@broberg/sso 0.6.0 → 0.7.0

package/dist/hono.d.cts

@@ -291,6 +291,11 @@ interface SessionPayload {
      *  reference, so a changed picture propagates without every app storing a
      *  copy that then goes stale. */
     picture?: string;
+    /**
+     * Whether BID has verified `email` (F084.152). Absent when BID did not say.
+     * Bind access to an address only when this is `true`.
+     */
+    email_verified?: boolean;
 }
 
 /**
@@ -318,6 +323,15 @@ interface BackchannelOptions {
     onStoreError?: "reject" | "allow";
 }
 interface SsoRoutesOptions {
+    /**
+     * What «Log ud» in the app does (F084.152).
+     * "app" (default): end THIS app's session and send the user to BID's login
+     *   dialog (prompt=login). They stay signed in to BID — its own «Log ud» is
+     *   a separate action (decision D-376ffa) — and BID shows the dialog anyway.
+     * "central": the pre-0.7.0 behaviour — RP-initiated logout at BID's
+     *   end-session endpoint, which also ends the BID session.
+     */
+    logout?: "app" | "central";
     /**
      * Receive «Log ud overalt» from BID at POST <mount>/backchannel-logout.
      * Nothing arrives until BID has registered that URL for this app (ship dark),

package/dist/hono.d.ts

@@ -291,6 +291,11 @@ interface SessionPayload {
      *  reference, so a changed picture propagates without every app storing a
      *  copy that then goes stale. */
     picture?: string;
+    /**
+     * Whether BID has verified `email` (F084.152). Absent when BID did not say.
+     * Bind access to an address only when this is `true`.
+     */
+    email_verified?: boolean;
 }
 
 /**
@@ -318,6 +323,15 @@ interface BackchannelOptions {
     onStoreError?: "reject" | "allow";
 }
 interface SsoRoutesOptions {
+    /**
+     * What «Log ud» in the app does (F084.152).
+     * "app" (default): end THIS app's session and send the user to BID's login
+     *   dialog (prompt=login). They stay signed in to BID — its own «Log ud» is
+     *   a separate action (decision D-376ffa) — and BID shows the dialog anyway.
+     * "central": the pre-0.7.0 behaviour — RP-initiated logout at BID's
+     *   end-session endpoint, which also ends the BID session.
+     */
+    logout?: "app" | "central";
     /**
      * Receive «Log ud overalt» from BID at POST <mount>/backchannel-logout.
      * Nothing arrives until BID has registered that URL for this app (ship dark),

package/dist/hono.js

@@ -667,9 +667,8 @@ function ssoRoutes(options = {}) {
         return c.json({ error: "invalid_request", error_description: msg }, 400);
       }
       try {
-        if (await backchannel.store.useJti(verified.jti, verified.exp)) {
-          await backchannel.store.revokeSubBefore(verified.sub, verified.iat);
-        }
+        await backchannel.store.revokeSubBefore(verified.sub, verified.iat);
+        await backchannel.store.useJti(verified.jti, verified.exp);
       } catch {
         return c.json({ error: "store_unavailable" }, 503);
       }
@@ -679,7 +678,7 @@ function ssoRoutes(options = {}) {
   app.get("/login", async (c) => {
     const prompt = c.req.query("prompt");
     const start = await client.beginLogin(
-      prompt === "none" ? { prompt: "none" } : {}
+      prompt === "none" || prompt === "login" ? { prompt } : {}
     );
     const tx = JSON.stringify({
       state: start.state,
@@ -739,7 +738,9 @@ function ssoRoutes(options = {}) {
       iat: Math.floor(Date.now() / 1e3),
       ...result.claims.email ? { email: result.claims.email } : {},
       ...result.claims.name ? { name: result.claims.name } : {},
-      ...result.claims.picture ? { picture: result.claims.picture } : {}
+      ...result.claims.picture ? { picture: result.claims.picture } : {},
+      // Only when BID actually said so — absent means "not stated", never false.
+      ...typeof result.claims.email_verified === "boolean" ? { email_verified: result.claims.email_verified } : {}
     };
     c.header(
       "Set-Cookie",
@@ -777,6 +778,9 @@ function ssoRoutes(options = {}) {
       cookieHeader(idTokenCookie, "", { maxAge: 0, secure: isSecure(c) }),
       { append: true }
     );
+    if ((options.logout ?? "app") === "app") {
+      return c.redirect(`${loginPath}/login?prompt=login`, 302);
+    }
     return c.redirect(await client.logoutUrl(idTokenHint ? { idTokenHint } : {}), 302);
   });
   const attach = async (c, next) => {