@eminuckan/spine 0.2.2 → 0.3.0

package/dist/auth/types.d.ts

@@ -3,9 +3,10 @@
  */
 /**
  * Application Type
- * Determines logout behavior and error handling
+ * Describes app UX shape for login/error handling.
  */
 export type ApplicationType = 'no-landing-page' | 'landing-page' | 'dashboard' | 'tenant-app' | 'custom';
+export type OidcClientAuthMethod = 'none' | 'client_secret_post' | 'client_secret_basic';
 /**
  * OAuth Configuration
  */
@@ -13,32 +14,22 @@ export interface AuthConfig {
     authority: string;
     clientId: string;
     clientSecret?: string;
+    clientAuthMethod?: OidcClientAuthMethod;
     redirectUri: string;
     postLogoutRedirectUri?: string;
     scope: string;
     /**
-     * Application type - determines logout behavior
-     * - 'no-landing-page': No landing page, defaults to full SSO logout
-     * - 'landing-page': Has a landing page, defaults to app-specific logout
+     * Application type - determines landing/error handling only.
+     * Logout scope is request intent:
+     * - default `/auth/logout`: RP-Initiated Logout at the identity provider
+     * - `/auth/logout?logout=local`: application session cleanup only
+     *
+     * Aliases:
      * - 'dashboard': Legacy alias for 'no-landing-page'
      * - 'tenant-app': Legacy alias for 'landing-page'
-     * - 'custom': Use explicit ssoLogout setting
      * @default 'custom'
      */
     applicationType?: ApplicationType;
-    /**
-     * Whether to perform full SSO logout (clear identity cookie) or app-specific logout
-     * - true: Full logout - clears identity cookie, revokes all tokens
-     * - false: App-specific logout - keeps identity cookie, revokes only this app's tokens
-     *
-     * If not set, determined by applicationType:
-     * - 'no-landing-page': true (full logout)
-     * - 'landing-page': false (app-specific)
-     * - 'dashboard': true (legacy alias)
-     * - 'tenant-app': false (legacy alias)
-     * - 'custom': false (default)
-     */
-    ssoLogout?: boolean;
     /**
      * Whether the application has a landing page
      * - true: Has landing page - OAuth errors redirect to home, user sees landing
@@ -95,20 +86,57 @@ export interface OAuthState {
     codeVerifier: string;
     nonce?: string;
     returnUrl?: string;
+    /** Keycloak application initiated action requested for this authorization flow. */
+    kcAction?: string;
     createdAt: number;
 }
 /**
  * Session Data stored in Redis
  */
 export interface SessionData {
+    sessionId?: string;
     userId?: string;
     accessToken?: string;
     refreshToken?: string;
     idToken?: string;
     expiresAt?: number;
+    issuer?: string;
+    sid?: string;
+    sessionState?: string;
+    clientId?: string;
+    ipAddress?: string;
+    userAgent?: string;
     user?: UserInfo;
+    createdAt?: number;
     lastActivity?: number;
 }
+export interface AuthSessionSummary {
+    sessionId: string;
+    userId?: string;
+    email?: string;
+    name?: string;
+    issuer?: string;
+    sid?: string;
+    sessionState?: string;
+    clientId?: string;
+    ipAddress?: string;
+    userAgent?: string;
+    createdAt?: number;
+    lastActivity?: number;
+    expiresAt?: number;
+    isCurrent?: boolean;
+}
+export interface BackChannelLogoutResult {
+    destroyedSessions: number;
+    issuer?: string;
+    subject?: string;
+    sid?: string;
+}
+export interface FrontChannelLogoutResult {
+    destroyedSessions: number;
+    issuer?: string;
+    sid?: string;
+}
 /**
  * Session Flash Data for temporary messages
  */
@@ -134,19 +162,58 @@ export interface TokenRefreshResult {
 /**
  * Route protection levels
  */
-export type ProtectionLevel = 'public' | 'auth' | 'onboarding-required' | 'subscription-required';
+export type ProtectionLevel = 'public' | 'auth' | 'policy'
+/** @deprecated Use policy with configureRouteProtection instead. */
+ | 'onboarding-required'
+/** @deprecated Use policy with configureRouteProtection instead. */
+ | 'subscription-required';
 /**
  * Protected route loader function type
  */
 export type ProtectedLoaderFn<T> = (user?: UserInfo) => Promise<T> | T;
+export type PublicAuthorizationStateContext = Record<string, string | number | boolean | null | undefined>;
 /**
  * Login options
  */
 export interface LoginOptions {
     /** Return URL after successful login */
     returnUrl?: string;
-    /** OAuth prompt parameter (none, login, consent, select_account) */
-    prompt?: 'none' | 'login' | 'consent' | 'select_account';
+    /** OAuth prompt parameter (none, login, consent, select_account, create) */
+    prompt?: 'none' | 'login' | 'consent' | 'select_account' | 'create';
+    /**
+     * Additional authorization request parameters.
+     *
+     * Use this for safe provider hints: `login_hint`, `ui_locales`,
+     * `acr_values`, `kc_idp_hint`, or app-specific provider hints allowed by
+     * `extraAuthParamNames` / `extraAuthParamPrefixes`.
+     * Security-sensitive protocol parameters such as state, nonce, redirect_uri,
+     * scope, PKCE, prompt, and kc_action are managed by Spine and cannot be
+     * overridden.
+     */
+    extraAuthParams?: Record<string, string | number | boolean | null | undefined>;
+    /**
+     * Additional non-sensitive authorization parameter names allowed for this
+     * login request. Use this for app-specific identity-provider theme hints.
+     */
+    extraAuthParamNames?: string[];
+    /**
+     * Additional non-sensitive authorization parameter prefixes allowed for this
+     * login request. Prefixes should be narrow and app-owned.
+     */
+    extraAuthParamPrefixes?: string[];
+    /**
+     * Optional public, non-secret UI context appended to the OAuth state value.
+     * This exists for identity-provider themes that need display hints while the
+     * server still validates the full exact state value during callback handling.
+     */
+    publicStateContext?: PublicAuthorizationStateContext;
+    /**
+     * Keycloak application initiated action.
+     *
+     * Example: `webauthn-register` starts native passkey registration.
+     * This is Keycloak-specific and is ignored by non-Keycloak providers.
+     */
+    kcAction?: string;
 }
 /**
  * Auth error information from OAuth callback

package/dist/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,cAAc,GACd,WAAW,GACX,YAAY,GACZ,QAAQ,CAAC;AAEb;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IAEd;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAElC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,eAAe,GACvB,QAAQ,GACR,MAAM,GACN,qBAAqB,GACrB,uBAAuB,CAAC;AAE5B;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAEvE;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,gBAAgB,CAAC;CAC1D;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB,iBAAiB,GACjB,cAAc,GACd,WAAW,GACX,YAAY,GACZ,QAAQ,CAAC;AAEb,MAAM,MAAM,oBAAoB,GAC5B,MAAM,GACN,oBAAoB,GACpB,qBAAqB,CAAC;AAE1B;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IAEd;;;;;;;;;;OAUG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAElC;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,eAAe,GACvB,QAAQ,GACR,MAAM,GACN,QAAQ;AACV,oEAAoE;GAClE,qBAAqB;AACvB,oEAAoE;GAClE,uBAAuB,CAAC;AAE5B;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAEvE,MAAM,MAAM,+BAA+B,GAAG,MAAM,CAClD,MAAM,EACN,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAC7C,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,gBAAgB,GAAG,QAAQ,CAAC;IACpE;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAC/E;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,+BAA+B,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}