najm-auth 3.1.4 → 3.2.0

package/README.md

@@ -272,9 +272,13 @@ login, `AuthSessionService.establish()`, Google OAuth (which redirects with
 recovery — so verified-email OAuth linking cannot skip it. Marking a new
 requirement also revokes the user's current sessions.
 
-`withAuthCookiePersistence` recognizes the setup response on its own: it drops
-any session cookies the response carried, clears the remembered preference, and
-leaves the opaque setup cookie alone.
+`withAuthCookiePersistence` recognizes logout and setup boundaries on its own.
+After a successful logout it drops stale auth-cookie issuances and guarantees
+exactly one deletion for each configured auth cookie. It preserves a valid
+upstream deletion (including a custom cookie path), or synthesizes a canonical
+deletion when one is missing. A setup response gets the same auth-cookie
+deletions, clears the remembered preference, and leaves the opaque setup cookie
+alone.
 
 ### Google Sign-In
 
@@ -721,7 +725,7 @@ limits are active when `auth()` is registered.
 | Route | Limit | Window | Key Strategy |
 |-------|-------|--------|--------------|
 | `POST /auth/register` | 5 | 15 minutes | IP |
-| `POST /auth/login` | 8 | 10 minutes | IP + hashed normalized identity |
+| `POST /auth/login` | 8 | 10 minutes | IP + hashed normalized identity |
 | `POST /auth/refresh` | 15 | 15 minutes | Cookie fingerprint |
 | `POST /auth/session/recover` | 120 | 1 minute | Cookie fingerprint |
 | `POST /auth/logout` | 10 | 15 minutes | User ID |
@@ -729,27 +733,27 @@ limits are active when `auth()` is registered.
 | `POST /auth/forgot-password` | 3 | 15 minutes | IP |
 | `POST /auth/reset-password` | 5 | 15 minutes | IP |
 
-### Customizing Rate Limits
-
-The login route has strict environment overrides. Values are read when the
-server imports `najm-auth`, so restart the process after changing them. Invalid
-values fail startup rather than silently weakening the limiter.
-
-```bash
-NAJM_AUTH_LOGIN_RATE_LIMIT_ENABLED=true
-NAJM_AUTH_LOGIN_RATE_LIMIT=8
-NAJM_AUTH_LOGIN_RATE_WINDOW=10m
-```
-
-`NAJM_AUTH_LOGIN_RATE_LIMIT_ENABLED=false` disables only the login-route
-limiter. Keep it enabled on public production deployments; a shorter window is
-the safer setting for a disposable production-built demo.
-
-The generic plugin configuration remains available for global limits and skip
-rules:
-
-```typescript
-auth({
+### Customizing Rate Limits
+
+The login route has strict environment overrides. Values are read when the
+server imports `najm-auth`, so restart the process after changing them. Invalid
+values fail startup rather than silently weakening the limiter.
+
+```bash
+NAJM_AUTH_LOGIN_RATE_LIMIT_ENABLED=true
+NAJM_AUTH_LOGIN_RATE_LIMIT=8
+NAJM_AUTH_LOGIN_RATE_WINDOW=10m
+```
+
+`NAJM_AUTH_LOGIN_RATE_LIMIT_ENABLED=false` disables only the login-route
+limiter. Keep it enabled on public production deployments; a shorter window is
+the safer setting for a disposable production-built demo.
+
+The generic plugin configuration remains available for global limits and skip
+rules:
+
+```typescript
+auth({
   rateLimit: {
     keyGenerator: 'ip',        // or 'user', 'api-key', 'user+ip'
     defaultWindow: '10m',
@@ -762,13 +766,14 @@ auth({
 
 ## Next.js App Router Structure
 
-Every App Router application keeps the same three files. Copying more than this
+Every App Router application keeps the same four files. Copying more than this
 between apps means logic that belongs in the package has leaked into them.
 
 ```text
 src/lib/auth.ts     defineAuth() configuration — browser, server, and proxy safe
 src/lib/session.ts  one createReactServerAuth() instance for Server Components
-src/proxy.ts        imports auth.ts only, and exports auth.middleware
+src/proxy.ts        exports auth.proxy plus Next's required static matcher
+src/app/api/[...route]/route.ts  binds the server through auth.routeHandlers()
 ```
 
 ```typescript
@@ -782,6 +787,7 @@ export const auth = defineAuth({
   publicRoutes: ['/', '/login'],
   protectedRoutes: ['/dashboard/:path*', '/admin/:path*'],
   roleRoutes: { '/admin/:path*': ['admin'] },
+  proxySessionMode: 'optimistic',
 });
 ```
 
@@ -800,10 +806,33 @@ export const serverAuth = createReactServerAuth(auth);
 // src/proxy.ts
 import { auth } from './lib/auth';
 
-export default auth.middleware;
-export const config = auth.config;
+export default auth.proxy;
+export const config = {
+  matcher: ['/((?!api|_next/static|_next/image|favicon.ico).*)'],
+};
 ```
 
+Next.js 16 requires the exported Proxy `config` to be a statically analyzable
+object literal. Turbopack rejects `export const config = auth.config`, so the
+matcher is the one integration value that cannot be composed at runtime.
+
+```typescript
+// src/app/api/[...route]/route.ts
+import { handle } from 'najm-core';
+import server from '@app/server';
+
+import { auth } from '../../../lib/auth';
+
+const handlers = auth.routeHandlers(handle(server));
+export const { GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS } = handlers;
+```
+
+`auth.routeHandlers()` applies the remember-me lifecycle to login, refresh,
+credential setup, and logout for every supported Next.js verb. It automatically
+uses the refresh and signed-session cookie names from `defineAuth()`; an app only
+passes an option when it intentionally customizes behavior, such as
+`{ rememberCookieName: 'school.remember' }`.
+
 ### Why `session.ts` exists
 
 A Next.js page is not one function. The root layout, each nested layout, and the
@@ -858,7 +887,7 @@ the same reason in mirror image:
 | the `createReactServerAuth()` module | server only | browser, Edge |
 
 `auth.client` and `auth.api` are what Client Components call, and
-`auth.middleware` is what the Edge proxy calls, so the `defineAuth()` module is
+`auth.proxy` is what the Edge proxy calls, so the `defineAuth()` module is
 always in the browser and Edge graphs. The adapter must never be. Putting both
 in one file puts the adapter everywhere `auth` already is, and the `browser`
 export condition — which exists precisely to catch this — resolves to a module
@@ -906,13 +935,19 @@ into a silently anonymous page.
 |---|---|
 | `loginRoute`, `forbiddenRoute`, route matchers, `roleRoutes` | when to redirect where |
 | cookie names, `apiBaseURL`, `authPrefix`, recovery URL | request memoization |
-| `refreshThreshold`, `tabSync`, `verifyAlways` | strict vs optional semantics |
+| `refreshThreshold`, `tabSync`, `proxySessionMode` | strict vs optional semantics |
 | — | `session.roles` / `user.role` fallback |
 | — | error classification |
 
-If a new app has to copy anything beyond the three files above, that logic
+If a new app has to copy anything beyond the four files above, that logic
 belongs in the package instead.
 
+`proxySessionMode: 'optimistic'` is the default and locally verifies the signed
+snapshot, matching Next.js guidance that Proxy is an optimistic routing boundary.
+Use `'authoritative'` only when every protected navigation must also validate
+refresh-session state. The older `verifyAlways` option and `auth.middleware`
+property remain as deprecated compatibility aliases.
+
 ### What a new app must prove
 
 At its real Next.js production boundary, not with mocks:
@@ -995,8 +1030,10 @@ throw new HttpError(403, 'Insufficient permissions for this action');
   when their public reverse-proxy origin is not reachable from the app process.
 - `onRecoveryFailure` exposes structured, secret-free recovery diagnostics
   without logging anything by default.
-- `verifyAlways` forces that authoritative check on every protected request;
-  the default bounds cached role/status staleness to `session.maxAge`.
+- `proxySessionMode: 'authoritative'` forces that check on every protected
+  request; the default `'optimistic'` mode bounds cached role/status staleness
+  to `session.maxAge`. The deprecated `verifyAlways` flag maps to the same
+  behavior for existing applications.
 
 ### Next.js 16 Reverse-Proxy Recovery
 

package/dist/client/edge.d.ts

@@ -2,6 +2,7 @@ import * as next_server from 'next/server';
 import { S as SessionRecoveryFailure } from '../sessionRecovery-D5Fa0yZ1.js';
 export { a as SessionRecoveryErrorDetails, b as SessionRecoveryFailureReason } from '../sessionRecovery-D5Fa0yZ1.js';
 
+type ProxySessionMode = 'optimistic' | 'authoritative';
 interface AuthMiddlewareConfig {
     /** Routes that require authentication (glob patterns) */
     protectedRoutes?: string[];
@@ -28,8 +29,15 @@ interface AuthMiddlewareConfig {
     /**
      * Force authoritative refresh-session validation on every protected request.
      * This reissues the signed session cookie without rotating refresh tokens.
+     * @deprecated Use `proxySessionMode: 'authoritative'` instead.
      */
     verifyAlways?: boolean;
+    /**
+     * How Proxy handles an otherwise valid signed session snapshot.
+     * `optimistic` verifies it locally; `authoritative` also checks refresh state.
+     * Defaults to `optimistic`.
+     */
+    proxySessionMode?: ProxySessionMode;
     /**
      * Session-recovery endpoint. Relative values resolve against the request
      * origin. Defaults to `${apiBaseURL}${authPrefix}/session/recover`.
@@ -67,4 +75,4 @@ interface AuthMiddlewareConfig {
  */
 declare function withAuthMiddleware(config: AuthMiddlewareConfig): (request: Request) => Promise<next_server.NextResponse<unknown>>;
 
-export { type AuthMiddlewareConfig, SessionRecoveryFailure, withAuthMiddleware };
+export { type AuthMiddlewareConfig, type ProxySessionMode, SessionRecoveryFailure, withAuthMiddleware };

package/dist/client/edge.js

@@ -345,11 +345,13 @@ function withAuthMiddleware(config) {
     sessionCookieName = "najm.session",
     sessionSecret,
     sessionMaxAge,
-    verifyAlways = false,
+    verifyAlways: legacyVerifyAlways = false,
+    proxySessionMode,
     recoveryURL,
     internalRecoveryURL,
     onRecoveryFailure
   } = config;
+  const verifyAlways = proxySessionMode === void 0 ? legacyVerifyAlways : proxySessionMode === "authoritative";
   const resolvedInternalRecoveryURL = resolveInternalRecoveryURL(internalRecoveryURL);
   return /* @__PURE__ */ __name(async function middleware(request) {
     const { NextResponse } = await import("next/server");

package/dist/client/server/index.d.ts

@@ -1,5 +1,6 @@
 import { A as AuthUser, R as RetryConfig } from '../../types-BaSfgxqE.js';
 import { F as FetchClient, N as NajmAuthClient } from '../../NajmAuthClient-ZtXTIUSF.js';
+import { ProxySessionMode } from '../edge.js';
 export { withAuthMiddleware } from '../edge.js';
 import { G as GetSessionConfig, S as ServerSession$1 } from '../../getSession-BthP85UA.js';
 export { A as AuthConfigError, a as AuthTransportError, N as NoSessionError, g as getSession } from '../../getSession-BthP85UA.js';
@@ -88,6 +89,68 @@ interface WithAuthProps<P> {
  */
 declare function withAuth<P extends Record<string, unknown> = Record<string, unknown>>(Page: (args: WithAuthProps<P>) => Promise<unknown> | unknown, options?: WithAuthOptions): (props: P) => Promise<unknown>;
 
+type AuthRouteHandler<Args extends unknown[] = []> = (request: Request, ...args: Args) => Response | Promise<Response>;
+interface NextAuthRouteHandlers<Args extends unknown[] = []> {
+    GET: AuthRouteHandler<Args>;
+    POST: AuthRouteHandler<Args>;
+    PUT: AuthRouteHandler<Args>;
+    PATCH: AuthRouteHandler<Args>;
+    DELETE: AuthRouteHandler<Args>;
+    HEAD: AuthRouteHandler<Args>;
+    OPTIONS: AuthRouteHandler<Args>;
+}
+interface AuthCookiePersistenceOptions {
+    /**
+     * Cookies whose lifetime this rewrites. Defaults to the two najm-auth issues.
+     * Anything not named here is passed through untouched.
+     */
+    authCookieNames?: string[];
+    /** Where the one-bit choice is stored. Defaults to `najm.remember`. */
+    rememberCookieName?: string;
+    /** How long a remembered choice lasts. Defaults to 7 days. */
+    maxAgeSeconds?: number;
+    /** Paths whose JSON body carries `rememberMe`. Defaults to `/api/auth/login`. */
+    loginPaths?: string[];
+    /** Paths that end a session and clear the choice. Defaults to `/api/auth/logout`. */
+    logoutPaths?: string[];
+    /** Paths that reissue cookies and must reapply the stored choice. */
+    refreshPaths?: string[];
+    /**
+     * Paths that finish credential setup. The stored choice is cleared there:
+     * the login it was recorded for never produced a session.
+     */
+    setupCompletionPaths?: string[];
+    /**
+     * Recognizes a response that has *not* issued a usable session because the
+     * user must still set up credentials.
+     *
+     * Najm's own setup response is recognized without this — supply it only to
+     * cover an application-specific shape. Such a response may carry auth
+     * cookies anyway, and persisting them would leave a half-authenticated
+     * browser that skips the setup step on reload. Returning `true` replaces
+     * them with deletions and clears the stored choice.
+     */
+    isSetupResponse?: (payload: unknown) => boolean;
+}
+/**
+ * Strips the lifetime attributes so the browser drops the cookie when it closes.
+ *
+ * Only the named auth cookies are touched — rewriting an unrelated `Set-Cookie`
+ * from the same response would be a silent side effect on someone else's state.
+ */
+declare function makeSessionCookie(setCookie: string, authCookieNames?: string[]): string;
+/**
+ * Wraps a request handler so the auth cookies it issues match the user's
+ * "remember me" choice.
+ *
+ * ```ts
+ * // app/api/[...route]/route.ts
+ * const handler = withAuthCookiePersistence((req) => server.fetch(req));
+ * export { handler as GET, handler as POST };
+ * ```
+ */
+declare function withAuthCookiePersistence<Args extends unknown[] = []>(handler: AuthRouteHandler<Args>, options?: AuthCookiePersistenceOptions): AuthRouteHandler<Args>;
+
 interface DefineAuthConfig {
     /** API base URL (default: '/api') */
     apiBaseURL?: string;
@@ -138,13 +201,22 @@ interface DefineAuthConfig {
     recoveryURL?: string | false;
     /** Loopback-only recovery endpoint for self-hosted reverse-proxy setups. */
     internalRecoveryURL?: string;
-    /** Next.js middleware matcher (default: exclude _next, favicon, api) */
+    /**
+     * Next.js middleware matcher (default: exclude _next, favicon, api).
+     * @deprecated Next.js 16 requires a static matcher literal in `proxy.ts`.
+     */
     matcher?: string[];
     /**
      * Force authoritative refresh-session validation on every protected request.
      * Recovery reissues the signed cookie without rotating refresh tokens.
+     * @deprecated Use `proxySessionMode: 'authoritative'` instead.
      */
     verifyAlways?: boolean;
+    /**
+     * How Proxy handles a valid signed session snapshot. Defaults to `optimistic`.
+     * API and server authorization remain authoritative in either mode.
+     */
+    proxySessionMode?: ProxySessionMode;
     /** Secret-free diagnostic hook for failed server or proxy recovery. */
     onRecoveryFailure?: (failure: SessionRecoveryFailure) => void;
 }
@@ -171,12 +243,19 @@ interface AuthKit {
      * ```
      */
     requireRole: (roles: string[]) => Promise<ServerSession$1>;
-    /** Generated Next.js middleware function */
+    /** Generated Next.js 16 Proxy function. */
+    proxy: (request: Request) => Promise<Response>;
+    /** @deprecated Next.js 16 renamed Middleware to Proxy. Use `proxy`. */
     middleware: (request: Request) => Promise<Response>;
-    /** Next.js middleware config with matcher */
+    /** @deprecated Next.js 16 requires a static config literal in `proxy.ts`. */
     config: {
         matcher: string[];
     };
+    /**
+     * Bind a Web Request handler to every Next.js Route Handler verb and apply
+     * Najm's login, refresh, setup, and logout cookie lifecycle consistently.
+     */
+    routeHandlers: <Args extends unknown[] = []>(handler: AuthRouteHandler<Args>, options?: AuthCookiePersistenceOptions) => NextAuthRouteHandlers<Args>;
     /**
      * Protect a server component — redirects to loginRoute if unauthenticated.
      * Passes session to the wrapped component.
@@ -219,57 +298,4 @@ interface SafeRedirectOptions {
  */
 declare function getSafeRedirectPath(value: string | string[] | undefined | null, options?: SafeRedirectOptions | string): string;
 
-type RequestHandler = (request: Request) => Promise<Response>;
-interface AuthCookiePersistenceOptions {
-    /**
-     * Cookies whose lifetime this rewrites. Defaults to the two najm-auth issues.
-     * Anything not named here is passed through untouched.
-     */
-    authCookieNames?: string[];
-    /** Where the one-bit choice is stored. Defaults to `najm.remember`. */
-    rememberCookieName?: string;
-    /** How long a remembered choice lasts. Defaults to 7 days. */
-    maxAgeSeconds?: number;
-    /** Paths whose JSON body carries `rememberMe`. Defaults to `/api/auth/login`. */
-    loginPaths?: string[];
-    /** Paths that end a session and clear the choice. Defaults to `/api/auth/logout`. */
-    logoutPaths?: string[];
-    /** Paths that reissue cookies and must reapply the stored choice. */
-    refreshPaths?: string[];
-    /**
-     * Paths that finish credential setup. The stored choice is cleared there:
-     * the login it was recorded for never produced a session.
-     */
-    setupCompletionPaths?: string[];
-    /**
-     * Recognizes a response that has *not* issued a usable session because the
-     * user must still set up credentials.
-     *
-     * Najm's own setup response is recognized without this — supply it only to
-     * cover an application-specific shape. Such a response may carry auth
-     * cookies anyway, and persisting them would leave a half-authenticated
-     * browser that skips the setup step on reload. Returning `true` strips them
-     * and clears the stored choice.
-     */
-    isSetupResponse?: (payload: unknown) => boolean;
-}
-/**
- * Strips the lifetime attributes so the browser drops the cookie when it closes.
- *
- * Only the named auth cookies are touched — rewriting an unrelated `Set-Cookie`
- * from the same response would be a silent side effect on someone else's state.
- */
-declare function makeSessionCookie(setCookie: string, authCookieNames?: string[]): string;
-/**
- * Wraps a request handler so the auth cookies it issues match the user's
- * "remember me" choice.
- *
- * ```ts
- * // app/api/[...route]/route.ts
- * const handler = withAuthCookiePersistence((req) => server.fetch(req));
- * export { handler as GET, handler as POST };
- * ```
- */
-declare function withAuthCookiePersistence(handler: RequestHandler, options?: AuthCookiePersistenceOptions): RequestHandler;
-
-export { type AuthCookiePersistenceOptions, type AuthKit, type DefineAuthConfig, GetSessionConfig, type SafeRedirectOptions, ServerSession$1 as ServerSession, SessionRecoveryFailure, type WithAuthOptions, type WithAuthProps, createServerClient, defineAuth, getSafeRedirectPath, getServerSession, makeSessionCookie, withAuth, withAuthCookiePersistence };
+export { type AuthCookiePersistenceOptions, type AuthKit, type AuthRouteHandler, type DefineAuthConfig, GetSessionConfig, type NextAuthRouteHandlers, ProxySessionMode, type SafeRedirectOptions, ServerSession$1 as ServerSession, SessionRecoveryFailure, type WithAuthOptions, type WithAuthProps, createServerClient, defineAuth, getSafeRedirectPath, getServerSession, makeSessionCookie, withAuth, withAuthCookiePersistence };

package/dist/client/server/index.js

@@ -756,11 +756,13 @@ function withAuthMiddleware(config) {
     sessionCookieName = "najm.session",
     sessionSecret,
     sessionMaxAge,
-    verifyAlways = false,
+    verifyAlways: legacyVerifyAlways = false,
+    proxySessionMode,
     recoveryURL,
     internalRecoveryURL,
     onRecoveryFailure
   } = config;
+  const verifyAlways = proxySessionMode === void 0 ? legacyVerifyAlways : proxySessionMode === "authoritative";
   const resolvedInternalRecoveryURL = resolveInternalRecoveryURL(internalRecoveryURL);
   return /* @__PURE__ */ __name(async function middleware(request) {
     const { NextResponse } = await import("next/server");
@@ -1442,6 +1444,175 @@ function attachReactServerInternals(kit, internals) {
 }
 __name(attachReactServerInternals, "attachReactServerInternals");
 
+// src/client/server/authCookiePersistence.ts
+var DEFAULTS = {
+  authCookieNames: ["refreshToken", "najm.session"],
+  rememberCookieName: "najm.remember",
+  maxAgeSeconds: 7 * 24 * 60 * 60,
+  loginPaths: ["/api/auth/login"],
+  logoutPaths: ["/api/auth/logout"],
+  refreshPaths: ["/api/auth/refresh", "/api/auth/session/recover"],
+  setupCompletionPaths: ["/api/auth/credential-setup/change"]
+};
+function isNajmSetupResponse(payload) {
+  if (typeof payload !== "object" || payload === null) return false;
+  const body = payload;
+  if (body.nextStep === "credential_setup") return true;
+  const data = body.data;
+  return typeof data === "object" && data !== null && data.nextStep === "credential_setup";
+}
+__name(isNajmSetupResponse, "isNajmSetupResponse");
+function cookieValue(header, name) {
+  for (const part of header.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator < 0) continue;
+    if (part.slice(0, separator).trim() !== name) continue;
+    return part.slice(separator + 1).trim();
+  }
+  return void 0;
+}
+__name(cookieValue, "cookieValue");
+function cookieName(setCookie) {
+  const separator = setCookie.indexOf("=");
+  return separator < 0 ? "" : setCookie.slice(0, separator).trim();
+}
+__name(cookieName, "cookieName");
+function makeSessionCookie(setCookie, authCookieNames = DEFAULTS.authCookieNames) {
+  if (!authCookieNames.includes(cookieName(setCookie))) return setCookie;
+  return setCookie.split(";").filter((part) => !/^\s*(?:expires|max-age)=/i.test(part)).join(";");
+}
+__name(makeSessionCookie, "makeSessionCookie");
+function isDeletionCookie(setCookie) {
+  if (/^[^=]+=\s*(?:;|$)/.test(setCookie)) return true;
+  if (/(?:^|;)\s*max-age=0(?:;|$)/i.test(setCookie)) return true;
+  const expires = /(?:^|;)\s*expires=([^;]+)/i.exec(setCookie)?.[1];
+  return expires ? new Date(expires).getTime() <= Date.now() : false;
+}
+__name(isDeletionCookie, "isDeletionCookie");
+function rememberCookie(name, mode, secure, maxAgeSeconds) {
+  const attributes = [
+    `${name}=${mode === "persistent" ? "1" : "0"}`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax"
+  ];
+  if (secure) attributes.push("Secure");
+  if (mode === "persistent") attributes.push(`Max-Age=${maxAgeSeconds}`);
+  return attributes.join("; ");
+}
+__name(rememberCookie, "rememberCookie");
+function clearedRememberCookie(name, secure) {
+  return [
+    `${name}=`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax",
+    ...secure ? ["Secure"] : [],
+    "Max-Age=0"
+  ].join("; ");
+}
+__name(clearedRememberCookie, "clearedRememberCookie");
+function clearedAuthCookie(name, secure) {
+  return [
+    `${name}=`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Lax",
+    ...secure ? ["Secure"] : [],
+    "Expires=Thu, 01 Jan 1970 00:00:00 GMT",
+    "Max-Age=0"
+  ].join("; ");
+}
+__name(clearedAuthCookie, "clearedAuthCookie");
+function withAuthCookiePersistence(handler, options = {}) {
+  const {
+    authCookieNames = DEFAULTS.authCookieNames,
+    rememberCookieName = DEFAULTS.rememberCookieName,
+    maxAgeSeconds = DEFAULTS.maxAgeSeconds,
+    loginPaths = DEFAULTS.loginPaths,
+    logoutPaths = DEFAULTS.logoutPaths,
+    refreshPaths = DEFAULTS.refreshPaths,
+    setupCompletionPaths = DEFAULTS.setupCompletionPaths,
+    isSetupResponse
+  } = options;
+  const resolveAction = /* @__PURE__ */ __name(async (request) => {
+    const { pathname } = new URL(request.url);
+    if (loginPaths.includes(pathname)) {
+      const body = await request.clone().json().catch(() => null);
+      return {
+        type: "apply",
+        mode: body?.rememberMe === true ? "persistent" : "session"
+      };
+    }
+    if (logoutPaths.includes(pathname)) return { type: "clear" };
+    if (setupCompletionPaths.includes(pathname)) return { type: "clear" };
+    if (refreshPaths.includes(pathname)) {
+      const remembered = cookieValue(
+        request.headers.get("cookie") ?? "",
+        rememberCookieName
+      );
+      if (remembered === "0") return { type: "apply", mode: "session" };
+      if (remembered === "1") return { type: "apply", mode: "persistent" };
+    }
+    return null;
+  }, "resolveAction");
+  const applyAction = /* @__PURE__ */ __name((response, action, secure) => {
+    const headers = new Headers(response.headers);
+    const setCookies = headers.getSetCookie();
+    headers.delete("set-cookie");
+    const clearedAuthCookies = /* @__PURE__ */ new Set();
+    for (const setCookie of setCookies) {
+      const name = cookieName(setCookie);
+      const isAuthCookie = authCookieNames.includes(name);
+      if ((action.type === "clear" || action.type === "setup") && isAuthCookie) {
+        if (isDeletionCookie(setCookie) && !clearedAuthCookies.has(name)) {
+          headers.append("set-cookie", setCookie);
+          clearedAuthCookies.add(name);
+        }
+        continue;
+      }
+      headers.append(
+        "set-cookie",
+        action.type === "apply" && action.mode === "session" ? makeSessionCookie(setCookie, authCookieNames) : setCookie
+      );
+    }
+    if (action.type === "clear" || action.type === "setup") {
+      for (const name of authCookieNames) {
+        if (!clearedAuthCookies.has(name)) {
+          headers.append("set-cookie", clearedAuthCookie(name, secure));
+        }
+      }
+    }
+    headers.append(
+      "set-cookie",
+      action.type === "clear" || action.type === "setup" ? clearedRememberCookie(rememberCookieName, secure) : rememberCookie(rememberCookieName, action.mode, secure, maxAgeSeconds)
+    );
+    return new Response(response.body, {
+      headers,
+      status: response.status,
+      statusText: response.statusText
+    });
+  }, "applyAction");
+  return async (request, ...args) => {
+    let action = await resolveAction(request);
+    const response = await handler(request, ...args);
+    if (!response.ok) return response;
+    if (action?.type === "apply" && loginPaths.includes(new URL(request.url).pathname)) {
+      const payload = await response.clone().json().catch(() => null);
+      if (isNajmSetupResponse(payload) || isSetupResponse?.(payload)) {
+        action = { type: "setup" };
+      }
+    }
+    if (!action) return response;
+    return applyAction(
+      response,
+      action,
+      new URL(request.url).protocol === "https:"
+    );
+  };
+}
+__name(withAuthCookiePersistence, "withAuthCookiePersistence");
+
 // src/client/server/defineAuth.ts
 function defineAuth(authConfig = {}) {
   const {
@@ -1459,7 +1630,8 @@ function defineAuth(authConfig = {}) {
     recoveryURL,
     internalRecoveryURL,
     matcher = ["/((?!_next/static|_next/image|favicon.ico|api).*)"],
-    verifyAlways = false,
+    verifyAlways,
+    proxySessionMode,
     onRecoveryFailure,
     refreshThreshold,
     tabSync,
@@ -1531,8 +1703,24 @@ function defineAuth(authConfig = {}) {
     recoveryURL,
     internalRecoveryURL,
     verifyAlways,
+    proxySessionMode,
     onRecoveryFailure
   });
+  const routeHandlers = /* @__PURE__ */ __name((handler, options = {}) => {
+    const persistentHandler = withAuthCookiePersistence(handler, {
+      ...options,
+      authCookieNames: options.authCookieNames ?? [cookieName2, sessionCookieName]
+    });
+    return {
+      GET: persistentHandler,
+      POST: persistentHandler,
+      PUT: persistentHandler,
+      PATCH: persistentHandler,
+      DELETE: persistentHandler,
+      HEAD: persistentHandler,
+      OPTIONS: persistentHandler
+    };
+  }, "routeHandlers");
   const protect = /* @__PURE__ */ __name((Page, options) => {
     return /* @__PURE__ */ __name(async function ProtectedPage(props) {
       const session = await getSession2();
@@ -1567,8 +1755,10 @@ function defineAuth(authConfig = {}) {
     getSession: getSession2,
     requireSession,
     requireRole,
+    proxy: middleware,
     middleware,
     config: { matcher },
+    routeHandlers,
     protect
   }, { resolveSessionOutcome: resolveSessionOutcome2, loginRoute, forbiddenRoute });
 }
@@ -1592,149 +1782,6 @@ function getSafeRedirectPath(value, options = {}) {
   return path;
 }
 __name(getSafeRedirectPath, "getSafeRedirectPath");
-
-// src/client/server/authCookiePersistence.ts
-var DEFAULTS = {
-  authCookieNames: ["refreshToken", "najm.session"],
-  rememberCookieName: "najm.remember",
-  maxAgeSeconds: 7 * 24 * 60 * 60,
-  loginPaths: ["/api/auth/login"],
-  logoutPaths: ["/api/auth/logout"],
-  refreshPaths: ["/api/auth/refresh", "/api/auth/session/recover"],
-  setupCompletionPaths: ["/api/auth/credential-setup/change"]
-};
-function isNajmSetupResponse(payload) {
-  if (typeof payload !== "object" || payload === null) return false;
-  const body = payload;
-  if (body.nextStep === "credential_setup") return true;
-  const data = body.data;
-  return typeof data === "object" && data !== null && data.nextStep === "credential_setup";
-}
-__name(isNajmSetupResponse, "isNajmSetupResponse");
-function cookieValue(header, name) {
-  for (const part of header.split(";")) {
-    const separator = part.indexOf("=");
-    if (separator < 0) continue;
-    if (part.slice(0, separator).trim() !== name) continue;
-    return part.slice(separator + 1).trim();
-  }
-  return void 0;
-}
-__name(cookieValue, "cookieValue");
-function cookieName(setCookie) {
-  const separator = setCookie.indexOf("=");
-  return separator < 0 ? "" : setCookie.slice(0, separator).trim();
-}
-__name(cookieName, "cookieName");
-function makeSessionCookie(setCookie, authCookieNames = DEFAULTS.authCookieNames) {
-  if (!authCookieNames.includes(cookieName(setCookie))) return setCookie;
-  return setCookie.split(";").filter((part) => !/^\s*(?:expires|max-age)=/i.test(part)).join(";");
-}
-__name(makeSessionCookie, "makeSessionCookie");
-function isDeletionCookie(setCookie) {
-  if (/^[^=]+=\s*(?:;|$)/.test(setCookie)) return true;
-  if (/(?:^|;)\s*max-age=0(?:;|$)/i.test(setCookie)) return true;
-  const expires = /(?:^|;)\s*expires=([^;]+)/i.exec(setCookie)?.[1];
-  return expires ? new Date(expires).getTime() <= Date.now() : false;
-}
-__name(isDeletionCookie, "isDeletionCookie");
-function rememberCookie(name, mode, secure, maxAgeSeconds) {
-  const attributes = [
-    `${name}=${mode === "persistent" ? "1" : "0"}`,
-    "Path=/",
-    "HttpOnly",
-    "SameSite=Lax"
-  ];
-  if (secure) attributes.push("Secure");
-  if (mode === "persistent") attributes.push(`Max-Age=${maxAgeSeconds}`);
-  return attributes.join("; ");
-}
-__name(rememberCookie, "rememberCookie");
-function clearedRememberCookie(name, secure) {
-  return [
-    `${name}=`,
-    "Path=/",
-    "HttpOnly",
-    "SameSite=Lax",
-    ...secure ? ["Secure"] : [],
-    "Max-Age=0"
-  ].join("; ");
-}
-__name(clearedRememberCookie, "clearedRememberCookie");
-function withAuthCookiePersistence(handler, options = {}) {
-  const {
-    authCookieNames = DEFAULTS.authCookieNames,
-    rememberCookieName = DEFAULTS.rememberCookieName,
-    maxAgeSeconds = DEFAULTS.maxAgeSeconds,
-    loginPaths = DEFAULTS.loginPaths,
-    logoutPaths = DEFAULTS.logoutPaths,
-    refreshPaths = DEFAULTS.refreshPaths,
-    setupCompletionPaths = DEFAULTS.setupCompletionPaths,
-    isSetupResponse
-  } = options;
-  const resolveAction = /* @__PURE__ */ __name(async (request) => {
-    const { pathname } = new URL(request.url);
-    if (loginPaths.includes(pathname)) {
-      const body = await request.clone().json().catch(() => null);
-      return {
-        type: "apply",
-        mode: body?.rememberMe === true ? "persistent" : "session"
-      };
-    }
-    if (logoutPaths.includes(pathname)) return { type: "clear" };
-    if (setupCompletionPaths.includes(pathname)) return { type: "clear" };
-    if (refreshPaths.includes(pathname)) {
-      const remembered = cookieValue(
-        request.headers.get("cookie") ?? "",
-        rememberCookieName
-      );
-      if (remembered === "0") return { type: "apply", mode: "session" };
-      if (remembered === "1") return { type: "apply", mode: "persistent" };
-    }
-    return null;
-  }, "resolveAction");
-  const applyAction = /* @__PURE__ */ __name((response, action, secure) => {
-    const headers = new Headers(response.headers);
-    const setCookies = headers.getSetCookie();
-    headers.delete("set-cookie");
-    for (const setCookie of setCookies) {
-      if (action.type === "setup" && authCookieNames.includes(cookieName(setCookie)) && !isDeletionCookie(setCookie)) {
-        continue;
-      }
-      headers.append(
-        "set-cookie",
-        action.type === "apply" && action.mode === "session" ? makeSessionCookie(setCookie, authCookieNames) : setCookie
-      );
-    }
-    headers.append(
-      "set-cookie",
-      action.type === "clear" || action.type === "setup" ? clearedRememberCookie(rememberCookieName, secure) : rememberCookie(rememberCookieName, action.mode, secure, maxAgeSeconds)
-    );
-    return new Response(response.body, {
-      headers,
-      status: response.status,
-      statusText: response.statusText
-    });
-  }, "applyAction");
-  return async (request) => {
-    let action = await resolveAction(request);
-    const response = await handler(request);
-    if (!response.ok) return response;
-    if (action?.type === "apply" && loginPaths.includes(new URL(request.url).pathname)) {
-      const payload = await response.clone().json().catch(() => null);
-      if (isNajmSetupResponse(payload) || isSetupResponse?.(payload)) {
-        action = { type: "setup" };
-      }
-    }
-    if (!action) return response;
-    return applyAction(
-      response,
-      action,
-      new URL(request.url).protocol === "https:"
-    );
-  };
-}
-__name(withAuthCookiePersistence, "withAuthCookiePersistence");
 export {
   AuthConfigError,
   AuthTransportError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "najm-auth",
-  "version": "3.1.4",
+  "version": "3.2.0",
   "description": "Authentication and authorization library for najm framework",
   "type": "module",
   "files": [