@zitadel/sdk-core 1.0.0-alpha.24 → 1.0.0-alpha.28

package/dist/middleware.mjs

@@ -0,0 +1,764 @@
+import { isJwtShaped, verifyJwt } from "./jwt.mjs";
+import { joinURL } from "ufo";
+//#region src/middleware.ts
+/**
+* Headers that must never be forwarded to an upstream service.
+* These are connection-level headers that are meaningful only between
+* two directly connected peers and become invalid when proxied.
+*/
+const HOP_BY_HOP = /* @__PURE__ */ new Set([
+	"connection",
+	"content-length",
+	"host",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade"
+]);
+/**
+* SDK-internal headers that must never be forwarded to the upstream backend.
+* These headers carry session data between the middleware and server components;
+* forwarding them upstream would expose internal state and allow header injection.
+*/
+const INTERNAL_HEADERS = /* @__PURE__ */ new Set(["x-nextgen-auth-token"]);
+/**
+* Returns `true` when `pathname` matches at least one entry in `routes`.
+*
+* An entry ending with `*` matches any path that starts with the prefix
+* before the `*`. All other entries match exactly, ignoring a trailing slash
+* on either side: `/profile` and `/profile/` name the same route, and several
+* frameworks (Qwik Router by default) serve the slashed form as canonical. An
+* exact compare would let `/profile/` past a `protectedRoutes: ["/profile"]`.
+*
+* @param pathname - The URL pathname to test.
+* @param routes   - The list of route patterns to match against.
+* @returns `true` if at least one pattern matches.
+*/
+function matchesRoutes(pathname, routes) {
+	const withoutTrailingSlash = (path) => {
+		let end = path.length;
+		while (end > 1 && path.charCodeAt(end - 1) === 47) end--;
+		return path.slice(0, end);
+	};
+	const path = withoutTrailingSlash(pathname);
+	return routes.some((route) => {
+		if (route.endsWith("*")) return pathname.startsWith(route.slice(0, -1));
+		return path === withoutTrailingSlash(route);
+	});
+}
+/**
+* The query parameter that brings a signed-out request's path to the login
+* page, where `<zitadel-login>` returns after sign-in.
+*/
+const RETURN_PATH_PARAM = "next";
+/**
+* Where a signed-out request for a protected route is sent: `loginPath`, with
+* the requested path and query string in `next`, so `<zitadel-login>` returns
+* to the page as it was asked for, filters and tabs included. The fragment
+* never reaches the server, so it cannot be carried.
+*
+* A `next` the request carries itself is left out, so a redirect never nests
+* an earlier one: should the login page be protected by mistake, each pass of
+* the redirect loop would otherwise wrap the last and grow the URL. The rest
+* of the query keeps the encoding it was sent with.
+*
+* Whatever query `loginPath` has of its own is kept, except a `next`, which
+* this replaces.
+*
+* @param loginPath  - The login page, a path starting with a single `/`.
+* @param requestUrl - The full URL of the signed-out request.
+* @returns The URL to redirect to, on the request's origin.
+*/
+function loginRedirectUrl(loginPath, requestUrl) {
+	const requested = new URL(requestUrl);
+	const query = requested.search.slice(1).split("&").filter((pair) => !new URLSearchParams(pair).has(RETURN_PATH_PARAM)).join("&");
+	const loginUrl = new URL(loginPath, requested);
+	loginUrl.searchParams.set(RETURN_PATH_PARAM, query === "" ? requested.pathname : `${requested.pathname}?${query}`);
+	return loginUrl;
+}
+/**
+* Whether a proxied call may carry the confidential project secret.
+*
+* ADR 036: the browser flow needs the secret only for the handoff exchange
+* (`POST /sessions/exchange`). Stamping it onto every proxied operation would
+* turn the app's public `/__nextgen/*` boundary into an open relay carrying
+* project-level authority for any anonymous caller.
+*
+* @param method   - The proxied request's HTTP method.
+* @param pathname - The path after the proxy prefix, e.g. `/sessions/exchange`.
+* @returns `true` only for the handoff exchange.
+*/
+function requiresProjectSecret(method, pathname) {
+	return method.toUpperCase() === "POST" && pathname === "/sessions/exchange";
+}
+/**
+* An upstream `Location`, pointed back at this app.
+*
+* Only the path, query and fragment survive; whatever origin the upstream
+* named is discarded and the result is re-based onto the request's own URL.
+* That keeps both properties the blanket strip was protecting -- an internal
+* hostname can never reach the browser, and the redirect can only ever land on
+* this app -- without needing to know what this app's public origin is.
+*
+* Comparing origins instead would have required that knowledge, and there is
+* no reliable source for it: `X-Forwarded-Host` is attacker-settable on a
+* direct request, and the request's own host is wrong behind a proxy that
+* terminates TLS or rewrites it. Discarding the origin sidesteps the question
+* -- a redirect to another origin becomes the same path on this one rather
+* than being dropped, so a deployment behind such a proxy works instead of
+* landing on a blank page.
+*
+* Nothing legitimate on this path points off-origin anyway: an outbound
+* redirect to a provider travels as `step.redirect_url` in a JSON body and the
+* widget performs it, never as a proxied header.
+*
+* A relative reference resolves against the path it came from (RFC 3986 §5),
+* so `next?flow=x` answered to `/__nextgen/idp/google/callback` means
+* `/__nextgen/idp/google/next?flow=x`. An unparseable value is the one case with
+* nothing to forward.
+*/
+function ontoThisApp(location, selfUrl) {
+	if (selfUrl === void 0 || selfUrl === "") return;
+	try {
+		const base = new URL(selfUrl);
+		const target = new URL(location, base);
+		return new URL(`${target.pathname}${target.search}${target.hash}`, base).toString();
+	} catch {
+		return;
+	}
+}
+/**
+* Filters upstream response headers for proxying: strips hop-by-hop headers
+* and `set-cookie` (handled separately via `getSetCookie()`), and reduces
+* `location` to a redirect that can only land on this app.
+*
+* `location` was stripped outright until the identity-provider callback
+* needed it: the provider returns the browser to `/__nextgen/idp/{slug}/callback`,
+* and the engine answers `303` back to the page the sign-in started on. That
+* is a top-level navigation with no JavaScript in the loop, so a dropped
+* `Location` leaves the browser on an empty page. Outbound redirects to a
+* provider do not travel this way -- they arrive as `step.redirect_url` in a
+* JSON body and the widget navigates -- so nothing legitimate points off-origin.
+*
+* @param upstream - The upstream response headers.
+* @param selfUrl - The app's own request URL, which is both the origin a
+*   redirect must land on and the base a relative one resolves against.
+*   Omitting it keeps the old behaviour of dropping every redirect.
+* @returns A new `Headers` object with filtered headers.
+*/
+function filterResponseHeaders(upstream, selfUrl) {
+	const filtered = new Headers();
+	upstream.forEach((value, key) => {
+		const name = key.toLowerCase();
+		if (HOP_BY_HOP.has(name) || name === "set-cookie") return;
+		if (name === "location") {
+			const onThisApp = ontoThisApp(value, selfUrl);
+			if (onThisApp !== void 0) filtered.set("location", onThisApp);
+			return;
+		}
+		filtered.set(key, value);
+	});
+	return filtered;
+}
+/** The cookie the server sets a session in and reads it from. */
+const SERVER_SESSION_COOKIE = "__nextgen_session";
+/** Every app's own session cookie starts with this. */
+const PROJECT_SESSION_COOKIE_PREFIX = `${SERVER_SESSION_COOKIE}_`;
+/**
+* The cookie an app keeps its project's session in: the server's name with the
+* project id appended (ADR 073). A browser shares one cookie jar across every
+* port of a host, so under the server's name alone the Console of a local
+* server and every app on `localhost` would hold their sessions in one slot and
+* replace each other's.
+*
+* Every byte of the id outside `[A-Za-z0-9_-]` is percent-encoded, so any
+* configured id makes a valid cookie name. Ids the server mints need none.
+*/
+function sessionCookieName(projectId) {
+	let name = PROJECT_SESSION_COOKIE_PREFIX;
+	for (const byte of new TextEncoder().encode(projectId)) {
+		const char = String.fromCharCode(byte);
+		name += /[A-Za-z0-9_-]/.test(char) ? char : `%${byte.toString(16).toUpperCase().padStart(2, "0")}`;
+	}
+	return name;
+}
+/** Whether `name` is a session cookie: the server's, or any app's own. */
+function isSessionCookie(name) {
+	return name === "__nextgen_session" || name.startsWith(PROJECT_SESSION_COOKIE_PREFIX);
+}
+/**
+* The `Set-Cookie` value for `cookie`, with the attributes the server gives its
+* own session cookie: `Path=/`, `HttpOnly`, `SameSite=Lax`.
+*/
+function serializeSessionCookie(cookie) {
+	const attributes = [`${cookie.name}=${cookie.value}`, "Path=/"];
+	if (cookie.maxAge !== void 0) attributes.push(`Max-Age=${cookie.maxAge}`);
+	attributes.push("HttpOnly", "SameSite=Lax");
+	if (cookie.secure) attributes.push("Secure");
+	return attributes.join("; ");
+}
+/**
+* The `Cache-Control` of a response that sets a session cookie, as the server
+* sends on its session answers: a shared cache must not hand the cookie, the
+* session token it carries or its clearing, to the next visitor.
+*/
+const SESSION_COOKIE_CACHE_CONTROL = "private, no-store";
+/** The first entry of a forwarded header a chain of proxies appended to, if any. */
+function firstForwarded(value) {
+	const first = value?.split(",")[0]?.trim();
+	return first ? first : void 0;
+}
+/**
+* Whether a session cookie this app sets needs `Secure`, by the rule the server
+* applies to its own (`cookieSecureFromContext`): always, except over plain
+* http to a loopback host, where Safari would drop a `Secure` cookie. The
+* scheme and host are what a proxy in front of the app forwarded (the first
+* `X-Forwarded-Proto` and `X-Forwarded-Host`), else the app's request URL's,
+* so an app behind a TLS proxy that talks to it over loopback keeps `Secure`.
+*/
+function secureFor(request) {
+	let url;
+	try {
+		url = new URL(request.requestUrl);
+	} catch {
+		return true;
+	}
+	if ((firstForwarded(request.forwardedProto) ?? url.protocol.slice(0, -1)).toLowerCase() !== "http") return true;
+	let host;
+	try {
+		host = new URL(`http://${firstForwarded(request.forwardedHost) ?? url.host}`).hostname;
+	} catch {
+		return true;
+	}
+	host = host.toLowerCase();
+	return !(host === "localhost" || host === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(host));
+}
+/** Seconds from now until `epochMs`, at least one, or `undefined` when unknown. */
+function secondsUntil(epochMs) {
+	return Number.isFinite(epochMs) ? Math.max(1, Math.floor((epochMs - Date.now()) / 1e3)) : void 0;
+}
+/** Clears the cookie `name`. */
+function clearedCookie(name, secure) {
+	return {
+		name,
+		value: "",
+		maxAge: 0,
+		secure
+	};
+}
+/**
+* Copies a session of this project found in the server's cookie into the
+* project's own. The server's cookie keeps it: on a server without platform
+* bootstrap the Console signs in to the app's project, and clearing the cookie
+* would sign it out. The proxy retires the server's cookie when the app signs
+* a user in or out ({@link proxySessionCookies}), so it cannot sign its user
+* back in once the app's own cookie is gone.
+*/
+function copiedToProjectCookie(token, projectId, maxAge, secure) {
+	return {
+		name: sessionCookieName(projectId),
+		value: token,
+		maxAge,
+		secure
+	};
+}
+/** The pieces of a `Cookie` header, each with the name it carries. */
+function cookiePieces(header) {
+	const pieces = [];
+	for (const raw of (header ?? "").split(";")) {
+		const piece = raw.trim();
+		if (piece !== "") {
+			const index = piece.indexOf("=");
+			pieces.push({
+				name: (index === -1 ? piece : piece.slice(0, index)).trim(),
+				piece
+			});
+		}
+	}
+	return pieces;
+}
+/** The value of the first cookie named `name`, or `null` when it is absent or empty. */
+function cookieValue(pieces, name) {
+	const found = pieces.find((candidate) => candidate.name === name);
+	const value = found ? found.piece.slice(found.piece.indexOf("=") + 1).trim() : "";
+	return value === "" ? null : value;
+}
+/** The name a `Set-Cookie` value sets. */
+function setCookieName(setCookie) {
+	const index = setCookie.indexOf("=");
+	return index === -1 ? "" : setCookie.slice(0, index).trim();
+}
+/**
+* The session cookies of a call the app proxies to the server (ADR 073). The
+* server knows one session cookie, `__nextgen_session`; the app keeps its
+* project's session in {@link sessionCookieName}, so it neither replaces nor
+* reads the session of another app or of the Console on the same host.
+*
+* - On the way up, the app's own session cookie goes under the server's name,
+*   and every other session cookie stays behind. Other cookies pass unchanged.
+* - On the way back, a `Set-Cookie` of the server's session cookie, which sets
+*   or clears it, is renamed to the app's.
+* - A session kept under the server's name goes up to one call only, the
+*   session probe `GET /sessions/me?project_id=<project>`, which the server
+*   refuses for another project's session. When the answer signs a user of
+*   this project in, the session is copied to the app's cookie; the server's
+*   cookie keeps it, since the Console may share the project.
+* - When the app signs a user in (`POST /sessions/exchange`) or out
+*   (`DELETE /sessions/me`), a session still kept under the server's name is
+*   retired, or it would sign its user back in once the app's own cookie is
+*   gone: the server is asked about it in this project, and a session of this
+*   project is cleared (and on sign-out also ended), a dead one cleared, and
+*   one of another project, the Console's on `localhost`, left alone.
+* - Without a project the cookies pass as they are: nothing says which session
+*   is the app's.
+*
+* @param request   - The proxied request.
+* @param projectId - The project this app signs its users in to.
+* @param upstream  - The server the proxy forwards to, which it asks about a
+*   session kept under the server's name.
+*/
+function proxySessionCookies(request, projectId, upstream) {
+	if (!projectId) return {
+		upstreamCookie: request.cookie,
+		toBrowser: async (upstream) => ({
+			setCookies: upstream.headers.getSetCookie?.() ?? [],
+			body: upstream.body
+		})
+	};
+	const ownName = sessionCookieName(projectId);
+	const pieces = cookiePieces(request.cookie);
+	const own = cookieValue(pieces, ownName);
+	const shared = cookieValue(pieces, SERVER_SESSION_COOKIE);
+	const method = request.method.toUpperCase();
+	const isProbe = method === "GET" && request.path === "/sessions/me" && new URLSearchParams(request.search).get("project_id") === projectId;
+	const signsIn = method === "POST" && request.path === "/sessions/exchange";
+	const signsOut = method === "DELETE" && request.path === "/sessions/me";
+	const probed = own === null && isProbe ? shared : null;
+	const secure = secureFor(request);
+	const sent = pieces.filter(({ name }) => !isSessionCookie(name)).map(({ piece }) => piece);
+	const session = own ?? probed;
+	if (session !== null) sent.push(`${SERVER_SESSION_COOKIE}=${session}`);
+	return {
+		upstreamCookie: sent.length > 0 ? sent.join("; ") : null,
+		async toBrowser(answer) {
+			const upstreamSetCookies = answer.headers.getSetCookie?.() ?? [];
+			const setCookies = upstreamSetCookies.map((setCookie) => setCookieName(setCookie) === "__nextgen_session" ? `${ownName}${setCookie.slice(setCookie.indexOf("="))}` : setCookie);
+			const setsSession = upstreamSetCookies.some((setCookie) => setCookieName(setCookie) === SERVER_SESSION_COOKIE);
+			if (shared !== null && (signsOut || signsIn && answer.ok && setsSession)) {
+				if (await retiresSharedSession(shared, projectId, upstream, signsOut)) setCookies.push(serializeSessionCookie(clearedCookie(SERVER_SESSION_COOKIE, secure)));
+			}
+			if (probed === null || answer.status !== 200) return {
+				setCookies,
+				body: answer.body
+			};
+			const body = await answer.text();
+			const signedIn = sessionAnswer(parsedJson(body), projectId);
+			if (signedIn.userId && !setCookies.some((setCookie) => setCookieName(setCookie) === ownName)) {
+				const maxAge = signedIn.expiresAt ? secondsUntil(Date.parse(signedIn.expiresAt)) : void 0;
+				setCookies.push(serializeSessionCookie(copiedToProjectCookie(probed, projectId, maxAge, secure)));
+			}
+			return {
+				setCookies,
+				body
+			};
+		}
+	};
+}
+/**
+* Whether the session kept under the server's name goes when the app signs a
+* user in or out: the server is asked about it in this project. A session of
+* this project goes, and on sign-out it is ended too, so that it cannot sign
+* its user back in; one the server no longer holds goes as well. One of another
+* project, the Console's on `localhost`, stays, and so does one the server gave
+* no verdict on, and a JWT, which the middleware judges itself.
+*/
+async function retiresSharedSession(token, projectId, upstream, signsOut) {
+	if (isJwtShaped(token)) return false;
+	const cookie = `${SERVER_SESSION_COOKIE}=${token}`;
+	let res;
+	try {
+		res = await fetch(`${joinURL(upstream.url, "/sessions/me")}?project_id=${encodeURIComponent(projectId)}`, {
+			method: "GET",
+			headers: { cookie },
+			signal: AbortSignal.timeout(upstream.timeoutMs)
+		});
+	} catch {
+		return false;
+	}
+	if (res.status === 401) return true;
+	if (res.status === 404 || res.status === 403) return await errorCode(res) === SESSION_NOT_FOUND;
+	if (!res.ok) return false;
+	if (parsedJson(await res.text().catch(() => ""))?.project_id !== projectId) return false;
+	if (signsOut) await fetch(joinURL(upstream.url, "/sessions/me"), {
+		method: "DELETE",
+		headers: { cookie },
+		signal: AbortSignal.timeout(upstream.timeoutMs)
+	}).catch(() => void 0);
+	return true;
+}
+/** `text` as JSON, or `undefined` when it is not JSON. */
+function parsedJson(text) {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return;
+	}
+}
+/**
+* The error code the backend answers a session read with when the session
+* belongs to another project than the one the read names.
+*/
+const SESSION_PROJECT_MISMATCH = "sess.project_mismatch";
+/** A live session that names no user of this app's project. */
+function noUser() {
+	return {
+		userId: null,
+		identifier: null,
+		identifierProperty: null,
+		display: null,
+		expiresAt: null
+	};
+}
+/**
+* What a `GET /sessions/me` answer says about this app's project. A session of
+* another project names no user here: a backend that predates `project_id`
+* answers for any project, so the project the answer names is checked too.
+*/
+function sessionAnswer(body, projectId) {
+	const answer = typeof body === "object" && body !== null ? body : {};
+	if (answer.project_id !== projectId) return noUser();
+	const text = (value) => typeof value === "string" && value !== "" ? value : null;
+	return {
+		userId: text(answer.user_id),
+		identifier: text(answer.user?.identifier),
+		identifierProperty: text(answer.user?.identifier_property),
+		display: text(answer.user?.display),
+		expiresAt: text(answer.expires_at)
+	};
+}
+/** The code the backend answers `GET /sessions/me` with when the session is gone. */
+const SESSION_NOT_FOUND = "sess.not_found";
+/**
+* Asks the backend (`GET {issuerUrl}/sessions/me?project_id={projectId}`)
+* whether an opaque session token names a live session in this app's project,
+* telling a refusal apart from no verdict.
+*
+* A live session of another project comes back with no user, like an
+* anonymous one: it signs no one in here, and its cookie is not dead. The
+* backend refuses such a session itself (`403 sess.project_mismatch`); the
+* project its answer names is checked as well, because a backend that predates
+* the parameter answers for any project.
+*
+* A `404` is a refusal only with the `sess.not_found` code. Without it, the
+* answer came from something in front of the backend (a proxy, a `url` with
+* the wrong path), which judged nothing.
+*
+* When there is no verdict, it logs why: the request it was asked for then
+* renders signed out, or answers `503` on a protected route, and nothing else
+* would say what went wrong.
+*
+* @param token     - The opaque session token from the app's session cookie.
+* @param issuerUrl - Base URL of the auth backend.
+* @param timeoutMs - How long to wait for the backend before giving up.
+* @param projectId - The project this app signs its users in to. Without one,
+*   no session can be shown to belong here: the backend is not asked, and the
+*   session reads as live with no user, so its cookie is kept.
+* @returns The backend's {@link OpaqueSessionCheck | verdict}.
+*/
+async function checkOpaqueSessionToken(token, issuerUrl, timeoutMs, projectId) {
+	if (!projectId) return {
+		verdict: "live",
+		session: noUser()
+	};
+	const key = await otherProjectKey(token, projectId);
+	if (otherProjectSessions.knows(key)) return {
+		verdict: "live",
+		session: noUser()
+	};
+	const endpoint = joinURL(issuerUrl, "/sessions/me");
+	try {
+		const res = await fetch(`${endpoint}?project_id=${encodeURIComponent(projectId)}`, {
+			method: "GET",
+			headers: { cookie: `${SERVER_SESSION_COOKIE}=${token}` },
+			signal: AbortSignal.timeout(timeoutMs)
+		});
+		if (res.status === 401) return { verdict: "refused" };
+		if (res.status === 404 && await errorCode(res) === SESSION_NOT_FOUND) return { verdict: "refused" };
+		if (res.status === 403 && await errorCode(res) === "sess.project_mismatch") {
+			otherProjectSessions.remember(key);
+			return {
+				verdict: "live",
+				session: noUser()
+			};
+		}
+		if (!res.ok) return undecided(endpoint, `HTTP ${res.status}`);
+		const body = await res.json();
+		if (body?.project_id !== projectId) otherProjectSessions.remember(key);
+		return {
+			verdict: "live",
+			session: sessionAnswer(body, projectId)
+		};
+	} catch (err) {
+		return undecided(endpoint, failureCause(err, timeoutMs));
+	}
+}
+/**
+* The opaque session tokens the backend placed in another project, so that a
+* request signed out here does not ask again about the session another app,
+* or on `localhost` the Console, keeps under the server's cookie: a session
+* never changes its project. Each is known for a while, and only so many.
+*/
+const otherProjectSessions = (() => {
+	const TTL_MS = 3e5;
+	const MAX_ENTRIES = 1024;
+	const known = /* @__PURE__ */ new Map();
+	return {
+		knows(key) {
+			const until = known.get(key);
+			if (until === void 0) return false;
+			if (until > Date.now()) return true;
+			known.delete(key);
+			return false;
+		},
+		remember(key) {
+			known.delete(key);
+			known.set(key, Date.now() + TTL_MS);
+			if (known.size > MAX_ENTRIES) {
+				const oldest = known.keys().next().value;
+				if (oldest !== void 0) known.delete(oldest);
+			}
+		},
+		clear() {
+			known.clear();
+		}
+	};
+})();
+/** The memo key of a token in a project: a hash, so that the memo holds no session token. */
+async function otherProjectKey(token, projectId) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token));
+	let hex = "";
+	for (const byte of new Uint8Array(digest)) hex += byte.toString(16).padStart(2, "0");
+	return `${projectId}:${hex}`;
+}
+/**
+* Forgets which session tokens the backend placed in another project
+* ({@link checkOpaqueSessionToken} remembers them for a while). For tests that
+* answer for the same token differently.
+*/
+function clearSessionCheckCache() {
+	otherProjectSessions.clear();
+}
+/**
+* Validates an opaque session token by asking the backend
+* (`GET {issuerUrl}/sessions/me?project_id={projectId}`) whether the session is
+* live in this app's project.
+*
+* `null` folds a refusal and no verdict together, so it says whether the
+* request is signed in, not whether the cookie is dead: clearing the cookie on
+* `null` signs users out whenever the backend fails. To decide that, use
+* {@link checkOpaqueSessionToken}.
+*
+* @param token     - The opaque session token from the app's session cookie.
+* @param issuerUrl - Base URL of the auth backend.
+* @param timeoutMs - How long to wait for the backend before giving up.
+* @param projectId - The project this app signs its users in to.
+* @returns The live session — with a `null` `userId` when it names no user of
+*   this project — or `null` when the backend did not confirm one: it refused
+*   the token, or gave no verdict.
+*/
+async function validateOpaqueSessionToken(token, issuerUrl, timeoutMs, projectId) {
+	const check = await checkOpaqueSessionToken(token, issuerUrl, timeoutMs, projectId);
+	return check.verdict === "live" ? check.session : null;
+}
+/** The `code` of an error envelope, or `undefined` when the body is not one. */
+async function errorCode(res) {
+	try {
+		const body = await res.json();
+		return typeof body.code === "string" ? body.code : void 0;
+	} catch {
+		return;
+	}
+}
+/** Why a session check failed, for the log. */
+function failureCause(err, timeoutMs) {
+	if (err?.name === "TimeoutError") return `no answer within ${timeoutMs} ms`;
+	const cause = err?.cause;
+	return cause instanceof Error ? `${String(err)}: ${cause.message}` : String(err);
+}
+/** Logs why the backend gave no verdict on a session cookie, and returns that. */
+function undecided(endpoint, cause) {
+	console.warn(`[nextgen] Could not check the session cookie against ${endpoint} (${cause}). That is not a refusal: the request counts as signed out, and the cookie is kept.`);
+	return { verdict: "undecided" };
+}
+/**
+* Whether a verified JWT names `projectId` in its `aud` claim, the one place a
+* self-contained token can say which project it was issued for.
+*/
+function jwtNamesProject(payload, projectId) {
+	const audience = payload.aud === void 0 ? [] : [payload.aud].flat();
+	return projectId !== "" && audience.includes(projectId);
+}
+function signedOut() {
+	return {
+		isAuthenticated: false,
+		session: null
+	};
+}
+let warnedMissingProject = false;
+/** Says once per process why no session counts: no project is configured. */
+function warnMissingProject() {
+	if (warnedMissingProject) return;
+	warnedMissingProject = true;
+	console.error("[nextgen] No project id is configured, so no session counts as signed in. Set ZITADEL_PROJECT_ID (or the `projectId` option) to the project this app signs its users in to.");
+}
+/**
+* The cookie a request's session is read from: the project's own
+* ({@link sessionCookieName}), else the server's `__nextgen_session`, where
+* this app kept its sessions before ADR 073 and where, on `localhost`, the
+* Console keeps its own.
+*/
+function storedSession(cookie, projectId) {
+	for (const name of [sessionCookieName(projectId), SERVER_SESSION_COOKIE]) {
+		const token = cookie(name);
+		if (token) return {
+			name,
+			token
+		};
+	}
+	return null;
+}
+/**
+* Judges a JWT. It signs its `sub` in when it verifies and its `aud` names
+* this project. Held in a cookie, it is dead when it fails verification or
+* names no user of this project; a verified JWT of another project is live
+* there, so its cookie stays.
+*/
+async function judgeJwt(token, projectId, options) {
+	const payload = isJwtShaped(token) ? await verifyJwt(token, {
+		issuerUrl: options.url,
+		allowedAlgorithms: options.allowedAlgorithms,
+		clockSkewMs: options.clockSkewMs,
+		audience: options.audience,
+		allowedTokenTypes: options.allowedTokenTypes,
+		jwksTimeoutMs: options.jwksTimeoutMs
+	}) : null;
+	if (!payload) return {
+		auth: signedOut(),
+		dead: true,
+		maxAge: void 0
+	};
+	const namesProject = jwtNamesProject(payload, projectId);
+	if (!payload.sub || !namesProject) return {
+		auth: signedOut(),
+		dead: namesProject,
+		maxAge: void 0
+	};
+	return {
+		auth: {
+			isAuthenticated: true,
+			session: {
+				userId: payload.sub,
+				identifier: payload.email ?? null,
+				identifierProperty: null,
+				display: payload.name ?? null,
+				token
+			}
+		},
+		dead: false,
+		maxAge: payload.exp === void 0 ? void 0 : secondsUntil(payload.exp * 1e3)
+	};
+}
+/**
+* Judges which user, if any, a request is signed in as in this app's project.
+* The one implementation behind every server SDK's middleware, so they cannot
+* drift on who counts as signed in.
+*
+* - A Bearer token is judged first, as a JWT. When it signs a user of this
+*   project in, that is the answer and the cookie is not judged; otherwise the
+*   cookie speaks for itself.
+* - The session cookie is the project's own, else the server's. A session of
+*   this project found in the server's cookie is copied to the project's own.
+* - A JWT-shaped session cookie signs its `sub` in when it verifies and its
+*   `aud` names the project. It never reaches the backend, which does not
+*   re-check JWT claims.
+* - Any other session cookie is checked by the backend
+*   ({@link checkOpaqueSessionToken}) and signs its user in when the session
+*   is live in this project.
+* - Only a cookie that held a dead session is cleared: one the backend refused,
+*   or a JWT that fails verification or names no user of this project. When
+*   the backend gives no verdict, the result says so
+*   ({@link ResolvedSession.undecided}) and the cookie stays.
+* - Without a project nothing signs in, and no cookie is touched.
+*/
+async function resolveSession(request, options) {
+	const { url, projectId, opaqueTokenTimeoutMs } = options;
+	if (!projectId) {
+		warnMissingProject();
+		return {
+			auth: signedOut(),
+			undecided: false,
+			cookies: []
+		};
+	}
+	if (request.bearer !== null) {
+		const bearer = await judgeJwt(request.bearer, projectId, options);
+		if (bearer.auth.isAuthenticated) return {
+			auth: bearer.auth,
+			undecided: false,
+			cookies: []
+		};
+	}
+	const stored = storedSession(request.cookie, projectId);
+	if (!stored) return {
+		auth: signedOut(),
+		undecided: false,
+		cookies: []
+	};
+	const secure = secureFor(request);
+	const moved = (maxAge) => stored.name === "__nextgen_session" ? [copiedToProjectCookie(stored.token, projectId, maxAge, secure)] : [];
+	const cleared = () => [clearedCookie(stored.name, secure)];
+	if (isJwtShaped(stored.token)) {
+		const judged = await judgeJwt(stored.token, projectId, options);
+		if (judged.auth.isAuthenticated) return {
+			auth: judged.auth,
+			undecided: false,
+			cookies: moved(judged.maxAge)
+		};
+		return {
+			auth: signedOut(),
+			undecided: false,
+			cookies: judged.dead ? cleared() : []
+		};
+	}
+	const check = await checkOpaqueSessionToken(stored.token, url, opaqueTokenTimeoutMs, projectId);
+	const userId = check.verdict === "live" ? check.session.userId : null;
+	if (check.verdict === "live" && userId) {
+		const { session } = check;
+		return {
+			auth: {
+				isAuthenticated: true,
+				session: {
+					userId,
+					identifier: session.identifier,
+					identifierProperty: session.identifierProperty,
+					display: session.display,
+					token: stored.token
+				}
+			},
+			undecided: false,
+			cookies: moved(session.expiresAt ? secondsUntil(Date.parse(session.expiresAt)) : void 0)
+		};
+	}
+	return {
+		auth: signedOut(),
+		undecided: check.verdict === "undecided",
+		cookies: check.verdict === "refused" ? cleared() : []
+	};
+}
+//#endregion
+export { HOP_BY_HOP, INTERNAL_HEADERS, SERVER_SESSION_COOKIE, SESSION_COOKIE_CACHE_CONTROL, SESSION_PROJECT_MISMATCH, checkOpaqueSessionToken, clearSessionCheckCache, filterResponseHeaders, jwtNamesProject, loginRedirectUrl, matchesRoutes, proxySessionCookies, requiresProjectSecret, resolveSession, serializeSessionCookie, sessionCookieName, validateOpaqueSessionToken };
+
+//# sourceMappingURL=middleware.mjs.map