@classic-homes/auth 1.27.0 → 1.28.0

package/README.md

@@ -148,6 +148,27 @@ function handleSSOLogin(redirectUrl: string) {
 }
 ```
 
+`initiateSSOLogin` also sends a random `client_state`, kept in this tab's
+sessionStorage (single-use, 10-minute TTL). The API echoes it in the callback
+hash (`client_state`, in both the token and the MFA-challenge variants); check
+it **before** storing any tokens from the hash, so a crafted callback URL can't
+sign the user into someone else's account (login CSRF):
+
+```typescript
+import { verifySsoClientState } from '@classic-homes/auth/core';
+
+const params = new URLSearchParams(window.location.hash.slice(1));
+const { accepted, result } = verifySsoClientState(params); // 'ok' | 'mismatch' | 'missing'
+if (!accepted) {
+  window.history.replaceState({}, '', window.location.pathname);
+  throw new Error('This sign-in link was not started from this browser tab. Please sign in again.');
+}
+```
+
+Set `sso.requireClientState: true` once the API echoing `client_state` is
+deployed to that environment. Until then (the default) every result is
+accepted, so log `result` to watch the rollout.
+
 ### 5. MFA Challenge Verification
 
 ```typescript
@@ -395,6 +416,8 @@ interface AuthConfig {
     enabled: boolean;
     provider: string;
     authorizeUrl?: string;
+    /** Reject SSO callbacks whose client_state is missing or wrong (default false) */
+    requireClientState?: boolean;
   };
 
   /** Callback when auth errors occur */

package/dist/{auth.svelte-WROD55FW.js → auth.svelte-JLSRQJAC.js}

@@ -1,3 +1,3 @@
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-POOONCPP.js';
-import './chunk-FEKQXUPJ.js';
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-S3DNV7VV.js';
+import './chunk-GBYHYVXX.js';
 import './chunk-K6TV3ZVS.js';

package/dist/{chunk-FEKQXUPJ.js → chunk-GBYHYVXX.js}

@@ -1,4 +1,72 @@
-import { getUserRoles, getConfig, getStorage, isTokenExpired, getFetch, isValidRedirectUrl } from './chunk-K6TV3ZVS.js';
+import { isInitialized, getConfig, getUserRoles, getStorage, isTokenExpired, getFetch, isValidRedirectUrl } from './chunk-K6TV3ZVS.js';
+
+// src/core/sso-state.ts
+var SSO_CLIENT_STATE_PARAM = "client_state";
+var SSO_CLIENT_STATE_TTL_MS = 10 * 60 * 1e3;
+function storageKey() {
+  const prefix = isInitialized() ? getConfig().storageKey ?? "classic_auth" : "classic_auth";
+  return `${prefix}_sso_client_state`;
+}
+function sessionStore() {
+  try {
+    return typeof globalThis.sessionStorage === "undefined" ? null : globalThis.sessionStorage;
+  } catch {
+    return null;
+  }
+}
+function randomUrlSafe(byteLength) {
+  const bytes = new Uint8Array(byteLength);
+  globalThis.crypto.getRandomValues(bytes);
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function createSsoClientState() {
+  const store = sessionStore();
+  if (!store) return null;
+  const value = randomUrlSafe(32);
+  const entry = { value, createdAt: Date.now() };
+  try {
+    store.setItem(storageKey(), JSON.stringify(entry));
+  } catch {
+    return null;
+  }
+  return value;
+}
+function takeStored() {
+  const store = sessionStore();
+  if (!store) return null;
+  const key = storageKey();
+  try {
+    const raw = store.getItem(key);
+    store.removeItem(key);
+    if (!raw) return null;
+    const parsed = JSON.parse(raw);
+    if (typeof parsed?.value !== "string" || typeof parsed.createdAt !== "number") return null;
+    return { value: parsed.value, createdAt: parsed.createdAt };
+  } catch {
+    return null;
+  }
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+function consumeSsoClientState(received) {
+  const stored = takeStored();
+  if (!received) return "missing";
+  if (!stored) return "mismatch";
+  if (Date.now() - stored.createdAt > SSO_CLIENT_STATE_TTL_MS) return "mismatch";
+  return timingSafeEqual(stored.value, received) ? "ok" : "mismatch";
+}
+function verifySsoClientState(input) {
+  const received = input instanceof URLSearchParams ? input.get(SSO_CLIENT_STATE_PARAM) : input;
+  const result = consumeSsoClientState(received);
+  const required = isInitialized() && getConfig().sso?.requireClientState === true;
+  return { result, accepted: result === "ok" || !required };
+}
 
 // src/core/errors.ts
 var RoleDeniedError = class _RoleDeniedError extends Error {
@@ -59,8 +127,8 @@ function getRefreshToken() {
 }
 function getSessionTokenKey() {
   const config = getConfig();
-  const storageKey = config.storageKey ?? "classic_auth";
-  return `${storageKey}_session`;
+  const storageKey2 = config.storageKey ?? "classic_auth";
+  return `${storageKey2}_session`;
 }
 function getSessionToken() {
   const storage = getStorage();
@@ -72,22 +140,22 @@ function updateStoredTokens(accessToken, refreshToken) {
 function writeStoredTokens(accessToken, refreshToken) {
   const config = getConfig();
   const storage = getStorage();
-  const storageKey = config.storageKey ?? "classic_auth";
+  const storageKey2 = config.storageKey ?? "classic_auth";
   let parsed = {};
   try {
-    const authData = storage.getItem(storageKey);
+    const authData = storage.getItem(storageKey2);
     if (authData) parsed = JSON.parse(authData);
   } catch {
   }
   parsed.accessToken = accessToken;
   parsed.refreshToken = refreshToken;
-  storage.setItem(storageKey, JSON.stringify(parsed));
+  storage.setItem(storageKey2, JSON.stringify(parsed));
   config.onTokenRefresh?.({ accessToken, refreshToken });
   return syncSvelteStore((authStore) => authStore.updateTokens(accessToken, refreshToken));
 }
 async function syncSvelteStore(apply) {
   try {
-    const { authStore } = await import('./auth.svelte-WROD55FW.js');
+    const { authStore } = await import('./auth.svelte-JLSRQJAC.js');
     apply(authStore);
   } catch {
   }
@@ -150,8 +218,8 @@ async function refreshOnce(refreshToken) {
 function withRefreshLock(fn) {
   const locks = typeof navigator !== "undefined" ? navigator.locks : void 0;
   if (!locks) return fn();
-  const storageKey = getConfig().storageKey ?? "classic_auth";
-  return locks.request(`${storageKey}:refresh`, fn);
+  const storageKey2 = getConfig().storageKey ?? "classic_auth";
+  return locks.request(`${storageKey2}:refresh`, fn);
 }
 function refreshSession(options = {}) {
   if (options.onlyIfExpired) {
@@ -368,9 +436,9 @@ function initCrossTabSync() {
   if (typeof window === "undefined") return () => {
   };
   const config = getConfig();
-  const storageKey = config.storageKey ?? "classic_auth";
+  const storageKey2 = config.storageKey ?? "classic_auth";
   function handleStorage(event) {
-    if (event.key !== storageKey) return;
+    if (event.key !== storageKey2) return;
     void syncSvelteStore((authStore) => authStore.rehydrate());
   }
   window.addEventListener("storage", handleStorage);
@@ -481,6 +549,8 @@ var authApi = {
    * Initiate SSO login by redirecting to the SSO provider.
    * @param options.callbackUrl - The URL where the SSO provider should redirect after auth
    * @param options.redirectUrl - The final URL to redirect to after processing the callback
+   * Also sends a fresh `client_state` (kept in this tab's sessionStorage) that
+   * the callback page must check with `verifySsoClientState()`.
    * @throws Error if redirectUrl or callbackUrl fail validation
    */
   initiateSSOLogin(options) {
@@ -500,6 +570,10 @@ var authApi = {
     if (options?.redirectUrl) {
       params.set("redirect", options.redirectUrl);
     }
+    const clientState = createSsoClientState();
+    if (clientState) {
+      params.set(SSO_CLIENT_STATE_PARAM, clientState);
+    }
     const url = params.toString() ? `${authorizeUrl}?${params}` : authorizeUrl;
     window.location.href = url;
   },
@@ -904,4 +978,4 @@ var authApi = {
   }
 };
 
-export { InvalidAuthResponseError, RoleDeniedError, api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, refreshSession, updateStoredTokens };
+export { InvalidAuthResponseError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, refreshSession, updateStoredTokens, verifySsoClientState };

package/dist/{chunk-POOONCPP.js → chunk-S3DNV7VV.js}

@@ -1,4 +1,4 @@
-import { InvalidAuthResponseError, authApi } from './chunk-FEKQXUPJ.js';
+import { InvalidAuthResponseError, authApi } from './chunk-GBYHYVXX.js';
 import { isInitialized, getConfig, isValidSSOLogoutUrl, hasRole, hasAnyRole, hasAllRoles, decodeJWT, getStorage, getDefaultStorage } from './chunk-K6TV3ZVS.js';
 
 // src/svelte/stores/auth.svelte.ts

package/dist/{chunk-C2UTC5B7.js → chunk-TUWTOMZZ.js}

@@ -1,4 +1,4 @@
-import { authApi, InvalidAuthResponseError, RoleDeniedError } from './chunk-FEKQXUPJ.js';
+import { authApi, InvalidAuthResponseError, RoleDeniedError } from './chunk-GBYHYVXX.js';
 import { hasAnyRole, getUserRoles } from './chunk-K6TV3ZVS.js';
 
 // src/core/guards.ts
@@ -19,7 +19,7 @@ function getAvailableMethods(response) {
 async function setStoreAuth(response) {
   let store;
   try {
-    store = (await import('./auth.svelte-WROD55FW.js')).authStore;
+    store = (await import('./auth.svelte-JLSRQJAC.js')).authStore;
   } catch {
     return;
   }

package/dist/{chunk-JFWZUQGP.js → chunk-XUOSWSDO.js}

@@ -1,5 +1,5 @@
-import { authService } from './chunk-C2UTC5B7.js';
-import { authStore, currentUser, isAuthenticated, authActions } from './chunk-POOONCPP.js';
+import { authService } from './chunk-TUWTOMZZ.js';
+import { authStore, currentUser, isAuthenticated, authActions } from './chunk-S3DNV7VV.js';
 import { isInitialized, initAuth, getUserRoles } from './chunk-K6TV3ZVS.js';
 
 // src/svelte/guards/auth-guard.ts

package/dist/core/index.d.ts

@@ -1,6 +1,69 @@
-import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, p as User, j as ProfileUpdateData, C as ChangePasswordData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, U as UpdateApiKeyRequest, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, q as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination, r as UserRolesResponse } from '../types-D_5ze47z.js';
-export { a as AuthConfig, b as AuthState, l as ResetPasswordData, S as SSOConfig, o as StorageAdapter, s as createMemoryStorage, t as createSessionStorage, u as getConfig, v as getDefaultStorage, w as getFetch, x as getStorage, y as initAuth, z as isInitialized, B as resetConfig } from '../types-D_5ze47z.js';
-export { A as AuthService, I as InvalidAuthResponseError, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-Tc6yv4-Q.js';
+import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, p as User, j as ProfileUpdateData, C as ChangePasswordData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, U as UpdateApiKeyRequest, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, q as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination, r as UserRolesResponse } from '../types-B70Kgcc_.js';
+export { a as AuthConfig, b as AuthState, l as ResetPasswordData, S as SSOConfig, o as StorageAdapter, s as createMemoryStorage, t as createSessionStorage, u as getConfig, v as getDefaultStorage, w as getFetch, x as getStorage, y as initAuth, z as isInitialized, B as resetConfig } from '../types-B70Kgcc_.js';
+export { A as AuthService, I as InvalidAuthResponseError, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-DWEU-Ovm.js';
+
+/**
+ * SSO client state
+ *
+ * Binds an SSO callback to the browser tab that started the login. Before
+ * redirecting to `/auth/sso/authorize`, the tab generates a random
+ * `client_state`, keeps it in sessionStorage (per-tab, single-use, 10-minute
+ * TTL) and sends it along; the server echoes it back in the callback hash
+ * fragment (token and MFA-challenge variants alike). The callback page then
+ * calls `verifySsoClientState()` before trusting anything in the hash.
+ *
+ * Without this, an attacker could complete SSO for their own account and send
+ * the victim the resulting callback URL, silently signing the victim in as the
+ * attacker (login CSRF / session fixation).
+ */
+/** Hash-fragment (and authorize query) parameter carrying the client state. */
+declare const SSO_CLIENT_STATE_PARAM = "client_state";
+/** How long a stored client state stays valid. */
+declare const SSO_CLIENT_STATE_TTL_MS: number;
+/**
+ * Result of checking a callback's `client_state` against the one this tab stored:
+ * - `ok`: present and matches an unexpired stored value
+ * - `mismatch`: present but this tab stored none, it expired, or it differs
+ * - `missing`: the callback carried no `client_state`
+ */
+type SsoClientStateResult = 'ok' | 'mismatch' | 'missing';
+interface SsoClientStateVerification {
+    result: SsoClientStateResult;
+    /**
+     * Whether the callback may proceed: always for `ok`; for `missing` and
+     * `mismatch` only while `sso.requireClientState` is off (rollout mode).
+     */
+    accepted: boolean;
+}
+/**
+ * Generate a fresh client state and store it for this tab, replacing any
+ * earlier one. Returns `null` when sessionStorage is unavailable — sending a
+ * value the callback can't check would only produce a mismatch.
+ */
+declare function createSsoClientState(): string | null;
+/**
+ * Compare the `client_state` an SSO callback received with the one this tab
+ * stored, and consume the stored value (single-use) whatever the outcome.
+ * This is the raw check; `verifySsoClientState()` applies the
+ * `sso.requireClientState` policy on top.
+ */
+declare function consumeSsoClientState(received: string | null | undefined): SsoClientStateResult;
+/**
+ * Verify an SSO callback's `client_state` and decide whether to proceed.
+ * Accepts the received value, or the callback's parsed hash params.
+ *
+ * With `sso.requireClientState: true`, anything but `ok` is rejected. While it
+ * is off (the default, so apps can ship before the API echoes the value),
+ * every result is accepted — log `result` to watch the rollout.
+ *
+ * @example
+ * ```typescript
+ * const params = new URLSearchParams(window.location.hash.slice(1));
+ * const { accepted, result } = verifySsoClientState(params);
+ * if (!accepted) throw new Error(`SSO sign-in could not be verified (${result})`);
+ * ```
+ */
+declare function verifySsoClientState(input: string | URLSearchParams | null | undefined): SsoClientStateVerification;
 
 /**
  * HTTP Client
@@ -194,6 +257,8 @@ declare const authApi: {
      * Initiate SSO login by redirecting to the SSO provider.
      * @param options.callbackUrl - The URL where the SSO provider should redirect after auth
      * @param options.redirectUrl - The final URL to redirect to after processing the callback
+     * Also sends a fresh `client_state` (kept in this tab's sessionStorage) that
+     * the callback page must check with `verifySsoClientState()`.
      * @throws Error if redirectUrl or callbackUrl fail validation
      */
     initiateSSOLogin(options?: {
@@ -631,4 +696,4 @@ declare function hasAnyRole(user: Pick<User, 'roles'> | null | undefined, roles:
  */
 declare function hasAllRoles(user: Pick<User, 'roles'> | null | undefined, roles: readonly string[]): boolean;
 
-export { ApiKey, type ApiRequestOptions, type ApiResponse, ChangePasswordData, CreateApiKeyRequest, CreateApiKeyResponse, Device, type JWTPayload, LinkedAccount, LoginCredentials, LoginResponse, LogoutResponse, MFAChallengeData, MFASetupResponse, MFAStatus, Pagination, ProfileUpdateData, ROLE_HIERARCHY, ROLE_NAMES, type RefreshOutcome, type RefreshSessionOptions, RegisterData, RegisterResponse, type RoleName, SecurityEvent, Session, UpdateApiKeyRequest, User, UserPreferences, UserRolesResponse, api, apiRequest, authApi, clearStoredAuth, computePrimaryRole, decodeJWT, extractClaims, extractData, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initCrossTabSync, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, refreshSession, updateStoredTokens };
+export { ApiKey, type ApiRequestOptions, type ApiResponse, ChangePasswordData, CreateApiKeyRequest, CreateApiKeyResponse, Device, type JWTPayload, LinkedAccount, LoginCredentials, LoginResponse, LogoutResponse, MFAChallengeData, MFASetupResponse, MFAStatus, Pagination, ProfileUpdateData, ROLE_HIERARCHY, ROLE_NAMES, type RefreshOutcome, type RefreshSessionOptions, RegisterData, RegisterResponse, type RoleName, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SecurityEvent, Session, type SsoClientStateResult, type SsoClientStateVerification, UpdateApiKeyRequest, User, UserPreferences, UserRolesResponse, api, apiRequest, authApi, clearStoredAuth, computePrimaryRole, consumeSsoClientState, createSsoClientState, decodeJWT, extractClaims, extractData, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initCrossTabSync, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, refreshSession, updateStoredTokens, verifySsoClientState };

package/dist/core/index.js

@@ -1,3 +1,3 @@
-export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from '../chunk-C2UTC5B7.js';
-export { InvalidAuthResponseError, RoleDeniedError, api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, refreshSession, updateStoredTokens } from '../chunk-FEKQXUPJ.js';
+export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from '../chunk-TUWTOMZZ.js';
+export { InvalidAuthResponseError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, refreshSession, updateStoredTokens, verifySsoClientState } from '../chunk-GBYHYVXX.js';
 export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-K6TV3ZVS.js';

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as ApiKey, a as AuthConfig, b as AuthState, C as ChangePasswordData, c as CreateApiKeyRequest, d as CreateApiKeyResponse, D as Device, L as LinkedAccount, e as LoginCredentials, f as LoginResponse, g as LogoutResponse, M as MFAChallengeData, h as MFASetupResponse, i as MFAStatus, P as Pagination, j as ProfileUpdateData, R as RegisterData, k as RegisterResponse, l as ResetPasswordData, S as SSOConfig, m as SecurityEvent, n as Session, o as StorageAdapter, U as UpdateApiKeyRequest, p as User, q as UserPreferences, r as UserRolesResponse, s as createMemoryStorage, t as createSessionStorage, u as getConfig, v as getDefaultStorage, w as getFetch, x as getStorage, y as initAuth, z as isInitialized, B as resetConfig } from './types-D_5ze47z.js';
-export { ApiRequestOptions, ApiResponse, JWTPayload, ROLE_HIERARCHY, ROLE_NAMES, RefreshOutcome, RefreshSessionOptions, RoleName, api, apiRequest, authApi, clearStoredAuth, computePrimaryRole, decodeJWT, extractClaims, extractData, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initCrossTabSync, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, refreshSession, updateStoredTokens } from './core/index.js';
-export { A as AuthService, I as InvalidAuthResponseError, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from './user-utils-Tc6yv4-Q.js';
+export { A as ApiKey, a as AuthConfig, b as AuthState, C as ChangePasswordData, c as CreateApiKeyRequest, d as CreateApiKeyResponse, D as Device, L as LinkedAccount, e as LoginCredentials, f as LoginResponse, g as LogoutResponse, M as MFAChallengeData, h as MFASetupResponse, i as MFAStatus, P as Pagination, j as ProfileUpdateData, R as RegisterData, k as RegisterResponse, l as ResetPasswordData, S as SSOConfig, m as SecurityEvent, n as Session, o as StorageAdapter, U as UpdateApiKeyRequest, p as User, q as UserPreferences, r as UserRolesResponse, s as createMemoryStorage, t as createSessionStorage, u as getConfig, v as getDefaultStorage, w as getFetch, x as getStorage, y as initAuth, z as isInitialized, B as resetConfig } from './types-B70Kgcc_.js';
+export { ApiRequestOptions, ApiResponse, JWTPayload, ROLE_HIERARCHY, ROLE_NAMES, RefreshOutcome, RefreshSessionOptions, RoleName, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SsoClientStateResult, SsoClientStateVerification, api, apiRequest, authApi, clearStoredAuth, computePrimaryRole, consumeSsoClientState, createSsoClientState, decodeJWT, extractClaims, extractData, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initCrossTabSync, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, refreshSession, updateStoredTokens, verifySsoClientState } from './core/index.js';
+export { A as AuthService, I as InvalidAuthResponseError, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from './user-utils-DWEU-Ovm.js';
 export { AuthClient, AuthGuardOptions, AuthGuardResult, AuthHookOptions, CreateAuthClientOptions, NavFilterOptions, RoleRestrictedItem, authActions, authStore, canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, currentUser, filterByAccess, filterNavSections, isAuthenticated, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './svelte/index.js';

package/dist/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-JFWZUQGP.js';
-export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from './chunk-C2UTC5B7.js';
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-POOONCPP.js';
-export { InvalidAuthResponseError, RoleDeniedError, api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, refreshSession, updateStoredTokens } from './chunk-FEKQXUPJ.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-XUOSWSDO.js';
+export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from './chunk-TUWTOMZZ.js';
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-S3DNV7VV.js';
+export { InvalidAuthResponseError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, refreshSession, updateStoredTokens, verifySsoClientState } from './chunk-GBYHYVXX.js';
 export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from './chunk-K6TV3ZVS.js';

package/dist/svelte/index.d.ts

@@ -1,7 +1,7 @@
-import { b as AuthState, p as User, a as AuthConfig } from '../types-D_5ze47z.js';
-export { y as initAuth, z as isInitialized } from '../types-D_5ze47z.js';
-import { a as authService } from '../user-utils-Tc6yv4-Q.js';
-export { I as InvalidAuthResponseError, R as RoleDeniedError, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-Tc6yv4-Q.js';
+import { b as AuthState, p as User, a as AuthConfig } from '../types-B70Kgcc_.js';
+export { y as initAuth, z as isInitialized } from '../types-B70Kgcc_.js';
+import { a as authService } from '../user-utils-DWEU-Ovm.js';
+export { I as InvalidAuthResponseError, R as RoleDeniedError, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-DWEU-Ovm.js';
 
 /**
  * Auth Store

package/dist/svelte/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-JFWZUQGP.js';
-export { formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials } from '../chunk-C2UTC5B7.js';
-export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-POOONCPP.js';
-export { InvalidAuthResponseError, RoleDeniedError, isRoleDeniedError } from '../chunk-FEKQXUPJ.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-XUOSWSDO.js';
+export { formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials } from '../chunk-TUWTOMZZ.js';
+export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-S3DNV7VV.js';
+export { InvalidAuthResponseError, RoleDeniedError, isRoleDeniedError } from '../chunk-GBYHYVXX.js';
 export { initAuth, isInitialized } from '../chunk-K6TV3ZVS.js';

package/dist/testing/index.d.ts

@@ -1,4 +1,4 @@
-import { p as User, D as Device, f as LoginResponse, m as SecurityEvent, n as Session, A as ApiKey, L as LinkedAccount, g as LogoutResponse, h as MFASetupResponse, i as MFAStatus, k as RegisterResponse, q as UserPreferences, o as StorageAdapter, b as AuthState, a as AuthConfig } from '../types-D_5ze47z.js';
+import { p as User, D as Device, f as LoginResponse, m as SecurityEvent, n as Session, A as ApiKey, L as LinkedAccount, g as LogoutResponse, h as MFASetupResponse, i as MFAStatus, k as RegisterResponse, q as UserPreferences, o as StorageAdapter, b as AuthState, a as AuthConfig } from '../types-B70Kgcc_.js';
 
 /**
  * User Fixtures

package/dist/{types-D_5ze47z.d.ts → types-B70Kgcc_.d.ts}

@@ -18,6 +18,14 @@ interface SSOConfig {
      * a logout URL anywhere else is dropped.
      */
     logoutOrigins?: string[];
+    /**
+     * Reject SSO callbacks whose `client_state` is missing or doesn't match the
+     * one this tab sent to the authorize endpoint (see `verifySsoClientState`).
+     * Default `false` for one release so apps can roll out before the API
+     * echoes `client_state`; turn it on once the API is deployed to that
+     * environment. It becomes the default in the next major.
+     */
+    requireClientState?: boolean;
 }
 interface StorageAdapter {
     getItem(key: string): string | null;

package/dist/{user-utils-Tc6yv4-Q.d.ts → user-utils-DWEU-Ovm.d.ts}

@@ -1,4 +1,4 @@
-import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, p as User, j as ProfileUpdateData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, U as UpdateApiKeyRequest, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, q as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination } from './types-D_5ze47z.js';
+import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, p as User, j as ProfileUpdateData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, U as UpdateApiKeyRequest, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, q as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination } from './types-B70Kgcc_.js';
 
 /**
  * Auth Service

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classic-homes/auth",
-  "version": "1.27.0",
+  "version": "1.28.0",
   "description": "Authentication services and Svelte bindings for Classic Theme apps",
   "type": "module",
   "main": "dist/index.js",