\n  const JWKS = createRemoteJWKSet(new URL(jwksUrl));\r\n  const { payload } = await jwtVerify(token, JWKS, {\r\n    issuer: options.issuer,\r\n    audience: options.audience,\r\n  });\r\n  // Optionally apply custom claims checks here (e.g., roles, scopes)\r\n  return payload;\r\n}\r\n"],"mappings":"AAAA,OAAS,SAAAA,MAAa,SCAtB,OAAS,cAAAC,EAAY,cAAAC,MAAkB,OAEvC,IAAMC,EAAgBC,GACpB,IAAI,YAAY,EAAE,OAAOA,EAAO,OAAO,GAAI,GAAG,EAAE,MAAM,EAAG,EAAE,CAAC,EAE9D,eAAsBC,EAAQC,EAAcF,EAAgB,CAC1D,OAAO,IAAIH,EAAWK,CAAO,EAC1B,mBAAmB,CAAE,IAAK,MAAO,IAAK,SAAU,CAAC,EACjD,YAAY,EACZ,kBAAkB,KAAK,EACvB,QAAQH,EAAaC,CAAM,CAAC,CACjC,CAEA,eAAsBG,EAAQC,EAAeJ,EAAgB,CAC3D,GAAI,CACF,GAAM,CAAE,QAAAE,CAAQ,EAAI,MAAMJ,EAAWM,EAAOL,EAAaC,CAAM,CAAC,EAChE,OAAOE,CACT,MAAY,CACV,OAAO,IACT,CACF,CDlBA,OAAsB,gBAAAG,MAAoB,cAC1C,OAAS,YAAAC,MAAgB,kBEHlB,SAASC,GAA+B,CAC7C,IAAMC,EAAQ,IAAI,WAAW,EAAE,EAC/B,cAAO,gBAAgBA,CAAK,EACrB,KAAK,OAAO,aAAa,GAAGA,CAAK,CAAC,EACtC,QAAQ,MAAO,GAAG,EAClB,QAAQ,MAAO,GAAG,EAClB,QAAQ,KAAM,EAAE,CACrB,CAEA,eAAsBC,EAAsBC,EAAmC,CAE7E,IAAMC,EADU,IAAI,YAAY,EACX,OAAOD,CAAQ,EAC9BE,EAAS,MAAM,OAAO,OAAO,OAAO,UAAWD,CAAI,EACzD,OAAO,KAAK,OAAO,aAAa,GAAG,IAAI,WAAWC,CAAM,CAAC,CAAC,EACvD,QAAQ,MAAO,GAAG,EAClB,QAAQ,MAAO,GAAG,EAClB,QAAQ,KAAM,EAAE,CACrB,CChBA,OAAgB,iBAAAC,EAAe,cAAAC,EAAY,YAAAC,EAAU,aAAAC,MAAiB,QCDtE,OAAS,aAAAC,EAAW,sBAAAC,MAA0B,OAM9C,eAAsBC,EACpBC,EACAC,EACAC,EAA+B,CAAC,EAChC,CACA,IAAMC,EAAOC,EAAmB,IAAI,IAAIH,CAAO,CAAC,EAC1C,CAAE,QAAAI,CAAQ,EAAI,MAAMC,EAAUN,EAAOG,EAAM,CAC/C,OAAQD,EAAQ,OAChB,SAAUA,EAAQ,QACpB,CAAC,EAED,OAAOG,CACT,CDqDI,cAAAE,MAAA,oBAjEJ,IAAMC,EAAcC,EAIjB,CAAE,KAAM,KAAM,UAAW,GAAM,OAAQ,IAAK,CAAC,EAEzC,SAASC,EAAa,CAC3B,SAAAC,EACA,OAAAC,CACF,EAGG,CACD,GAAM,CAACC,EAAMC,CAAO,EAAIC,EAA4B,IAAI,EAClD,CAACC,EAAWC,CAAY,EAAIF,EAAS,EAAI,EACzC,CAACG,EAAOC,CAAQ,EAAIJ,EAAS,IAAI,EACjC,CAACK,EAAaC,CAAc,EAAIN,EAAS,IAAI,EAC7C,CAACO,EAAcC,CAAe,EAAIR,EAAS,IAAI,EAC/C,CAACS,EAASC,CAAU,EAAIV,EAAS,IAAI,EACrC,CAACW,EAAQC,CAAS,EAAIZ,EAAS,IAAI,EACnC,CAACa,EAAWC,CAAY,EAAId,EAAS,IAAI,EAsB/C,OAAAe,EAAU,IAAM,CACd,eAAeC,GAAW,CACxB,GAAI,CAEF,IAAMC,EAAO,MADD,MAAM,MAAM,cAAc,GACf,KAAK,EAEtB,CAAE,UAAAC,EAAW,SAAAC,EAAU,MAAAC,EAAO,eAAAC,EAAgB,KAAAC,CAAK,EACvD,MAAMC,EACJN,EAAK,SACLpB,EAAO,MAAQ,yCACf,CACE,OAAQA,EAAO,QAAU,sCACzB,SAAUA,EAAO,QACnB,CACF,EACFE,EAAQ,CAAE,UAAAmB,EAAW,SAAAC,EAAU,MAAAC,EAAO,eAAAC,EAAgB,KAAAC,CAAK,CAAC,CAC9D,QAAE,CACApB,EAAa,EAAK,CACpB,CACF,CACAc,EAAS,CACX,EAAG,CAAC,CAAC,EAEHxB,EAACC,EAAY,SAAZ,CACC,MAAO,CACL,KAAAK,EACA,UAAAG,EACA,OAAAJ,CAOF,EAEC,SAAAD,EACH,CAEJ,CAaO,IAAM4B,EAAU,IAAMC,EAAWC,CAAW,EHwEpC,cAAAC,MAAA,oBAjJf,IAAMC,EAA+B,CACnC,MAAO,QACP,UAAW,kBACX,OAAQ,SACR,SAAU,WACV,GAAI,IACN,EAEO,SAASC,GAAWC,EAAsBC,EAAwB,CACvE,IAAMC,EAAgB,CAAE,GAAGJ,EAAgB,GAAGG,CAAQ,EAEhDE,EAAa,MAAOC,GAA+B,CACvD,IAAMC,EAAeD,EAAI,QAAQ,IAAI,QAAQ,GAAK,GAE5CE,EADUC,EAAMF,CAAY,EACL,eAC7B,OAAKC,EACE,MAAME,EAAQF,EAAcN,EAAO,MAAM,EADtB,IAE5B,EAEA,MAAO,CACL,WAAY,IAAM,MAAOI,GAAqB,CAC5C,IAAMK,EAASL,EAAI,QAAQ,SAAS,MAAM,GAAG,EAAE,IAAI,EAG7CM,EADgBN,EAAI,QAAQ,aAAa,IAAI,WAAW,GAE3CJ,EAAO,UAAY,iBAGtC,GAAIS,IAAWP,EAAc,MAAO,CAClC,IAAMS,EAAWP,EAAI,QAAQ,aAAa,IAAI,UAAU,GAAK,IACvDQ,EAAWC,EAAqB,EAChCC,EAAY,MAAMC,EAAsBH,CAAQ,EAEhDI,EAAM,IAAI,IAAI,GAAGhB,EAAO,MAAM,YAAY,EAChDgB,EAAI,aAAa,IAAI,YAAahB,EAAO,QAAQ,EACjDgB,EAAI,aAAa,IAAI,gBAAiB,MAAM,EAC5CA,EAAI,aAAa,IAAI,eAAgBhB,EAAO,WAAW,EACvDgB,EAAI,aAAa,IAAI,QAAS,sBAAsB,EACpDA,EAAI,aAAa,IAAI,iBAAkBF,CAAS,EAChDE,EAAI,aAAa,IAAI,wBAAyB,MAAM,EAChDN,GACFM,EAAI,aAAa,IAAI,YAAaN,CAAiB,EAErD,IAAMO,EAAWC,EAAa,SAASF,EAAI,SAAS,CAAC,EAGrD,OAAAC,EAAS,QAAQ,IAAI,uBAAwBL,EAAU,CACrD,SAAU,GACV,OAAQ,GACR,SAAU,MACV,OAAQ,GACV,CAAC,EACDK,EAAS,QAAQ,IAAI,mBAAoBP,EAAmB,CAC1D,SAAU,GACV,OAAQ,GACR,OAAQ,GACV,CAAC,EACDO,EAAS,QAAQ,IAAI,mBAAoBN,EAAU,CACjD,SAAU,GACV,OAAQ,GACV,CAAC,EACMM,CACT,CAEA,GAAIR,IAAWP,EAAc,GAAI,CAC/B,IAAMiB,EAAU,MAAMhB,EAAWC,CAAG,EACpC,OAAKe,EAIED,EAAa,KAAKC,CAAO,EAHvB,IAAID,EAAa,KAAK,UAAU,CAAE,KAAM,IAAK,CAAC,EAAG,CACtD,OAAQ,GACV,CAAC,CAEL,CAGA,GAAIT,IAAWP,EAAc,OAAQ,CACnC,IAAMe,EAAWC,EAAa,SAAS,IAAI,IAAI,IAAKd,EAAI,GAAG,CAAC,EAC5D,OAAAa,EAAS,QAAQ,OAAO,gBAAgB,EACjCA,CACT,CACA,GAAIR,IAAW,WAAY,CACzB,IAAMW,EAAOhB,EAAI,QAAQ,aAAa,IAAI,MAAM,EAC1CQ,EAAWR,EAAI,QAAQ,IAAI,sBAAsB,GAAG,MAE1D,GAAI,CAACgB,GAAQ,CAACR,EACZ,OAAO,IAAIM,EAAa,2BAA4B,CAAE,OAAQ,GAAI,CAAC,EAIrE,IAAMG,EADiBjB,EAAI,QAAQ,IAAI,kBAAkB,GAAG,OACpBM,EAmBlCY,EAAS,MAjBH,MAAM,MAAM,GAAGtB,EAAO,MAAM,SAAU,CAChD,OAAQ,OACR,QAAS,CACP,eAAgB,mBAChB,cAAeqB,CACjB,EACA,KAAM,KAAK,UAAU,CACnB,WAAY,qBACZ,UAAWrB,EAAO,SAClB,cAAeA,EAAO,aACtB,KAAAoB,EACA,cAAeR,EACf,aAAcZ,EAAO,YACrB,UAAWqB,CACb,CAAC,CACH,CAAC,GAEwB,KAAK,EAC9B,GAAIC,EAAO,MAAO,OAAOJ,EAAa,KAAKI,EAAQ,CAAE,OAAQ,GAAI,CAAC,EAElE,IAAMC,EAAmB,MAAMC,EAAQF,EAAQtB,EAAO,MAAM,EAEtDW,EAAWP,EAAI,QAAQ,IAAI,kBAAkB,GAAG,OAAS,IACzDa,EAAWC,EAAa,SAAS,IAAI,IAAIP,EAAUP,EAAI,GAAG,CAAC,EAGjE,OAAAa,EAAS,QAAQ,OAAO,sBAAsB,EAC9CA,EAAS,QAAQ,IAAI,iBAAkBM,EAAkB,CACvD,SAAU,GACV,OAAQ,GACR,SAAU,MACV,OAAQ,KAAU,EACpB,CAAC,EAEMN,CACT,CAEA,OAAO,IAAIC,EAAa,YAAa,CAAE,OAAQ,GAAI,CAAC,CACtD,EAEA,WAAAf,EAEA,qBACEsB,GAEO,MAAOC,GAAa,CAEzB,GAAM,CAAE,QAAAC,CAAQ,EAAI,KAAM,QAAO,cAAc,EACzCR,EAAU,MAAMhB,EAAW,CAAE,QAAS,MAAMwB,EAAQ,CAAE,CAAQ,EAEpE,OAAKR,GACHS,EAAS1B,EAAc,SAAS,EAI3BL,EAAC4B,EAAA,CAAW,GAAGC,EAAO,KAAMP,EAAS,CAC9C,EAGF,mBAAoB,IACX,MAAOf,GAAqB,CACjC,IAAME,EAAeF,EAAI,QAAQ,IAAI,gBAAgB,GAAG,MAKxD,GAAI,EAJYE,EACZ,MAAME,EAAQF,EAAcN,EAAO,MAAM,EACzC,MAEU,CAEZ,GAAM,CAAE,SAAA6B,EAAU,OAAAC,CAAO,EAAI1B,EAAI,QAC3BY,EAAM,IAAI,IAAId,EAAc,UAAWE,EAAI,GAAG,EACpD,OAAAY,EAAI,aAAa,IAAI,WAAY,GAAGa,CAAQ,GAAGC,CAAM,EAAE,EAChDZ,EAAa,SAASF,CAAG,CAClC,CAEA,OAAOE,EAAa,KAAK,CAC3B,CAEJ,CACF","names":["parse","EncryptJWT","jwtDecrypt","getSecretKey","secret","encrypt","payload","decrypt","token","NextResponse","redirect","generateCodeVerifier","array","generateCodeChallenge","verifier","data","digest","createContext","useContext","useState","useEffect","jwtVerify","createRemoteJWKSet","verifyAccessToken","token","jwksUrl","options","JWKS","createRemoteJWKSet","payload","jwtVerify","jsx","UserContext","createContext","UserProvider","children","config","user","setUser","useState","isLoading","setIsLoading","token","setToken","accessToken","setAccessToken","refreshToken","setRefreshToken","idToken","setIdToken","client","setClient","expiresIn","setExpiresIn","useEffect","loadUser","data","companyId","domainId","email","email_verified","name","verifyAccessToken","useUser","useContext","UserContext","jsx","defaultActions","initUniDir","config","actions","uniDirActions","getSession","req","cookieHeader","sessionToken","parse","decrypt","action","effectiveDeviceId","returnTo","verifier","generateCodeVerifier","challenge","generateCodeChallenge","url","response","NextResponse","session","code","deviceIdToUse","tokens","encryptedSession","encrypt","Component","props","headers","redirect","pathname","search"]}

package/package.json

@@ -1,10 +1,13 @@
 {
   "name": "@unidir/unidir-nextjs",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.mjs",
   "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
   "publishConfig": {
     "access": "public"
   },

package/src/client.tsx

@@ -1,101 +0,0 @@
-"use client";
-import React, { createContext, useContext, useState, useEffect } from "react";
-import { UniDirConfig } from ".";
-import { verifyAccessToken } from "./jwks";
-import { JWTPayload } from "jose";
-
-const UserContext = createContext<{
-  user: any;
-  isLoading: boolean;
-  config: UniDirConfig | null;
-}>({ user: null, isLoading: true, config: null });
-
-export function UserProvider({
-  children,
-  config,
-}: {
-  children: React.ReactNode;
-  config: UniDirConfig;
-}) {
-  const [user, setUser] = useState<JWTPayload | null>(null);
-  const [isLoading, setIsLoading] = useState(true);
-  const [token, setToken] = useState(null);
-  const [accessToken, setAccessToken] = useState(null);
-  const [refreshToken, setRefreshToken] = useState(null);
-  const [idToken, setIdToken] = useState(null);
-  const [client, setClient] = useState(null);
-  const [expiresIn, setExpiresIn] = useState(null);
-
-  //   useEffect(() => {
-  //     fetch("/api/auth/me")
-  //       .then((res) => res.json())
-  //       .then((data) => {
-  //         if (data) {
-  //           setUser(data.client);
-  //           setToken(data);
-  //           setAccessToken(data.access_token);
-  //           setRefreshToken(data.refresh_token);
-  //           const idTokenAll = await jwtVerify(
-  //             data.id_token,
-  //             config.jwks || "https://oauth.biocloud.pro/jwks.json"
-  //           );
-  //           setIdToken(data.id_token);
-  //           setClient(data.client);
-  //           setExpiresIn(data.expres_in);
-  //         }
-  //       })
-  //       .catch(() => setUser(null));
-  //   }, []);
-  useEffect(() => {
-    async function loadUser() {
-      try {
-        const res = await fetch("/api/auth/me");
-        const data = await res.json();
-        //setUser(data.user);
-        const { companyId, domainId, email, email_verified, name } =
-          await verifyAccessToken(
-            data.id_token,
-            config.jwks || "https://oauth.igoodworks.com/jwks.json",
-            {
-              issuer: config.issuer || "http://oauth.unidir.igoodworks.com/",
-              audience: config.clientId,
-            }
-          );
-        setUser({ companyId, domainId, email, email_verified, name });
-      } finally {
-        setIsLoading(false);
-      }
-    }
-    loadUser();
-  }, []);
-  return (
-    <UserContext.Provider
-      value={{
-        user,
-        isLoading,
-        config,
-        // token,
-        // expiresIn,
-        // accessToken,
-        // refreshToken,
-        // client,
-        // idToken,
-      }}
-    >
-      {children}
-    </UserContext.Provider>
-  );
-}
-
-export function getDeviceId(): string {
-  if (typeof window === "undefined") return "server-default";
-
-  let id = localStorage.getItem("unidir_device_id");
-  if (!id) {
-    id = crypto.randomUUID();
-    localStorage.setItem("unidir_device_id", id);
-  }
-  return id;
-}
-
-export const useUser = () => useContext(UserContext);

package/src/index.tsx

@@ -1,198 +0,0 @@
-import { parse } from "cookie";
-import { encrypt, decrypt } from "./session";
-import { NextRequest, NextResponse } from "next/server";
-import { redirect } from "next/navigation";
-import { generateCodeVerifier, generateCodeChallenge } from "./pkce";
-
-export interface UniDirConfig {
-  domain: string;
-  clientId: string;
-  clientSecret: string;
-  secret: string;
-  redirectUri: string;
-  logoutRedirectUri?: string;
-  deviceId?: string;
-  scope?: string;
-  audience?: string;
-  jwks?: string;
-  issuer?: string;
-}
-
-interface UniDirAction {
-  login: string;
-  loginPath: string;
-  logout: string;
-  callback: string;
-  me: string;
-}
-const defaultActions: UniDirAction = {
-  login: "login",
-  loginPath: "/api/auth/login",
-  logout: "logout",
-  callback: "callback",
-  me: "me",
-};
-
-export function initUniDir(config: UniDirConfig, actions?: UniDirAction) {
-  const uniDirActions = { ...defaultActions, ...actions };
-
-  const getSession = async (req: Request | NextRequest) => {
-    const cookieHeader = req.headers.get("cookie") || "";
-    const cookies = parse(cookieHeader);
-    const sessionToken = cookies["unidir_session"];
-    if (!sessionToken) return null;
-    return await decrypt(sessionToken, config.secret);
-  };
-
-  return {
-    handleAuth: () => async (req: NextRequest) => {
-      const action = req.nextUrl.pathname.split("/").pop();
-      // Capture the deviceId from the query param sent by the LoginButton
-      const queryDeviceId = req.nextUrl.searchParams.get("device_id");
-      const effectiveDeviceId =
-        queryDeviceId || config.deviceId || "unknown-device";
-      //const deviceId = req.headers.get("x-device-id");
-
-      if (action === uniDirActions.login) {
-        const returnTo = req.nextUrl.searchParams.get("returnTo") || "/";
-        const verifier = generateCodeVerifier();
-        const challenge = await generateCodeChallenge(verifier);
-
-        const url = new URL(`${config.domain}/authorize`);
-        url.searchParams.set("client_id", config.clientId);
-        url.searchParams.set("response_type", "code");
-        url.searchParams.set("redirect_uri", config.redirectUri);
-        url.searchParams.set("scope", "openid profile email");
-        url.searchParams.set("code_challenge", challenge);
-        url.searchParams.set("code_challenge_method", "S256");
-        if (effectiveDeviceId) {
-          url.searchParams.set("device_id", effectiveDeviceId);
-        }
-        const response = NextResponse.redirect(url.toString());
-
-        // Store verifier in a short-lived, secure cookie
-        response.cookies.set("unidir_pkce_verifier", verifier, {
-          httpOnly: true,
-          secure: true,
-          sameSite: "lax",
-          maxAge: 60 * 5, // 5 minutes
-        });
-        response.cookies.set("unidir_device_id", effectiveDeviceId, {
-          httpOnly: true,
-          secure: true,
-          maxAge: 60 * 10, // 10 minutes
-        });
-        response.cookies.set("unidir_return_to", returnTo, {
-          httpOnly: true,
-          maxAge: 60 * 5,
-        });
-        return response;
-      }
-      // Profile Handler (for useUser hook)
-      if (action === uniDirActions.me) {
-        const session = await getSession(req);
-        if (!session)
-          return new NextResponse(JSON.stringify({ user: null }), {
-            status: 401,
-          });
-        return NextResponse.json(session);
-      }
-
-      // Logout Handler
-      if (action === uniDirActions.logout) {
-        const response = NextResponse.redirect(new URL("/", req.url));
-        response.cookies.delete("unidir_session");
-        return response;
-      }
-      if (action === "callback") {
-        const code = req.nextUrl.searchParams.get("code");
-        const verifier = req.cookies.get("unidir_pkce_verifier")?.value;
-
-        if (!code || !verifier) {
-          return new NextResponse("Missing code or verifier", { status: 400 });
-        }
-
-        const storedDeviceId = req.cookies.get("unidir_device_id")?.value;
-        const deviceIdToUse = storedDeviceId || effectiveDeviceId;
-
-        const res = await fetch(`${config.domain}/token`, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            "x-device-id": deviceIdToUse, // Added to header
-          },
-          body: JSON.stringify({
-            grant_type: "authorization_code",
-            client_id: config.clientId,
-            client_secret: config.clientSecret,
-            code,
-            code_verifier: verifier, // Pass the verifier back
-            redirect_uri: config.redirectUri,
-            device_id: deviceIdToUse,
-          }),
-        });
-
-        const tokens = await res.json();
-        if (tokens.error) return NextResponse.json(tokens, { status: 400 });
-
-        const encryptedSession = await encrypt(tokens, config.secret);
-        // const response = NextResponse.redirect(new URL("/", req.url));
-        const returnTo = req.cookies.get("unidir_return_to")?.value || "/";
-        const response = NextResponse.redirect(new URL(returnTo, req.url));
-
-        // Clean up PKCE cookie and set session
-        response.cookies.delete("unidir_pkce_verifier");
-        response.cookies.set("unidir_session", encryptedSession, {
-          httpOnly: true,
-          secure: true,
-          sameSite: "lax",
-          maxAge: 60 * 60 * 24,
-        });
-
-        return response;
-      }
-
-      return new NextResponse("Not Found", { status: 404 });
-    },
-
-    getSession,
-
-    withPageAuthRequired: <P extends object>(
-      Component: React.ComponentType<P>
-    ) => {
-      return async (props: P) => {
-        // Import headers dynamically to avoid issues in non-server environments
-        const { headers } = await import("next/headers");
-        const session = await getSession({ headers: await headers() } as any);
-
-        if (!session) {
-          redirect(uniDirActions.loginPath);
-        }
-
-        // Return the component as JSX
-        return <Component {...props} user={session} />;
-      };
-    },
-
-    withMiddlewareAuth: () => {
-      return async (req: NextRequest) => {
-        const sessionToken = req.cookies.get("unidir_session")?.value;
-        const session = sessionToken
-          ? await decrypt(sessionToken, config.secret)
-          : null;
-
-        if (!session) {
-          // Redirect to login but save the current URL to return back later
-          const { pathname, search } = req.nextUrl;
-          const url = new URL(uniDirActions.loginPath, req.url);
-          url.searchParams.set("returnTo", `${pathname}${search}`);
-          return NextResponse.redirect(url);
-        }
-
-        return NextResponse.next();
-      };
-    },
-  };
-}
-
-export { UserProvider, useUser } from "./client";

package/src/jwks.ts

@@ -1,19 +0,0 @@
-import { jwtVerify, createRemoteJWKSet } from "jose";
-
-// Replace with your IdP issuer and audience
-const ISSUER = "https://YOUR_ISSUER/";
-const AUDIENCE = "YOUR_CLIENT_ID";
-
-export async function verifyAccessToken(
-  token: string,
-  jwksUrl: string,
-  options: Record<string, any> = {}
-) {
-  const JWKS = createRemoteJWKSet(new URL(jwksUrl));
-  const { payload } = await jwtVerify(token, JWKS, {
-    issuer: options.issuer,
-    audience: options.audience,
-  });
-  // Optionally apply custom claims checks here (e.g., roles, scopes)
-  return payload;
-}

package/src/pkce.ts

@@ -1,18 +0,0 @@
-export function generateCodeVerifier(): string {
-  const array = new Uint8Array(32);
-  crypto.getRandomValues(array);
-  return btoa(String.fromCharCode(...array))
-    .replace(/\+/g, "-")
-    .replace(/\//g, "_")
-    .replace(/=/g, "");
-}
-
-export async function generateCodeChallenge(verifier: string): Promise<string> {
-  const encoder = new TextEncoder();
-  const data = encoder.encode(verifier);
-  const digest = await crypto.subtle.digest("SHA-256", data);
-  return btoa(String.fromCharCode(...new Uint8Array(digest)))
-    .replace(/\+/g, "-")
-    .replace(/\//g, "_")
-    .replace(/=/g, "");
-}

package/src/session.ts

@@ -1,21 +0,0 @@
-import { EncryptJWT, jwtDecrypt } from "jose";
-
-const getSecretKey = (secret: string) =>
-  new TextEncoder().encode(secret.padEnd(32, "0").slice(0, 32));
-
-export async function encrypt(payload: any, secret: string) {
-  return new EncryptJWT(payload)
-    .setProtectedHeader({ alg: "dir", enc: "A256GCM" })
-    .setIssuedAt()
-    .setExpirationTime("24h")
-    .encrypt(getSecretKey(secret));
-}
-
-export async function decrypt(token: string, secret: string) {
-  try {
-    const { payload } = await jwtDecrypt(token, getSecretKey(secret));
-    return payload;
-  } catch (e) {
-    return null;
-  }
-}

package/tsconfig.json

@@ -1,21 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ESNext",
-    "module": "ESNext",
-    "moduleResolution": "bundler",
-    "lib": ["DOM", "DOM.Iterable", "ESNext"],
-    "jsx": "react-jsx",
-    "declaration": true,
-    "declarationMap": true,
-    "sourceMap": true,
-    "outDir": "./dist",
-    "isolatedModules": true,
-    "esModuleInterop": true,
-    "forceConsistentCasingInFileNames": true,
-    "strict": true,
-    "skipLibCheck": true,
-    "types": ["node"]
-  },
-  "include": ["src"],
-  "exclude": ["node_modules", "dist"]
-}

package/tsup.config.ts

@@ -1,18 +0,0 @@
-import { defineConfig } from "tsup";
-
-export default defineConfig({
-  entry: ["src/index.tsx"],
-  format: ["cjs", "esm"],
-  dts: true,
-  splitting: false,
-  sourcemap: true,
-  clean: true,
-  minify: true,
-  bundle: true,
-  external: ["react", "next"],
-  outExtension({ format }) {
-    return {
-      js: format === "esm" ? ".mjs" : ".cjs",
-    };
-  },
-});