{"version":3,"sources":["../src/server/middleware/auth.ts","../src/server/middleware/session.ts"],"sourcesContent":["import { contentstackAuthCallbacks, createAuthProvider, getUser } from \"../../index.js\"\nimport type { OAuthMiddlewareConfig } from \"./types.js\"\n\n/**\n * Create a complete Auth.js v5 (NextAuth) configuration for Contentstack OAuth.\n *\n * This wraps NextAuth with all Contentstack-specific config baked in, reducing\n * ~150 lines of Auth.js configuration down to ~10 lines.\n *\n * Requires `next-auth@>=5.0.0-beta.0` as an installed peer dependency.\n *\n * @example\n * ```ts\n * import { createContentstackAuth } from \"@timbenniks/contentstack-platform-sdk/server/middleware\"\n *\n * const { handlers, auth, signIn, signOut } = await createContentstackAuth({\n * region: \"us\",\n * appId: \"your-app-uid\",\n * clientId: \"your-client-id\",\n * clientSecret: \"your-client-secret\",\n * scopes: [\"user:read\"],\n * secret: process.env.AUTH_SECRET!,\n * })\n *\n * // app/api/auth/[...nextauth]/route.ts\n * export const { GET, POST } = handlers\n * ```\n */\nexport async function createContentstackAuth(config: OAuthMiddlewareConfig) {\n // Dynamic import — next-auth is an optional peer dependency.\n // This prevents module resolution errors when importing the middleware\n // module in environments where next-auth is not installed.\n const { default: NextAuth } = await import(\"next-auth\")\n\n const oauthConfig = {\n region: config.region,\n appId: config.appId,\n clientId: config.clientId,\n clientSecret: config.clientSecret,\n scopes: config.scopes,\n redirectUri: config.redirectUri ?? \"auto\",\n }\n\n const provider = createAuthProvider(oauthConfig)\n const baseCallbacks = contentstackAuthCallbacks(oauthConfig)\n\n const callbacks = {\n async jwt(params: {\n token: Record\n account?: Record | null\n }) {\n const token = await baseCallbacks.jwt(params)\n\n // Call onSignIn on initial sign-in (account is only present once)\n if (params.account && config.onSignIn) {\n try {\n const user = await getUser(config.region, token.accessToken as string)\n const tokens = {\n accessToken: token.accessToken as string,\n refreshToken: token.refreshToken as string,\n expiresIn: Math.floor(((token.accessTokenExpiresAt as number) - Date.now()) / 1000),\n tokenType: \"Bearer\",\n }\n await config.onSignIn(user, tokens)\n } catch {\n // onSignIn errors should not block authentication\n }\n }\n\n return token\n },\n session: baseCallbacks.session,\n }\n\n // The core package returns generic `Record` for framework\n // independence. Cast to `never` at the NextAuth boundary — the shape is\n // guaranteed correct by createAuthProvider/contentstackAuthCallbacks.\n return NextAuth({\n providers: [provider as never],\n callbacks: callbacks as never,\n secret: config.secret,\n logger: config.logger,\n trustHost: config.trustHost ?? true,\n session: { strategy: \"jwt\" as const },\n pages: {\n signIn: config.signInPage ?? \"/login\",\n error: config.errorPage ?? \"/login\",\n },\n })\n}\n","import { ContentstackAuthError } from \"../../index.js\"\nimport type { AuthFn, ContentstackSession } from \"./types.js\"\n\n/**\n * Get the current Contentstack session.\n *\n * @param authFn - Framework-agnostic auth function (e.g., the `auth()` function from NextAuth)\n * @returns The session with `accessToken`, or `null` if unauthenticated.\n */\nexport async function getSession(authFn: AuthFn): Promise {\n const session = await authFn()\n if (!session?.accessToken) return null\n return { accessToken: session.accessToken, user: session.user }\n}\n\n/**\n * Require an authenticated Contentstack session.\n * Throws `ContentstackAuthError` if no session or no access token is present.\n *\n * @param authFn - Framework-agnostic auth function\n * @param redirectTo - Optional redirect path included in the error for the caller to use\n * @returns The session with a guaranteed `accessToken`.\n */\nexport async function requireSession(\n authFn: AuthFn,\n redirectTo?: string,\n): Promise {\n const session = await getSession(authFn)\n if (!session) {\n throw new ContentstackAuthError(\n redirectTo\n ? `Authentication required. Redirect to: ${redirectTo}`\n : \"Authentication required\",\n { status: 401 },\n )\n }\n return session\n}\n\n/**\n * Get the OAuth access token from the current session.\n *\n * @param authFn - Framework-agnostic auth function\n * @returns The access token string, or `null` if unauthenticated.\n */\nexport async function getAccessToken(authFn: AuthFn): Promise {\n const session = await authFn()\n return session?.accessToken ?? null\n}\n"],"mappings":";;;;;;;;;;AA4BA,eAAsB,uBAAuB,QAA+B;AAI1E,QAAM,EAAE,SAAS,SAAS,IAAI,MAAM,OAAO,WAAW;AAEtD,QAAM,cAAc;AAAA,IAClB,QAAQ,OAAO;AAAA,IACf,OAAO,OAAO;AAAA,IACd,UAAU,OAAO;AAAA,IACjB,cAAc,OAAO;AAAA,IACrB,QAAQ,OAAO;AAAA,IACf,aAAa,OAAO,eAAe;AAAA,EACrC;AAEA,QAAM,WAAW,mBAAmB,WAAW;AAC/C,QAAM,gBAAgB,0BAA0B,WAAW;AAE3D,QAAM,YAAY;AAAA,IAChB,MAAM,IAAI,QAGP;AACD,YAAM,QAAQ,MAAM,cAAc,IAAI,MAAM;AAG5C,UAAI,OAAO,WAAW,OAAO,UAAU;AACrC,YAAI;AACF,gBAAM,OAAO,MAAM,QAAQ,OAAO,QAAQ,MAAM,WAAqB;AACrE,gBAAM,SAAS;AAAA,YACb,aAAa,MAAM;AAAA,YACnB,cAAc,MAAM;AAAA,YACpB,WAAW,KAAK,OAAQ,MAAM,uBAAkC,KAAK,IAAI,KAAK,GAAI;AAAA,YAClF,WAAW;AAAA,UACb;AACA,gBAAM,OAAO,SAAS,MAAM,MAAM;AAAA,QACpC,QAAQ;AAAA,QAER;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAAA,IACA,SAAS,cAAc;AAAA,EACzB;AAKA,SAAO,SAAS;AAAA,IACd,WAAW,CAAC,QAAiB;AAAA,IAC7B;AAAA,IACA,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,WAAW,OAAO,aAAa;AAAA,IAC/B,SAAS,EAAE,UAAU,MAAe;AAAA,IACpC,OAAO;AAAA,MACL,QAAQ,OAAO,cAAc;AAAA,MAC7B,OAAO,OAAO,aAAa;AAAA,IAC7B;AAAA,EACF,CAAC;AACH;;;AChFA,eAAsB,WAAW,QAAqD;AACpF,QAAM,UAAU,MAAM,OAAO;AAC7B,MAAI,CAAC,SAAS,YAAa,QAAO;AAClC,SAAO,EAAE,aAAa,QAAQ,aAAa,MAAM,QAAQ,KAAK;AAChE;AAUA,eAAsB,eACpB,QACA,YAC8B;AAC9B,QAAM,UAAU,MAAM,WAAW,MAAM;AACvC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR,aACI,yCAAyC,UAAU,KACnD;AAAA,MACJ,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAQA,eAAsB,eAAe,QAAwC;AAC3E,QAAM,UAAU,MAAM,OAAO;AAC7B,SAAO,SAAS,eAAe;AACjC;","names":[]}