@darkauth/client 1.22.2 → 1.23.1

package/README.md

@@ -72,7 +72,8 @@ setConfig({
   tokenStorage: 'memory',                  // Optional. Default 'memory'. Use 'localStorage' only for legacy flows.
   drkStorage: 'memory',                    // Optional. Default 'memory'. Use 'localStorage' only for explicit convenience mode.
   refreshMode: 'cookie',                   // Optional. Default 'cookie'. Use 'token' only for legacy refresh-token clients.
-  credentials: 'include'                   // Optional. Default 'include' for cookie refresh.
+  credentials: 'include',                  // Optional. Default 'include' for cookie refresh.
+  endSessionEndpoint: 'https://auth.example.com/api/logout' // Optional. Override the RP-initiated logout endpoint (otherwise read from discovery).
 });
 ```
 
@@ -106,7 +107,28 @@ Behavior:
 
 #### `logout(): void`
 
-Clears the in-memory session, callback state, PKCE verifier, ephemeral ZK key, and any explicitly configured legacy storage.
+Clears the in-memory session, callback state, PKCE verifier, ephemeral ZK key, and any explicitly configured legacy storage. This is a **local-only** logout — it does not end the DarkAuth SSO session, so a subsequent `initiateLogin()` may silently re-authenticate. Use `endSession()` when you need to end the IdP session too.
+
+#### `endSession(options?: EndSessionOptions): Promise<void>`
+
+Performs OIDC [RP-initiated logout](https://openid.net/specs/openid-connect-rpinitiated-1_0.html). Clears the local session (same as `logout()`) and then redirects the browser to DarkAuth's `end_session_endpoint`, which ends the SSO session and redirects back to your app.
+
+```typescript
+import { endSession } from '@DarkAuth/client';
+
+await endSession({
+  postLogoutRedirectUri: `${window.location.origin}/login`,
+  state: 'optional-csrf-value',
+});
+```
+
+Options (`EndSessionOptions`):
+- `postLogoutRedirectUri?`: Where DarkAuth redirects after ending the session. **Must be registered in the client's `post_logout_redirect_uris` allowlist** on the DarkAuth server (exact match), otherwise the request is rejected. When provided, the SDK also sends `client_id` (the configured `clientId` unless overridden).
+- `state?`: Opaque value echoed back on the post-logout redirect (use it to protect against CSRF / restore app state).
+- `idTokenHint?`: The ID token to send as `id_token_hint`. Defaults to the current session's ID token. With a valid hint DarkAuth ends the session without a confirmation prompt.
+- `clientId?`: Override the `client_id` sent alongside `post_logout_redirect_uri` (defaults to the configured `clientId`).
+
+The `end_session_endpoint` is resolved from the server's `/.well-known/openid-configuration` discovery document, falling back to `<issuer>/api/logout`, or to the `endSessionEndpoint` config value when set.
 
 #### `getStoredSession(): AuthSession | null`
 
@@ -300,6 +322,17 @@ type Config = {
   drkStorage?: 'memory' | 'localStorage';
   refreshMode?: 'cookie' | 'token';
   credentials?: RequestCredentials;
+  endSessionEndpoint?: string;
+}
+```
+
+### `EndSessionOptions`
+```typescript
+type EndSessionOptions = {
+  postLogoutRedirectUri?: string;
+  state?: string;
+  idTokenHint?: string;
+  clientId?: string;
 }
 ```
 

package/dist/index.d.ts

@@ -9,6 +9,7 @@ type Config = {
     zk?: boolean;
     authorizationEndpoint?: string;
     tokenEndpoint?: string;
+    endSessionEndpoint?: string;
     discovery?: boolean;
     firstParty?: boolean;
     tokenStorage?: "memory" | "localStorage";
@@ -60,6 +61,12 @@ export type SwitchOrganizationOptions = {
 export type RefreshSessionOptions = {
     force?: boolean;
 };
+export type EndSessionOptions = {
+    postLogoutRedirectUri?: string;
+    state?: string;
+    idTokenHint?: string;
+    clientId?: string;
+};
 export type DarkAuthSessionInfo = {
     authenticated: boolean;
     sub?: string;
@@ -94,4 +101,5 @@ export declare function listOrganizations(): Promise<DarkAuthOrganization[]>;
 export declare function getSessionInfo(): Promise<DarkAuthSessionInfo>;
 export declare function switchOrganization(organizationId: string, options?: SwitchOrganizationOptions): Promise<AuthSession | null>;
 export declare function logout(): void;
+export declare function endSession(options?: EndSessionOptions): Promise<void>;
 export declare function getCurrentUser(): JwtClaims | null;

package/dist/index.js

@@ -155,6 +155,7 @@ async function resolveEndpoints() {
         cfg.scope || "",
         cfg.authorizationEndpoint || "",
         cfg.tokenEndpoint || "",
+        cfg.endSessionEndpoint || "",
         cfg.discovery === false ? "0" : "1",
     ].join("|");
     if (endpointsInFlight && endpointsCacheKey === cacheKey)
@@ -164,8 +165,9 @@ async function resolveEndpoints() {
         const fallback = {
             authorizationEndpoint: cfg.authorizationEndpoint || rootEndpoint("/authorize"),
             tokenEndpoint: cfg.tokenEndpoint || rootEndpoint("/token"),
+            endSessionEndpoint: cfg.endSessionEndpoint || rootEndpoint("/api/logout"),
         };
-        if (cfg.authorizationEndpoint && cfg.tokenEndpoint)
+        if (cfg.authorizationEndpoint && cfg.tokenEndpoint && cfg.endSessionEndpoint)
             return fallback;
         if (cfg.discovery === false || typeof fetch !== "function")
             return fallback;
@@ -184,6 +186,10 @@ async function resolveEndpoints() {
                     (typeof metadata.token_endpoint === "string"
                         ? metadata.token_endpoint
                         : fallback.tokenEndpoint),
+                endSessionEndpoint: cfg.endSessionEndpoint ||
+                    (typeof metadata.end_session_endpoint === "string"
+                        ? metadata.end_session_endpoint
+                        : fallback.endSessionEndpoint),
             };
         }
         catch {
@@ -744,7 +750,7 @@ export async function switchOrganization(organizationId, options = {}) {
     location.assign(switchUrl.toString());
     return null;
 }
-export function logout() {
+function clearLocalSession() {
     memorySession = null;
     memoryRefreshToken = null;
     clearStoredIdToken();
@@ -755,6 +761,27 @@ export function logout() {
     sessionStorage.removeItem(OAUTH_STATE_KEY);
     localStorage.removeItem(REFRESH_TOKEN_KEY);
 }
+export function logout() {
+    clearLocalSession();
+}
+export async function endSession(options = {}) {
+    const idTokenHint = options.idTokenHint ||
+        memorySession?.idToken ||
+        (tokenStorageMode() === "localStorage" ? getStoredIdToken() : null) ||
+        undefined;
+    const endpoints = await resolveEndpoints();
+    const url = new URL(endpoints.endSessionEndpoint);
+    if (idTokenHint)
+        url.searchParams.set("id_token_hint", idTokenHint);
+    if (options.postLogoutRedirectUri) {
+        url.searchParams.set("post_logout_redirect_uri", options.postLogoutRedirectUri);
+        url.searchParams.set("client_id", options.clientId || cfg.clientId);
+    }
+    if (options.state)
+        url.searchParams.set("state", options.state);
+    clearLocalSession();
+    location.assign(url.toString());
+}
 export function getCurrentUser() {
     const idToken = memorySession?.idToken || (tokenStorageMode() === "localStorage" ? getStoredIdToken() : null);
     if (!idToken)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@darkauth/client",
-  "version": "1.22.2",
+  "version": "1.23.1",
   "license": "MIT",
   "repository": {
     "directory": "packages/darkauth-client",
@@ -25,7 +25,7 @@
   },
   "scripts": {
     "build": "tsc",
-    "test": "pnpm run build && node --test --test-reporter=dot --experimental-specifier-resolution=node",
+    "test": "tsc -p tsconfig.test.json && node --test --test-reporter=dot \".test-build/**/*.test.js\"",
     "typecheck": "tsc --noEmit",
     "format": "biome format --write .",
     "lint": "biome lint .",