@broberg/sso 0.6.1 → 0.8.0

package/dist/hono.d.ts

@@ -162,6 +162,18 @@ interface SsoClaims extends JWTPayload {
 }
 interface LoginResult {
     claims: SsoClaims;
+    /**
+     * The claims in `claims` that came from the UNSIGNED userinfo response and
+     * not from the signed ID token (components-F084.51, since 0.8.0). Sorted; an
+     * empty list means everything in `claims` was signed (or userinfo was not
+     * reached). When both sources carry a claim, the signed token's value wins
+     * and the claim is not listed.
+     *
+     * On BID today this always contains "email" and "email_verified": the ID
+     * token does not carry them (measured by broberg-id, 20 Sep 2026). A decision
+     * that must rest on a signed identity binds on `claims.sub`, never on email.
+     */
+    unverifiedClaims: string[];
     idToken: string;
     accessToken?: string;
     refreshToken?: string;
@@ -291,6 +303,11 @@ interface SessionPayload {
      *  reference, so a changed picture propagates without every app storing a
      *  copy that then goes stale. */
     picture?: string;
+    /**
+     * Whether BID has verified `email` (F084.152). Absent when BID did not say.
+     * Bind access to an address only when this is `true`.
+     */
+    email_verified?: boolean;
 }
 
 /**
@@ -318,6 +335,15 @@ interface BackchannelOptions {
     onStoreError?: "reject" | "allow";
 }
 interface SsoRoutesOptions {
+    /**
+     * What «Log ud» in the app does (F084.152).
+     * "app" (default): end THIS app's session and send the user to BID's login
+     *   dialog (prompt=login). They stay signed in to BID — its own «Log ud» is
+     *   a separate action (decision D-376ffa) — and BID shows the dialog anyway.
+     * "central": the pre-0.7.0 behaviour — RP-initiated logout at BID's
+     *   end-session endpoint, which also ends the BID session.
+     */
+    logout?: "app" | "central";
     /**
      * Receive «Log ud overalt» from BID at POST <mount>/backchannel-logout.
      * Nothing arrives until BID has registered that URL for this app (ship dark),

package/dist/hono.js

@@ -358,18 +358,19 @@ function createSsoClient(config, options = {}) {
   }
   async function withUserInfo(claims, accessToken) {
     const doc = await discovery();
-    if (!doc.userinfo_endpoint) return claims;
+    if (!doc.userinfo_endpoint) return { claims, unverifiedClaims: [] };
     const res = await fetchImpl(doc.userinfo_endpoint, {
       headers: { authorization: `Bearer ${accessToken}` }
     });
-    if (!res.ok) return claims;
+    if (!res.ok) return { claims, unverifiedClaims: [] };
     const info = await res.json();
     if (info.sub !== claims.sub) {
       throw new SsoError(
         `userinfo describes ${String(info.sub)} but the ID token is for ${claims.sub} \u2014 refusing to merge another user's profile onto this session.`
       );
     }
-    return { ...claims, ...info, sub: claims.sub };
+    const unverifiedClaims = Object.keys(info).filter((k) => k !== "sub" && info[k] !== void 0 && !(k in claims)).sort();
+    return { claims: { ...info, ...claims, sub: claims.sub }, unverifiedClaims };
   }
   return {
     discovery,
@@ -441,8 +442,10 @@ function createSsoClient(config, options = {}) {
         );
       }
       const claims = await verifyIdToken(body.id_token, { nonce });
+      const merged = body.access_token ? await withUserInfo(claims, body.access_token) : { claims, unverifiedClaims: [] };
       return {
-        claims: body.access_token ? await withUserInfo(claims, body.access_token) : claims,
+        claims: merged.claims,
+        unverifiedClaims: merged.unverifiedClaims,
         idToken: body.id_token,
         ...body.access_token ? { accessToken: body.access_token } : {},
         ...body.refresh_token ? { refreshToken: body.refresh_token } : {}
@@ -678,7 +681,7 @@ function ssoRoutes(options = {}) {
   app.get("/login", async (c) => {
     const prompt = c.req.query("prompt");
     const start = await client.beginLogin(
-      prompt === "none" ? { prompt: "none" } : {}
+      prompt === "none" || prompt === "login" ? { prompt } : {}
     );
     const tx = JSON.stringify({
       state: start.state,
@@ -738,7 +741,9 @@ function ssoRoutes(options = {}) {
       iat: Math.floor(Date.now() / 1e3),
       ...result.claims.email ? { email: result.claims.email } : {},
       ...result.claims.name ? { name: result.claims.name } : {},
-      ...result.claims.picture ? { picture: result.claims.picture } : {}
+      ...result.claims.picture ? { picture: result.claims.picture } : {},
+      // Only when BID actually said so — absent means "not stated", never false.
+      ...typeof result.claims.email_verified === "boolean" ? { email_verified: result.claims.email_verified } : {}
     };
     c.header(
       "Set-Cookie",
@@ -776,6 +781,9 @@ function ssoRoutes(options = {}) {
       cookieHeader(idTokenCookie, "", { maxAge: 0, secure: isSecure(c) }),
       { append: true }
     );
+    if ((options.logout ?? "app") === "app") {
+      return c.redirect(`${loginPath}/login?prompt=login`, 302);
+    }
     return c.redirect(await client.logoutUrl(idTokenHint ? { idTokenHint } : {}), 302);
   });
   const attach = async (c, next) => {