@dehwyyy/auth 1.0.7 → 2.0.0

package/README.md

@@ -0,0 +1,185 @@
+# @dehwyyy/auth
+
+Browser-side OIDC auth client for the Paylonium SPAs. Talks directly to Zitadel
+using Authorization Code + PKCE (S256). No backend auth proxy.
+
+- ESM only, single runtime dependency: `openapi-fetch`.
+- PKCE via WebCrypto (no extra deps).
+- Tokens in `localStorage` (`accessToken` / `refreshToken` / `idToken`).
+- PKCE `verifier` / `state` / `returnTo` in `sessionStorage`.
+- Refresh-token rotation with single-flight and cross-tab compare-and-clear.
+- Vue Router guard with role checks and an OIDC-callback anti-loop.
+
+## Install
+
+```bash
+bun add @dehwyyy/auth
+```
+
+Both `@dehwyyy/auth` and `@dehwyyy/auth/v2` resolve to the same v2 entrypoint.
+
+## Configuration
+
+```ts
+import type { ZitadelConfig } from "@dehwyyy/auth"
+
+const config: ZitadelConfig = {
+  issuer: "https://core.auth.my-paylonium.com",
+  clientId: "376852297126373720",
+  redirectUri: window.location.origin + "/auth/callback",
+  postLogoutRedirectUri: window.location.origin + "/",
+  // scopes is optional; this is the default:
+  // ["openid","profile","email","offline_access",
+  //  "urn:zitadel:iam:org:projects:roles","urn:zitadel:iam:user:metadata"]
+}
+```
+
+## Wiring with `createAuth`
+
+`createAuth` is the single wiring entry point. It builds the refresh client, the
+authenticated API client (access-token attach + auto-refresh on 401), the
+services, and a `MiddlewareBuilder` you can reuse for your own API clients.
+
+```ts
+import { createAuth } from "@dehwyyy/auth"
+
+export const auth = createAuth(config)
+// auth.authService      — Login / HandleCallback / GetMe / Logout
+// auth.baseAuthService  — Refresh / RequestWithAccessToken
+// auth.middlewareBuilder — for wiring your own openapi-fetch clients
+// auth.callbackPath     — derived from config.redirectUri (e.g. "/auth/callback")
+```
+
+Reuse the middleware for your domain API client:
+
+```ts
+import createClient from "openapi-fetch"
+import type { paths } from "./api/schema"
+
+export const api = createClient<paths>({ baseUrl: import.meta.env.VITE_API_URL })
+api.use(...auth.middlewareBuilder.buildDefault())
+```
+
+## Login
+
+```ts
+// returnTo is optional; pass the path you want to land on after auth.
+await auth.authService.Login(router.currentRoute.value.fullPath)
+// redirects the browser to Zitadel's /oauth/v2/authorize
+```
+
+## Callback page
+
+Mount this on `config.redirectUri` (e.g. `/auth/callback`). It performs the
+token exchange, fetches the user, and redirects to `returnTo`.
+
+```vue
+<script setup lang="ts">
+import { onMounted } from "vue"
+import { useRouter } from "vue-router"
+import { CallbackError } from "@dehwyyy/auth"
+import { auth } from "@/auth"
+
+const router = useRouter()
+
+onMounted(async () => {
+  try {
+    const { returnTo } = await auth.authService.HandleCallback()
+    // returnTo is already same-origin/relative-validated by the library
+    // (a foreign origin is dropped to null), so it is safe to navigate to.
+    await router.replace(returnTo ?? "/")
+  } catch (e) {
+    if (e instanceof CallbackError) {
+      // e.code: "state_mismatch" | "verifier_missing" | "code_missing" | "exchange_failed"
+      console.error("auth callback failed:", e.code)
+    }
+    await router.replace("/")
+  }
+})
+</script>
+
+<template>
+  <div>Signing you in…</div>
+</template>
+```
+
+`HandleCallback` is idempotent per authorization code: a double mount (Vue dev
+StrictMode) or an F5 on the callback URL reuses the in-flight/resolved exchange
+instead of failing with a state mismatch.
+
+## Route guard
+
+```ts
+import { RouterAuthGuard } from "@dehwyyy/auth"
+import { auth } from "@/auth"
+
+const guard = new RouterAuthGuard(auth.authService, {
+  callbackPath: auth.callbackPath,         // required — only this route may carry ?code&state
+  fallbackPage: "/forbidden",
+  baseServiceURL: window.location.origin,
+  onGetMe: (user) => { /* hydrate your store */ },
+  // cacheTTL is optional, defaults to 15000 (ms)
+})
+
+router.beforeEach(guard.Authorized(["ADMIN", "DEV"]))   // require one of these roles
+// or guard.Authorized() to require only authentication
+// or guard.Unauthorized([{ to: "/dashboard", roles: ["MERCHANT"] }]) on public pages
+```
+
+Security note: the guard only treats a navigation as the OIDC callback when the
+target path equals `callbackPath` **and** `code`+`state` are present. Appending
+`?code&state` to any other protected route does not bypass the guard.
+
+## Logout
+
+```ts
+await auth.authService.Logout()
+// clears tokens and redirects to Zitadel /oidc/v1/end_session
+```
+
+## Composability (without `createAuth`)
+
+The pieces remain individually exported for custom wiring:
+`AuthService`, `BaseAuthService`, `ClientBuilder`, `ClientInstance`,
+`MiddlewareBuilder`, `CreateAuthClientInstance`, `BaseAuthClientInstance`,
+`RouterAuthGuard`, `CallbackError`, plus types
+`ZitadelConfig`, `GetMeResponse`, `VerboseUserInfo`, `HandleCallbackResult`,
+`RouteLocation`, `CallbackErrorCode`, `Auth`.
+
+### Footgun: `BaseAuthClientInstance` is a process-wide singleton
+
+`BaseAuthClientInstance(issuer)` caches its client on first call — the first
+`issuer` wins for the module's lifetime, and later calls with a different issuer
+return the original client. For a single-issuer SPA this is fine. If you need
+multiple issuers (or isolated instances in tests), use `createAuth` instead,
+which constructs fresh clients each call.
+
+## GetMe response shape
+
+```ts
+type GetMeResponse = {
+  user_id: string
+  roles: string[]    // keys of the Zitadel project-roles claim
+  active: boolean     // always true when a userinfo response is returned
+  info?: {            // populated only when verbose
+    username?: string
+    email?: string
+    email_verified?: boolean
+    name?: string
+    picture?: string
+  }
+}
+```
+
+## Development
+
+```bash
+bun install
+bun run gen     # regenerate src/v2/pkg/types/schema.d.ts from spec/zitadel-oidc.yaml
+bun run build   # tsc + tsc-alias (full-path ESM resolution)
+bun test
+```
+
+The OIDC surface (`/oauth/v2/token`, `/oidc/v1/userinfo`, `/oidc/v1/end_session`)
+is described in `spec/zitadel-oidc.yaml`; all schema types are generated from it
+via `openapi-typescript`. Do not hand-edit `schema.d.ts`.

package/dist/v2/auth/client/baseClient.d.ts

@@ -1,2 +1,2 @@
-import { HttpAuthClient } from '../../../v2/pkg/types';
-export declare const BaseAuthClientInstance: (baseUrl: string) => HttpAuthClient;
+import { HttpAuthClient } from '../../../v2/pkg/types/index.js';
+export declare const BaseAuthClientInstance: (issuer: string) => HttpAuthClient;

package/dist/v2/auth/client/baseClient.js

@@ -1,10 +1,13 @@
+import { normalizeIssuer } from '../../../v2/pkg/url/index.js';
 import createClient from 'openapi-fetch';
 let baseClient = null;
-export const BaseAuthClientInstance = (baseUrl) => {
+// NOTE: process-wide singleton — the first issuer wins for the lifetime of the
+// module. Re-calling with a different issuer returns the original client. Fine
+// for the single-issuer SPA setups this package targets; see README footgun.
+export const BaseAuthClientInstance = (issuer) => {
     if (!baseClient) {
         baseClient = createClient({
-            baseUrl,
-            credentials: 'include',
+            baseUrl: normalizeIssuer(issuer),
         });
     }
     return baseClient;

package/dist/v2/auth/client/client.d.ts

@@ -1,3 +1,3 @@
-import { BaseAuthService } from "../../../v2/pkg/types";
+import { BaseAuthService } from "../../../v2/pkg/types/index.js";
 import { paths } from "@dehwyyy/auth/v2/pkg/types/schema";
-export declare const CreateAuthClientInstance: (baseURL: string, baseAuthService: BaseAuthService) => import("openapi-fetch").Client<paths, `${string}/${string}`>;
+export declare const CreateAuthClientInstance: (issuer: string, baseAuthService: BaseAuthService, fetchImpl?: typeof fetch) => import("openapi-fetch").Client<paths, `${string}/${string}`>;

package/dist/v2/auth/client/client.js

@@ -1,7 +1,7 @@
-import { ClientBuilder, MiddlewareBuilder } from "../../../v2/client";
-export const CreateAuthClientInstance = (baseURL, baseAuthService) => new ClientBuilder().
-    withMiddleware(...new MiddlewareBuilder(baseAuthService).buildDefault()).
+import { ClientBuilder, MiddlewareBuilder } from "../../../v2/client/index.js";
+import { normalizeIssuer } from "../../../v2/pkg/url/index.js";
+export const CreateAuthClientInstance = (issuer, baseAuthService, fetchImpl = fetch) => new ClientBuilder().
+    withMiddleware(...new MiddlewareBuilder(baseAuthService, fetchImpl).buildDefault()).
     build({
-    baseUrl: baseURL,
-    credentials: 'include',
+    baseUrl: normalizeIssuer(issuer),
 });

package/dist/v2/auth/client/index.d.ts

@@ -1,3 +1,3 @@
-import { BaseAuthClientInstance } from "../../../v2/auth/client/baseClient";
-import { CreateAuthClientInstance } from "../../../v2/auth/client/client";
+import { BaseAuthClientInstance } from "../../../v2/auth/client/baseClient.js";
+import { CreateAuthClientInstance } from "../../../v2/auth/client/client.js";
 export { BaseAuthClientInstance, CreateAuthClientInstance };

package/dist/v2/auth/client/index.js

@@ -1,3 +1,3 @@
-import { BaseAuthClientInstance } from "../../../v2/auth/client/baseClient";
-import { CreateAuthClientInstance } from "../../../v2/auth/client/client";
+import { BaseAuthClientInstance } from "../../../v2/auth/client/baseClient.js";
+import { CreateAuthClientInstance } from "../../../v2/auth/client/client.js";
 export { BaseAuthClientInstance, CreateAuthClientInstance };

package/dist/v2/auth/factory.d.ts

@@ -0,0 +1,20 @@
+import { BaseAuthService } from "../../v2/auth/service/baseService.js";
+import { AuthService } from "../../v2/auth/service/service.js";
+import { MiddlewareBuilder } from "../../v2/client/index.js";
+import { ZitadelConfig } from "../../v2/pkg/types/index.js";
+export type Auth = {
+    authService: AuthService;
+    baseAuthService: BaseAuthService;
+    middlewareBuilder: MiddlewareBuilder;
+    callbackPath: string;
+};
+/**
+ * Single wiring entry point for the three SPA frontends. Builds:
+ *  - a bare token client for refresh (no auto-refresh middleware to avoid
+ *    a refresh -> 401 -> refresh loop),
+ *  - the BaseAuthService driving that client,
+ *  - an authenticated client (access token attach + auto-refresh on 401),
+ *  - the AuthService over it,
+ *  - a MiddlewareBuilder for callers wiring their own API clients.
+ */
+export declare function createAuth(config: ZitadelConfig, fetchImpl?: typeof fetch): Auth;

package/dist/v2/auth/factory.js

@@ -0,0 +1,31 @@
+import { BaseAuthService } from "../../v2/auth/service/baseService.js";
+import { AuthService } from "../../v2/auth/service/service.js";
+import { ClientBuilder, MiddlewareBuilder } from "../../v2/client/index.js";
+import { normalizeIssuer, pathnameOf } from "../../v2/pkg/url/index.js";
+import createClient from "openapi-fetch";
+/**
+ * Single wiring entry point for the three SPA frontends. Builds:
+ *  - a bare token client for refresh (no auto-refresh middleware to avoid
+ *    a refresh -> 401 -> refresh loop),
+ *  - the BaseAuthService driving that client,
+ *  - an authenticated client (access token attach + auto-refresh on 401),
+ *  - the AuthService over it,
+ *  - a MiddlewareBuilder for callers wiring their own API clients.
+ */
+export function createAuth(config, fetchImpl = fetch) {
+    const issuer = normalizeIssuer(config.issuer);
+    const normalizedConfig = { ...config, issuer };
+    const tokenClient = createClient({ baseUrl: issuer });
+    const baseAuthService = new BaseAuthService(tokenClient, normalizedConfig);
+    const middlewareBuilder = new MiddlewareBuilder(baseAuthService, fetchImpl);
+    const authClient = new ClientBuilder()
+        .withMiddleware(...middlewareBuilder.buildDefault())
+        .build({ baseUrl: issuer });
+    const authService = new AuthService(baseAuthService, authClient, normalizedConfig);
+    return {
+        authService,
+        baseAuthService,
+        middlewareBuilder,
+        callbackPath: pathnameOf(config.redirectUri),
+    };
+}

package/dist/v2/auth/service/baseService.d.ts

@@ -1,12 +1,9 @@
-import { HttpAuthClient, BaseAuthService as IBaseAuthService } from "../../../v2/pkg/types";
+import { HttpAuthClient, BaseAuthService as IBaseAuthService, ZitadelConfig } from "../../../v2/pkg/types/index.js";
 export declare class BaseAuthService implements IBaseAuthService {
     private httpAuthClient;
+    private config;
     private refreshPromise;
-    constructor(httpAuthClient: HttpAuthClient);
-    /**
-     * @description Refresh access token
-     * @returns  `accessToken` -> refresh ok. `null` -> refresh failed
-     **/
+    constructor(httpAuthClient: HttpAuthClient, config: ZitadelConfig);
     private doRefresh;
     Refresh(): Promise<string | null>;
     RequestWithAccessToken(req: Request, token?: string | null): Request;

package/dist/v2/auth/service/baseService.js

@@ -1,29 +1,57 @@
-import { Storage, StorageKey } from "../../../v2/pkg/localStorage";
+import { Storage, StorageKey } from "../../../v2/pkg/localStorage/index.js";
 export class BaseAuthService {
     httpAuthClient;
-    // @Info Holds the current refresh promise
-    // @Returns the new access token or null
+    config;
     refreshPromise = null;
-    constructor(httpAuthClient) {
+    constructor(httpAuthClient, config) {
         this.httpAuthClient = httpAuthClient;
+        this.config = config;
     }
-    /**
-     * @description Refresh access token
-     * @returns  `accessToken` -> refresh ok. `null` -> refresh failed
-     **/
     async doRefresh() {
-        const { data, error } = await this.httpAuthClient.POST('/auth/refresh');
-        if (error) {
-            console.error('Refresh error:', error);
-            Storage.Delete(StorageKey.ACCESS_TOKEN);
+        const refreshToken = Storage.Get(StorageKey.REFRESH_TOKEN);
+        if (!refreshToken) {
             return null;
         }
-        if (data?.accessToken) {
-            Storage.Set(StorageKey.ACCESS_TOKEN, data.accessToken);
-            return data.accessToken;
+        const body = new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+            client_id: this.config.clientId,
+        });
+        const scopes = this.config.scopes;
+        if (scopes && scopes.length > 0) {
+            body.set('scope', scopes.join(' '));
         }
-        Storage.Delete(StorageKey.ACCESS_TOKEN);
-        return null;
+        const { data, error } = await this.httpAuthClient.POST('/oauth/v2/token', {
+            body: body,
+            bodySerializer: () => body.toString(),
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        });
+        if (error || !data?.access_token) {
+            // Compare-and-clear: another tab may have already rotated the token while
+            // this request was in flight. Only drop stored credentials when they are
+            // still the ones we attempted with, and only for a hard auth failure.
+            const stored = Storage.Get(StorageKey.REFRESH_TOKEN);
+            const isInvalidGrant = error?.error === 'invalid_grant';
+            if (isInvalidGrant && stored === refreshToken) {
+                Storage.Delete(StorageKey.ACCESS_TOKEN);
+                Storage.Delete(StorageKey.REFRESH_TOKEN);
+                Storage.Delete(StorageKey.ID_TOKEN);
+                return null;
+            }
+            if (stored && stored !== refreshToken) {
+                // A concurrent refresh succeeded; reuse the freshly stored access token.
+                return Storage.Get(StorageKey.ACCESS_TOKEN);
+            }
+            return null;
+        }
+        Storage.Set(StorageKey.ACCESS_TOKEN, data.access_token);
+        if (data.refresh_token) {
+            Storage.Set(StorageKey.REFRESH_TOKEN, data.refresh_token);
+        }
+        if (data.id_token) {
+            Storage.Set(StorageKey.ID_TOKEN, data.id_token);
+        }
+        return data.access_token;
     }
     async Refresh() {
         if (!this.refreshPromise) {

package/dist/v2/auth/service/index.d.ts

@@ -1,3 +1,3 @@
-import { BaseAuthService } from "../../../v2/auth/service/baseService";
-import { AuthService } from "../../../v2/auth/service/service";
+import { BaseAuthService } from "../../../v2/auth/service/baseService.js";
+import { AuthService } from "../../../v2/auth/service/service.js";
 export { AuthService, BaseAuthService };

package/dist/v2/auth/service/index.js

@@ -1,3 +1,3 @@
-import { BaseAuthService } from "../../../v2/auth/service/baseService";
-import { AuthService } from "../../../v2/auth/service/service";
+import { BaseAuthService } from "../../../v2/auth/service/baseService.js";
+import { AuthService } from "../../../v2/auth/service/service.js";
 export { AuthService, BaseAuthService };

package/dist/v2/auth/service/service.d.ts

@@ -1,10 +1,19 @@
-import { BaseAuthService, GetMeResponse, HttpAuthClient, AuthService as IAuthService } from "../../../v2/pkg/types";
+import { BaseAuthService, GetMeResponse, HandleCallbackResult, HttpAuthClient, AuthService as IAuthService, ZitadelConfig } from "../../../v2/pkg/types/index.js";
+import { components } from "@dehwyyy/auth/v2/pkg/types/schema";
+type UserInfo = components["schemas"]["UserInfo"];
 export declare class AuthService implements IAuthService {
-    private baseAuthClient;
+    private baseAuthService;
     private authClient;
-    private loginUrl;
-    constructor(baseAuthClient: BaseAuthService, authClient: HttpAuthClient, loginUrl: string);
-    Login(callbackUrl: string, app: string): void;
+    private config;
+    private issuer;
+    private callbackByCode;
+    constructor(baseAuthService: BaseAuthService, authClient: HttpAuthClient, config: ZitadelConfig);
+    private scopes;
+    Login(returnTo?: string): Promise<void>;
+    HandleCallback(): Promise<HandleCallbackResult>;
+    private exchange;
+    GetMe(verbose?: boolean): Promise<GetMeResponse | null>;
     Logout(): Promise<void>;
-    GetMe(app: string, verbose?: boolean): Promise<GetMeResponse | null>;
+    static mapUserInfo(claims: UserInfo, verbose: boolean): GetMeResponse;
 }
+export {};

package/dist/v2/auth/service/service.js

@@ -1,48 +1,162 @@
-import { Storage, StorageKey } from "../../../v2/pkg/localStorage";
+import { SessionKey, SessionStore, Storage, StorageKey } from "../../../v2/pkg/localStorage/index.js";
+import { CallbackError } from "../../../v2/pkg/errors/index.js";
+import { challengeS256, generateState, generateVerifier } from "../../../v2/pkg/pkce/index.js";
+import { normalizeIssuer, sanitizeReturnTo } from "../../../v2/pkg/url/index.js";
+const ROLES_CLAIM = "urn:zitadel:iam:org:project:roles";
+const DEFAULT_SCOPES = [
+    "openid",
+    "profile",
+    "email",
+    "offline_access",
+    "urn:zitadel:iam:org:projects:roles",
+    "urn:zitadel:iam:user:metadata",
+];
 export class AuthService {
-    baseAuthClient;
+    baseAuthService;
     authClient;
-    loginUrl;
-    constructor(baseAuthClient, authClient, loginUrl) {
-        this.baseAuthClient = baseAuthClient;
+    config;
+    issuer;
+    callbackByCode = new Map();
+    constructor(baseAuthService, authClient, config) {
+        this.baseAuthService = baseAuthService;
         this.authClient = authClient;
-        this.loginUrl = loginUrl;
+        this.config = config;
+        this.issuer = normalizeIssuer(config.issuer);
     }
-    Login(callbackUrl, app) {
-        window.location.href = `${this.loginUrl}?app=${app}&redirect_uri=${callbackUrl}`;
+    scopes() {
+        return (this.config.scopes ?? DEFAULT_SCOPES).join(" ");
     }
-    async Logout() {
-        Storage.Delete(StorageKey.ACCESS_TOKEN);
-        const { response, error } = await this.authClient.POST('/auth/logout');
-        if (error || !response.ok) {
-            console.error(error, response);
-            return Promise.reject(error);
+    async Login(returnTo) {
+        const verifier = generateVerifier();
+        const state = generateState();
+        const challenge = await challengeS256(verifier);
+        SessionStore.Set(SessionKey.PKCE_VERIFIER, verifier);
+        SessionStore.Set(SessionKey.PKCE_STATE, state);
+        if (returnTo) {
+            SessionStore.Set(SessionKey.RETURN_TO, returnTo);
+        }
+        else {
+            SessionStore.Delete(SessionKey.RETURN_TO);
+        }
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            redirect_uri: this.config.redirectUri,
+            response_type: "code",
+            scope: this.scopes(),
+            code_challenge: challenge,
+            code_challenge_method: "S256",
+            state,
+        });
+        location.assign(`${this.issuer}/oauth/v2/authorize?${params.toString()}`);
+    }
+    HandleCallback() {
+        const search = new URLSearchParams(location.search);
+        const code = search.get("code");
+        if (!code) {
+            return Promise.reject(new CallbackError("code_missing", "authorization code missing in callback"));
+        }
+        // Single-flight per authorization code: a double invocation (Vue dev double
+        // mount, manual refresh) reuses the in-flight/resolved exchange instead of
+        // re-running it and tripping a "state mismatch" on cleared session state.
+        const existing = this.callbackByCode.get(code);
+        if (existing) {
+            return existing;
+        }
+        const promise = this.exchange(code, search.get("state"));
+        this.callbackByCode.set(code, promise);
+        return promise;
+    }
+    async exchange(code, state) {
+        const storedState = SessionStore.Get(SessionKey.PKCE_STATE);
+        const verifier = SessionStore.Get(SessionKey.PKCE_VERIFIER);
+        const returnTo = sanitizeReturnTo(SessionStore.Get(SessionKey.RETURN_TO));
+        try {
+            if (!state || state !== storedState) {
+                throw new CallbackError("state_mismatch", "state mismatch in callback");
+            }
+            if (!verifier) {
+                throw new CallbackError("verifier_missing", "pkce verifier missing in callback");
+            }
+            const body = new URLSearchParams({
+                grant_type: "authorization_code",
+                code,
+                redirect_uri: this.config.redirectUri,
+                client_id: this.config.clientId,
+                code_verifier: verifier,
+            });
+            const { data, error } = await this.authClient.POST("/oauth/v2/token", {
+                body: body,
+                bodySerializer: () => body.toString(),
+                headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            });
+            if (error || !data?.access_token) {
+                throw new CallbackError("exchange_failed", "token exchange failed");
+            }
+            Storage.Set(StorageKey.ACCESS_TOKEN, data.access_token);
+            if (data.refresh_token) {
+                Storage.Set(StorageKey.REFRESH_TOKEN, data.refresh_token);
+            }
+            if (data.id_token) {
+                Storage.Set(StorageKey.ID_TOKEN, data.id_token);
+            }
+            const me = await this.GetMe(true);
+            return { me, returnTo };
+        }
+        finally {
+            SessionStore.Delete(SessionKey.PKCE_VERIFIER);
+            SessionStore.Delete(SessionKey.PKCE_STATE);
+            SessionStore.Delete(SessionKey.RETURN_TO);
         }
     }
-    async GetMe(app, verbose = false) {
+    async GetMe(verbose = false) {
         let token = Storage.Get(StorageKey.ACCESS_TOKEN);
         if (!token) {
-            token = await this.baseAuthClient.Refresh();
+            token = await this.baseAuthService.Refresh();
             if (!token) {
                 return null;
             }
         }
-        const { data, error } = await this.authClient.GET("/auth/me", {
-            params: {
-                query: {
-                    app,
-                    verbose: verbose ? "all" : "none",
-                }
-            }
-        });
+        const { data, error } = await this.authClient.GET("/oidc/v1/userinfo");
         if (error) {
-            console.error(error);
             return null;
         }
-        if (!data || !data.user_id) {
-            console.warn("Failed to get user info:", data);
+        if (!data || !data.sub) {
             return null;
         }
-        return data;
+        return AuthService.mapUserInfo(data, verbose);
+    }
+    async Logout() {
+        const idToken = Storage.Get(StorageKey.ID_TOKEN);
+        Storage.Delete(StorageKey.ACCESS_TOKEN);
+        Storage.Delete(StorageKey.REFRESH_TOKEN);
+        Storage.Delete(StorageKey.ID_TOKEN);
+        const params = new URLSearchParams();
+        if (idToken) {
+            params.set("id_token_hint", idToken);
+        }
+        const postLogout = this.config.postLogoutRedirectUri;
+        if (postLogout) {
+            params.set("post_logout_redirect_uri", postLogout);
+        }
+        location.assign(`${this.issuer}/oidc/v1/end_session?${params.toString()}`);
+    }
+    static mapUserInfo(claims, verbose) {
+        const rolesClaim = claims[ROLES_CLAIM] ?? {};
+        const roles = Object.keys(rolesClaim);
+        const me = {
+            user_id: claims.sub,
+            roles,
+            active: true,
+        };
+        if (verbose) {
+            me.info = {
+                username: claims.preferred_username,
+                email: claims.email,
+                email_verified: claims.email_verified,
+                name: claims.name,
+                picture: claims.picture,
+            };
+        }
+        return me;
     }
 }

package/dist/v2/client/builder/index.d.ts

@@ -1,2 +1,2 @@
-import { ClientBuilder } from "../../../v2/client/builder/builder";
+import { ClientBuilder } from "../../../v2/client/builder/builder.js";
 export { ClientBuilder };

package/dist/v2/client/builder/index.js

@@ -1,2 +1,2 @@
-import { ClientBuilder } from "../../../v2/client/builder/builder";
+import { ClientBuilder } from "../../../v2/client/builder/builder.js";
 export { ClientBuilder };

package/dist/v2/client/client.d.ts

@@ -1,13 +1,7 @@
-import createClient, { ClientOptions, Middleware as OpenAPIMiddleware } from "openapi-fetch";
+import createClient from "openapi-fetch";
 type Client = ReturnType<typeof createClient<{}>>;
 export declare class ClientInstance {
     private static map;
     New<T extends Client>(key: string, clientFactory: () => T): T;
 }
-export declare class ClientBuilder<OpenAPIClientDefinitions extends {}> {
-    private middlewares;
-    constructor();
-    withMiddleware(...middlewares: OpenAPIMiddleware[]): this;
-    build(opts: ClientOptions): ReturnType<typeof createClient<OpenAPIClientDefinitions>>;
-}
 export {};