@zitadel/sdk-core 1.0.0-alpha.24 → 1.0.0-alpha.28

package/dist/middleware.d.ts

@@ -1,202 +0,0 @@
-/**
- * Shared constants and utility functions for the SDK middleware proxy layer.
- *
- * These are consumed by both `sdk-next` and `sdk-nuxt` to avoid duplicating
- * pure, framework-agnostic logic.
- */
-/**
- * Headers that must never be forwarded to an upstream service.
- * These are connection-level headers that are meaningful only between
- * two directly connected peers and become invalid when proxied.
- */
-export declare const HOP_BY_HOP: ReadonlySet<string>;
-/**
- * SDK-internal headers that must never be forwarded to the upstream backend.
- * These headers carry session data between the middleware and server components;
- * forwarding them upstream would expose internal state and allow header injection.
- */
-export declare const INTERNAL_HEADERS: ReadonlySet<string>;
-/**
- * Returns `true` when `pathname` matches at least one entry in `routes`.
- *
- * An entry ending with `*` matches any path that starts with the prefix
- * before the `*`. All other entries require an exact match.
- *
- * @param pathname - The URL pathname to test.
- * @param routes   - The list of route patterns to match against.
- * @returns `true` if at least one pattern matches.
- */
-export declare function matchesRoutes(pathname: string, routes: readonly string[]): boolean;
-/**
- * Filters upstream response headers for proxying: strips hop-by-hop headers
- * and `set-cookie` (handled separately via `getSetCookie()`), and reduces
- * `location` to a redirect that can only land on this app.
- *
- * `location` was stripped outright until the identity-provider callback
- * needed it: the provider returns the browser to `/__nextgen/idp/callback`,
- * and the engine answers `302` back to the page the sign-in started on. That
- * is a top-level navigation with no JavaScript in the loop, so a dropped
- * `Location` leaves the browser on an empty page. Outbound redirects to a
- * provider do not travel this way -- they arrive as `step.redirect_url` in a
- * JSON body and the widget navigates -- so nothing legitimate points off-origin.
- *
- * @param upstream - The upstream response headers.
- * @param selfUrl - The app's own request URL, which is both the origin a
- *   redirect must land on and the base a relative one resolves against.
- *   Omitting it keeps the old behaviour of dropping every redirect.
- * @returns A new `Headers` object with filtered headers.
- */
-export declare function filterResponseHeaders(upstream: Headers, selfUrl?: string): Headers;
-/**
- * The authenticated session for a signed-in user. Identity follows the
- * user-ref vocabulary (ADR 058): render `display`, falling back to
- * `identifier`, then `userId`.
- */
-export type NextgenSession = {
-    /** The user's unique identifier (`sub` claim). */
-    userId: string;
-    /**
-     * The user schema's designated identifier value (the login identifier,
-     * e.g. an email address or username), or `null` when unresolved. On the
-     * JWT path this carries the `email` claim.
-     */
-    identifier: string | null;
-    /**
-     * The schema property `identifier` came from (e.g. `"email"`), or `null`
-     * when unknown — JWT-claim identities carry no property attribution.
-     */
-    identifierProperty: string | null;
-    /** The user's display name rendering, or `null` when the schema designates none. */
-    display: string | null;
-    /** The raw verified JWT. */
-    token: string;
-};
-/** Auth state when the user is signed in. */
-export type AuthState = {
-    isAuthenticated: true;
-    session: NextgenSession;
-};
-/** Auth state when the user is not signed in. */
-export type UnauthState = {
-    isAuthenticated: false;
-    session: null;
-};
-/** Union of all possible auth states. */
-export type AuthResult = AuthState | UnauthState;
-/**
- * The client-safe session exposed to app UI (headers, account menus).
- * Identical to {@link NextgenSession} but omits `token` — the raw session
- * token must never reach client-side JavaScript, whether through an SSR
- * payload or a client-side fetch result.
- */
-export type ClientSession = {
-    /** The user's unique identifier (`sub` claim). */
-    userId: string;
-    /** The designated identifier value (login identifier), or `null`. */
-    identifier: string | null;
-    /** The schema property the identifier came from, or `null`. */
-    identifierProperty: string | null;
-    /** The display name rendering, or `null`. */
-    display: string | null;
-};
-/** Client-safe auth state when the user is signed in. */
-export type ClientAuthState = {
-    isAuthenticated: true;
-    session: ClientSession;
-};
-/**
- * Union of all possible client-safe auth states. Returned by the client
- * session reads (`useAuth()` in sdk-nuxt, `getSession()` in sdk-next).
- * Token is intentionally absent — use the server-side helpers when the raw
- * token is needed.
- */
-export type ClientAuthResult = ClientAuthState | UnauthState;
-/**
- * Options passed to the SDK middleware factory (`nextgenMiddleware` in
- * sdk-next, `createNextgenMiddleware` in sdk-nuxt).
- */
-export type NextgenMiddlewareOptions = {
-    /**
-     * Full URL of the Zitadel auth backend.
-     * @default process.env.ZITADEL_URL ?? "http://localhost:8080"
-     */
-    url?: string;
-    /**
-     * URL path prefix that is reverse-proxied to the auth backend.
-     * @default "/__nextgen"
-     */
-    proxyPath?: string;
-    /**
-     * Pathnames that require a valid session. Requests to these routes without
-     * a valid token are redirected to {@link loginPath}.
-     * Entries ending with `*` match any sub-path (e.g. `"/admin*"`).
-     * @default []
-     */
-    protectedRoutes?: string[];
-    /**
-     * Pathnames that are completely skipped by the middleware — no JWT
-     * verification, no protection check, no header tunnelling.
-     * Useful for webhooks, health-check endpoints, or any route where
-     * running auth logic is undesirable.
-     * Entries ending with `*` match any sub-path (e.g. `"/public*"`).
-     * @default []
-     */
-    ignoredRoutes?: string[];
-    /**
-     * Pathname to redirect unauthenticated users to.
-     * A `next` query parameter is appended with the originally requested path.
-     * @default "/login"
-     */
-    loginPath?: string;
-    /**
-     * Reserved for future use. Local PEM public key for offline JWT verification.
-     */
-    jwtKey?: string;
-    /**
-     * Restrict accepted JWT `alg` header values. Tokens whose algorithm is not
-     * in this list are rejected before JWKS is fetched.
-     * @default ["RS256", "ES256"]
-     */
-    allowedAlgorithms?: string[];
-    /**
-     * Clock skew tolerance in milliseconds applied to `exp`, `nbf`, and `iat`
-     * claim validation.
-     * @default 5000
-     */
-    clockSkewMs?: number;
-    /**
-     * Expected value(s) of the `aud` claim. When omitted, audience is not
-     * validated. Pass a single string or an array when a token may carry
-     * multiple audiences.
-     */
-    audience?: string | string[];
-    /**
-     * Accepted values for the JWT header `typ` claim (case-insensitive).
-     * Tokens whose `typ` is not in this list are rejected.
-     * Set to `[]` to disable token-type checking entirely.
-     * @default ["JWT", "at+JWT"]
-     */
-    allowedTokenTypes?: string[];
-    /**
-     * Timeout in milliseconds for JWKS endpoint requests.
-     * Requests that do not complete within this window are aborted and the
-     * token is rejected, treating the request as unauthenticated.
-     * @default 5000
-     */
-    jwksTimeoutMs?: number;
-    /**
-     * Timeout in milliseconds for upstream proxy requests.
-     * Requests that do not complete within this window are aborted with a
-     * network error. Defaults to 5 000 ms.
-     * @default 5000
-     */
-    proxyTimeoutMs?: number;
-    /**
-     * Timeout in milliseconds for opaque (non-JWT) session token validation
-     * via the backend's `GET /sessions/me` endpoint. Tokens that cannot be
-     * validated within this window are treated as invalid.
-     * @default 5000
-     */
-    opaqueTokenTimeoutMs?: number;
-};
-//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,WAAW,CAAC,MAAM,CAazC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAqC,CAAC;AAIvF;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAUlF;AA2CD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAiBlF;AAID;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;OAGG;IACH,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,oFAAoF;IACpF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,4BAA4B;IAC5B,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,SAAS,GAAG;IAAE,eAAe,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAE3E,iDAAiD;AACjD,MAAM,MAAM,WAAW,GAAG;IAAE,eAAe,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC;AAEpE,yCAAyC;AACzC,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,+DAA+D;IAC/D,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,6CAA6C;IAC7C,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CAAC;AAEF,yDAAyD;AACzD,MAAM,MAAM,eAAe,GAAG;IAAE,eAAe,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,WAAW,CAAC;AAE7D;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE7B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAE7B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE7B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC"}

package/dist/middleware.js

@@ -1,131 +0,0 @@
-/**
- * Shared constants and utility functions for the SDK middleware proxy layer.
- *
- * These are consumed by both `sdk-next` and `sdk-nuxt` to avoid duplicating
- * pure, framework-agnostic logic.
- */
-// ─── Constants ────────────────────────────────────────────────────────────────
-/**
- * Headers that must never be forwarded to an upstream service.
- * These are connection-level headers that are meaningful only between
- * two directly connected peers and become invalid when proxied.
- */
-export const HOP_BY_HOP = new Set([
-    "connection",
-    // host is not a hop-by-hop header per RFC 7230, but it must be stripped so
-    // the fetch implementation derives the correct Host from the upstream URL
-    // rather than forwarding the client's Host and causing SNI/vhost mismatches.
-    "host",
-    "keep-alive",
-    "proxy-authenticate",
-    "proxy-authorization",
-    "te",
-    "trailer",
-    "transfer-encoding",
-    "upgrade",
-]);
-/**
- * SDK-internal headers that must never be forwarded to the upstream backend.
- * These headers carry session data between the middleware and server components;
- * forwarding them upstream would expose internal state and allow header injection.
- */
-export const INTERNAL_HEADERS = new Set(["x-nextgen-auth-token"]);
-// ─── Route matching ──────────────────────────────────────────────────────────
-/**
- * Returns `true` when `pathname` matches at least one entry in `routes`.
- *
- * An entry ending with `*` matches any path that starts with the prefix
- * before the `*`. All other entries require an exact match.
- *
- * @param pathname - The URL pathname to test.
- * @param routes   - The list of route patterns to match against.
- * @returns `true` if at least one pattern matches.
- */
-export function matchesRoutes(pathname, routes) {
-    if (routes.length === 0) {
-        return false;
-    }
-    return routes.some((pattern) => {
-        if (pattern.endsWith("*")) {
-            return pathname.startsWith(pattern.slice(0, -1));
-        }
-        return pathname === pattern;
-    });
-}
-// ─── Response header filtering ───────────────────────────────────────────────
-/**
- * An upstream `Location`, pointed back at this app.
- *
- * Only the path, query and fragment survive; whatever origin the upstream
- * named is discarded and the result is re-based onto the request's own URL.
- * That keeps both properties the blanket strip was protecting -- an internal
- * hostname can never reach the browser, and the redirect can only ever land on
- * this app -- without needing to know what this app's public origin is.
- *
- * Comparing origins instead would have required that knowledge, and there is
- * no reliable source for it: `X-Forwarded-Host` is attacker-settable on a
- * direct request, and the request's own host is wrong behind a proxy that
- * terminates TLS or rewrites it. Discarding the origin sidesteps the question
- * -- a redirect to another origin becomes the same path on this one rather
- * than being dropped, so a deployment behind such a proxy works instead of
- * landing on a blank page.
- *
- * Nothing legitimate on this path points off-origin anyway: an outbound
- * redirect to a provider travels as `step.redirect_url` in a JSON body and the
- * widget performs it, never as a proxied header.
- *
- * A relative reference resolves against the path it came from (RFC 3986 §5),
- * so `next?flow=x` answered to `/__nextgen/idp/callback` means
- * `/__nextgen/idp/next?flow=x`. An unparseable value is the one case with
- * nothing to forward.
- */
-function ontoThisApp(location, selfUrl) {
-    if (selfUrl === undefined || selfUrl === "") {
-        return undefined;
-    }
-    try {
-        const base = new URL(selfUrl);
-        const target = new URL(location, base);
-        return new URL(`${target.pathname}${target.search}${target.hash}`, base).toString();
-    }
-    catch {
-        return undefined;
-    }
-}
-/**
- * Filters upstream response headers for proxying: strips hop-by-hop headers
- * and `set-cookie` (handled separately via `getSetCookie()`), and reduces
- * `location` to a redirect that can only land on this app.
- *
- * `location` was stripped outright until the identity-provider callback
- * needed it: the provider returns the browser to `/__nextgen/idp/callback`,
- * and the engine answers `302` back to the page the sign-in started on. That
- * is a top-level navigation with no JavaScript in the loop, so a dropped
- * `Location` leaves the browser on an empty page. Outbound redirects to a
- * provider do not travel this way -- they arrive as `step.redirect_url` in a
- * JSON body and the widget navigates -- so nothing legitimate points off-origin.
- *
- * @param upstream - The upstream response headers.
- * @param selfUrl - The app's own request URL, which is both the origin a
- *   redirect must land on and the base a relative one resolves against.
- *   Omitting it keeps the old behaviour of dropping every redirect.
- * @returns A new `Headers` object with filtered headers.
- */
-export function filterResponseHeaders(upstream, selfUrl) {
-    const filtered = new Headers();
-    upstream.forEach((value, key) => {
-        const name = key.toLowerCase();
-        if (HOP_BY_HOP.has(name) || name === "set-cookie") {
-            return;
-        }
-        if (name === "location") {
-            const onThisApp = ontoThisApp(value, selfUrl);
-            if (onThisApp !== undefined) {
-                filtered.set("location", onThisApp);
-            }
-            return;
-        }
-        filtered.set(key, value);
-    });
-    return filtered;
-}