najm-auth 2.0.2 → 2.0.4

package/dist/client/edge.d.ts

@@ -11,14 +11,17 @@ interface AuthMiddlewareConfig {
     roleRoutes?: Record<string, string[]>;
     /** Refresh token cookie name (default: 'refreshToken') */
     cookieName?: string;
-    /** Session cookie name to clear on redirect (default: 'najm.session') */
+    /** Signed session cookie name (default: 'najm.session') */
     sessionCookieName?: string;
-    /** URL of the verify endpoint (default: derived from request) */
+    /** @deprecated Session cookies are verified locally at the Edge. */
     verifyURL?: string;
+    /** Secret for verifying the session cookie HMAC. Falls back to env vars. */
+    sessionSecret?: string;
+    /** Must match the auth plugin's session.maxAge. Default: 300 seconds. */
+    sessionMaxAge?: number;
     /**
-     * When true, call the verify endpoint on EVERY protected route (not just
-     * roleRoutes). Redirects to loginRoute if the session is invalid. Adds one
-     * fetch per navigation — trade latency for stronger guarantees.
+     * Retained for compatibility. Every protected route now verifies the signed
+     * session cookie locally, so enabling this never calls `/auth/me`.
      */
     verifyAlways?: boolean;
 }
@@ -28,7 +31,7 @@ interface AuthMiddlewareConfig {
  * @example
  * ```ts
  * // middleware.ts
- * import { withAuthMiddleware } from 'najm-auth/client/server';
+   * import { withAuthMiddleware } from 'najm-auth/client/edge';
  *
  * export default withAuthMiddleware({
  *   protectedRoutes: ['/dashboard/:path*', '/admin/:path*'],

package/dist/client/edge.js

@@ -1,6 +1,136 @@
 var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
+// src/client/sessionCookie.ts
+var DEFAULT_SESSION_MAX_AGE_SECONDS = 300;
+var MAX_CLOCK_SKEW_MS = 3e4;
+var HMAC_SHA256_BASE64URL_LENGTH = 43;
+var BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+function resolveSessionSecret(explicit) {
+  if (explicit !== void 0) return explicit || void 0;
+  if (typeof process === "undefined") return void 0;
+  return process.env.NAJM_SESSION_SECRET || process.env.JWT_ACCESS_SECRET || void 0;
+}
+__name(resolveSessionSecret, "resolveSessionSecret");
+function parseSessionCookiePayload(payload, maxAgeSeconds = DEFAULT_SESSION_MAX_AGE_SECONDS, now = Date.now()) {
+  if (!Number.isFinite(maxAgeSeconds) || maxAgeSeconds <= 0) return null;
+  try {
+    const data = JSON.parse(payload);
+    if (!isRecord(data) || !isValidUser(data.user)) return null;
+    if (!isStringArray(data.roles) || !isStringArray(data.permissions)) return null;
+    if (!Number.isInteger(data.sessionVersion) || data.sessionVersion < 0) return null;
+    if (!Number.isFinite(data.iat) || !Number.isInteger(data.iat) || data.iat <= 0) return null;
+    const issuedAt = data.iat;
+    if (issuedAt > now + MAX_CLOCK_SKEW_MS) return null;
+    if (now - issuedAt >= maxAgeSeconds * 1e3) return null;
+    return {
+      user: data.user,
+      roles: [...data.roles],
+      permissions: [...data.permissions],
+      sessionVersion: data.sessionVersion,
+      iat: issuedAt
+    };
+  } catch {
+    return null;
+  }
+}
+__name(parseSessionCookiePayload, "parseSessionCookiePayload");
+async function verifySessionCookie(rawCookieValue, options) {
+  if (!rawCookieValue || !options.secret || !globalThis.crypto?.subtle) return null;
+  for (const signedValue of cookieValueCandidates(rawCookieValue)) {
+    const lastDot = signedValue.lastIndexOf(".");
+    if (lastDot <= 0 || lastDot === signedValue.length - 1) continue;
+    const payload = signedValue.slice(0, lastDot);
+    const signature = signedValue.slice(lastDot + 1);
+    if (!await verifyHmac(payload, signature, options.secret)) continue;
+    return parseSessionCookiePayload(
+      payload,
+      options.maxAgeSeconds ?? DEFAULT_SESSION_MAX_AGE_SECONDS,
+      options.now
+    );
+  }
+  return null;
+}
+__name(verifySessionCookie, "verifySessionCookie");
+function readCookieValue(cookieHeader, name) {
+  for (const part of cookieHeader.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator === -1) continue;
+    if (part.slice(0, separator).trim() === name) {
+      const value = part.slice(separator + 1).trim();
+      return value || void 0;
+    }
+  }
+  return void 0;
+}
+__name(readCookieValue, "readCookieValue");
+async function verifyHmac(payload, signature, secret) {
+  if (signature.length !== HMAC_SHA256_BASE64URL_LENGTH) return false;
+  const signatureBytes = decodeBase64Url(signature);
+  if (!signatureBytes || signatureBytes.length !== 32) return false;
+  try {
+    const encoder = new TextEncoder();
+    const key = await globalThis.crypto.subtle.importKey(
+      "raw",
+      encoder.encode(secret),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["verify"]
+    );
+    return await globalThis.crypto.subtle.verify(
+      "HMAC",
+      key,
+      signatureBytes,
+      encoder.encode(payload)
+    );
+  } catch {
+    return false;
+  }
+}
+__name(verifyHmac, "verifyHmac");
+function cookieValueCandidates(raw) {
+  const candidates = [raw];
+  try {
+    const decoded = decodeURIComponent(raw);
+    if (decoded !== raw) candidates.push(decoded);
+  } catch {
+  }
+  return candidates;
+}
+__name(cookieValueCandidates, "cookieValueCandidates");
+function decodeBase64Url(value) {
+  if (!/^[A-Za-z0-9_-]+$/.test(value)) return null;
+  const bytes = [];
+  let accumulator = 0;
+  let bits = 0;
+  for (const char of value) {
+    const digit = BASE64URL_ALPHABET.indexOf(char);
+    if (digit === -1) return null;
+    accumulator = accumulator << 6 | digit;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      bytes.push(accumulator >> bits & 255);
+      accumulator &= (1 << bits) - 1;
+    }
+  }
+  if (bits > 0 && accumulator !== 0) return null;
+  return new Uint8Array(bytes);
+}
+__name(decodeBase64Url, "decodeBase64Url");
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+__name(isRecord, "isRecord");
+function isValidUser(value) {
+  return isRecord(value) && typeof value.id === "string" && value.id.length > 0 && typeof value.email === "string" && value.email.length > 0 && (value.role === void 0 || value.role === null || typeof value.role === "string");
+}
+__name(isValidUser, "isValidUser");
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+__name(isStringArray, "isStringArray");
+
 // src/client/server/withAuthMiddleware.ts
 function withAuthMiddleware(config) {
   const {
@@ -10,8 +140,11 @@ function withAuthMiddleware(config) {
     roleRoutes = {},
     cookieName = "refreshToken",
     sessionCookieName = "najm.session",
+    sessionSecret,
+    sessionMaxAge,
     verifyAlways = false
   } = config;
+  void verifyAlways;
   return /* @__PURE__ */ __name(async function middleware(request) {
     const { NextResponse } = await import("next/server");
     const redirectToLogin = /* @__PURE__ */ __name((pathname2, clearCookies) => {
@@ -32,31 +165,21 @@ function withAuthMiddleware(config) {
     const isProtected = protectedRoutes.length === 0 || matchesAny(pathname, protectedRoutes);
     if (!isProtected) return NextResponse.next();
     const cookie = request.headers.get("cookie") ?? "";
-    const hasToken = cookieRegex(cookieName).test(cookie);
-    if (!hasToken) {
+    const sessionCookie = readCookieValue(cookie, sessionCookieName);
+    const secret = resolveSessionSecret(sessionSecret);
+    if (!sessionCookie || !secret) {
+      return redirectToLogin(pathname, true);
+    }
+    const session = await verifySessionCookie(sessionCookie, {
+      secret,
+      maxAgeSeconds: sessionMaxAge
+    });
+    if (!session) {
       return redirectToLogin(pathname, true);
     }
     const requiredRoles = findMatchingRoles(pathname, roleRoutes);
-    const needsVerify = verifyAlways || !!requiredRoles;
-    if (needsVerify) {
-      const verifyURL = config.verifyURL ?? `${url.origin}/api/auth/me`;
-      try {
-        const res = await fetch(verifyURL, {
-          headers: { "Cookie": cookie, "Accept": "application/json" }
-        });
-        if (!res.ok) {
-          return redirectToLogin(pathname, true);
-        }
-        if (requiredRoles) {
-          const body = await res.json();
-          const userRole = body?.data?.role;
-          if (!userRole || !requiredRoles.includes(userRole)) {
-            return new NextResponse(null, { status: 403 });
-          }
-        }
-      } catch {
-        return redirectToLogin(pathname, true);
-      }
+    if (requiredRoles && !session.roles.some((role) => requiredRoles.includes(role))) {
+      return new NextResponse(null, { status: 403 });
     }
     return NextResponse.next();
   }, "middleware");
@@ -72,10 +195,6 @@ function matchPattern(pathname, pattern) {
   return new RegExp(`^${regex}$`).test(pathname);
 }
 __name(matchPattern, "matchPattern");
-function cookieRegex(name) {
-  return new RegExp(`(?:^|;\\s*)${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}=[^;]`);
-}
-__name(cookieRegex, "cookieRegex");
 function findMatchingRoles(pathname, roleRoutes) {
   for (const [pattern, roles] of Object.entries(roleRoutes)) {
     if (matchPattern(pathname, pattern)) return roles;

package/dist/client/server/index.d.ts

@@ -96,6 +96,11 @@ interface GetSessionConfig {
      * Falls back to NAJM_SESSION_SECRET or JWT_ACCESS_SECRET env vars.
      */
     sessionSecret?: string;
+    /**
+     * Maximum accepted session-cookie age in seconds.
+     * Must match the auth plugin's `session.maxAge`. Default: 300.
+     */
+    sessionMaxAge?: number;
     /**
      * Error handling mode:
      * - 'nullable' (default): returns null on any failure
@@ -193,12 +198,13 @@ interface DefineAuthConfig {
     sessionCookieName?: string;
     /** Secret for verifying session cookie HMAC. Falls back to env vars. */
     sessionSecret?: string;
+    /** Must match the auth plugin's session.maxAge. Default: 300 seconds. */
+    sessionMaxAge?: number;
     /** Next.js middleware matcher (default: exclude _next, favicon, api) */
     matcher?: string[];
     /**
-     * When true, call the verify endpoint on every protected route (not just
-     * roleRoutes). Redirects to loginRoute if the session is invalid. One extra
-     * fetch per navigation in exchange for guaranteed fresh auth state.
+     * Retained for compatibility. Every protected route verifies the signed
+     * session cookie locally without an `/auth/me` request.
      */
     verifyAlways?: boolean;
 }

package/dist/client/server/index.js

@@ -9,6 +9,141 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/client/sessionCookie.ts
+function resolveSessionSecret(explicit) {
+  if (explicit !== void 0) return explicit || void 0;
+  if (typeof process === "undefined") return void 0;
+  return process.env.NAJM_SESSION_SECRET || process.env.JWT_ACCESS_SECRET || void 0;
+}
+function parseSessionCookiePayload(payload, maxAgeSeconds = DEFAULT_SESSION_MAX_AGE_SECONDS, now = Date.now()) {
+  if (!Number.isFinite(maxAgeSeconds) || maxAgeSeconds <= 0) return null;
+  try {
+    const data = JSON.parse(payload);
+    if (!isRecord(data) || !isValidUser(data.user)) return null;
+    if (!isStringArray(data.roles) || !isStringArray(data.permissions)) return null;
+    if (!Number.isInteger(data.sessionVersion) || data.sessionVersion < 0) return null;
+    if (!Number.isFinite(data.iat) || !Number.isInteger(data.iat) || data.iat <= 0) return null;
+    const issuedAt = data.iat;
+    if (issuedAt > now + MAX_CLOCK_SKEW_MS) return null;
+    if (now - issuedAt >= maxAgeSeconds * 1e3) return null;
+    return {
+      user: data.user,
+      roles: [...data.roles],
+      permissions: [...data.permissions],
+      sessionVersion: data.sessionVersion,
+      iat: issuedAt
+    };
+  } catch {
+    return null;
+  }
+}
+async function verifySessionCookie(rawCookieValue, options) {
+  if (!rawCookieValue || !options.secret || !globalThis.crypto?.subtle) return null;
+  for (const signedValue of cookieValueCandidates(rawCookieValue)) {
+    const lastDot = signedValue.lastIndexOf(".");
+    if (lastDot <= 0 || lastDot === signedValue.length - 1) continue;
+    const payload = signedValue.slice(0, lastDot);
+    const signature = signedValue.slice(lastDot + 1);
+    if (!await verifyHmac(payload, signature, options.secret)) continue;
+    return parseSessionCookiePayload(
+      payload,
+      options.maxAgeSeconds ?? DEFAULT_SESSION_MAX_AGE_SECONDS,
+      options.now
+    );
+  }
+  return null;
+}
+function readCookieValue(cookieHeader, name) {
+  for (const part of cookieHeader.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator === -1) continue;
+    if (part.slice(0, separator).trim() === name) {
+      const value = part.slice(separator + 1).trim();
+      return value || void 0;
+    }
+  }
+  return void 0;
+}
+async function verifyHmac(payload, signature, secret) {
+  if (signature.length !== HMAC_SHA256_BASE64URL_LENGTH) return false;
+  const signatureBytes = decodeBase64Url(signature);
+  if (!signatureBytes || signatureBytes.length !== 32) return false;
+  try {
+    const encoder = new TextEncoder();
+    const key = await globalThis.crypto.subtle.importKey(
+      "raw",
+      encoder.encode(secret),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["verify"]
+    );
+    return await globalThis.crypto.subtle.verify(
+      "HMAC",
+      key,
+      signatureBytes,
+      encoder.encode(payload)
+    );
+  } catch {
+    return false;
+  }
+}
+function cookieValueCandidates(raw) {
+  const candidates = [raw];
+  try {
+    const decoded = decodeURIComponent(raw);
+    if (decoded !== raw) candidates.push(decoded);
+  } catch {
+  }
+  return candidates;
+}
+function decodeBase64Url(value) {
+  if (!/^[A-Za-z0-9_-]+$/.test(value)) return null;
+  const bytes = [];
+  let accumulator = 0;
+  let bits = 0;
+  for (const char of value) {
+    const digit = BASE64URL_ALPHABET.indexOf(char);
+    if (digit === -1) return null;
+    accumulator = accumulator << 6 | digit;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      bytes.push(accumulator >> bits & 255);
+      accumulator &= (1 << bits) - 1;
+    }
+  }
+  if (bits > 0 && accumulator !== 0) return null;
+  return new Uint8Array(bytes);
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isValidUser(value) {
+  return isRecord(value) && typeof value.id === "string" && value.id.length > 0 && typeof value.email === "string" && value.email.length > 0 && (value.role === void 0 || value.role === null || typeof value.role === "string");
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+var DEFAULT_SESSION_MAX_AGE_SECONDS, MAX_CLOCK_SKEW_MS, HMAC_SHA256_BASE64URL_LENGTH, BASE64URL_ALPHABET;
+var init_sessionCookie = __esm({
+  "src/client/sessionCookie.ts"() {
+    DEFAULT_SESSION_MAX_AGE_SECONDS = 300;
+    MAX_CLOCK_SKEW_MS = 3e4;
+    HMAC_SHA256_BASE64URL_LENGTH = 43;
+    BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+    __name(resolveSessionSecret, "resolveSessionSecret");
+    __name(parseSessionCookiePayload, "parseSessionCookiePayload");
+    __name(verifySessionCookie, "verifySessionCookie");
+    __name(readCookieValue, "readCookieValue");
+    __name(verifyHmac, "verifyHmac");
+    __name(cookieValueCandidates, "cookieValueCandidates");
+    __name(decodeBase64Url, "decodeBase64Url");
+    __name(isRecord, "isRecord");
+    __name(isValidUser, "isValidUser");
+    __name(isStringArray, "isStringArray");
+  }
+});
+
 // src/client/server/getSession.ts
 var getSession_exports = {};
 __export(getSession_exports, {
@@ -17,45 +152,12 @@ __export(getSession_exports, {
   NoSessionError: () => NoSessionError,
   getSession: () => getSession
 });
-import { createHmac, timingSafeEqual } from "crypto";
 function defaultBaseURL() {
   const explicit = typeof process !== "undefined" ? process.env.NAJM_AUTH_BASE_URL : void 0;
   if (explicit) return explicit;
   const origin = typeof process !== "undefined" ? process.env.NEXT_PUBLIC_API_URL ?? `http://localhost:${process.env.PORT ?? 3e3}` : "http://localhost:3000";
   return `${origin.replace(/\/$/, "")}/api`;
 }
-function getSessionSecret(config) {
-  return config.sessionSecret ?? (typeof process !== "undefined" ? process.env.NAJM_SESSION_SECRET : void 0) ?? (typeof process !== "undefined" ? process.env.JWT_ACCESS_SECRET : void 0);
-}
-function verifyHmac(payload, signature, secret) {
-  const expected = createHmac("sha256", secret).update(payload).digest("base64url");
-  if (expected.length !== signature.length) return false;
-  try {
-    return timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
-  } catch {
-    return false;
-  }
-}
-function parseSessionCookie(raw, secret) {
-  const lastDot = raw.lastIndexOf(".");
-  if (lastDot === -1) return null;
-  const payload = raw.substring(0, lastDot);
-  const signature = raw.substring(lastDot + 1);
-  if (!verifyHmac(payload, signature, secret)) return null;
-  try {
-    const decoded = decodeURIComponent(payload);
-    const data = JSON.parse(decoded);
-    if (Date.now() - data.iat > SESSION_COOKIE_MAX_AGE_MS) return null;
-    const { user, roles, permissions } = data;
-    return {
-      user,
-      roles: roles ?? (user.role ? [user.role] : void 0),
-      permissions: permissions ?? void 0
-    };
-  } catch {
-    return null;
-  }
-}
 function buildSession(body) {
   if (!body?.data) return null;
   const { roles, permissions, ...user } = body.data;
@@ -88,11 +190,24 @@ async function getSession(config = {}) {
     return null;
   }
   if (sessionCookieValue) {
-    const secret = getSessionSecret(config);
-    if (secret) {
-      const session = parseSessionCookie(sessionCookieValue, secret);
-      if (session) return session;
+    const secret = resolveSessionSecret(config.sessionSecret);
+    if (!secret) {
+      if (strict) throw new AuthConfigError("Session cookie secret is not configured");
+      return null;
+    }
+    const claims = await verifySessionCookie(sessionCookieValue, {
+      secret,
+      maxAgeSeconds: config.sessionMaxAge
+    });
+    if (!claims) {
+      if (strict) throw new NoSessionError("Invalid or expired session cookie");
+      return null;
     }
+    return {
+      user: claims.user,
+      roles: claims.roles,
+      permissions: claims.permissions
+    };
   }
   if (!hasRefreshCookie) {
     if (strict) throw new NoSessionError("No refresh token cookie");
@@ -121,9 +236,10 @@ async function getSession(config = {}) {
     return null;
   }
 }
-var NoSessionError, AuthConfigError, AuthTransportError, SESSION_COOKIE_MAX_AGE_MS;
+var NoSessionError, AuthConfigError, AuthTransportError;
 var init_getSession = __esm({
   "src/client/server/getSession.ts"() {
+    init_sessionCookie();
     NoSessionError = class extends Error {
       static {
         __name(this, "NoSessionError");
@@ -156,10 +272,6 @@ var init_getSession = __esm({
       code = "AUTH_TRANSPORT_ERROR";
     };
     __name(defaultBaseURL, "defaultBaseURL");
-    __name(getSessionSecret, "getSessionSecret");
-    __name(verifyHmac, "verifyHmac");
-    SESSION_COOKIE_MAX_AGE_MS = 3e5;
-    __name(parseSessionCookie, "parseSessionCookie");
     __name(buildSession, "buildSession");
     __name(getSession, "getSession");
   }
@@ -355,6 +467,7 @@ function createServerClient(config) {
 __name(createServerClient, "createServerClient");
 
 // src/client/server/withAuthMiddleware.ts
+init_sessionCookie();
 function withAuthMiddleware(config) {
   const {
     protectedRoutes = [],
@@ -363,8 +476,11 @@ function withAuthMiddleware(config) {
     roleRoutes = {},
     cookieName = "refreshToken",
     sessionCookieName = "najm.session",
+    sessionSecret,
+    sessionMaxAge,
     verifyAlways = false
   } = config;
+  void verifyAlways;
   return /* @__PURE__ */ __name(async function middleware(request) {
     const { NextResponse } = await import("next/server");
     const redirectToLogin = /* @__PURE__ */ __name((pathname2, clearCookies) => {
@@ -385,31 +501,21 @@ function withAuthMiddleware(config) {
     const isProtected = protectedRoutes.length === 0 || matchesAny(pathname, protectedRoutes);
     if (!isProtected) return NextResponse.next();
     const cookie = request.headers.get("cookie") ?? "";
-    const hasToken = cookieRegex(cookieName).test(cookie);
-    if (!hasToken) {
+    const sessionCookie = readCookieValue(cookie, sessionCookieName);
+    const secret = resolveSessionSecret(sessionSecret);
+    if (!sessionCookie || !secret) {
+      return redirectToLogin(pathname, true);
+    }
+    const session = await verifySessionCookie(sessionCookie, {
+      secret,
+      maxAgeSeconds: sessionMaxAge
+    });
+    if (!session) {
       return redirectToLogin(pathname, true);
     }
     const requiredRoles = findMatchingRoles(pathname, roleRoutes);
-    const needsVerify = verifyAlways || !!requiredRoles;
-    if (needsVerify) {
-      const verifyURL = config.verifyURL ?? `${url.origin}/api/auth/me`;
-      try {
-        const res = await fetch(verifyURL, {
-          headers: { "Cookie": cookie, "Accept": "application/json" }
-        });
-        if (!res.ok) {
-          return redirectToLogin(pathname, true);
-        }
-        if (requiredRoles) {
-          const body = await res.json();
-          const userRole = body?.data?.role;
-          if (!userRole || !requiredRoles.includes(userRole)) {
-            return new NextResponse(null, { status: 403 });
-          }
-        }
-      } catch {
-        return redirectToLogin(pathname, true);
-      }
+    if (requiredRoles && !session.roles.some((role) => requiredRoles.includes(role))) {
+      return new NextResponse(null, { status: 403 });
     }
     return NextResponse.next();
   }, "middleware");
@@ -425,10 +531,6 @@ function matchPattern(pathname, pattern) {
   return new RegExp(`^${regex}$`).test(pathname);
 }
 __name(matchPattern, "matchPattern");
-function cookieRegex(name) {
-  return new RegExp(`(?:^|;\\s*)${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}=[^;]`);
-}
-__name(cookieRegex, "cookieRegex");
 function findMatchingRoles(pathname, roleRoutes) {
   for (const [pattern, roles] of Object.entries(roleRoutes)) {
     if (matchPattern(pathname, pattern)) return roles;
@@ -935,27 +1037,6 @@ function createAuthClient(config) {
 __name(createAuthClient, "createAuthClient");
 
 // src/client/server/defineAuth.ts
-function matchesAny2(pathname, patterns) {
-  return patterns.some((p) => matchPattern2(pathname, p));
-}
-__name(matchesAny2, "matchesAny");
-function matchPattern2(pathname, pattern) {
-  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&");
-  const regex = escaped.replace(/\/:[^/]+\*/g, "(?:/.*)?").replace(/\/\\\*$/g, "(?:/.*)?").replace(/\\\*/g, "(?:/.*)?").replace(/\//g, "\\/");
-  return new RegExp(`^${regex}$`).test(pathname);
-}
-__name(matchPattern2, "matchPattern");
-function cookieRegex2(name) {
-  return new RegExp(`(?:^|;\\s*)${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}=[^;]`);
-}
-__name(cookieRegex2, "cookieRegex");
-function findMatchingRoles2(pathname, roleRoutes) {
-  for (const [pattern, roles] of Object.entries(roleRoutes)) {
-    if (matchPattern2(pathname, pattern)) return roles;
-  }
-  return null;
-}
-__name(findMatchingRoles2, "findMatchingRoles");
 function defineAuth(authConfig = {}) {
   const {
     apiBaseURL = "/api",
@@ -967,6 +1048,7 @@ function defineAuth(authConfig = {}) {
     cookieName = "refreshToken",
     sessionCookieName = "najm.session",
     sessionSecret,
+    sessionMaxAge,
     matcher = ["/((?!_next/static|_next/image|favicon.ico|api).*)"],
     verifyAlways = false,
     refreshThreshold,
@@ -981,7 +1063,8 @@ function defineAuth(authConfig = {}) {
     authPrefix,
     cookieName,
     sessionCookieName,
-    sessionSecret
+    sessionSecret,
+    sessionMaxAge
   };
   let _client = null;
   const getClient = /* @__PURE__ */ __name(() => {
@@ -1023,54 +1106,17 @@ function defineAuth(authConfig = {}) {
       throw err;
     }
   }, "requireSession");
-  const middleware = /* @__PURE__ */ __name(async (request) => {
-    const { NextResponse } = await import("next/server");
-    const url = new URL(request.url);
-    const pathname = url.pathname;
-    const redirectToLogin = /* @__PURE__ */ __name((clearCookies) => {
-      const loginUrl = new URL(loginRoute, request.url);
-      loginUrl.searchParams.set("from", pathname);
-      const res = NextResponse.redirect(loginUrl);
-      if (clearCookies) {
-        res.cookies.delete(cookieName);
-        res.cookies.delete(sessionCookieName);
-      }
-      return res;
-    }, "redirectToLogin");
-    if (matchesAny2(pathname, publicRoutes)) {
-      return NextResponse.next();
-    }
-    const isProtected = protectedRoutes.length === 0 || matchesAny2(pathname, protectedRoutes);
-    if (!isProtected) return NextResponse.next();
-    const cookie = request.headers.get("cookie") ?? "";
-    const hasToken = cookieRegex2(cookieName).test(cookie);
-    if (!hasToken) {
-      return redirectToLogin(true);
-    }
-    const requiredRoles = findMatchingRoles2(pathname, roleRoutes);
-    const needsVerify = verifyAlways || !!requiredRoles;
-    if (needsVerify) {
-      const verifyURL = `${url.origin}${apiBaseURL}${authPrefix}/me`;
-      try {
-        const res = await fetch(verifyURL, {
-          headers: { Cookie: cookie, Accept: "application/json" }
-        });
-        if (!res.ok) {
-          return redirectToLogin(true);
-        }
-        if (requiredRoles) {
-          const body = await res.json();
-          const userRole = body?.data?.role;
-          if (!userRole || !requiredRoles.includes(userRole)) {
-            return new NextResponse(null, { status: 403 });
-          }
-        }
-      } catch {
-        return redirectToLogin(true);
-      }
-    }
-    return NextResponse.next();
-  }, "middleware");
+  const middleware = withAuthMiddleware({
+    protectedRoutes,
+    publicRoutes,
+    loginRoute,
+    roleRoutes,
+    cookieName,
+    sessionCookieName,
+    sessionSecret,
+    sessionMaxAge,
+    verifyAlways
+  });
   const protect = /* @__PURE__ */ __name((Page, options) => {
     return /* @__PURE__ */ __name(async function ProtectedPage(props) {
       const session = await getSession2();

package/dist/index.d.ts

@@ -42,7 +42,7 @@ interface SessionCookieConfig {
     name: string;
     /** Max age in seconds (default: 300 = 5 min) */
     maxAge: number;
-    /** Secret used to HMAC-sign the cookie. Defaults to jwt.accessSecret. */
+    /** HMAC secret. Falls back to NAJM_SESSION_SECRET, then jwt.accessSecret. */
     secret?: string;
 }
 type OAuthProvider = 'google';
@@ -518,7 +518,7 @@ declare class CookieManager {
     getCookieName(): string;
     /**
      * Write a signed session cookie containing user data, roles, and permissions.
-     * The cookie is HMAC-signed with the access secret so it is tamper-proof
+     * The cookie is HMAC-signed with the configured session secret so it is tamper-proof
      * but readable without a database query. Short TTL (5 min) ensures freshness.
      */
     setSessionCookie(data: Omit<SessionCookieData, 'iat'>): void;

package/dist/index.js

@@ -293,6 +293,47 @@ EncryptionService = __decorate([
 import { Service, Inject as Inject2 } from "najm-core";
 import { CookieService } from "najm-cookies";
 import timestring from "timestring";
+
+// src/client/sessionCookie.ts
+var DEFAULT_SESSION_MAX_AGE_SECONDS = 300;
+var MAX_CLOCK_SKEW_MS = 3e4;
+function parseSessionCookiePayload(payload, maxAgeSeconds = DEFAULT_SESSION_MAX_AGE_SECONDS, now = Date.now()) {
+  if (!Number.isFinite(maxAgeSeconds) || maxAgeSeconds <= 0) return null;
+  try {
+    const data = JSON.parse(payload);
+    if (!isRecord(data) || !isValidUser(data.user)) return null;
+    if (!isStringArray(data.roles) || !isStringArray(data.permissions)) return null;
+    if (!Number.isInteger(data.sessionVersion) || data.sessionVersion < 0) return null;
+    if (!Number.isFinite(data.iat) || !Number.isInteger(data.iat) || data.iat <= 0) return null;
+    const issuedAt = data.iat;
+    if (issuedAt > now + MAX_CLOCK_SKEW_MS) return null;
+    if (now - issuedAt >= maxAgeSeconds * 1e3) return null;
+    return {
+      user: data.user,
+      roles: [...data.roles],
+      permissions: [...data.permissions],
+      sessionVersion: data.sessionVersion,
+      iat: issuedAt
+    };
+  } catch {
+    return null;
+  }
+}
+__name(parseSessionCookiePayload, "parseSessionCookiePayload");
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+__name(isRecord, "isRecord");
+function isValidUser(value) {
+  return isRecord(value) && typeof value.id === "string" && value.id.length > 0 && typeof value.email === "string" && value.email.length > 0 && (value.role === void 0 || value.role === null || typeof value.role === "string");
+}
+__name(isValidUser, "isValidUser");
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+__name(isStringArray, "isStringArray");
+
+// src/auth/CookieManager.ts
 var __decorate2 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
   if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -348,7 +389,7 @@ var CookieManager = class CookieManager2 {
   // =========================================================================
   /**
    * Write a signed session cookie containing user data, roles, and permissions.
-   * The cookie is HMAC-signed with the access secret so it is tamper-proof
+   * The cookie is HMAC-signed with the configured session secret so it is tamper-proof
    * but readable without a database query. Short TTL (5 min) ensures freshness.
    */
   setSessionCookie(data) {
@@ -368,15 +409,7 @@ var CookieManager = class CookieManager2 {
     const raw = this.cookieService.getSigned(this.sessionCookieName, this.sessionSecret);
     if (!raw)
       return null;
-    try {
-      const data = JSON.parse(raw);
-      const age = Date.now() - data.iat;
-      if (age > this.sessionMaxAge * 1e3)
-        return null;
-      return data;
-    } catch {
-      return null;
-    }
+    return parseSessionCookiePayload(raw, this.sessionMaxAge);
   }
   /**
    * Clear the session cookie (on logout, password change, etc.)
@@ -400,7 +433,7 @@ CookieManager = __decorate2([
 // src/auth/AuthController.ts
 import { Controller } from "najm-core";
 import { Get, Post, ResMsg } from "najm-core";
-import { Body, User as User3, Headers } from "najm-core";
+import { Body, User as User2, Headers } from "najm-core";
 
 // src/auth/AuthService.ts
 import { Injectable as Injectable8, Inject as Inject8 } from "najm-core";
@@ -2402,7 +2435,7 @@ var isAuth = createGuard(AuthGuard);
 
 // src/roles/RoleGuards.ts
 import { Service as Service3 } from "najm-core";
-import { GuardParams, User as User2 } from "najm-core";
+import { GuardParams, Role as RequestRole } from "najm-core";
 import { composeGuards, createGuard as createGuard2 } from "najm-guard";
 var __decorate14 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -2435,7 +2468,7 @@ var RoleGuard = class RoleGuard2 {
 };
 __decorate14([
   __param4(0, GuardParams()),
-  __param4(1, User2("role")),
+  __param4(1, RequestRole()),
   __metadata14("design:type", Function),
   __metadata14("design:paramtypes", [Object, String]),
   __metadata14("design:returntype", void 0)
@@ -2630,7 +2663,7 @@ __decorate15([
   Post("/logout"),
   isAuth(),
   RateLimit({ limit: 10, window: "15m", key: "user" }),
-  __param5(0, User3("id")),
+  __param5(0, User2("id")),
   __param5(1, Headers("authorization")),
   __metadata15("design:type", Function),
   __metadata15("design:paramtypes", [String, String]),
@@ -2641,7 +2674,7 @@ __decorate15([
   isAuth(),
   Validate(changePasswordDto),
   ResMsg("auth.success.passwordChanged"),
-  __param5(0, User3("id")),
+  __param5(0, User2("id")),
   __param5(1, Body()),
   __metadata15("design:type", Function),
   __metadata15("design:paramtypes", [String, Object]),
@@ -3370,7 +3403,7 @@ PermissionRepository = __decorate19([
 
 // src/permissions/PermissionGuards.ts
 import { Injectable as Injectable9 } from "najm-core";
-import { GuardParams as GuardParams2, User as User4 } from "najm-core";
+import { GuardParams as GuardParams2, User as User3 } from "najm-core";
 import { createGuard as createGuard4, composeGuards as composeGuards3 } from "najm-guard";
 var __decorate20 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -3416,7 +3449,7 @@ var PermissionGuard = class PermissionGuard2 {
 };
 __decorate20([
   __param8(0, GuardParams2()),
-  __param8(1, User4("permissions")),
+  __param8(1, User3("permissions")),
   __metadata20("design:type", Function),
   __metadata20("design:paramtypes", [String, Array]),
   __metadata20("design:returntype", Object)
@@ -4038,7 +4071,7 @@ function own(table, opts) {
 __name(own, "own");
 
 // src/ownership/configureOwnership.ts
-import { Injectable as Injectable12, Inject as Inject11, User as User5, Body as Body5, Params as Params4 } from "najm-core";
+import { Injectable as Injectable12, Inject as Inject11, User as User4, Body as Body5, Params as Params4 } from "najm-core";
 import { createGuard as createGuard5, composeGuards as composeGuards4 } from "najm-guard";
 var __decorate24 = function(decorators, target, key, desc) {
   var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -4083,7 +4116,7 @@ function createResourceGuards(ownershipClass, resourceType, resource, options) {
     __metadata24("design:type", Object)
   ], AccessGuard.prototype, "ownership", void 0);
   __decorate24([
-    __param10(0, User5()),
+    __param10(0, User4()),
     __param10(1, Params4("id")),
     __metadata24("design:type", Function),
     __metadata24("design:paramtypes", [Object, String]),
@@ -4107,7 +4140,7 @@ function createResourceGuards(ownershipClass, resourceType, resource, options) {
     __metadata24("design:type", Object)
   ], ListGuard.prototype, "ownership", void 0);
   __decorate24([
-    __param10(0, User5()),
+    __param10(0, User4()),
     __metadata24("design:type", Function),
     __metadata24("design:paramtypes", [Object]),
     __metadata24("design:returntype", typeof (_b12 = typeof Promise !== "undefined" && Promise) === "function" ? _b12 : Object)
@@ -4266,7 +4299,7 @@ function configureOwnership(config) {
       __metadata24("design:type", GeneratedOwnershipService)
     ], BodyAccessGuard.prototype, "ownership", void 0);
     __decorate24([
-      __param10(0, User5()),
+      __param10(0, User4()),
       __param10(1, Body5()),
       __metadata24("design:type", Function),
       __metadata24("design:paramtypes", [Object, Object]),
@@ -4977,7 +5010,7 @@ OAuthAccountService = __decorate29([
 
 // src/oauth/OAuthController.ts
 import { createHash as createHash4 } from "crypto";
-import { Controller as Controller5, Ctx, Get as Get5, Post as Post5, Query as Query2, User as User6 } from "najm-core";
+import { Controller as Controller5, Ctx, Get as Get5, Post as Post5, Query as Query2, User as User5 } from "najm-core";
 import { RateLimit as RateLimit2 } from "najm-rate";
 
 // src/oauth/OAuthService.ts
@@ -5284,7 +5317,7 @@ __decorate32([
   Post5("/link"),
   isAuth(),
   RateLimit2({ limit: 10, window: "15m", key: "user" }),
-  __param11(0, User6("id")),
+  __param11(0, User5("id")),
   __param11(1, Query2("returnTo")),
   __metadata32("design:type", Function),
   __metadata32("design:paramtypes", [String, String]),
@@ -5379,8 +5412,9 @@ var resolveAuthConfig = /* @__PURE__ */ __name((config) => {
     session: {
       name: config?.session?.name ?? "najm.session",
       maxAge: config?.session?.maxAge ?? 300,
-      secret: config?.session?.secret
-      // fallback to jwt.accessSecret at use site
+      // Keep Edge/server readers aligned with the documented secret order.
+      // CookieManager falls back to jwt.accessSecret when this is undefined.
+      secret: config?.session?.secret ?? process.env.NAJM_SESSION_SECRET
     },
     oauth: {
       google: resolveGoogleConfig(config)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "2.0.2",
+  "version": "2.0.4",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [
@@ -76,8 +76,8 @@
   "dependencies": {
     "bcryptjs": "^3.0.2",
     "najm-cookies": "^2.0.2",
-    "najm-core": "^2.0.3",
-    "najm-database": "^2.0.2",
+    "najm-core": "^2.0.4",
+    "najm-database": "^2.0.3",
     "najm-guard": "^2.0.2",
     "najm-i18n": "^2.0.2",
     "najm-cache": "^2.0.2",