najm-auth 2.0.3 → 2.0.5

package/dist/client/server/index.js

@@ -9,121 +9,324 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// src/client/server/getSession.ts
-var getSession_exports = {};
-__export(getSession_exports, {
-  AuthConfigError: () => AuthConfigError,
-  AuthTransportError: () => AuthTransportError,
-  NoSessionError: () => NoSessionError,
-  getSession: () => getSession
-});
-import { createHmac, timingSafeEqual } from "crypto";
-function defaultBaseURL() {
-  const explicit = typeof process !== "undefined" ? process.env.NAJM_AUTH_BASE_URL : void 0;
-  if (explicit) return explicit;
-  const origin = typeof process !== "undefined" ? process.env.NEXT_PUBLIC_API_URL ?? `http://localhost:${process.env.PORT ?? 3e3}` : "http://localhost:3000";
-  return `${origin.replace(/\/$/, "")}/api`;
+// src/client/sessionCookie.ts
+function resolveSessionSecret(explicit) {
+  if (explicit !== void 0) return explicit || void 0;
+  if (typeof process === "undefined") return void 0;
+  return process.env.NAJM_SESSION_SECRET || process.env.JWT_ACCESS_SECRET || void 0;
+}
+function parseSessionCookiePayload(payload, maxAgeSeconds = DEFAULT_SESSION_MAX_AGE_SECONDS, now = Date.now()) {
+  if (!Number.isFinite(maxAgeSeconds) || maxAgeSeconds <= 0) return null;
+  try {
+    const data = JSON.parse(payload);
+    if (!isRecord(data) || !isValidUser(data.user)) return null;
+    if (!isStringArray(data.roles) || !isStringArray(data.permissions)) return null;
+    if (!Number.isInteger(data.sessionVersion) || data.sessionVersion < 0) return null;
+    if (!Number.isFinite(data.iat) || !Number.isInteger(data.iat) || data.iat <= 0) return null;
+    const issuedAt = data.iat;
+    if (issuedAt > now + MAX_CLOCK_SKEW_MS) return null;
+    if (now - issuedAt >= maxAgeSeconds * 1e3) return null;
+    return {
+      user: data.user,
+      roles: [...data.roles],
+      permissions: [...data.permissions],
+      sessionVersion: data.sessionVersion,
+      iat: issuedAt
+    };
+  } catch {
+    return null;
+  }
+}
+async function verifySessionCookie(rawCookieValue, options) {
+  if (!rawCookieValue || !options.secret || !globalThis.crypto?.subtle) return null;
+  for (const signedValue of cookieValueCandidates(rawCookieValue)) {
+    const lastDot = signedValue.lastIndexOf(".");
+    if (lastDot <= 0 || lastDot === signedValue.length - 1) continue;
+    const payload = signedValue.slice(0, lastDot);
+    const signature = signedValue.slice(lastDot + 1);
+    if (!await verifyHmac(payload, signature, options.secret)) continue;
+    return parseSessionCookiePayload(
+      payload,
+      options.maxAgeSeconds ?? DEFAULT_SESSION_MAX_AGE_SECONDS,
+      options.now
+    );
+  }
+  return null;
 }
-function getSessionSecret(config) {
-  return config.sessionSecret ?? (typeof process !== "undefined" ? process.env.NAJM_SESSION_SECRET : void 0) ?? (typeof process !== "undefined" ? process.env.JWT_ACCESS_SECRET : void 0);
+function readCookieValue(cookieHeader, name) {
+  for (const part of cookieHeader.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator === -1) continue;
+    if (part.slice(0, separator).trim() === name) {
+      const value = part.slice(separator + 1).trim();
+      return value || void 0;
+    }
+  }
+  return void 0;
 }
-function verifyHmac(payload, signature, secret) {
-  const expected = createHmac("sha256", secret).update(payload).digest("base64url");
-  if (expected.length !== signature.length) return false;
+async function verifyHmac(payload, signature, secret) {
+  if (signature.length !== HMAC_SHA256_BASE64URL_LENGTH) return false;
+  const signatureBytes = decodeBase64Url(signature);
+  if (!signatureBytes || signatureBytes.length !== 32) return false;
   try {
-    return timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
+    const encoder = new TextEncoder();
+    const key = await globalThis.crypto.subtle.importKey(
+      "raw",
+      encoder.encode(secret),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["verify"]
+    );
+    return await globalThis.crypto.subtle.verify(
+      "HMAC",
+      key,
+      signatureBytes,
+      encoder.encode(payload)
+    );
   } catch {
     return false;
   }
 }
-function parseSessionCookie(raw, secret) {
-  const lastDot = raw.lastIndexOf(".");
-  if (lastDot === -1) return null;
-  const payload = raw.substring(0, lastDot);
-  const signature = raw.substring(lastDot + 1);
-  if (!verifyHmac(payload, signature, secret)) return null;
+function cookieValueCandidates(raw) {
+  const candidates = [raw];
   try {
-    const decoded = decodeURIComponent(payload);
-    const data = JSON.parse(decoded);
-    if (Date.now() - data.iat > SESSION_COOKIE_MAX_AGE_MS) return null;
-    const { user, roles, permissions } = data;
-    return {
-      user,
-      roles: roles ?? (user.role ? [user.role] : void 0),
-      permissions: permissions ?? void 0
-    };
+    const decoded = decodeURIComponent(raw);
+    if (decoded !== raw) candidates.push(decoded);
   } catch {
-    return null;
   }
+  return candidates;
+}
+function decodeBase64Url(value) {
+  if (!/^[A-Za-z0-9_-]+$/.test(value)) return null;
+  const bytes = [];
+  let accumulator = 0;
+  let bits = 0;
+  for (const char of value) {
+    const digit = BASE64URL_ALPHABET.indexOf(char);
+    if (digit === -1) return null;
+    accumulator = accumulator << 6 | digit;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      bytes.push(accumulator >> bits & 255);
+      accumulator &= (1 << bits) - 1;
+    }
+  }
+  if (bits > 0 && accumulator !== 0) return null;
+  return new Uint8Array(bytes);
 }
-function buildSession(body) {
-  if (!body?.data) return null;
-  const { roles, permissions, ...user } = body.data;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isValidUser(value) {
+  return isRecord(value) && typeof value.id === "string" && value.id.length > 0 && typeof value.email === "string" && value.email.length > 0 && (value.role === void 0 || value.role === null || typeof value.role === "string");
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
+var DEFAULT_SESSION_MAX_AGE_SECONDS, MAX_CLOCK_SKEW_MS, HMAC_SHA256_BASE64URL_LENGTH, BASE64URL_ALPHABET;
+var init_sessionCookie = __esm({
+  "src/client/sessionCookie.ts"() {
+    DEFAULT_SESSION_MAX_AGE_SECONDS = 300;
+    MAX_CLOCK_SKEW_MS = 3e4;
+    HMAC_SHA256_BASE64URL_LENGTH = 43;
+    BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+    __name(resolveSessionSecret, "resolveSessionSecret");
+    __name(parseSessionCookiePayload, "parseSessionCookiePayload");
+    __name(verifySessionCookie, "verifySessionCookie");
+    __name(readCookieValue, "readCookieValue");
+    __name(verifyHmac, "verifyHmac");
+    __name(cookieValueCandidates, "cookieValueCandidates");
+    __name(decodeBase64Url, "decodeBase64Url");
+    __name(isRecord, "isRecord");
+    __name(isValidUser, "isValidUser");
+    __name(isStringArray, "isStringArray");
+  }
+});
+
+// src/client/sessionRecovery.ts
+async function requestSessionRecovery(options) {
+  if (!isCookieName(options.refreshCookieName) || !isCookieName(options.sessionCookieName)) {
+    return { status: "unavailable" };
+  }
+  if (!isCookieValue(options.refreshCookieValue)) {
+    return { status: "invalid" };
+  }
+  if (!isSafeRecoveryEndpoint(options.endpoint)) {
+    return { status: "unavailable" };
+  }
+  let response;
+  try {
+    response = await fetch(options.endpoint, {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        Cookie: `${options.refreshCookieName}=${options.refreshCookieValue}`,
+        "X-Najm-Session-Recovery": "1"
+      },
+      cache: "no-store",
+      redirect: "manual"
+    });
+  } catch {
+    return { status: "unavailable" };
+  }
+  if (!response.ok) {
+    const status = response.status;
+    return {
+      status: status === 400 || status === 401 || status === 403 ? "invalid" : "unavailable",
+      httpStatus: status
+    };
+  }
+  const setCookie = response.headers.get("set-cookie");
+  if (!setCookie) return { status: "unavailable", httpStatus: response.status };
+  const sessionCookieValue = readSetCookieValue(setCookie, options.sessionCookieName);
+  if (!sessionCookieValue) {
+    return { status: "unavailable", httpStatus: response.status };
+  }
+  const claims = await verifySessionCookie(sessionCookieValue, {
+    secret: options.sessionSecret,
+    maxAgeSeconds: options.sessionMaxAge
+  });
+  if (!claims) return { status: "unavailable", httpStatus: response.status };
   return {
-    user,
-    roles: roles ?? (user.role ? [user.role] : void 0),
-    permissions: permissions ?? user.permissions
+    status: "recovered",
+    claims,
+    setCookie,
+    sessionCookieValue
   };
 }
+function authEndpoint(baseURL, authPrefix, suffix, requestURL) {
+  const normalizedBase = baseURL.replace(/\/+$/, "");
+  const normalizedPrefix = `/${authPrefix.replace(/^\/+|\/+$/g, "")}`;
+  const normalizedSuffix = `/${suffix.replace(/^\/+/, "")}`;
+  const value = `${normalizedBase}${normalizedPrefix}${normalizedSuffix}`;
+  return requestURL ? new URL(value, requestURL).toString() : value;
+}
+function replaceCookieValue(cookieHeader, name, value) {
+  const parts = cookieHeader.split(";").map((part) => part.trim()).filter(Boolean).filter((part) => part.slice(0, part.indexOf("=")).trim() !== name);
+  parts.push(`${name}=${value}`);
+  return parts.join("; ");
+}
+function readSetCookieValue(setCookie, name) {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const match = setCookie.match(new RegExp(`(?:^|,\\s*)${escaped}=([^;]*)`));
+  return match?.[1] || void 0;
+}
+function isCookieName(value) {
+  return /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(value);
+}
+function isCookieValue(value) {
+  return value.length > 0 && !/[\r\n;]/.test(value);
+}
+function isSafeRecoveryEndpoint(value) {
+  try {
+    const url = new URL(value);
+    if (url.username || url.password) return false;
+    if (url.protocol === "https:") return true;
+    if (url.protocol !== "http:") return false;
+    return url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]" || url.hostname === "::1";
+  } catch {
+    return false;
+  }
+}
+var init_sessionRecovery = __esm({
+  "src/client/sessionRecovery.ts"() {
+    init_sessionCookie();
+    __name(requestSessionRecovery, "requestSessionRecovery");
+    __name(authEndpoint, "authEndpoint");
+    __name(replaceCookieValue, "replaceCookieValue");
+    __name(readSetCookieValue, "readSetCookieValue");
+    __name(isCookieName, "isCookieName");
+    __name(isCookieValue, "isCookieValue");
+    __name(isSafeRecoveryEndpoint, "isSafeRecoveryEndpoint");
+  }
+});
+
+// src/client/server/getSession.ts
+var getSession_exports = {};
+__export(getSession_exports, {
+  AuthConfigError: () => AuthConfigError,
+  AuthTransportError: () => AuthTransportError,
+  NoSessionError: () => NoSessionError,
+  getSession: () => getSession
+});
+function defaultBaseURL() {
+  const explicit = typeof process !== "undefined" ? process.env.NAJM_AUTH_BASE_URL : void 0;
+  if (explicit) return explicit;
+  const origin = typeof process !== "undefined" ? process.env.NEXT_PUBLIC_API_URL ?? `http://localhost:${process.env.PORT ?? 3e3}` : "http://localhost:3000";
+  return `${origin.replace(/\/$/, "")}/api`;
+}
 async function getSession(config = {}) {
   const cookieName = config.cookieName ?? "refreshToken";
   const sessionCookieName = config.sessionCookieName ?? "najm.session";
   const baseURL = config.baseURL ?? defaultBaseURL();
   const prefix = config.authPrefix ?? "/auth";
   const strict = config.mode === "strict";
-  let cookieHeader = "";
   let sessionCookieValue;
-  let hasRefreshCookie = false;
+  let refreshCookieValue;
   try {
     const mod = await import("next/headers");
     const cookieStore = await mod.cookies();
-    const sessionCookie = cookieStore.get(sessionCookieName);
-    if (sessionCookie) sessionCookieValue = sessionCookie.value;
-    if (typeof cookieStore.get === "function") {
-      hasRefreshCookie = !!cookieStore.get(cookieName);
-    }
-    cookieHeader = cookieStore.getAll().map((c) => `${c.name}=${c.value}`).join("; ");
-  } catch (err) {
+    sessionCookieValue = cookieStore.get(sessionCookieName)?.value;
+    refreshCookieValue = cookieStore.get(cookieName)?.value;
+  } catch {
     if (strict) throw new AuthConfigError("Failed to read cookies from Next.js headers()");
     return null;
   }
-  if (sessionCookieValue) {
-    const secret = getSessionSecret(config);
-    if (secret) {
-      const session = parseSessionCookie(sessionCookieValue, secret);
-      if (session) return session;
+  const secret = resolveSessionSecret(config.sessionSecret);
+  if (sessionCookieValue && secret) {
+    const claims = await verifySessionCookie(sessionCookieValue, {
+      secret,
+      maxAgeSeconds: config.sessionMaxAge
+    });
+    if (claims) {
+      return {
+        user: claims.user,
+        roles: claims.roles,
+        permissions: claims.permissions
+      };
     }
   }
-  if (!hasRefreshCookie) {
-    if (strict) throw new NoSessionError("No refresh token cookie");
+  if (!secret) {
+    if (strict) throw new AuthConfigError("Session cookie secret is not configured");
     return null;
   }
-  if (!cookieHeader) {
-    if (strict) throw new NoSessionError("Empty cookie header");
+  if (!refreshCookieValue || config.recoveryURL === false) {
+    if (strict) throw new NoSessionError("No recoverable refresh session");
     return null;
   }
-  try {
-    const res = await fetch(`${baseURL}${prefix}/me`, {
-      headers: { Cookie: cookieHeader, Accept: "application/json" },
-      cache: "no-store"
-    });
-    if (!res.ok) {
-      if (strict) throw new AuthTransportError(`/auth/me returned ${res.status}`, res.status);
-      return null;
+  const endpoint = config.recoveryURL ? new URL(config.recoveryURL, baseURL).toString() : authEndpoint(baseURL, prefix, "/session/recover");
+  const recovery = await requestSessionRecovery({
+    endpoint,
+    refreshCookieName: cookieName,
+    refreshCookieValue,
+    sessionCookieName,
+    sessionSecret: secret,
+    sessionMaxAge: config.sessionMaxAge
+  });
+  if (recovery.status === "recovered") {
+    return {
+      user: recovery.claims.user,
+      roles: recovery.claims.roles,
+      permissions: recovery.claims.permissions
+    };
+  }
+  if (strict) {
+    if (recovery.status === "invalid") {
+      throw new NoSessionError("Refresh session is invalid or revoked");
     }
-    const body = await res.json();
-    const session = buildSession(body);
-    if (!session && strict) throw new NoSessionError("No user data in /auth/me response");
-    return session;
-  } catch (err) {
-    if (err instanceof NoSessionError || err instanceof AuthTransportError) throw err;
-    if (strict) throw new AuthTransportError(`Failed to fetch /auth/me: ${err.message}`);
-    return null;
+    throw new AuthTransportError(
+      "Session recovery endpoint was unavailable or returned an invalid session",
+      recovery.httpStatus
+    );
   }
+  return null;
 }
-var NoSessionError, AuthConfigError, AuthTransportError, SESSION_COOKIE_MAX_AGE_MS;
+var NoSessionError, AuthConfigError, AuthTransportError;
 var init_getSession = __esm({
   "src/client/server/getSession.ts"() {
+    init_sessionCookie();
+    init_sessionRecovery();
     NoSessionError = class extends Error {
       static {
         __name(this, "NoSessionError");
@@ -156,11 +359,6 @@ var init_getSession = __esm({
       code = "AUTH_TRANSPORT_ERROR";
     };
     __name(defaultBaseURL, "defaultBaseURL");
-    __name(getSessionSecret, "getSessionSecret");
-    __name(verifyHmac, "verifyHmac");
-    SESSION_COOKIE_MAX_AGE_MS = 3e5;
-    __name(parseSessionCookie, "parseSessionCookie");
-    __name(buildSession, "buildSession");
     __name(getSession, "getSession");
   }
 });
@@ -355,6 +553,8 @@ function createServerClient(config) {
 __name(createServerClient, "createServerClient");
 
 // src/client/server/withAuthMiddleware.ts
+init_sessionCookie();
+init_sessionRecovery();
 function withAuthMiddleware(config) {
   const {
     protectedRoutes = [],
@@ -362,54 +562,86 @@ function withAuthMiddleware(config) {
     loginRoute = "/login",
     roleRoutes = {},
     cookieName = "refreshToken",
+    apiBaseURL = "/api",
+    authPrefix = "/auth",
     sessionCookieName = "najm.session",
-    verifyAlways = false
+    sessionSecret,
+    sessionMaxAge,
+    verifyAlways = false,
+    recoveryURL
   } = config;
   return /* @__PURE__ */ __name(async function middleware(request) {
     const { NextResponse } = await import("next/server");
-    const redirectToLogin = /* @__PURE__ */ __name((pathname2, clearCookies) => {
+    const redirectToLogin = /* @__PURE__ */ __name((returnPath2, clearCookies) => {
       const loginUrl = new URL(loginRoute, request.url);
-      loginUrl.searchParams.set("from", pathname2);
+      loginUrl.searchParams.set("from", returnPath2);
       const res = NextResponse.redirect(loginUrl);
-      if (clearCookies) {
+      if (clearCookies.includes("refresh")) {
         res.cookies.delete(cookieName);
+      }
+      if (clearCookies.includes("session")) {
         res.cookies.delete(sessionCookieName);
       }
       return res;
     }, "redirectToLogin");
     const url = new URL(request.url);
     const pathname = url.pathname;
+    const returnPath = `${url.pathname}${url.search}`;
     if (matchesAny(pathname, publicRoutes)) {
       return NextResponse.next();
     }
     const isProtected = protectedRoutes.length === 0 || matchesAny(pathname, protectedRoutes);
     if (!isProtected) return NextResponse.next();
     const cookie = request.headers.get("cookie") ?? "";
-    const hasToken = cookieRegex(cookieName).test(cookie);
-    if (!hasToken) {
-      return redirectToLogin(pathname, true);
+    const sessionCookie = readCookieValue(cookie, sessionCookieName);
+    const secret = resolveSessionSecret(sessionSecret);
+    if (!secret) {
+      return redirectToLogin(returnPath, ["session"]);
+    }
+    let session = sessionCookie ? await verifySessionCookie(sessionCookie, {
+      secret,
+      maxAgeSeconds: sessionMaxAge
+    }) : null;
+    let recovery = null;
+    if (!session || verifyAlways) {
+      const refreshCookie = readCookieValue(cookie, cookieName);
+      if (!refreshCookie || recoveryURL === false) {
+        return redirectToLogin(returnPath, ["refresh", "session"]);
+      }
+      const endpoint = recoveryURL ? new URL(recoveryURL, request.url).toString() : authEndpoint(apiBaseURL, authPrefix, "/session/recover", request.url);
+      recovery = await requestSessionRecovery({
+        endpoint,
+        refreshCookieName: cookieName,
+        refreshCookieValue: refreshCookie,
+        sessionCookieName,
+        sessionSecret: secret,
+        sessionMaxAge
+      });
+      if (recovery.status !== "recovered") {
+        return redirectToLogin(
+          returnPath,
+          recovery.status === "invalid" ? ["refresh", "session"] : ["session"]
+        );
+      }
+      session = recovery.claims;
     }
     const requiredRoles = findMatchingRoles(pathname, roleRoutes);
-    const needsVerify = verifyAlways || !!requiredRoles;
-    if (needsVerify) {
-      const verifyURL = config.verifyURL ?? `${url.origin}/api/auth/me`;
-      try {
-        const res = await fetch(verifyURL, {
-          headers: { "Cookie": cookie, "Accept": "application/json" }
-        });
-        if (!res.ok) {
-          return redirectToLogin(pathname, true);
-        }
-        if (requiredRoles) {
-          const body = await res.json();
-          const userRole = body?.data?.role;
-          if (!userRole || !requiredRoles.includes(userRole)) {
-            return new NextResponse(null, { status: 403 });
-          }
-        }
-      } catch {
-        return redirectToLogin(pathname, true);
+    if (requiredRoles && !session.roles.some((role) => requiredRoles.includes(role))) {
+      const forbidden = new NextResponse(null, { status: 403 });
+      if (recovery?.status === "recovered") {
+        forbidden.headers.append("Set-Cookie", recovery.setCookie);
       }
+      return forbidden;
+    }
+    if (recovery?.status === "recovered") {
+      const requestHeaders = new Headers(request.headers);
+      requestHeaders.set(
+        "cookie",
+        replaceCookieValue(cookie, sessionCookieName, recovery.sessionCookieValue)
+      );
+      const response = NextResponse.next({ request: { headers: requestHeaders } });
+      response.headers.append("Set-Cookie", recovery.setCookie);
+      return response;
     }
     return NextResponse.next();
   }, "middleware");
@@ -425,10 +657,6 @@ function matchPattern(pathname, pattern) {
   return new RegExp(`^${regex}$`).test(pathname);
 }
 __name(matchPattern, "matchPattern");
-function cookieRegex(name) {
-  return new RegExp(`(?:^|;\\s*)${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}=[^;]`);
-}
-__name(cookieRegex, "cookieRegex");
 function findMatchingRoles(pathname, roleRoutes) {
   for (const [pattern, roles] of Object.entries(roleRoutes)) {
     if (matchPattern(pathname, pattern)) return roles;
@@ -935,27 +1163,6 @@ function createAuthClient(config) {
 __name(createAuthClient, "createAuthClient");
 
 // src/client/server/defineAuth.ts
-function matchesAny2(pathname, patterns) {
-  return patterns.some((p) => matchPattern2(pathname, p));
-}
-__name(matchesAny2, "matchesAny");
-function matchPattern2(pathname, pattern) {
-  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&");
-  const regex = escaped.replace(/\/:[^/]+\*/g, "(?:/.*)?").replace(/\/\\\*$/g, "(?:/.*)?").replace(/\\\*/g, "(?:/.*)?").replace(/\//g, "\\/");
-  return new RegExp(`^${regex}$`).test(pathname);
-}
-__name(matchPattern2, "matchPattern");
-function cookieRegex2(name) {
-  return new RegExp(`(?:^|;\\s*)${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}=[^;]`);
-}
-__name(cookieRegex2, "cookieRegex");
-function findMatchingRoles2(pathname, roleRoutes) {
-  for (const [pattern, roles] of Object.entries(roleRoutes)) {
-    if (matchPattern2(pathname, pattern)) return roles;
-  }
-  return null;
-}
-__name(findMatchingRoles2, "findMatchingRoles");
 function defineAuth(authConfig = {}) {
   const {
     apiBaseURL = "/api",
@@ -967,6 +1174,8 @@ function defineAuth(authConfig = {}) {
     cookieName = "refreshToken",
     sessionCookieName = "najm.session",
     sessionSecret,
+    sessionMaxAge,
+    recoveryURL,
     matcher = ["/((?!_next/static|_next/image|favicon.ico|api).*)"],
     verifyAlways = false,
     refreshThreshold,
@@ -981,7 +1190,9 @@ function defineAuth(authConfig = {}) {
     authPrefix,
     cookieName,
     sessionCookieName,
-    sessionSecret
+    sessionSecret,
+    sessionMaxAge,
+    recoveryURL
   };
   let _client = null;
   const getClient = /* @__PURE__ */ __name(() => {
@@ -1023,54 +1234,20 @@ function defineAuth(authConfig = {}) {
       throw err;
     }
   }, "requireSession");
-  const middleware = /* @__PURE__ */ __name(async (request) => {
-    const { NextResponse } = await import("next/server");
-    const url = new URL(request.url);
-    const pathname = url.pathname;
-    const redirectToLogin = /* @__PURE__ */ __name((clearCookies) => {
-      const loginUrl = new URL(loginRoute, request.url);
-      loginUrl.searchParams.set("from", pathname);
-      const res = NextResponse.redirect(loginUrl);
-      if (clearCookies) {
-        res.cookies.delete(cookieName);
-        res.cookies.delete(sessionCookieName);
-      }
-      return res;
-    }, "redirectToLogin");
-    if (matchesAny2(pathname, publicRoutes)) {
-      return NextResponse.next();
-    }
-    const isProtected = protectedRoutes.length === 0 || matchesAny2(pathname, protectedRoutes);
-    if (!isProtected) return NextResponse.next();
-    const cookie = request.headers.get("cookie") ?? "";
-    const hasToken = cookieRegex2(cookieName).test(cookie);
-    if (!hasToken) {
-      return redirectToLogin(true);
-    }
-    const requiredRoles = findMatchingRoles2(pathname, roleRoutes);
-    const needsVerify = verifyAlways || !!requiredRoles;
-    if (needsVerify) {
-      const verifyURL = `${url.origin}${apiBaseURL}${authPrefix}/me`;
-      try {
-        const res = await fetch(verifyURL, {
-          headers: { Cookie: cookie, Accept: "application/json" }
-        });
-        if (!res.ok) {
-          return redirectToLogin(true);
-        }
-        if (requiredRoles) {
-          const body = await res.json();
-          const userRole = body?.data?.role;
-          if (!userRole || !requiredRoles.includes(userRole)) {
-            return new NextResponse(null, { status: 403 });
-          }
-        }
-      } catch {
-        return redirectToLogin(true);
-      }
-    }
-    return NextResponse.next();
-  }, "middleware");
+  const middleware = withAuthMiddleware({
+    protectedRoutes,
+    publicRoutes,
+    loginRoute,
+    roleRoutes,
+    cookieName,
+    apiBaseURL,
+    authPrefix,
+    sessionCookieName,
+    sessionSecret,
+    sessionMaxAge,
+    recoveryURL,
+    verifyAlways
+  });
   const protect = /* @__PURE__ */ __name((Page, options) => {
     return /* @__PURE__ */ __name(async function ProtectedPage(props) {
       const session = await getSession2();