@atlasauth/js 0.4.0 → 0.5.0

package/dist/frontchannel-logout.d.ts

@@ -0,0 +1,45 @@
+/**
+ * OIDC Front-Channel Logout after a sign-out made in this browser.
+ *
+ * When a session signed in on this browser is revoked
+ * (`POST /v1/client/sessions/:id/revoke`), the Frontend API response lists
+ * `frontchannel_logout_urls`: the front-channel logout URLs (already carrying
+ * `iss` and `sid`) of the apps that used "Sign in with Atlas" through that
+ * session. Loading each one in a hidden iframe lets those apps clear their own
+ * sessions in this browser.
+ *
+ * Best-effort by design: it never throws, never blocks longer than `timeoutMs`,
+ * and is a no-op outside a browser (SSR, workers, native).
+ */
+export interface FrontChannelLogoutOptions {
+    /** Upper bound on how long sign-out waits for the frames. Default 5000 ms. */
+    timeoutMs?: number;
+}
+/** Options accepted by every browser SDK's `signOut()`. */
+export interface SignOutOptions {
+    /**
+     * Run OIDC Front-Channel Logout for the apps signed in with this session
+     * (hidden iframes, capped at 5 s). Default `true`; pass `false` to skip it.
+     */
+    frontchannel?: boolean;
+}
+/** The default wait for front-channel logout frames. */
+export declare const FRONTCHANNEL_LOGOUT_TIMEOUT_MS = 5000;
+/**
+ * Keep only the URLs safe to load: `https:` anywhere, `http:` only on a
+ * loopback host (local development). Anything else — other schemes, relative
+ * or malformed URLs, non-strings — is dropped.
+ */
+export declare function frontChannelLogoutUrls(urls: unknown): string[];
+/**
+ * Load each front-channel logout URL in a hidden iframe, then remove the frames
+ * once every one has loaded (or failed) or after `timeoutMs`, whichever comes
+ * first. Resolves in every case.
+ */
+export declare function runFrontChannelLogout(urls: unknown, options?: FrontChannelLogoutOptions): Promise<void>;
+/**
+ * Run front-channel logout from a Frontend API sign-out (`/revoke`) response.
+ * Accepts `undefined` (a failed request) and non-OK or non-JSON responses as
+ * no-ops; the body is read from a clone, so the caller can still consume it.
+ */
+export declare function runFrontChannelLogoutFromResponse(response: Response | null | undefined, options?: FrontChannelLogoutOptions): Promise<void>;

package/dist/frontchannel-logout.js

@@ -0,0 +1,130 @@
+"use strict";
+/**
+ * OIDC Front-Channel Logout after a sign-out made in this browser.
+ *
+ * When a session signed in on this browser is revoked
+ * (`POST /v1/client/sessions/:id/revoke`), the Frontend API response lists
+ * `frontchannel_logout_urls`: the front-channel logout URLs (already carrying
+ * `iss` and `sid`) of the apps that used "Sign in with Atlas" through that
+ * session. Loading each one in a hidden iframe lets those apps clear their own
+ * sessions in this browser.
+ *
+ * Best-effort by design: it never throws, never blocks longer than `timeoutMs`,
+ * and is a no-op outside a browser (SSR, workers, native).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FRONTCHANNEL_LOGOUT_TIMEOUT_MS = void 0;
+exports.frontChannelLogoutUrls = frontChannelLogoutUrls;
+exports.runFrontChannelLogout = runFrontChannelLogout;
+exports.runFrontChannelLogoutFromResponse = runFrontChannelLogoutFromResponse;
+/** The default wait for front-channel logout frames. */
+exports.FRONTCHANNEL_LOGOUT_TIMEOUT_MS = 5000;
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+/**
+ * Keep only the URLs safe to load: `https:` anywhere, `http:` only on a
+ * loopback host (local development). Anything else — other schemes, relative
+ * or malformed URLs, non-strings — is dropped.
+ */
+function frontChannelLogoutUrls(urls) {
+    if (!Array.isArray(urls))
+        return [];
+    const out = [];
+    for (const raw of urls) {
+        if (typeof raw !== 'string')
+            continue;
+        let url;
+        try {
+            url = new URL(raw);
+        }
+        catch {
+            continue;
+        }
+        const secure = url.protocol === 'https:';
+        const localDev = url.protocol === 'http:' && LOOPBACK_HOSTS.has(url.hostname);
+        if (secure || localDev)
+            out.push(url.href);
+    }
+    return out;
+}
+/**
+ * Load each front-channel logout URL in a hidden iframe, then remove the frames
+ * once every one has loaded (or failed) or after `timeoutMs`, whichever comes
+ * first. Resolves in every case.
+ */
+function runFrontChannelLogout(urls, options = {}) {
+    if (typeof document === 'undefined' || typeof window === 'undefined' || !document.body) {
+        return Promise.resolve();
+    }
+    const list = frontChannelLogoutUrls(urls);
+    if (list.length === 0)
+        return Promise.resolve();
+    const timeoutMs = options.timeoutMs ?? exports.FRONTCHANNEL_LOGOUT_TIMEOUT_MS;
+    return new Promise((resolve) => {
+        const frames = [];
+        let pending = list.length;
+        let done = false;
+        let timer;
+        const finish = () => {
+            if (done)
+                return;
+            done = true;
+            if (timer !== undefined)
+                clearTimeout(timer);
+            for (const frame of frames) {
+                try {
+                    frame.remove();
+                }
+                catch {
+                    /* already gone */
+                }
+            }
+            resolve();
+        };
+        const settle = () => {
+            pending -= 1;
+            if (pending <= 0)
+                finish();
+        };
+        timer = setTimeout(finish, timeoutMs);
+        for (const url of list) {
+            try {
+                const frame = document.createElement('iframe');
+                frame.style.display = 'none';
+                frame.setAttribute('aria-hidden', 'true');
+                frame.setAttribute('tabindex', '-1');
+                // Same sandbox as Atlas's own logout page and account pages (the
+                // documented contract): the frame keeps its origin, so the app's
+                // logout response can clear its cookies, but no scripts, navigation,
+                // popups or forms. Apps clear their session in the HTTP response.
+                frame.setAttribute('sandbox', 'allow-same-origin');
+                frame.addEventListener('load', settle, { once: true });
+                frame.addEventListener('error', settle, { once: true });
+                frame.src = url;
+                frames.push(frame);
+                document.body.appendChild(frame);
+            }
+            catch {
+                settle();
+            }
+        }
+    });
+}
+/**
+ * Run front-channel logout from a Frontend API sign-out (`/revoke`) response.
+ * Accepts `undefined` (a failed request) and non-OK or non-JSON responses as
+ * no-ops; the body is read from a clone, so the caller can still consume it.
+ */
+async function runFrontChannelLogoutFromResponse(response, options = {}) {
+    if (!response || !response.ok)
+        return;
+    let body;
+    try {
+        body = await response.clone().json();
+    }
+    catch {
+        return;
+    }
+    const urls = body?.frontchannel_logout_urls;
+    await runFrontChannelLogout(urls, options);
+}
+//# sourceMappingURL=frontchannel-logout.js.map

package/dist/frontchannel-logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontchannel-logout.js","sourceRoot":"","sources":["../src/frontchannel-logout.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AA0BH,wDAgBC;AAOD,sDAuDC;AAOD,8EAaC;AA5GD,wDAAwD;AAC3C,QAAA,8BAA8B,GAAG,IAAI,CAAC;AAEnD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,IAAa;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QACtC,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9E,IAAI,MAAM,IAAI,QAAQ;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CACnC,IAAa,EACb,UAAqC,EAAE;IAEvC,IAAI,OAAO,QAAQ,KAAK,WAAW,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,sCAA8B,CAAC;IAEtE,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,MAAM,GAAwB,EAAE,CAAC;QACvC,IAAI,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,KAAgD,CAAC;QACrD,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,IAAI,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB;gBACpB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,OAAO,IAAI,CAAC;gBAAE,MAAM,EAAE,CAAC;QAC7B,CAAC,CAAC;QACF,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC/C,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC;gBAC7B,KAAK,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;gBAC1C,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACrC,iEAAiE;gBACjE,iEAAiE;gBACjE,qEAAqE;gBACrE,kEAAkE;gBAClE,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;gBACnD,KAAK,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvD,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxD,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;gBAChB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,EAAE,CAAC;YACX,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,iCAAiC,CACrD,QAAqC,EACrC,UAAqC,EAAE;IAEvC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO;IACtC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAI,IAAsD,EAAE,wBAAwB,CAAC;IAC/F,MAAM,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC"}

package/dist/index.d.ts

@@ -13,5 +13,6 @@ export * from './reauth';
 export * from './connect';
 export * from './password-reset';
 export * from './check-session';
+export * from './frontchannel-logout';
 export * from './captcha';
 export { type AuthzClaims, type ProtectCondition, type ProtectOutcome, type ProtectReason, evaluate, hasFromClaims, protectFromClaims, ForbiddenError, ROLE_KEY_PATTERN, PERMISSION_KEY_PATTERN, isRoleKey, isPermissionKey, } from '@atlasauth/authz';

package/dist/index.js

@@ -30,6 +30,8 @@ __exportStar(require("./reauth"), exports);
 __exportStar(require("./connect"), exports);
 __exportStar(require("./password-reset"), exports);
 __exportStar(require("./check-session"), exports);
+// OIDC Front-Channel Logout after a browser sign-out.
+__exportStar(require("./frontchannel-logout"), exports);
 // §5 "captcha anywhere" — fetch the central widget config, render the provider
 // widget, and verify a solved token, all without hardcoding provider keys.
 __exportStar(require("./captcha"), exports);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/js",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "devDependencies": {