prism-authts 0.0.0-stage → 1.0.0

package/README.md

@@ -1,3 +1,133 @@
-# Temporary Holding Version
+# prism-authts
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Cloudflare Workers 与 Edge Runtime 的 Prism OAuth2 / OIDC 单点登录 (SSO) 鉴权中间件。
+
+提供防时序侧信道攻击 (Timing-safe) HMAC-SHA256 签名校验、CSRF 状态校验、泛域名 Cookie 共享支持，并自动处理登录拦截、回调换取 Token 及登出逻辑。
+
+---
+
+## 特性
+
+- ⚡️ **边缘计算原生**：基于标准 Web Crypto API，完美适配 Cloudflare Workers、Vercel Edge 等边缘环境。
+- 🔒 **安全可靠**：内置 HMAC-SHA256 防篡改签名、时序安全比对（防御 Timing Attack）与 Open Redirect 防御。
+- 📦 **双格式构建**：支持 ESM 与 CommonJS，开箱即用完整的 TypeScript 类型定义 (`.d.ts`)。
+- 🍪 **单点登录与子域名共享**：支持设置 `COOKIE_DOMAIN`，实现多级子域名共享登录态。
+- 🛠 **灵活接入**：支持类继承 (`PrismWorker`)、函数包装器 (`withPrismAuth`) 与旧版 Service Worker 三种接入方式。
+
+---
+
+## 安装
+
+```bash
+npm install prism-authts
+# 或
+pnpm add prism-authts
+# 或
+yarn add prism-authts
+```
+
+---
+
+## 环境变量配置
+
+在 Cloudflare Worker 的 `wrangler.toml` 或环境变量中配置以下变量：
+
+| 变量名 | 必填 | 说明 |
+| :--- | :---: | :--- |
+| `PRISM_URL` | 是 | Prism 服务端的基础 URL（例如：`https://auth.example.com`） |
+| `PRISM_CLIENT_ID` | 是 | OAuth2 Client ID |
+| `PRISM_CLIENT_SECRET` | 是 | OAuth2 Client Secret |
+| `COOKIE_DOMAIN` | 否 | 共享 Cookie 的域名（例如：`.example.com`，留空则默认当前站点） |
+| `PRISM_SCOPE` | 否 | OAuth 请求的 Scope（默认：`openid profile email`） |
+
+---
+
+## 使用方式
+
+### 方式 1：类继承模式（推荐）
+
+通过继承 `PrismWorker` 类并实现 `handleRequest`：
+
+```typescript
+import { PrismWorker, type AuthenticatedRequest, type PrismEnv, type PrismUser } from 'prism-authts';
+
+export default class MyWorker extends PrismWorker {
+  // 可选：重写公开白名单路由（无需登录即可访问）
+  override isPublic(url: URL, request: Request): boolean {
+    if (url.pathname === '/favicon.ico' || url.pathname.startsWith('/public/')) {
+      return true;
+    }
+    return super.isPublic(url, request);
+  }
+
+  // 鉴权通过后的业务逻辑
+  override async handleRequest(
+    request: AuthenticatedRequest,
+    env: PrismEnv,
+    ctx: any,
+    user: PrismUser | null
+  ): Promise<Response> {
+    return new Response(JSON.stringify({
+      message: "认证成功！",
+      user: user, // 当前登录用户信息
+    }), {
+      headers: { "Content-Type": "application/json; charset=utf-8" },
+    });
+  }
+}
+```
+
+### 方式 2：函数式包装器 (`withPrismAuth`)
+
+如果不习惯类继承，可以直接使用函数包装器：
+
+```typescript
+import { withPrismAuth } from 'prism-authts';
+
+export default {
+  fetch: withPrismAuth(
+    async (request, env, ctx, user) => {
+      return new Response(`欢迎登录, ${user?.name || user?.email || '用户'}!`);
+    },
+    {
+      // 可选：自定义放行规则
+      isPublic: (url) => url.pathname.startsWith('/api/health'),
+    }
+  ),
+};
+```
+
+### 方式 3：兼容旧版 Service Worker 模式
+
+```typescript
+import { registerServiceWorker } from 'prism-authts';
+
+registerServiceWorker(async (event, user) => {
+  return new Response(`Hello, ${user?.sub}`);
+});
+```
+
+---
+
+## 内置路由端点
+
+- **`GET /auth/callback`**：OAuth2 授权码重定向回调端点（自动拦截并换取 Token、写入 Cookie）。
+- **`GET /__logout`**：注销登录端点，访问后自动清空当前站点的登录 Cookie 并重定向至 `/`。
+
+---
+
+## 构建与发布
+
+```bash
+# 本地构建
+npm run build
+
+# 发布至 npm（会自动执行 npm run build）
+npm publish
+```
+
+---
+
+## License
+
+MIT

package/dist/prism-auth.cjs

@@ -0,0 +1,308 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/prism-auth.ts
+var prism_auth_exports = {};
+__export(prism_auth_exports, {
+  PrismWorker: () => PrismWorker,
+  default: () => prism_auth_default,
+  registerServiceWorker: () => registerServiceWorker,
+  withPrismAuth: () => withPrismAuth
+});
+module.exports = __toCommonJS(prism_auth_exports);
+function timingSafeEqual(a, b) {
+  if (typeof a !== "string" || typeof b !== "string" || a.length !== b.length) {
+    return false;
+  }
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
+var _cachedSecret = null;
+var _cachedKey = null;
+async function getHmacKey(secret) {
+  if (_cachedKey && _cachedSecret === secret) return _cachedKey;
+  const enc = new TextEncoder();
+  _cachedKey = await crypto.subtle.importKey(
+    "raw",
+    enc.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign", "verify"]
+  );
+  _cachedSecret = secret;
+  return _cachedKey;
+}
+async function hmacSign(data, secret) {
+  const key = await getHmacKey(secret);
+  const enc = new TextEncoder();
+  const sig = await crypto.subtle.sign("HMAC", key, enc.encode(data));
+  return btoa(String.fromCharCode(...new Uint8Array(sig))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function hmacVerify(data, signature, secret) {
+  const expected = await hmacSign(data, secret);
+  return timingSafeEqual(expected, signature);
+}
+function base64UrlEncode(str) {
+  const bytes = new TextEncoder().encode(str);
+  let binary = "";
+  for (let i = 0; i < bytes.byteLength; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlDecode(str) {
+  let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+  while (base64.length % 4) {
+    base64 += "=";
+  }
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return new TextDecoder().decode(bytes);
+}
+function parseCookies(cookieHeader) {
+  const cookies = {};
+  if (!cookieHeader) return cookies;
+  for (const item of cookieHeader.split(";")) {
+    const idx = item.indexOf("=");
+    if (idx !== -1) {
+      const key = item.slice(0, idx).trim();
+      const val = item.slice(idx + 1).trim();
+      cookies[key] = val;
+    }
+  }
+  return cookies;
+}
+function sanitizeRedirectPath(path) {
+  if (!path || typeof path !== "string") return "/";
+  if (path.startsWith("/") && !path.startsWith("//") && !path.startsWith("/\\")) {
+    return path;
+  }
+  return "/";
+}
+var PrismWorker = class {
+  /**
+   * 可选扩展：指定公开免登路径（如 /favicon.ico 或静态公共 API）
+   * 子类可以重写此方法以自定义放行规则
+   */
+  isPublic(url, request) {
+    return url.pathname === "/favicon.ico";
+  }
+  /**
+   * Worker 入口：拦截未登录、OAuth 回调、登出并透传业务请求
+   */
+  async fetch(request, env, ctx) {
+    const currentEnv = env || (typeof globalThis !== "undefined" ? globalThis : {});
+    const url = new URL(request.url);
+    if (!currentEnv.PRISM_URL || !currentEnv.PRISM_CLIENT_ID || !currentEnv.PRISM_CLIENT_SECRET) {
+      return new Response("\u914D\u7F6E\u9519\u8BEF\uFF1A\u7F3A\u5C11\u5FC5\u8981\u7684\u73AF\u5883\u53D8\u91CF (PRISM_URL, PRISM_CLIENT_ID, PRISM_CLIENT_SECRET)", {
+        status: 500,
+        headers: { "Content-Type": "text/plain; charset=utf-8" }
+      });
+    }
+    if (this.isPublic(url, request)) {
+      return this.handleRequest(request, currentEnv, ctx, null);
+    }
+    const cookies = parseCookies(request.headers.get("Cookie"));
+    const prismBase = currentEnv.PRISM_URL.replace(/\/+$/, "");
+    let cookieDomain = (currentEnv.COOKIE_DOMAIN || "").trim();
+    if (cookieDomain && !cookieDomain.startsWith(".")) {
+      cookieDomain = "." + cookieDomain;
+    }
+    const domainAttr = cookieDomain ? `; Domain=${cookieDomain}` : "";
+    if (url.pathname === "/__logout") {
+      return new Response("\u5DF2\u9000\u51FA\u5F53\u524D\u7AD9\u70B9\u767B\u5F55", {
+        status: 302,
+        headers: {
+          "Location": "/",
+          "Set-Cookie": `prism_session=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0${domainAttr}`
+        }
+      });
+    }
+    if (url.pathname === "/auth/callback") {
+      const error = url.searchParams.get("error");
+      if (error) {
+        const desc = url.searchParams.get("error_description") || error;
+        return new Response(`Prism \u6388\u6743\u5931\u8D25: ${desc}`, { status: 403 });
+      }
+      const code = url.searchParams.get("code");
+      const rawState = url.searchParams.get("state");
+      if (!code) return new Response("\u7F3A\u5C11\u6388\u6743\u7801 (Code)", { status: 400 });
+      let targetPath = "/";
+      if (rawState && rawState.includes(".")) {
+        const [statePayloadB64, stateSig] = rawState.split(".");
+        if (await hmacVerify(statePayloadB64, stateSig, currentEnv.PRISM_CLIENT_SECRET)) {
+          try {
+            const parsed = JSON.parse(base64UrlDecode(statePayloadB64));
+            if (parsed.exp && parsed.exp > Date.now()) {
+              targetPath = sanitizeRedirectPath(parsed.path);
+            }
+          } catch (e) {
+          }
+        }
+      }
+      const tokenRes = await fetch(`${prismBase}/api/oauth/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "authorization_code",
+          client_id: currentEnv.PRISM_CLIENT_ID,
+          client_secret: currentEnv.PRISM_CLIENT_SECRET,
+          code,
+          redirect_uri: `${url.origin}/auth/callback`
+        })
+      });
+      if (!tokenRes.ok) {
+        const errText = await tokenRes.text();
+        return new Response(`Prism \u6362\u53D6 Token \u5931\u8D25: ${errText}`, { status: 401 });
+      }
+      const tokenData = await tokenRes.json();
+      let user2 = {};
+      if (tokenData.id_token) {
+        try {
+          const idPayload = tokenData.id_token.split(".")[1];
+          user2 = JSON.parse(base64UrlDecode(idPayload));
+        } catch (e) {
+        }
+      } else if (tokenData.access_token) {
+        try {
+          const uRes = await fetch(`${prismBase}/api/oauth/userinfo`, {
+            headers: { Authorization: `Bearer ${tokenData.access_token}` }
+          });
+          if (uRes.ok) user2 = await uRes.json();
+        } catch (e) {
+        }
+      }
+      const expireAt = Date.now() + 7 * 86400 * 1e3;
+      const sessionPayload = {
+        aud: currentEnv.PRISM_CLIENT_ID,
+        exp: expireAt,
+        user: user2
+      };
+      const payloadStr = JSON.stringify(sessionPayload);
+      const encodedPayload = base64UrlEncode(payloadStr);
+      const signature = await hmacSign(encodedPayload, currentEnv.PRISM_CLIENT_SECRET);
+      const sessionValue = `${encodedPayload}.${signature}`;
+      return new Response(null, {
+        status: 302,
+        headers: {
+          "Location": targetPath,
+          "Set-Cookie": `prism_session=${sessionValue}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=604800${domainAttr}`
+        }
+      });
+    }
+    const sessionCookie = cookies["prism_session"];
+    let user = null;
+    if (sessionCookie && sessionCookie.includes(".")) {
+      const [encodedPayload, signature] = sessionCookie.split(".");
+      if (encodedPayload && signature) {
+        const isValid = await hmacVerify(encodedPayload, signature, currentEnv.PRISM_CLIENT_SECRET);
+        if (isValid) {
+          try {
+            const sessionData = JSON.parse(base64UrlDecode(encodedPayload));
+            if (Number(sessionData.exp) > Date.now() && sessionData.aud === currentEnv.PRISM_CLIENT_ID) {
+              user = sessionData.user || { authenticated: true };
+            }
+          } catch (e) {
+          }
+        }
+      }
+    }
+    if (!user) {
+      const isApi = url.pathname.startsWith("/api/") || request.headers.get("Accept")?.includes("application/json") || request.headers.get("X-Requested-With") === "XMLHttpRequest";
+      if (isApi) {
+        return new Response(
+          JSON.stringify({ error: "Unauthorized", message: "\u672A\u767B\u5F55\u6216\u767B\u5F55\u5DF2\u8FC7\u671F" }),
+          {
+            status: 401,
+            headers: { "Content-Type": "application/json; charset=utf-8" }
+          }
+        );
+      }
+      const stateData = JSON.stringify({
+        path: url.pathname + url.search,
+        exp: Date.now() + 600 * 1e3
+      });
+      const stateB64 = base64UrlEncode(stateData);
+      const stateSig = await hmacSign(stateB64, currentEnv.PRISM_CLIENT_SECRET);
+      const stateToken = `${stateB64}.${stateSig}`;
+      const authUrl = new URL(`${prismBase}/api/oauth/authorize`);
+      authUrl.searchParams.set("client_id", currentEnv.PRISM_CLIENT_ID);
+      authUrl.searchParams.set("redirect_uri", `${url.origin}/auth/callback`);
+      authUrl.searchParams.set("response_type", "code");
+      authUrl.searchParams.set("scope", currentEnv.PRISM_SCOPE || "openid profile email");
+      authUrl.searchParams.set("state", stateToken);
+      return Response.redirect(authUrl.toString(), 302);
+    }
+    const authReq = request;
+    authReq.user = user;
+    return this.handleRequest(authReq, currentEnv, ctx, user);
+  }
+  /**
+   * 子类重写的业务方法（增加第 4 个参数 user，获取当前登录用户信息）
+   */
+  async handleRequest(request, env, ctx, user) {
+    return new Response("\u8BF7\u5728\u5B50\u7C7B\u4E2D\u91CD\u5199 handleRequest \u65B9\u6CD5", { status: 404 });
+  }
+};
+function withPrismAuth(handler, options = {}) {
+  const instance = new class extends PrismWorker {
+    isPublic(url, req) {
+      return options.isPublic ? options.isPublic(url, req) : super.isPublic(url, req);
+    }
+    async handleRequest(req, env, ctx, user) {
+      return handler(req, env, ctx, user);
+    }
+  }();
+  return (req, env, ctx) => instance.fetch(req, env, ctx);
+}
+function registerServiceWorker(handleRequest, options = {}) {
+  const worker = new class extends PrismWorker {
+    isPublic(url, req) {
+      return options.isPublic ? options.isPublic(url, req) : super.isPublic(url, req);
+    }
+    async handleRequest(request, env, ctx, user) {
+      const fakeEvent = {
+        request,
+        respondWith: () => {
+        },
+        waitUntil: (p) => ctx && ctx.waitUntil ? ctx.waitUntil(p) : p,
+        user
+      };
+      return handleRequest(fakeEvent, user);
+    }
+  }();
+  if (typeof addEventListener !== "undefined") {
+    addEventListener("fetch", (event) => {
+      event.respondWith(worker.fetch(event.request, globalThis, event));
+    });
+  }
+}
+var prism_auth_default = PrismWorker;
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  PrismWorker,
+  registerServiceWorker,
+  withPrismAuth
+});
+//# sourceMappingURL=prism-auth.cjs.map

package/dist/prism-auth.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/prism-auth.ts"],"sourcesContent":["// prism-auth.ts\n\n// =========================================================================\n// 类型定义 (Types)\n// =========================================================================\n\nexport interface PrismEnv {\n    PRISM_URL: string;\n    PRISM_CLIENT_ID: string;\n    PRISM_CLIENT_SECRET: string;\n    COOKIE_DOMAIN?: string;\n    PRISM_SCOPE?: string;\n    [key: string]: any;\n}\n\nexport interface PrismUser {\n    sub?: string;\n    name?: string;\n    email?: string;\n    preferred_username?: string;\n    authenticated?: boolean;\n    [key: string]: any;\n}\n\nexport interface AuthenticatedRequest extends Request {\n    user?: PrismUser;\n}\n\nexport interface PrismWorkerOptions {\n    isPublic?: (url: URL, req: Request) => boolean;\n}\n\nexport type PrismHandler = (\n    req: AuthenticatedRequest,\n    env: PrismEnv,\n    ctx: any,\n    user: PrismUser | null\n) => Promise<Response> | Response;\n\n// =========================================================================\n// 1. 加密与安全工具函数 (Web Crypto & Timing-Safe)\n// =========================================================================\n\n// 恒定时间字符串比对（防御时序侧信道攻击）\nfunction timingSafeEqual(a: string, b: string): boolean {\n    if (typeof a !== \"string\" || typeof b !== \"string\" || a.length !== b.length) {\n        return false;\n    }\n    let diff = 0;\n    for (let i = 0; i < a.length; i++) {\n        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n    }\n    return diff === 0;\n}\n\n// 缓存 CryptoKey，避免高并发下每个请求重复 importKey 消耗 CPU\nlet _cachedSecret: string | null = null;\nlet _cachedKey: CryptoKey | null = null;\n\nasync function getHmacKey(secret: string): Promise<CryptoKey> {\n    if (_cachedKey && _cachedSecret === secret) return _cachedKey;\n    const enc = new TextEncoder();\n    _cachedKey = await crypto.subtle.importKey(\n        \"raw\",\n        enc.encode(secret),\n        { name: \"HMAC\", hash: \"SHA-256\" },\n        false,\n        [\"sign\", \"verify\"]\n    );\n    _cachedSecret = secret;\n    return _cachedKey;\n}\n\n// 基于 Web Crypto 的 HMAC-SHA256 签名工具\nasync function hmacSign(data: string, secret: string): Promise<string> {\n    const key = await getHmacKey(secret);\n    const enc = new TextEncoder();\n    const sig = await crypto.subtle.sign(\"HMAC\", key, enc.encode(data));\n    return btoa(String.fromCharCode(...new Uint8Array(sig)))\n        .replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nasync function hmacVerify(data: string, signature: string, secret: string): Promise<boolean> {\n    const expected = await hmacSign(data, secret);\n    return timingSafeEqual(expected, signature);\n}\n\n// UTF-8 安全的 Base64URL 编解码工具\nfunction base64UrlEncode(str: string): string {\n    const bytes = new TextEncoder().encode(str);\n    let binary = \"\";\n    for (let i = 0; i < bytes.byteLength; i++) {\n        binary += String.fromCharCode(bytes[i]);\n    }\n    return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction base64UrlDecode(str: string): string {\n    let base64 = str.replace(/-/g, \"+\").replace(/_/g, \"/\");\n    while (base64.length % 4) {\n        base64 += \"=\";\n    }\n    const binary = atob(base64);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n        bytes[i] = binary.charCodeAt(i);\n    }\n    return new TextDecoder().decode(bytes);\n}\n\n// 健壮的 Cookie 解析方法（避免 split(\"=\") 误切 base64 中的等于号）\nfunction parseCookies(cookieHeader: string | null): Record<string, string> {\n    const cookies: Record<string, string> = {};\n    if (!cookieHeader) return cookies;\n    for (const item of cookieHeader.split(\";\")) {\n        const idx = item.indexOf(\"=\");\n        if (idx !== -1) {\n            const key = item.slice(0, idx).trim();\n            const val = item.slice(idx + 1).trim();\n            cookies[key] = val;\n        }\n    }\n    return cookies;\n}\n\n// 防御开放重定向（Open Redirect）：强制要求单斜杠内部相对路径，禁止 // 或 /\\ 外部协议伪造\nfunction sanitizeRedirectPath(path: string | null | undefined): string {\n    if (!path || typeof path !== \"string\") return \"/\";\n    if (path.startsWith(\"/\") && !path.startsWith(\"//\") && !path.startsWith(\"/\\\\\")) {\n        return path;\n    }\n    return \"/\";\n}\n\n// =========================================================================\n// 2. 鉴权基类 (PrismWorker)\n// =========================================================================\n\nexport class PrismWorker {\n    /**\n     * 可选扩展：指定公开免登路径（如 /favicon.ico 或静态公共 API）\n     * 子类可以重写此方法以自定义放行规则\n     */\n    isPublic(url: URL, request: Request): boolean {\n        return url.pathname === \"/favicon.ico\";\n    }\n\n    /**\n     * Worker 入口：拦截未登录、OAuth 回调、登出并透传业务请求\n     */\n    async fetch(request: Request, env?: PrismEnv, ctx?: any): Promise<Response> {\n        const currentEnv: PrismEnv = env || (typeof globalThis !== \"undefined\" ? (globalThis as any) : {});\n        const url = new URL(request.url);\n\n        // 前置环境变量完整性检查\n        if (!currentEnv.PRISM_URL || !currentEnv.PRISM_CLIENT_ID || !currentEnv.PRISM_CLIENT_SECRET) {\n            return new Response(\"配置错误：缺少必要的环境变量 (PRISM_URL, PRISM_CLIENT_ID, PRISM_CLIENT_SECRET)\", {\n                status: 500,\n                headers: { \"Content-Type\": \"text/plain; charset=utf-8\" },\n            });\n        }\n\n        // 白名单路径直接放行\n        if (this.isPublic(url, request)) {\n            return this.handleRequest(request as AuthenticatedRequest, currentEnv, ctx, null);\n        }\n\n        const cookies = parseCookies(request.headers.get(\"Cookie\"));\n        const prismBase = currentEnv.PRISM_URL.replace(/\\/+$/, \"\");\n        // 泛域名 Cookie 支持（例如 .b.cc.cd 或 .cc.cd，让多级子域名站点直接共享登录态）\n        // 自动容错：去除前后空格，若未写前导点号自动补齐，输入 \"b.cc.cd\" 也会标准化为 \".b.cc.cd\"\n        let cookieDomain = (currentEnv.COOKIE_DOMAIN || \"\").trim();\n        if (cookieDomain && !cookieDomain.startsWith(\".\")) {\n            cookieDomain = \".\" + cookieDomain;\n        }\n        const domainAttr = cookieDomain ? `; Domain=${cookieDomain}` : \"\";\n\n        // 【功能 1：主动登出】访问 /__logout 即可清理 Cookie 并登出\n        if (url.pathname === \"/__logout\") {\n            return new Response(\"已退出当前站点登录\", {\n                status: 302,\n                headers: {\n                    \"Location\": \"/\",\n                    \"Set-Cookie\": `prism_session=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0${domainAttr}`,\n                },\n            });\n        }\n\n        // 【功能 2：OAuth 回调处理】拦截 Prism 登录完成后的跳回\n        if (url.pathname === \"/auth/callback\") {\n            const error = url.searchParams.get(\"error\");\n            if (error) {\n                const desc = url.searchParams.get(\"error_description\") || error;\n                return new Response(`Prism 授权失败: ${desc}`, { status: 403 });\n            }\n\n            const code = url.searchParams.get(\"code\");\n            const rawState = url.searchParams.get(\"state\");\n            if (!code) return new Response(\"缺少授权码 (Code)\", { status: 400 });\n\n            // 校验 State：防范登录 CSRF 攻击与开放重定向\n            let targetPath = \"/\";\n            if (rawState && rawState.includes(\".\")) {\n                const [statePayloadB64, stateSig] = rawState.split(\".\");\n                if (await hmacVerify(statePayloadB64, stateSig, currentEnv.PRISM_CLIENT_SECRET)) {\n                    try {\n                        const parsed = JSON.parse(base64UrlDecode(statePayloadB64));\n                        // 10 分钟有效期校验\n                        if (parsed.exp && parsed.exp > Date.now()) {\n                            targetPath = sanitizeRedirectPath(parsed.path);\n                        }\n                    } catch (e) { }\n                }\n            }\n\n            // 向 Prism 请求换取 Token（标准端点为 /api/oauth/token）\n            const tokenRes = await fetch(`${prismBase}/api/oauth/token`, {\n                method: \"POST\",\n                headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n                body: new URLSearchParams({\n                    grant_type: \"authorization_code\",\n                    client_id: currentEnv.PRISM_CLIENT_ID,\n                    client_secret: currentEnv.PRISM_CLIENT_SECRET,\n                    code,\n                    redirect_uri: `${url.origin}/auth/callback`,\n                }),\n            });\n\n            if (!tokenRes.ok) {\n                const errText = await tokenRes.text();\n                return new Response(`Prism 换取 Token 失败: ${errText}`, { status: 401 });\n            }\n\n            const tokenData: any = await tokenRes.json();\n            let user: PrismUser = {};\n\n            // 解析用户身份信息（优先从 OIDC id_token 解码，回退 userinfo 端点）\n            if (tokenData.id_token) {\n                try {\n                    const idPayload = tokenData.id_token.split(\".\")[1];\n                    user = JSON.parse(base64UrlDecode(idPayload));\n                } catch (e) { }\n            } else if (tokenData.access_token) {\n                try {\n                    const uRes = await fetch(`${prismBase}/api/oauth/userinfo`, {\n                        headers: { Authorization: `Bearer ${tokenData.access_token}` },\n                    });\n                    if (uRes.ok) user = await uRes.json();\n                } catch (e) { }\n            }\n\n            // 生成带签名的 Session Cookie（绑定 client_id，默认有效期 7 天）\n            const expireAt = Date.now() + 7 * 86400 * 1000;\n            const sessionPayload = {\n                aud: currentEnv.PRISM_CLIENT_ID,\n                exp: expireAt,\n                user,\n            };\n            const payloadStr = JSON.stringify(sessionPayload);\n            const encodedPayload = base64UrlEncode(payloadStr);\n            const signature = await hmacSign(encodedPayload, currentEnv.PRISM_CLIENT_SECRET);\n            const sessionValue = `${encodedPayload}.${signature}`;\n\n            return new Response(null, {\n                status: 302,\n                headers: {\n                    \"Location\": targetPath,\n                    \"Set-Cookie\": `prism_session=${sessionValue}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=604800${domainAttr}`,\n                },\n            });\n        }\n\n        // 【功能 3：校验本地登录态】\n        const sessionCookie = cookies[\"prism_session\"];\n        let user: PrismUser | null = null;\n\n        if (sessionCookie && sessionCookie.includes(\".\")) {\n            const [encodedPayload, signature] = sessionCookie.split(\".\");\n            if (encodedPayload && signature) {\n                const isValid = await hmacVerify(encodedPayload, signature, currentEnv.PRISM_CLIENT_SECRET);\n                if (isValid) {\n                    try {\n                        const sessionData = JSON.parse(base64UrlDecode(encodedPayload));\n                        // 校验有效期与 Client ID 归属\n                        if (\n                            Number(sessionData.exp) > Date.now() &&\n                            sessionData.aud === currentEnv.PRISM_CLIENT_ID\n                        ) {\n                            user = sessionData.user || { authenticated: true };\n                        }\n                    } catch (e) { }\n                }\n            }\n        }\n\n        // 【功能 4：未登录拦截】\n        if (!user) {\n            // 对 API 或 Ajax 请求返回 401 JSON，避免前端 302 跟随重定向导致 CORS 跨域报错\n            const isApi = url.pathname.startsWith(\"/api/\") ||\n                request.headers.get(\"Accept\")?.includes(\"application/json\") ||\n                request.headers.get(\"X-Requested-With\") === \"XMLHttpRequest\";\n\n            if (isApi) {\n                return new Response(\n                    JSON.stringify({ error: \"Unauthorized\", message: \"未登录或登录已过期\" }),\n                    {\n                        status: 401,\n                        headers: { \"Content-Type\": \"application/json; charset=utf-8\" },\n                    }\n                );\n            }\n\n            // 生成带签名与防篡改的 State（有效期 10 分钟）\n            const stateData = JSON.stringify({\n                path: url.pathname + url.search,\n                exp: Date.now() + 600 * 1000,\n            });\n            const stateB64 = base64UrlEncode(stateData);\n            const stateSig = await hmacSign(stateB64, currentEnv.PRISM_CLIENT_SECRET);\n            const stateToken = `${stateB64}.${stateSig}`;\n\n            // 网页端未登录：重定向至 Prism 登录（标准端点为 /api/oauth/authorize）\n            const authUrl = new URL(`${prismBase}/api/oauth/authorize`);\n            authUrl.searchParams.set(\"client_id\", currentEnv.PRISM_CLIENT_ID);\n            authUrl.searchParams.set(\"redirect_uri\", `${url.origin}/auth/callback`);\n            authUrl.searchParams.set(\"response_type\", \"code\");\n            // scope 默认包含 openid profile email（按需通过 PRISM_SCOPE 覆盖）\n            authUrl.searchParams.set(\"scope\", currentEnv.PRISM_SCOPE || \"openid profile email\");\n            authUrl.searchParams.set(\"state\", stateToken);\n\n            return Response.redirect(authUrl.toString(), 302);\n        }\n\n        // 鉴权通过：把 user 挂载到 request 并透传给业务逻辑\n        const authReq = request as AuthenticatedRequest;\n        authReq.user = user;\n        return this.handleRequest(authReq, currentEnv, ctx, user);\n    }\n\n    /**\n     * 子类重写的业务方法（增加第 4 个参数 user，获取当前登录用户信息）\n     */\n    async handleRequest(\n        request: AuthenticatedRequest,\n        env: PrismEnv,\n        ctx: any,\n        user: PrismUser | null\n    ): Promise<Response> {\n        return new Response(\"请在子类中重写 handleRequest 方法\", { status: 404 });\n    }\n}\n\n// 兼容纯函数式习惯的导出包装器\nexport function withPrismAuth(\n    handler: PrismHandler,\n    options: PrismWorkerOptions = {}\n): (req: Request, env?: PrismEnv, ctx?: any) => Promise<Response> {\n    const instance = new (class extends PrismWorker {\n        override isPublic(url: URL, req: Request) {\n            return options.isPublic ? options.isPublic(url, req) : super.isPublic(url, req);\n        }\n        override async handleRequest(req: AuthenticatedRequest, env: PrismEnv, ctx: any, user: PrismUser | null) {\n            return handler(req, env, ctx, user);\n        }\n    })();\n    return (req: Request, env?: PrismEnv, ctx?: any) => instance.fetch(req, env, ctx);\n}\n\n// 兼容旧版 Service Worker (addEventListener(\"fetch\")) 模式\nexport function registerServiceWorker(\n    handleRequest: (event: any, user: PrismUser | null) => Promise<Response> | Response,\n    options: PrismWorkerOptions = {}\n): void {\n    const worker = new (class extends PrismWorker {\n        override isPublic(url: URL, req: Request) {\n            return options.isPublic ? options.isPublic(url, req) : super.isPublic(url, req);\n        }\n        override async handleRequest(request: AuthenticatedRequest, env: PrismEnv, ctx: any, user: PrismUser | null) {\n            // 构造兼容旧版代码的 event 对象\n            const fakeEvent = {\n                request,\n                respondWith: () => { },\n                waitUntil: (p: Promise<any>) => (ctx && ctx.waitUntil ? ctx.waitUntil(p) : p),\n                user,\n            };\n            return handleRequest(fakeEvent, user);\n        }\n    })();\n\n    if (typeof addEventListener !== \"undefined\") {\n        addEventListener(\"fetch\", (event: any) => {\n            event.respondWith(worker.fetch(event.request, (globalThis as any), event));\n        });\n    }\n}\n\nexport default PrismWorker;\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4CA,SAAS,gBAAgB,GAAW,GAAoB;AACpD,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,YAAY,EAAE,WAAW,EAAE,QAAQ;AACzE,WAAO;AAAA,EACX;AACA,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AAC/B,YAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AAAA,EAC5C;AACA,SAAO,SAAS;AACpB;AAGA,IAAI,gBAA+B;AACnC,IAAI,aAA+B;AAEnC,eAAe,WAAW,QAAoC;AAC1D,MAAI,cAAc,kBAAkB,OAAQ,QAAO;AACnD,QAAM,MAAM,IAAI,YAAY;AAC5B,eAAa,MAAM,OAAO,OAAO;AAAA,IAC7B;AAAA,IACA,IAAI,OAAO,MAAM;AAAA,IACjB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,QAAQ,QAAQ;AAAA,EACrB;AACA,kBAAgB;AAChB,SAAO;AACX;AAGA,eAAe,SAAS,MAAc,QAAiC;AACnE,QAAM,MAAM,MAAM,WAAW,MAAM;AACnC,QAAM,MAAM,IAAI,YAAY;AAC5B,QAAM,MAAM,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,OAAO,IAAI,CAAC;AAClE,SAAO,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,GAAG,CAAC,CAAC,EAClD,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAClE;AAEA,eAAe,WAAW,MAAc,WAAmB,QAAkC;AACzF,QAAM,WAAW,MAAM,SAAS,MAAM,MAAM;AAC5C,SAAO,gBAAgB,UAAU,SAAS;AAC9C;AAGA,SAAS,gBAAgB,KAAqB;AAC1C,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,GAAG;AAC1C,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,YAAY,KAAK;AACvC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EAC1C;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AACjF;AAEA,SAAS,gBAAgB,KAAqB;AAC1C,MAAI,SAAS,IAAI,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACrD,SAAO,OAAO,SAAS,GAAG;AACtB,cAAU;AAAA,EACd;AACA,QAAM,SAAS,KAAK,MAAM;AAC1B,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACpC,UAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,EAClC;AACA,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK;AACzC;AAGA,SAAS,aAAa,cAAqD;AACvE,QAAM,UAAkC,CAAC;AACzC,MAAI,CAAC,aAAc,QAAO;AAC1B,aAAW,QAAQ,aAAa,MAAM,GAAG,GAAG;AACxC,UAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,QAAI,QAAQ,IAAI;AACZ,YAAM,MAAM,KAAK,MAAM,GAAG,GAAG,EAAE,KAAK;AACpC,YAAM,MAAM,KAAK,MAAM,MAAM,CAAC,EAAE,KAAK;AACrC,cAAQ,GAAG,IAAI;AAAA,IACnB;AAAA,EACJ;AACA,SAAO;AACX;AAGA,SAAS,qBAAqB,MAAyC;AACnE,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,MAAI,KAAK,WAAW,GAAG,KAAK,CAAC,KAAK,WAAW,IAAI,KAAK,CAAC,KAAK,WAAW,KAAK,GAAG;AAC3E,WAAO;AAAA,EACX;AACA,SAAO;AACX;AAMO,IAAM,cAAN,MAAkB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKrB,SAAS,KAAU,SAA2B;AAC1C,WAAO,IAAI,aAAa;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAM,SAAkB,KAAgB,KAA8B;AACxE,UAAM,aAAuB,QAAQ,OAAO,eAAe,cAAe,aAAqB,CAAC;AAChG,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAG/B,QAAI,CAAC,WAAW,aAAa,CAAC,WAAW,mBAAmB,CAAC,WAAW,qBAAqB;AACzF,aAAO,IAAI,SAAS,0IAAoE;AAAA,QACpF,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,4BAA4B;AAAA,MAC3D,CAAC;AAAA,IACL;AAGA,QAAI,KAAK,SAAS,KAAK,OAAO,GAAG;AAC7B,aAAO,KAAK,cAAc,SAAiC,YAAY,KAAK,IAAI;AAAA,IACpF;AAEA,UAAM,UAAU,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAC1D,UAAM,YAAY,WAAW,UAAU,QAAQ,QAAQ,EAAE;AAGzD,QAAI,gBAAgB,WAAW,iBAAiB,IAAI,KAAK;AACzD,QAAI,gBAAgB,CAAC,aAAa,WAAW,GAAG,GAAG;AAC/C,qBAAe,MAAM;AAAA,IACzB;AACA,UAAM,aAAa,eAAe,YAAY,YAAY,KAAK;AAG/D,QAAI,IAAI,aAAa,aAAa;AAC9B,aAAO,IAAI,SAAS,0DAAa;AAAA,QAC7B,QAAQ;AAAA,QACR,SAAS;AAAA,UACL,YAAY;AAAA,UACZ,cAAc,oEAAoE,UAAU;AAAA,QAChG;AAAA,MACJ,CAAC;AAAA,IACL;AAGA,QAAI,IAAI,aAAa,kBAAkB;AACnC,YAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAC1C,UAAI,OAAO;AACP,cAAM,OAAO,IAAI,aAAa,IAAI,mBAAmB,KAAK;AAC1D,eAAO,IAAI,SAAS,mCAAe,IAAI,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC9D;AAEA,YAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,YAAM,WAAW,IAAI,aAAa,IAAI,OAAO;AAC7C,UAAI,CAAC,KAAM,QAAO,IAAI,SAAS,yCAAgB,EAAE,QAAQ,IAAI,CAAC;AAG9D,UAAI,aAAa;AACjB,UAAI,YAAY,SAAS,SAAS,GAAG,GAAG;AACpC,cAAM,CAAC,iBAAiB,QAAQ,IAAI,SAAS,MAAM,GAAG;AACtD,YAAI,MAAM,WAAW,iBAAiB,UAAU,WAAW,mBAAmB,GAAG;AAC7E,cAAI;AACA,kBAAM,SAAS,KAAK,MAAM,gBAAgB,eAAe,CAAC;AAE1D,gBAAI,OAAO,OAAO,OAAO,MAAM,KAAK,IAAI,GAAG;AACvC,2BAAa,qBAAqB,OAAO,IAAI;AAAA,YACjD;AAAA,UACJ,SAAS,GAAG;AAAA,UAAE;AAAA,QAClB;AAAA,MACJ;AAGA,YAAM,WAAW,MAAM,MAAM,GAAG,SAAS,oBAAoB;AAAA,QACzD,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D,MAAM,IAAI,gBAAgB;AAAA,UACtB,YAAY;AAAA,UACZ,WAAW,WAAW;AAAA,UACtB,eAAe,WAAW;AAAA,UAC1B;AAAA,UACA,cAAc,GAAG,IAAI,MAAM;AAAA,QAC/B,CAAC;AAAA,MACL,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AACd,cAAM,UAAU,MAAM,SAAS,KAAK;AACpC,eAAO,IAAI,SAAS,0CAAsB,OAAO,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,MACxE;AAEA,YAAM,YAAiB,MAAM,SAAS,KAAK;AAC3C,UAAIA,QAAkB,CAAC;AAGvB,UAAI,UAAU,UAAU;AACpB,YAAI;AACA,gBAAM,YAAY,UAAU,SAAS,MAAM,GAAG,EAAE,CAAC;AACjD,UAAAA,QAAO,KAAK,MAAM,gBAAgB,SAAS,CAAC;AAAA,QAChD,SAAS,GAAG;AAAA,QAAE;AAAA,MAClB,WAAW,UAAU,cAAc;AAC/B,YAAI;AACA,gBAAM,OAAO,MAAM,MAAM,GAAG,SAAS,uBAAuB;AAAA,YACxD,SAAS,EAAE,eAAe,UAAU,UAAU,YAAY,GAAG;AAAA,UACjE,CAAC;AACD,cAAI,KAAK,GAAI,CAAAA,QAAO,MAAM,KAAK,KAAK;AAAA,QACxC,SAAS,GAAG;AAAA,QAAE;AAAA,MAClB;AAGA,YAAM,WAAW,KAAK,IAAI,IAAI,IAAI,QAAQ;AAC1C,YAAM,iBAAiB;AAAA,QACnB,KAAK,WAAW;AAAA,QAChB,KAAK;AAAA,QACL,MAAAA;AAAA,MACJ;AACA,YAAM,aAAa,KAAK,UAAU,cAAc;AAChD,YAAM,iBAAiB,gBAAgB,UAAU;AACjD,YAAM,YAAY,MAAM,SAAS,gBAAgB,WAAW,mBAAmB;AAC/E,YAAM,eAAe,GAAG,cAAc,IAAI,SAAS;AAEnD,aAAO,IAAI,SAAS,MAAM;AAAA,QACtB,QAAQ;AAAA,QACR,SAAS;AAAA,UACL,YAAY;AAAA,UACZ,cAAc,iBAAiB,YAAY,2DAA2D,UAAU;AAAA,QACpH;AAAA,MACJ,CAAC;AAAA,IACL;AAGA,UAAM,gBAAgB,QAAQ,eAAe;AAC7C,QAAI,OAAyB;AAE7B,QAAI,iBAAiB,cAAc,SAAS,GAAG,GAAG;AAC9C,YAAM,CAAC,gBAAgB,SAAS,IAAI,cAAc,MAAM,GAAG;AAC3D,UAAI,kBAAkB,WAAW;AAC7B,cAAM,UAAU,MAAM,WAAW,gBAAgB,WAAW,WAAW,mBAAmB;AAC1F,YAAI,SAAS;AACT,cAAI;AACA,kBAAM,cAAc,KAAK,MAAM,gBAAgB,cAAc,CAAC;AAE9D,gBACI,OAAO,YAAY,GAAG,IAAI,KAAK,IAAI,KACnC,YAAY,QAAQ,WAAW,iBACjC;AACE,qBAAO,YAAY,QAAQ,EAAE,eAAe,KAAK;AAAA,YACrD;AAAA,UACJ,SAAS,GAAG;AAAA,UAAE;AAAA,QAClB;AAAA,MACJ;AAAA,IACJ;AAGA,QAAI,CAAC,MAAM;AAEP,YAAM,QAAQ,IAAI,SAAS,WAAW,OAAO,KACzC,QAAQ,QAAQ,IAAI,QAAQ,GAAG,SAAS,kBAAkB,KAC1D,QAAQ,QAAQ,IAAI,kBAAkB,MAAM;AAEhD,UAAI,OAAO;AACP,eAAO,IAAI;AAAA,UACP,KAAK,UAAU,EAAE,OAAO,gBAAgB,SAAS,yDAAY,CAAC;AAAA,UAC9D;AAAA,YACI,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,kCAAkC;AAAA,UACjE;AAAA,QACJ;AAAA,MACJ;AAGA,YAAM,YAAY,KAAK,UAAU;AAAA,QAC7B,MAAM,IAAI,WAAW,IAAI;AAAA,QACzB,KAAK,KAAK,IAAI,IAAI,MAAM;AAAA,MAC5B,CAAC;AACD,YAAM,WAAW,gBAAgB,SAAS;AAC1C,YAAM,WAAW,MAAM,SAAS,UAAU,WAAW,mBAAmB;AACxE,YAAM,aAAa,GAAG,QAAQ,IAAI,QAAQ;AAG1C,YAAM,UAAU,IAAI,IAAI,GAAG,SAAS,sBAAsB;AAC1D,cAAQ,aAAa,IAAI,aAAa,WAAW,eAAe;AAChE,cAAQ,aAAa,IAAI,gBAAgB,GAAG,IAAI,MAAM,gBAAgB;AACtE,cAAQ,aAAa,IAAI,iBAAiB,MAAM;AAEhD,cAAQ,aAAa,IAAI,SAAS,WAAW,eAAe,sBAAsB;AAClF,cAAQ,aAAa,IAAI,SAAS,UAAU;AAE5C,aAAO,SAAS,SAAS,QAAQ,SAAS,GAAG,GAAG;AAAA,IACpD;AAGA,UAAM,UAAU;AAChB,YAAQ,OAAO;AACf,WAAO,KAAK,cAAc,SAAS,YAAY,KAAK,IAAI;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cACF,SACA,KACA,KACA,MACiB;AACjB,WAAO,IAAI,SAAS,yEAA4B,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnE;AACJ;AAGO,SAAS,cACZ,SACA,UAA8B,CAAC,GAC+B;AAC9D,QAAM,WAAW,IAAK,cAAc,YAAY;AAAA,IACnC,SAAS,KAAU,KAAc;AACtC,aAAO,QAAQ,WAAW,QAAQ,SAAS,KAAK,GAAG,IAAI,MAAM,SAAS,KAAK,GAAG;AAAA,IAClF;AAAA,IACA,MAAe,cAAc,KAA2B,KAAe,KAAU,MAAwB;AACrG,aAAO,QAAQ,KAAK,KAAK,KAAK,IAAI;AAAA,IACtC;AAAA,EACJ,EAAG;AACH,SAAO,CAAC,KAAc,KAAgB,QAAc,SAAS,MAAM,KAAK,KAAK,GAAG;AACpF;AAGO,SAAS,sBACZ,eACA,UAA8B,CAAC,GAC3B;AACJ,QAAM,SAAS,IAAK,cAAc,YAAY;AAAA,IACjC,SAAS,KAAU,KAAc;AACtC,aAAO,QAAQ,WAAW,QAAQ,SAAS,KAAK,GAAG,IAAI,MAAM,SAAS,KAAK,GAAG;AAAA,IAClF;AAAA,IACA,MAAe,cAAc,SAA+B,KAAe,KAAU,MAAwB;AAEzG,YAAM,YAAY;AAAA,QACd;AAAA,QACA,aAAa,MAAM;AAAA,QAAE;AAAA,QACrB,WAAW,CAAC,MAAqB,OAAO,IAAI,YAAY,IAAI,UAAU,CAAC,IAAI;AAAA,QAC3E;AAAA,MACJ;AACA,aAAO,cAAc,WAAW,IAAI;AAAA,IACxC;AAAA,EACJ,EAAG;AAEH,MAAI,OAAO,qBAAqB,aAAa;AACzC,qBAAiB,SAAS,CAAC,UAAe;AACtC,YAAM,YAAY,OAAO,MAAM,MAAM,SAAU,YAAoB,KAAK,CAAC;AAAA,IAC7E,CAAC;AAAA,EACL;AACJ;AAEA,IAAO,qBAAQ;","names":["user"]}

package/dist/prism-auth.d.cts

@@ -0,0 +1,42 @@
+interface PrismEnv {
+    PRISM_URL: string;
+    PRISM_CLIENT_ID: string;
+    PRISM_CLIENT_SECRET: string;
+    COOKIE_DOMAIN?: string;
+    PRISM_SCOPE?: string;
+    [key: string]: any;
+}
+interface PrismUser {
+    sub?: string;
+    name?: string;
+    email?: string;
+    preferred_username?: string;
+    authenticated?: boolean;
+    [key: string]: any;
+}
+interface AuthenticatedRequest extends Request {
+    user?: PrismUser;
+}
+interface PrismWorkerOptions {
+    isPublic?: (url: URL, req: Request) => boolean;
+}
+type PrismHandler = (req: AuthenticatedRequest, env: PrismEnv, ctx: any, user: PrismUser | null) => Promise<Response> | Response;
+declare class PrismWorker {
+    /**
+     * 可选扩展：指定公开免登路径（如 /favicon.ico 或静态公共 API）
+     * 子类可以重写此方法以自定义放行规则
+     */
+    isPublic(url: URL, request: Request): boolean;
+    /**
+     * Worker 入口：拦截未登录、OAuth 回调、登出并透传业务请求
+     */
+    fetch(request: Request, env?: PrismEnv, ctx?: any): Promise<Response>;
+    /**
+     * 子类重写的业务方法（增加第 4 个参数 user，获取当前登录用户信息）
+     */
+    handleRequest(request: AuthenticatedRequest, env: PrismEnv, ctx: any, user: PrismUser | null): Promise<Response>;
+}
+declare function withPrismAuth(handler: PrismHandler, options?: PrismWorkerOptions): (req: Request, env?: PrismEnv, ctx?: any) => Promise<Response>;
+declare function registerServiceWorker(handleRequest: (event: any, user: PrismUser | null) => Promise<Response> | Response, options?: PrismWorkerOptions): void;
+
+export { type AuthenticatedRequest, type PrismEnv, type PrismHandler, type PrismUser, PrismWorker, type PrismWorkerOptions, PrismWorker as default, registerServiceWorker, withPrismAuth };

package/dist/prism-auth.d.ts

@@ -0,0 +1,42 @@
+interface PrismEnv {
+    PRISM_URL: string;
+    PRISM_CLIENT_ID: string;
+    PRISM_CLIENT_SECRET: string;
+    COOKIE_DOMAIN?: string;
+    PRISM_SCOPE?: string;
+    [key: string]: any;
+}
+interface PrismUser {
+    sub?: string;
+    name?: string;
+    email?: string;
+    preferred_username?: string;
+    authenticated?: boolean;
+    [key: string]: any;
+}
+interface AuthenticatedRequest extends Request {
+    user?: PrismUser;
+}
+interface PrismWorkerOptions {
+    isPublic?: (url: URL, req: Request) => boolean;
+}
+type PrismHandler = (req: AuthenticatedRequest, env: PrismEnv, ctx: any, user: PrismUser | null) => Promise<Response> | Response;
+declare class PrismWorker {
+    /**
+     * 可选扩展：指定公开免登路径（如 /favicon.ico 或静态公共 API）
+     * 子类可以重写此方法以自定义放行规则
+     */
+    isPublic(url: URL, request: Request): boolean;
+    /**
+     * Worker 入口：拦截未登录、OAuth 回调、登出并透传业务请求
+     */
+    fetch(request: Request, env?: PrismEnv, ctx?: any): Promise<Response>;
+    /**
+     * 子类重写的业务方法（增加第 4 个参数 user，获取当前登录用户信息）
+     */
+    handleRequest(request: AuthenticatedRequest, env: PrismEnv, ctx: any, user: PrismUser | null): Promise<Response>;
+}
+declare function withPrismAuth(handler: PrismHandler, options?: PrismWorkerOptions): (req: Request, env?: PrismEnv, ctx?: any) => Promise<Response>;
+declare function registerServiceWorker(handleRequest: (event: any, user: PrismUser | null) => Promise<Response> | Response, options?: PrismWorkerOptions): void;
+
+export { type AuthenticatedRequest, type PrismEnv, type PrismHandler, type PrismUser, PrismWorker, type PrismWorkerOptions, PrismWorker as default, registerServiceWorker, withPrismAuth };

package/dist/prism-auth.js

@@ -0,0 +1,282 @@
+// src/prism-auth.ts
+function timingSafeEqual(a, b) {
+  if (typeof a !== "string" || typeof b !== "string" || a.length !== b.length) {
+    return false;
+  }
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
+var _cachedSecret = null;
+var _cachedKey = null;
+async function getHmacKey(secret) {
+  if (_cachedKey && _cachedSecret === secret) return _cachedKey;
+  const enc = new TextEncoder();
+  _cachedKey = await crypto.subtle.importKey(
+    "raw",
+    enc.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign", "verify"]
+  );
+  _cachedSecret = secret;
+  return _cachedKey;
+}
+async function hmacSign(data, secret) {
+  const key = await getHmacKey(secret);
+  const enc = new TextEncoder();
+  const sig = await crypto.subtle.sign("HMAC", key, enc.encode(data));
+  return btoa(String.fromCharCode(...new Uint8Array(sig))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function hmacVerify(data, signature, secret) {
+  const expected = await hmacSign(data, secret);
+  return timingSafeEqual(expected, signature);
+}
+function base64UrlEncode(str) {
+  const bytes = new TextEncoder().encode(str);
+  let binary = "";
+  for (let i = 0; i < bytes.byteLength; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlDecode(str) {
+  let base64 = str.replace(/-/g, "+").replace(/_/g, "/");
+  while (base64.length % 4) {
+    base64 += "=";
+  }
+  const binary = atob(base64);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return new TextDecoder().decode(bytes);
+}
+function parseCookies(cookieHeader) {
+  const cookies = {};
+  if (!cookieHeader) return cookies;
+  for (const item of cookieHeader.split(";")) {
+    const idx = item.indexOf("=");
+    if (idx !== -1) {
+      const key = item.slice(0, idx).trim();
+      const val = item.slice(idx + 1).trim();
+      cookies[key] = val;
+    }
+  }
+  return cookies;
+}
+function sanitizeRedirectPath(path) {
+  if (!path || typeof path !== "string") return "/";
+  if (path.startsWith("/") && !path.startsWith("//") && !path.startsWith("/\\")) {
+    return path;
+  }
+  return "/";
+}
+var PrismWorker = class {
+  /**
+   * 可选扩展：指定公开免登路径（如 /favicon.ico 或静态公共 API）
+   * 子类可以重写此方法以自定义放行规则
+   */
+  isPublic(url, request) {
+    return url.pathname === "/favicon.ico";
+  }
+  /**
+   * Worker 入口：拦截未登录、OAuth 回调、登出并透传业务请求
+   */
+  async fetch(request, env, ctx) {
+    const currentEnv = env || (typeof globalThis !== "undefined" ? globalThis : {});
+    const url = new URL(request.url);
+    if (!currentEnv.PRISM_URL || !currentEnv.PRISM_CLIENT_ID || !currentEnv.PRISM_CLIENT_SECRET) {
+      return new Response("\u914D\u7F6E\u9519\u8BEF\uFF1A\u7F3A\u5C11\u5FC5\u8981\u7684\u73AF\u5883\u53D8\u91CF (PRISM_URL, PRISM_CLIENT_ID, PRISM_CLIENT_SECRET)", {
+        status: 500,
+        headers: { "Content-Type": "text/plain; charset=utf-8" }
+      });
+    }
+    if (this.isPublic(url, request)) {
+      return this.handleRequest(request, currentEnv, ctx, null);
+    }
+    const cookies = parseCookies(request.headers.get("Cookie"));
+    const prismBase = currentEnv.PRISM_URL.replace(/\/+$/, "");
+    let cookieDomain = (currentEnv.COOKIE_DOMAIN || "").trim();
+    if (cookieDomain && !cookieDomain.startsWith(".")) {
+      cookieDomain = "." + cookieDomain;
+    }
+    const domainAttr = cookieDomain ? `; Domain=${cookieDomain}` : "";
+    if (url.pathname === "/__logout") {
+      return new Response("\u5DF2\u9000\u51FA\u5F53\u524D\u7AD9\u70B9\u767B\u5F55", {
+        status: 302,
+        headers: {
+          "Location": "/",
+          "Set-Cookie": `prism_session=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0${domainAttr}`
+        }
+      });
+    }
+    if (url.pathname === "/auth/callback") {
+      const error = url.searchParams.get("error");
+      if (error) {
+        const desc = url.searchParams.get("error_description") || error;
+        return new Response(`Prism \u6388\u6743\u5931\u8D25: ${desc}`, { status: 403 });
+      }
+      const code = url.searchParams.get("code");
+      const rawState = url.searchParams.get("state");
+      if (!code) return new Response("\u7F3A\u5C11\u6388\u6743\u7801 (Code)", { status: 400 });
+      let targetPath = "/";
+      if (rawState && rawState.includes(".")) {
+        const [statePayloadB64, stateSig] = rawState.split(".");
+        if (await hmacVerify(statePayloadB64, stateSig, currentEnv.PRISM_CLIENT_SECRET)) {
+          try {
+            const parsed = JSON.parse(base64UrlDecode(statePayloadB64));
+            if (parsed.exp && parsed.exp > Date.now()) {
+              targetPath = sanitizeRedirectPath(parsed.path);
+            }
+          } catch (e) {
+          }
+        }
+      }
+      const tokenRes = await fetch(`${prismBase}/api/oauth/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "authorization_code",
+          client_id: currentEnv.PRISM_CLIENT_ID,
+          client_secret: currentEnv.PRISM_CLIENT_SECRET,
+          code,
+          redirect_uri: `${url.origin}/auth/callback`
+        })
+      });
+      if (!tokenRes.ok) {
+        const errText = await tokenRes.text();
+        return new Response(`Prism \u6362\u53D6 Token \u5931\u8D25: ${errText}`, { status: 401 });
+      }
+      const tokenData = await tokenRes.json();
+      let user2 = {};
+      if (tokenData.id_token) {
+        try {
+          const idPayload = tokenData.id_token.split(".")[1];
+          user2 = JSON.parse(base64UrlDecode(idPayload));
+        } catch (e) {
+        }
+      } else if (tokenData.access_token) {
+        try {
+          const uRes = await fetch(`${prismBase}/api/oauth/userinfo`, {
+            headers: { Authorization: `Bearer ${tokenData.access_token}` }
+          });
+          if (uRes.ok) user2 = await uRes.json();
+        } catch (e) {
+        }
+      }
+      const expireAt = Date.now() + 7 * 86400 * 1e3;
+      const sessionPayload = {
+        aud: currentEnv.PRISM_CLIENT_ID,
+        exp: expireAt,
+        user: user2
+      };
+      const payloadStr = JSON.stringify(sessionPayload);
+      const encodedPayload = base64UrlEncode(payloadStr);
+      const signature = await hmacSign(encodedPayload, currentEnv.PRISM_CLIENT_SECRET);
+      const sessionValue = `${encodedPayload}.${signature}`;
+      return new Response(null, {
+        status: 302,
+        headers: {
+          "Location": targetPath,
+          "Set-Cookie": `prism_session=${sessionValue}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=604800${domainAttr}`
+        }
+      });
+    }
+    const sessionCookie = cookies["prism_session"];
+    let user = null;
+    if (sessionCookie && sessionCookie.includes(".")) {
+      const [encodedPayload, signature] = sessionCookie.split(".");
+      if (encodedPayload && signature) {
+        const isValid = await hmacVerify(encodedPayload, signature, currentEnv.PRISM_CLIENT_SECRET);
+        if (isValid) {
+          try {
+            const sessionData = JSON.parse(base64UrlDecode(encodedPayload));
+            if (Number(sessionData.exp) > Date.now() && sessionData.aud === currentEnv.PRISM_CLIENT_ID) {
+              user = sessionData.user || { authenticated: true };
+            }
+          } catch (e) {
+          }
+        }
+      }
+    }
+    if (!user) {
+      const isApi = url.pathname.startsWith("/api/") || request.headers.get("Accept")?.includes("application/json") || request.headers.get("X-Requested-With") === "XMLHttpRequest";
+      if (isApi) {
+        return new Response(
+          JSON.stringify({ error: "Unauthorized", message: "\u672A\u767B\u5F55\u6216\u767B\u5F55\u5DF2\u8FC7\u671F" }),
+          {
+            status: 401,
+            headers: { "Content-Type": "application/json; charset=utf-8" }
+          }
+        );
+      }
+      const stateData = JSON.stringify({
+        path: url.pathname + url.search,
+        exp: Date.now() + 600 * 1e3
+      });
+      const stateB64 = base64UrlEncode(stateData);
+      const stateSig = await hmacSign(stateB64, currentEnv.PRISM_CLIENT_SECRET);
+      const stateToken = `${stateB64}.${stateSig}`;
+      const authUrl = new URL(`${prismBase}/api/oauth/authorize`);
+      authUrl.searchParams.set("client_id", currentEnv.PRISM_CLIENT_ID);
+      authUrl.searchParams.set("redirect_uri", `${url.origin}/auth/callback`);
+      authUrl.searchParams.set("response_type", "code");
+      authUrl.searchParams.set("scope", currentEnv.PRISM_SCOPE || "openid profile email");
+      authUrl.searchParams.set("state", stateToken);
+      return Response.redirect(authUrl.toString(), 302);
+    }
+    const authReq = request;
+    authReq.user = user;
+    return this.handleRequest(authReq, currentEnv, ctx, user);
+  }
+  /**
+   * 子类重写的业务方法（增加第 4 个参数 user，获取当前登录用户信息）
+   */
+  async handleRequest(request, env, ctx, user) {
+    return new Response("\u8BF7\u5728\u5B50\u7C7B\u4E2D\u91CD\u5199 handleRequest \u65B9\u6CD5", { status: 404 });
+  }
+};
+function withPrismAuth(handler, options = {}) {
+  const instance = new class extends PrismWorker {
+    isPublic(url, req) {
+      return options.isPublic ? options.isPublic(url, req) : super.isPublic(url, req);
+    }
+    async handleRequest(req, env, ctx, user) {
+      return handler(req, env, ctx, user);
+    }
+  }();
+  return (req, env, ctx) => instance.fetch(req, env, ctx);
+}
+function registerServiceWorker(handleRequest, options = {}) {
+  const worker = new class extends PrismWorker {
+    isPublic(url, req) {
+      return options.isPublic ? options.isPublic(url, req) : super.isPublic(url, req);
+    }
+    async handleRequest(request, env, ctx, user) {
+      const fakeEvent = {
+        request,
+        respondWith: () => {
+        },
+        waitUntil: (p) => ctx && ctx.waitUntil ? ctx.waitUntil(p) : p,
+        user
+      };
+      return handleRequest(fakeEvent, user);
+    }
+  }();
+  if (typeof addEventListener !== "undefined") {
+    addEventListener("fetch", (event) => {
+      event.respondWith(worker.fetch(event.request, globalThis, event));
+    });
+  }
+}
+var prism_auth_default = PrismWorker;
+export {
+  PrismWorker,
+  prism_auth_default as default,
+  registerServiceWorker,
+  withPrismAuth
+};
+//# sourceMappingURL=prism-auth.js.map

package/dist/prism-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/prism-auth.ts"],"sourcesContent":["// prism-auth.ts\n\n// =========================================================================\n// 类型定义 (Types)\n// =========================================================================\n\nexport interface PrismEnv {\n    PRISM_URL: string;\n    PRISM_CLIENT_ID: string;\n    PRISM_CLIENT_SECRET: string;\n    COOKIE_DOMAIN?: string;\n    PRISM_SCOPE?: string;\n    [key: string]: any;\n}\n\nexport interface PrismUser {\n    sub?: string;\n    name?: string;\n    email?: string;\n    preferred_username?: string;\n    authenticated?: boolean;\n    [key: string]: any;\n}\n\nexport interface AuthenticatedRequest extends Request {\n    user?: PrismUser;\n}\n\nexport interface PrismWorkerOptions {\n    isPublic?: (url: URL, req: Request) => boolean;\n}\n\nexport type PrismHandler = (\n    req: AuthenticatedRequest,\n    env: PrismEnv,\n    ctx: any,\n    user: PrismUser | null\n) => Promise<Response> | Response;\n\n// =========================================================================\n// 1. 加密与安全工具函数 (Web Crypto & Timing-Safe)\n// =========================================================================\n\n// 恒定时间字符串比对（防御时序侧信道攻击）\nfunction timingSafeEqual(a: string, b: string): boolean {\n    if (typeof a !== \"string\" || typeof b !== \"string\" || a.length !== b.length) {\n        return false;\n    }\n    let diff = 0;\n    for (let i = 0; i < a.length; i++) {\n        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n    }\n    return diff === 0;\n}\n\n// 缓存 CryptoKey，避免高并发下每个请求重复 importKey 消耗 CPU\nlet _cachedSecret: string | null = null;\nlet _cachedKey: CryptoKey | null = null;\n\nasync function getHmacKey(secret: string): Promise<CryptoKey> {\n    if (_cachedKey && _cachedSecret === secret) return _cachedKey;\n    const enc = new TextEncoder();\n    _cachedKey = await crypto.subtle.importKey(\n        \"raw\",\n        enc.encode(secret),\n        { name: \"HMAC\", hash: \"SHA-256\" },\n        false,\n        [\"sign\", \"verify\"]\n    );\n    _cachedSecret = secret;\n    return _cachedKey;\n}\n\n// 基于 Web Crypto 的 HMAC-SHA256 签名工具\nasync function hmacSign(data: string, secret: string): Promise<string> {\n    const key = await getHmacKey(secret);\n    const enc = new TextEncoder();\n    const sig = await crypto.subtle.sign(\"HMAC\", key, enc.encode(data));\n    return btoa(String.fromCharCode(...new Uint8Array(sig)))\n        .replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nasync function hmacVerify(data: string, signature: string, secret: string): Promise<boolean> {\n    const expected = await hmacSign(data, secret);\n    return timingSafeEqual(expected, signature);\n}\n\n// UTF-8 安全的 Base64URL 编解码工具\nfunction base64UrlEncode(str: string): string {\n    const bytes = new TextEncoder().encode(str);\n    let binary = \"\";\n    for (let i = 0; i < bytes.byteLength; i++) {\n        binary += String.fromCharCode(bytes[i]);\n    }\n    return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction base64UrlDecode(str: string): string {\n    let base64 = str.replace(/-/g, \"+\").replace(/_/g, \"/\");\n    while (base64.length % 4) {\n        base64 += \"=\";\n    }\n    const binary = atob(base64);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n        bytes[i] = binary.charCodeAt(i);\n    }\n    return new TextDecoder().decode(bytes);\n}\n\n// 健壮的 Cookie 解析方法（避免 split(\"=\") 误切 base64 中的等于号）\nfunction parseCookies(cookieHeader: string | null): Record<string, string> {\n    const cookies: Record<string, string> = {};\n    if (!cookieHeader) return cookies;\n    for (const item of cookieHeader.split(\";\")) {\n        const idx = item.indexOf(\"=\");\n        if (idx !== -1) {\n            const key = item.slice(0, idx).trim();\n            const val = item.slice(idx + 1).trim();\n            cookies[key] = val;\n        }\n    }\n    return cookies;\n}\n\n// 防御开放重定向（Open Redirect）：强制要求单斜杠内部相对路径，禁止 // 或 /\\ 外部协议伪造\nfunction sanitizeRedirectPath(path: string | null | undefined): string {\n    if (!path || typeof path !== \"string\") return \"/\";\n    if (path.startsWith(\"/\") && !path.startsWith(\"//\") && !path.startsWith(\"/\\\\\")) {\n        return path;\n    }\n    return \"/\";\n}\n\n// =========================================================================\n// 2. 鉴权基类 (PrismWorker)\n// =========================================================================\n\nexport class PrismWorker {\n    /**\n     * 可选扩展：指定公开免登路径（如 /favicon.ico 或静态公共 API）\n     * 子类可以重写此方法以自定义放行规则\n     */\n    isPublic(url: URL, request: Request): boolean {\n        return url.pathname === \"/favicon.ico\";\n    }\n\n    /**\n     * Worker 入口：拦截未登录、OAuth 回调、登出并透传业务请求\n     */\n    async fetch(request: Request, env?: PrismEnv, ctx?: any): Promise<Response> {\n        const currentEnv: PrismEnv = env || (typeof globalThis !== \"undefined\" ? (globalThis as any) : {});\n        const url = new URL(request.url);\n\n        // 前置环境变量完整性检查\n        if (!currentEnv.PRISM_URL || !currentEnv.PRISM_CLIENT_ID || !currentEnv.PRISM_CLIENT_SECRET) {\n            return new Response(\"配置错误：缺少必要的环境变量 (PRISM_URL, PRISM_CLIENT_ID, PRISM_CLIENT_SECRET)\", {\n                status: 500,\n                headers: { \"Content-Type\": \"text/plain; charset=utf-8\" },\n            });\n        }\n\n        // 白名单路径直接放行\n        if (this.isPublic(url, request)) {\n            return this.handleRequest(request as AuthenticatedRequest, currentEnv, ctx, null);\n        }\n\n        const cookies = parseCookies(request.headers.get(\"Cookie\"));\n        const prismBase = currentEnv.PRISM_URL.replace(/\\/+$/, \"\");\n        // 泛域名 Cookie 支持（例如 .b.cc.cd 或 .cc.cd，让多级子域名站点直接共享登录态）\n        // 自动容错：去除前后空格，若未写前导点号自动补齐，输入 \"b.cc.cd\" 也会标准化为 \".b.cc.cd\"\n        let cookieDomain = (currentEnv.COOKIE_DOMAIN || \"\").trim();\n        if (cookieDomain && !cookieDomain.startsWith(\".\")) {\n            cookieDomain = \".\" + cookieDomain;\n        }\n        const domainAttr = cookieDomain ? `; Domain=${cookieDomain}` : \"\";\n\n        // 【功能 1：主动登出】访问 /__logout 即可清理 Cookie 并登出\n        if (url.pathname === \"/__logout\") {\n            return new Response(\"已退出当前站点登录\", {\n                status: 302,\n                headers: {\n                    \"Location\": \"/\",\n                    \"Set-Cookie\": `prism_session=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0${domainAttr}`,\n                },\n            });\n        }\n\n        // 【功能 2：OAuth 回调处理】拦截 Prism 登录完成后的跳回\n        if (url.pathname === \"/auth/callback\") {\n            const error = url.searchParams.get(\"error\");\n            if (error) {\n                const desc = url.searchParams.get(\"error_description\") || error;\n                return new Response(`Prism 授权失败: ${desc}`, { status: 403 });\n            }\n\n            const code = url.searchParams.get(\"code\");\n            const rawState = url.searchParams.get(\"state\");\n            if (!code) return new Response(\"缺少授权码 (Code)\", { status: 400 });\n\n            // 校验 State：防范登录 CSRF 攻击与开放重定向\n            let targetPath = \"/\";\n            if (rawState && rawState.includes(\".\")) {\n                const [statePayloadB64, stateSig] = rawState.split(\".\");\n                if (await hmacVerify(statePayloadB64, stateSig, currentEnv.PRISM_CLIENT_SECRET)) {\n                    try {\n                        const parsed = JSON.parse(base64UrlDecode(statePayloadB64));\n                        // 10 分钟有效期校验\n                        if (parsed.exp && parsed.exp > Date.now()) {\n                            targetPath = sanitizeRedirectPath(parsed.path);\n                        }\n                    } catch (e) { }\n                }\n            }\n\n            // 向 Prism 请求换取 Token（标准端点为 /api/oauth/token）\n            const tokenRes = await fetch(`${prismBase}/api/oauth/token`, {\n                method: \"POST\",\n                headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n                body: new URLSearchParams({\n                    grant_type: \"authorization_code\",\n                    client_id: currentEnv.PRISM_CLIENT_ID,\n                    client_secret: currentEnv.PRISM_CLIENT_SECRET,\n                    code,\n                    redirect_uri: `${url.origin}/auth/callback`,\n                }),\n            });\n\n            if (!tokenRes.ok) {\n                const errText = await tokenRes.text();\n                return new Response(`Prism 换取 Token 失败: ${errText}`, { status: 401 });\n            }\n\n            const tokenData: any = await tokenRes.json();\n            let user: PrismUser = {};\n\n            // 解析用户身份信息（优先从 OIDC id_token 解码，回退 userinfo 端点）\n            if (tokenData.id_token) {\n                try {\n                    const idPayload = tokenData.id_token.split(\".\")[1];\n                    user = JSON.parse(base64UrlDecode(idPayload));\n                } catch (e) { }\n            } else if (tokenData.access_token) {\n                try {\n                    const uRes = await fetch(`${prismBase}/api/oauth/userinfo`, {\n                        headers: { Authorization: `Bearer ${tokenData.access_token}` },\n                    });\n                    if (uRes.ok) user = await uRes.json();\n                } catch (e) { }\n            }\n\n            // 生成带签名的 Session Cookie（绑定 client_id，默认有效期 7 天）\n            const expireAt = Date.now() + 7 * 86400 * 1000;\n            const sessionPayload = {\n                aud: currentEnv.PRISM_CLIENT_ID,\n                exp: expireAt,\n                user,\n            };\n            const payloadStr = JSON.stringify(sessionPayload);\n            const encodedPayload = base64UrlEncode(payloadStr);\n            const signature = await hmacSign(encodedPayload, currentEnv.PRISM_CLIENT_SECRET);\n            const sessionValue = `${encodedPayload}.${signature}`;\n\n            return new Response(null, {\n                status: 302,\n                headers: {\n                    \"Location\": targetPath,\n                    \"Set-Cookie\": `prism_session=${sessionValue}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=604800${domainAttr}`,\n                },\n            });\n        }\n\n        // 【功能 3：校验本地登录态】\n        const sessionCookie = cookies[\"prism_session\"];\n        let user: PrismUser | null = null;\n\n        if (sessionCookie && sessionCookie.includes(\".\")) {\n            const [encodedPayload, signature] = sessionCookie.split(\".\");\n            if (encodedPayload && signature) {\n                const isValid = await hmacVerify(encodedPayload, signature, currentEnv.PRISM_CLIENT_SECRET);\n                if (isValid) {\n                    try {\n                        const sessionData = JSON.parse(base64UrlDecode(encodedPayload));\n                        // 校验有效期与 Client ID 归属\n                        if (\n                            Number(sessionData.exp) > Date.now() &&\n                            sessionData.aud === currentEnv.PRISM_CLIENT_ID\n                        ) {\n                            user = sessionData.user || { authenticated: true };\n                        }\n                    } catch (e) { }\n                }\n            }\n        }\n\n        // 【功能 4：未登录拦截】\n        if (!user) {\n            // 对 API 或 Ajax 请求返回 401 JSON，避免前端 302 跟随重定向导致 CORS 跨域报错\n            const isApi = url.pathname.startsWith(\"/api/\") ||\n                request.headers.get(\"Accept\")?.includes(\"application/json\") ||\n                request.headers.get(\"X-Requested-With\") === \"XMLHttpRequest\";\n\n            if (isApi) {\n                return new Response(\n                    JSON.stringify({ error: \"Unauthorized\", message: \"未登录或登录已过期\" }),\n                    {\n                        status: 401,\n                        headers: { \"Content-Type\": \"application/json; charset=utf-8\" },\n                    }\n                );\n            }\n\n            // 生成带签名与防篡改的 State（有效期 10 分钟）\n            const stateData = JSON.stringify({\n                path: url.pathname + url.search,\n                exp: Date.now() + 600 * 1000,\n            });\n            const stateB64 = base64UrlEncode(stateData);\n            const stateSig = await hmacSign(stateB64, currentEnv.PRISM_CLIENT_SECRET);\n            const stateToken = `${stateB64}.${stateSig}`;\n\n            // 网页端未登录：重定向至 Prism 登录（标准端点为 /api/oauth/authorize）\n            const authUrl = new URL(`${prismBase}/api/oauth/authorize`);\n            authUrl.searchParams.set(\"client_id\", currentEnv.PRISM_CLIENT_ID);\n            authUrl.searchParams.set(\"redirect_uri\", `${url.origin}/auth/callback`);\n            authUrl.searchParams.set(\"response_type\", \"code\");\n            // scope 默认包含 openid profile email（按需通过 PRISM_SCOPE 覆盖）\n            authUrl.searchParams.set(\"scope\", currentEnv.PRISM_SCOPE || \"openid profile email\");\n            authUrl.searchParams.set(\"state\", stateToken);\n\n            return Response.redirect(authUrl.toString(), 302);\n        }\n\n        // 鉴权通过：把 user 挂载到 request 并透传给业务逻辑\n        const authReq = request as AuthenticatedRequest;\n        authReq.user = user;\n        return this.handleRequest(authReq, currentEnv, ctx, user);\n    }\n\n    /**\n     * 子类重写的业务方法（增加第 4 个参数 user，获取当前登录用户信息）\n     */\n    async handleRequest(\n        request: AuthenticatedRequest,\n        env: PrismEnv,\n        ctx: any,\n        user: PrismUser | null\n    ): Promise<Response> {\n        return new Response(\"请在子类中重写 handleRequest 方法\", { status: 404 });\n    }\n}\n\n// 兼容纯函数式习惯的导出包装器\nexport function withPrismAuth(\n    handler: PrismHandler,\n    options: PrismWorkerOptions = {}\n): (req: Request, env?: PrismEnv, ctx?: any) => Promise<Response> {\n    const instance = new (class extends PrismWorker {\n        override isPublic(url: URL, req: Request) {\n            return options.isPublic ? options.isPublic(url, req) : super.isPublic(url, req);\n        }\n        override async handleRequest(req: AuthenticatedRequest, env: PrismEnv, ctx: any, user: PrismUser | null) {\n            return handler(req, env, ctx, user);\n        }\n    })();\n    return (req: Request, env?: PrismEnv, ctx?: any) => instance.fetch(req, env, ctx);\n}\n\n// 兼容旧版 Service Worker (addEventListener(\"fetch\")) 模式\nexport function registerServiceWorker(\n    handleRequest: (event: any, user: PrismUser | null) => Promise<Response> | Response,\n    options: PrismWorkerOptions = {}\n): void {\n    const worker = new (class extends PrismWorker {\n        override isPublic(url: URL, req: Request) {\n            return options.isPublic ? options.isPublic(url, req) : super.isPublic(url, req);\n        }\n        override async handleRequest(request: AuthenticatedRequest, env: PrismEnv, ctx: any, user: PrismUser | null) {\n            // 构造兼容旧版代码的 event 对象\n            const fakeEvent = {\n                request,\n                respondWith: () => { },\n                waitUntil: (p: Promise<any>) => (ctx && ctx.waitUntil ? ctx.waitUntil(p) : p),\n                user,\n            };\n            return handleRequest(fakeEvent, user);\n        }\n    })();\n\n    if (typeof addEventListener !== \"undefined\") {\n        addEventListener(\"fetch\", (event: any) => {\n            event.respondWith(worker.fetch(event.request, (globalThis as any), event));\n        });\n    }\n}\n\nexport default PrismWorker;\n"],"mappings":";AA4CA,SAAS,gBAAgB,GAAW,GAAoB;AACpD,MAAI,OAAO,MAAM,YAAY,OAAO,MAAM,YAAY,EAAE,WAAW,EAAE,QAAQ;AACzE,WAAO;AAAA,EACX;AACA,MAAI,OAAO;AACX,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,KAAK;AAC/B,YAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AAAA,EAC5C;AACA,SAAO,SAAS;AACpB;AAGA,IAAI,gBAA+B;AACnC,IAAI,aAA+B;AAEnC,eAAe,WAAW,QAAoC;AAC1D,MAAI,cAAc,kBAAkB,OAAQ,QAAO;AACnD,QAAM,MAAM,IAAI,YAAY;AAC5B,eAAa,MAAM,OAAO,OAAO;AAAA,IAC7B;AAAA,IACA,IAAI,OAAO,MAAM;AAAA,IACjB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,QAAQ,QAAQ;AAAA,EACrB;AACA,kBAAgB;AAChB,SAAO;AACX;AAGA,eAAe,SAAS,MAAc,QAAiC;AACnE,QAAM,MAAM,MAAM,WAAW,MAAM;AACnC,QAAM,MAAM,IAAI,YAAY;AAC5B,QAAM,MAAM,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,IAAI,OAAO,IAAI,CAAC;AAClE,SAAO,KAAK,OAAO,aAAa,GAAG,IAAI,WAAW,GAAG,CAAC,CAAC,EAClD,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAClE;AAEA,eAAe,WAAW,MAAc,WAAmB,QAAkC;AACzF,QAAM,WAAW,MAAM,SAAS,MAAM,MAAM;AAC5C,SAAO,gBAAgB,UAAU,SAAS;AAC9C;AAGA,SAAS,gBAAgB,KAAqB;AAC1C,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,GAAG;AAC1C,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,YAAY,KAAK;AACvC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EAC1C;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AACjF;AAEA,SAAS,gBAAgB,KAAqB;AAC1C,MAAI,SAAS,IAAI,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACrD,SAAO,OAAO,SAAS,GAAG;AACtB,cAAU;AAAA,EACd;AACA,QAAM,SAAS,KAAK,MAAM;AAC1B,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACpC,UAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,EAClC;AACA,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK;AACzC;AAGA,SAAS,aAAa,cAAqD;AACvE,QAAM,UAAkC,CAAC;AACzC,MAAI,CAAC,aAAc,QAAO;AAC1B,aAAW,QAAQ,aAAa,MAAM,GAAG,GAAG;AACxC,UAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,QAAI,QAAQ,IAAI;AACZ,YAAM,MAAM,KAAK,MAAM,GAAG,GAAG,EAAE,KAAK;AACpC,YAAM,MAAM,KAAK,MAAM,MAAM,CAAC,EAAE,KAAK;AACrC,cAAQ,GAAG,IAAI;AAAA,IACnB;AAAA,EACJ;AACA,SAAO;AACX;AAGA,SAAS,qBAAqB,MAAyC;AACnE,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,MAAI,KAAK,WAAW,GAAG,KAAK,CAAC,KAAK,WAAW,IAAI,KAAK,CAAC,KAAK,WAAW,KAAK,GAAG;AAC3E,WAAO;AAAA,EACX;AACA,SAAO;AACX;AAMO,IAAM,cAAN,MAAkB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKrB,SAAS,KAAU,SAA2B;AAC1C,WAAO,IAAI,aAAa;AAAA,EAC5B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAM,SAAkB,KAAgB,KAA8B;AACxE,UAAM,aAAuB,QAAQ,OAAO,eAAe,cAAe,aAAqB,CAAC;AAChG,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAG/B,QAAI,CAAC,WAAW,aAAa,CAAC,WAAW,mBAAmB,CAAC,WAAW,qBAAqB;AACzF,aAAO,IAAI,SAAS,0IAAoE;AAAA,QACpF,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,4BAA4B;AAAA,MAC3D,CAAC;AAAA,IACL;AAGA,QAAI,KAAK,SAAS,KAAK,OAAO,GAAG;AAC7B,aAAO,KAAK,cAAc,SAAiC,YAAY,KAAK,IAAI;AAAA,IACpF;AAEA,UAAM,UAAU,aAAa,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AAC1D,UAAM,YAAY,WAAW,UAAU,QAAQ,QAAQ,EAAE;AAGzD,QAAI,gBAAgB,WAAW,iBAAiB,IAAI,KAAK;AACzD,QAAI,gBAAgB,CAAC,aAAa,WAAW,GAAG,GAAG;AAC/C,qBAAe,MAAM;AAAA,IACzB;AACA,UAAM,aAAa,eAAe,YAAY,YAAY,KAAK;AAG/D,QAAI,IAAI,aAAa,aAAa;AAC9B,aAAO,IAAI,SAAS,0DAAa;AAAA,QAC7B,QAAQ;AAAA,QACR,SAAS;AAAA,UACL,YAAY;AAAA,UACZ,cAAc,oEAAoE,UAAU;AAAA,QAChG;AAAA,MACJ,CAAC;AAAA,IACL;AAGA,QAAI,IAAI,aAAa,kBAAkB;AACnC,YAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAC1C,UAAI,OAAO;AACP,cAAM,OAAO,IAAI,aAAa,IAAI,mBAAmB,KAAK;AAC1D,eAAO,IAAI,SAAS,mCAAe,IAAI,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC9D;AAEA,YAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,YAAM,WAAW,IAAI,aAAa,IAAI,OAAO;AAC7C,UAAI,CAAC,KAAM,QAAO,IAAI,SAAS,yCAAgB,EAAE,QAAQ,IAAI,CAAC;AAG9D,UAAI,aAAa;AACjB,UAAI,YAAY,SAAS,SAAS,GAAG,GAAG;AACpC,cAAM,CAAC,iBAAiB,QAAQ,IAAI,SAAS,MAAM,GAAG;AACtD,YAAI,MAAM,WAAW,iBAAiB,UAAU,WAAW,mBAAmB,GAAG;AAC7E,cAAI;AACA,kBAAM,SAAS,KAAK,MAAM,gBAAgB,eAAe,CAAC;AAE1D,gBAAI,OAAO,OAAO,OAAO,MAAM,KAAK,IAAI,GAAG;AACvC,2BAAa,qBAAqB,OAAO,IAAI;AAAA,YACjD;AAAA,UACJ,SAAS,GAAG;AAAA,UAAE;AAAA,QAClB;AAAA,MACJ;AAGA,YAAM,WAAW,MAAM,MAAM,GAAG,SAAS,oBAAoB;AAAA,QACzD,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D,MAAM,IAAI,gBAAgB;AAAA,UACtB,YAAY;AAAA,UACZ,WAAW,WAAW;AAAA,UACtB,eAAe,WAAW;AAAA,UAC1B;AAAA,UACA,cAAc,GAAG,IAAI,MAAM;AAAA,QAC/B,CAAC;AAAA,MACL,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AACd,cAAM,UAAU,MAAM,SAAS,KAAK;AACpC,eAAO,IAAI,SAAS,0CAAsB,OAAO,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,MACxE;AAEA,YAAM,YAAiB,MAAM,SAAS,KAAK;AAC3C,UAAIA,QAAkB,CAAC;AAGvB,UAAI,UAAU,UAAU;AACpB,YAAI;AACA,gBAAM,YAAY,UAAU,SAAS,MAAM,GAAG,EAAE,CAAC;AACjD,UAAAA,QAAO,KAAK,MAAM,gBAAgB,SAAS,CAAC;AAAA,QAChD,SAAS,GAAG;AAAA,QAAE;AAAA,MAClB,WAAW,UAAU,cAAc;AAC/B,YAAI;AACA,gBAAM,OAAO,MAAM,MAAM,GAAG,SAAS,uBAAuB;AAAA,YACxD,SAAS,EAAE,eAAe,UAAU,UAAU,YAAY,GAAG;AAAA,UACjE,CAAC;AACD,cAAI,KAAK,GAAI,CAAAA,QAAO,MAAM,KAAK,KAAK;AAAA,QACxC,SAAS,GAAG;AAAA,QAAE;AAAA,MAClB;AAGA,YAAM,WAAW,KAAK,IAAI,IAAI,IAAI,QAAQ;AAC1C,YAAM,iBAAiB;AAAA,QACnB,KAAK,WAAW;AAAA,QAChB,KAAK;AAAA,QACL,MAAAA;AAAA,MACJ;AACA,YAAM,aAAa,KAAK,UAAU,cAAc;AAChD,YAAM,iBAAiB,gBAAgB,UAAU;AACjD,YAAM,YAAY,MAAM,SAAS,gBAAgB,WAAW,mBAAmB;AAC/E,YAAM,eAAe,GAAG,cAAc,IAAI,SAAS;AAEnD,aAAO,IAAI,SAAS,MAAM;AAAA,QACtB,QAAQ;AAAA,QACR,SAAS;AAAA,UACL,YAAY;AAAA,UACZ,cAAc,iBAAiB,YAAY,2DAA2D,UAAU;AAAA,QACpH;AAAA,MACJ,CAAC;AAAA,IACL;AAGA,UAAM,gBAAgB,QAAQ,eAAe;AAC7C,QAAI,OAAyB;AAE7B,QAAI,iBAAiB,cAAc,SAAS,GAAG,GAAG;AAC9C,YAAM,CAAC,gBAAgB,SAAS,IAAI,cAAc,MAAM,GAAG;AAC3D,UAAI,kBAAkB,WAAW;AAC7B,cAAM,UAAU,MAAM,WAAW,gBAAgB,WAAW,WAAW,mBAAmB;AAC1F,YAAI,SAAS;AACT,cAAI;AACA,kBAAM,cAAc,KAAK,MAAM,gBAAgB,cAAc,CAAC;AAE9D,gBACI,OAAO,YAAY,GAAG,IAAI,KAAK,IAAI,KACnC,YAAY,QAAQ,WAAW,iBACjC;AACE,qBAAO,YAAY,QAAQ,EAAE,eAAe,KAAK;AAAA,YACrD;AAAA,UACJ,SAAS,GAAG;AAAA,UAAE;AAAA,QAClB;AAAA,MACJ;AAAA,IACJ;AAGA,QAAI,CAAC,MAAM;AAEP,YAAM,QAAQ,IAAI,SAAS,WAAW,OAAO,KACzC,QAAQ,QAAQ,IAAI,QAAQ,GAAG,SAAS,kBAAkB,KAC1D,QAAQ,QAAQ,IAAI,kBAAkB,MAAM;AAEhD,UAAI,OAAO;AACP,eAAO,IAAI;AAAA,UACP,KAAK,UAAU,EAAE,OAAO,gBAAgB,SAAS,yDAAY,CAAC;AAAA,UAC9D;AAAA,YACI,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,kCAAkC;AAAA,UACjE;AAAA,QACJ;AAAA,MACJ;AAGA,YAAM,YAAY,KAAK,UAAU;AAAA,QAC7B,MAAM,IAAI,WAAW,IAAI;AAAA,QACzB,KAAK,KAAK,IAAI,IAAI,MAAM;AAAA,MAC5B,CAAC;AACD,YAAM,WAAW,gBAAgB,SAAS;AAC1C,YAAM,WAAW,MAAM,SAAS,UAAU,WAAW,mBAAmB;AACxE,YAAM,aAAa,GAAG,QAAQ,IAAI,QAAQ;AAG1C,YAAM,UAAU,IAAI,IAAI,GAAG,SAAS,sBAAsB;AAC1D,cAAQ,aAAa,IAAI,aAAa,WAAW,eAAe;AAChE,cAAQ,aAAa,IAAI,gBAAgB,GAAG,IAAI,MAAM,gBAAgB;AACtE,cAAQ,aAAa,IAAI,iBAAiB,MAAM;AAEhD,cAAQ,aAAa,IAAI,SAAS,WAAW,eAAe,sBAAsB;AAClF,cAAQ,aAAa,IAAI,SAAS,UAAU;AAE5C,aAAO,SAAS,SAAS,QAAQ,SAAS,GAAG,GAAG;AAAA,IACpD;AAGA,UAAM,UAAU;AAChB,YAAQ,OAAO;AACf,WAAO,KAAK,cAAc,SAAS,YAAY,KAAK,IAAI;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cACF,SACA,KACA,KACA,MACiB;AACjB,WAAO,IAAI,SAAS,yEAA4B,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnE;AACJ;AAGO,SAAS,cACZ,SACA,UAA8B,CAAC,GAC+B;AAC9D,QAAM,WAAW,IAAK,cAAc,YAAY;AAAA,IACnC,SAAS,KAAU,KAAc;AACtC,aAAO,QAAQ,WAAW,QAAQ,SAAS,KAAK,GAAG,IAAI,MAAM,SAAS,KAAK,GAAG;AAAA,IAClF;AAAA,IACA,MAAe,cAAc,KAA2B,KAAe,KAAU,MAAwB;AACrG,aAAO,QAAQ,KAAK,KAAK,KAAK,IAAI;AAAA,IACtC;AAAA,EACJ,EAAG;AACH,SAAO,CAAC,KAAc,KAAgB,QAAc,SAAS,MAAM,KAAK,KAAK,GAAG;AACpF;AAGO,SAAS,sBACZ,eACA,UAA8B,CAAC,GAC3B;AACJ,QAAM,SAAS,IAAK,cAAc,YAAY;AAAA,IACjC,SAAS,KAAU,KAAc;AACtC,aAAO,QAAQ,WAAW,QAAQ,SAAS,KAAK,GAAG,IAAI,MAAM,SAAS,KAAK,GAAG;AAAA,IAClF;AAAA,IACA,MAAe,cAAc,SAA+B,KAAe,KAAU,MAAwB;AAEzG,YAAM,YAAY;AAAA,QACd;AAAA,QACA,aAAa,MAAM;AAAA,QAAE;AAAA,QACrB,WAAW,CAAC,MAAqB,OAAO,IAAI,YAAY,IAAI,UAAU,CAAC,IAAI;AAAA,QAC3E;AAAA,MACJ;AACA,aAAO,cAAc,WAAW,IAAI;AAAA,IACxC;AAAA,EACJ,EAAG;AAEH,MAAI,OAAO,qBAAqB,aAAa;AACzC,qBAAiB,SAAS,CAAC,UAAe;AACtC,YAAM,YAAY,OAAO,MAAM,MAAM,SAAU,YAAoB,KAAK,CAAC;AAAA,IAC7E,CAAC;AAAA,EACL;AACJ;AAEA,IAAO,qBAAQ;","names":["user"]}

package/package.json

@@ -1,6 +1,39 @@
 {
   "name": "prism-authts",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "Zero-dependency Cloudflare Worker & Edge middleware for Prism OAuth2/OIDC SSO authentication",
+  "type": "module",
+  "main": "./dist/prism-auth.cjs",
+  "module": "./dist/prism-auth.js",
+  "types": "./dist/prism-auth.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/prism-auth.d.ts",
+      "import": "./dist/prism-auth.js",
+      "require": "./dist/prism-auth.cjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "prism",
+    "auth",
+    "sso",
+    "oauth2",
+    "oidc",
+    "cloudflare-workers",
+    "edge"
+  ],
+  "author": "",
+  "license": "MIT",
+  "devDependencies": {
+    "tsup": "^8.5.1",
+    "typescript": "^5.8.2"
+  }
+}