Next.js quickstart

import { generateKeyPairSync } from 'node:crypto'// Run once on your machine. Ed25519 and P-256 are the two key types identity accepts.const { publicKey, privateKey } = generateKeyPairSync('ed25519')// The key id names this key in every client assertion you sign, and in the request to register it.export const kid = 'app-key-1'// Send this and the kid to whoever registers your client. It is public.export const publicJwk = { ...publicKey.export({ format: 'jwk' }), kid }// Keep this in your secret manager. It never leaves your infrastructure.export const privateJwk = privateKey.export({ format: 'jwk' })

import { createRelyingParty, importDpopKeyPair } from '@tdacorp/identity-sdk/rp'// Secrets come from your secret store, never from source. The values are placeholders.const clientKey = JSON.parse(process.env.TDAID_CLIENT_KEY_JWK ?? '{}')const dpopKey = JSON.parse(process.env.TDAID_DPOP_KEY_JWK ?? '{}')export const rp = createRelyingParty({  issuer: 'https://identity.tdacorp.in',  clientId: process.env.TDAID_CLIENT_ID ?? '',  redirectUri: 'https://app.example.com/api/auth/callback',  // The private half of the key whose public JWK was registered with the client.  key: { kid: process.env.TDAID_CLIENT_KID ?? '', privateKey: clientKey },  // Required for any client registered with require_dpop. Keep it stable: refresh tokens are bound to it.  dpop: await importDpopKeyPair(dpopKey),})

// app/api/auth/[action]/route.tsimport { signSession } from '@tdacorp/identity-sdk/sealed'import { createNextAuthHandlers } from '@tdacorp/identity-sdk/rp/next'import { rp } from './relying-party'const cookieSecret = process.env.APP_COOKIE_SECRET ?? '' // at least 32 bytes// One process only. A shared store replaces this when the app runs on several instances.const endedSessions = new Set<string>()export const { GET, POST } = createNextAuthHandlers({  rp,  appOrigin: 'https://app.example.com',  cookieSecret,  scope: 'openid profile email offline_access',  defaultReturnTo: '/dashboard',  // Runs after the SDK has checked the callback and verified the ID token.  onLogin: async (login) => {    // Persist login.tokens.refreshToken on your server before answering: it rotates on every refresh.    const session = await signSession(      { sub: login.idToken.sub, ...(login.idToken.sid === null ? {} : { sid: login.idToken.sid }) },      { secret: cookieSecret, ttlSeconds: 3600, purpose: 'app:session' },    )    return new Response(null, {      status: 303,      headers: {        location: login.redirectTo,        'set-cookie': `app_session=${session.value}; Path=/; Max-Age=${String(session.maxAge)}; HttpOnly; SameSite=Lax; Secure`,      },    })  },  logout: {    postLogoutRedirectUri: 'https://app.example.com/signed-out',    clearSessionCookies: () => ['app_session=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax; Secure'],  },  backchannelLogout: {    // Make this idempotent: the issuer retries when you answer with an error.    onLogout: (token) => {      if (token.sid !== null) endedSessions.add(token.sid)    },  },})