@enterprisestandard/react 0.0.3-beta.3 → 0.0.5

package/dist/index.js

@@ -1,9 +1,287 @@
 // src/iam.ts
 async function iam(config) {
+  return {};
+}
+
+// src/oidc-schema.ts
+function oidcCallbackSchema(vendor) {
   return {
-    url: config.url,
-    userEndpoint: config.userEndpoint,
-    groupEndpoint: config.groupEndpoint
+    "~standard": {
+      version: 1,
+      vendor,
+      validate: (value) => {
+        if (typeof value !== "object" || value === null) {
+          return {
+            issues: [
+              {
+                message: "Expected an object"
+              }
+            ]
+          };
+        }
+        const params = value;
+        const issues = [];
+        const result = {};
+        if ("code" in params) {
+          if (typeof params.code === "string") {
+            result.code = params.code;
+          } else {
+            issues.push({
+              message: "code must be a string",
+              path: ["code"]
+            });
+          }
+        } else if (!("error" in params)) {
+          issues.push({
+            message: "code is required",
+            path: ["code"]
+          });
+        }
+        if ("state" in params) {
+          if (typeof params.state === "string" || params.state === undefined) {
+            result.state = params.state;
+          } else {
+            issues.push({
+              message: "state must be a string",
+              path: ["state"]
+            });
+          }
+        }
+        if ("session_state" in params) {
+          if (typeof params.session_state === "string" || params.session_state === undefined) {
+            result.session_state = params.session_state;
+          } else {
+            issues.push({
+              message: "session_state must be a string",
+              path: ["session_state"]
+            });
+          }
+        }
+        if ("error" in params) {
+          if (typeof params.error === "string") {
+            result.error = params.error;
+          } else {
+            issues.push({
+              message: "error must be a string",
+              path: ["error"]
+            });
+          }
+          if ("error_description" in params) {
+            if (typeof params.error_description === "string" || params.error_description === undefined) {
+              result.error_description = params.error_description;
+            } else {
+              issues.push({
+                message: "error_description must be a string",
+                path: ["error_description"]
+              });
+            }
+          }
+          if ("error_uri" in params) {
+            if (typeof params.error_uri === "string" || params.error_uri === undefined) {
+              result.error_uri = params.error_uri;
+            } else {
+              issues.push({
+                message: "error_uri must be a string",
+                path: ["error_uri"]
+              });
+            }
+          }
+        }
+        if ("iss" in params) {
+          if (typeof params.iss === "string" || params.iss === undefined) {
+            result.iss = params.iss;
+          } else {
+            issues.push({
+              message: "iss must be a string",
+              path: ["iss"]
+            });
+          }
+        }
+        if (issues.length > 0) {
+          return { issues };
+        }
+        return { value: result };
+      }
+    }
+  };
+}
+function tokenResponseSchema(vendor) {
+  return {
+    "~standard": {
+      version: 1,
+      vendor,
+      validate: (value) => {
+        if (typeof value !== "object" || value === null) {
+          return {
+            issues: [
+              {
+                message: "Expected an object"
+              }
+            ]
+          };
+        }
+        const response = value;
+        const issues = [];
+        const result = {};
+        if ("access_token" in response) {
+          if (typeof response.access_token === "string") {
+            result.access_token = response.access_token;
+          } else {
+            issues.push({
+              message: "access_token must be a string",
+              path: ["access_token"]
+            });
+          }
+        } else {
+          issues.push({
+            message: "access_token is required",
+            path: ["access_token"]
+          });
+        }
+        if ("id_token" in response) {
+          if (typeof response.id_token === "string") {
+            result.id_token = response.id_token;
+          } else {
+            issues.push({
+              message: "id_token must be a string",
+              path: ["id_token"]
+            });
+          }
+        } else {
+          issues.push({
+            message: "id_token is required",
+            path: ["id_token"]
+          });
+        }
+        if ("token_type" in response) {
+          if (typeof response.token_type === "string") {
+            result.token_type = response.token_type;
+          } else {
+            issues.push({
+              message: "token_type must be a string",
+              path: ["token_type"]
+            });
+          }
+        } else {
+          issues.push({
+            message: "token_type is required",
+            path: ["token_type"]
+          });
+        }
+        if ("refresh_token" in response) {
+          if (typeof response.refresh_token === "string" || response.refresh_token === undefined) {
+            result.refresh_token = response.refresh_token;
+          } else {
+            issues.push({
+              message: "refresh_token must be a string",
+              path: ["refresh_token"]
+            });
+          }
+        }
+        if ("scope" in response) {
+          if (typeof response.scope === "string" || response.scope === undefined) {
+            result.scope = response.scope;
+          } else {
+            issues.push({
+              message: "scope must be a string",
+              path: ["scope"]
+            });
+          }
+        }
+        if ("session_state" in response) {
+          if (typeof response.session_state === "string" || response.session_state === undefined) {
+            result.session_state = response.session_state;
+          } else {
+            issues.push({
+              message: "session_state must be a string",
+              path: ["session_state"]
+            });
+          }
+        }
+        if ("expires" in response) {
+          if (typeof response.expires === "string" || response.expires === undefined) {
+            result.expires = response.expires;
+          } else {
+            issues.push({
+              message: "expires must be a string",
+              path: ["expires"]
+            });
+          }
+        }
+        if ("expires_in" in response) {
+          if (typeof response.expires_in === "number" || response.expires_in === undefined) {
+            result.expires_in = response.expires_in;
+          } else {
+            issues.push({
+              message: "expires_in must be a number",
+              path: ["expires_in"]
+            });
+          }
+        }
+        if ("refresh_expires_in" in response) {
+          if (typeof response.refresh_expires_in === "number" || response.refresh_expires_in === undefined) {
+            result.refresh_expires_in = response.refresh_expires_in;
+          } else {
+            issues.push({
+              message: "refresh_expires_in must be a number",
+              path: ["refresh_expires_in"]
+            });
+          }
+        }
+        if (issues.length > 0) {
+          return { issues };
+        }
+        return { value: result };
+      }
+    }
+  };
+}
+function idTokenClaimsSchema(vendor) {
+  return {
+    "~standard": {
+      version: 1,
+      vendor,
+      validate: (value) => {
+        if (typeof value !== "object" || value === null) {
+          return {
+            issues: [
+              {
+                message: "Expected an object"
+              }
+            ]
+          };
+        }
+        const claims = value;
+        const issues = [];
+        const result = { ...claims };
+        const stringFields = ["iss", "aud", "sub", "sid", "name", "email", "preferred_username", "picture"];
+        for (const field of stringFields) {
+          if (field in claims && claims[field] !== undefined) {
+            if (typeof claims[field] !== "string") {
+              issues.push({
+                message: `${field} must be a string`,
+                path: [field]
+              });
+            }
+          }
+        }
+        const numberFields = ["exp", "iat"];
+        for (const field of numberFields) {
+          if (field in claims && claims[field] !== undefined) {
+            if (typeof claims[field] !== "number") {
+              issues.push({
+                message: `${field} must be a number`,
+                path: [field]
+              });
+            }
+          }
+        }
+        if (issues.length > 0) {
+          return { issues };
+        }
+        return { value: result };
+      }
+    }
   };
 }
 
@@ -34,10 +312,17 @@ var jwksCache = new Map;
 function sso(config) {
   const configWithDefaults = {
     ...config,
-    secure: config.secure !== undefined ? config.secure : false,
-    sameSite: config.sameSite !== undefined ? config.sameSite : "Lax",
-    cookiePrefix: config.cookiePrefix ?? `es.sso.${config.client_id}`,
-    cookiePath: config.cookiePath ?? "/"
+    authority: must(config.authority, "Missing 'authority' from SSO Config"),
+    token_url: must(config.token_url, "Missing 'token_url' from SSO Config"),
+    authorization_url: must(config.authorization_url, "Missing 'authorization_url' from SSO Config"),
+    client_id: must(config.client_id, "Missing 'client_id' from SSO Config"),
+    redirect_uri: must(config.redirect_uri, "Missing 'redirect_uri' from SSO Config"),
+    scope: must(config.scope, "Missing 'scope' from SSO Config"),
+    response_type: config.response_type ?? "code",
+    cookies_secure: config.cookies_secure !== undefined ? config.cookies_secure : true,
+    cookies_same_site: config.cookies_same_site !== undefined ? config.cookies_same_site : "Strict",
+    cookies_prefix: config.cookies_prefix ?? `es.sso.${config.client_id}`,
+    cookies_path: config.cookies_path ?? "/"
   };
   async function getUser(request) {
     if (!configWithDefaults) {
@@ -93,16 +378,123 @@ function sso(config) {
       }
     });
   }
-  async function callbackHandler(request) {
+  async function logout(request, _config) {
+    try {
+      const refreshToken2 = getCookie("refresh", request);
+      if (refreshToken2) {
+        await revokeToken(refreshToken2);
+      }
+    } catch (error) {
+      console.warn("Failed to revoke token:", error);
+    }
+    if (config.session_store) {
+      try {
+        const user = await getUser(request);
+        if (user?.sso?.profile.sid) {
+          const sid = user.sso.profile.sid;
+          await config.session_store.delete(sid);
+          console.log(`Session ${sid} deleted from store`);
+        }
+      } catch (error) {
+        console.warn("Failed to delete session:", error);
+      }
+    }
+    const clearHeaders = [
+      ["Set-Cookie", clearCookie("access")],
+      ["Set-Cookie", clearCookie("id")],
+      ["Set-Cookie", clearCookie("refresh")],
+      ["Set-Cookie", clearCookie("control")],
+      ["Set-Cookie", clearCookie("state")]
+    ];
+    const url = new URL(request.url);
+    const redirectTo = url.searchParams.get("redirect");
+    if (redirectTo) {
+      return new Response("Logged out", {
+        status: 302,
+        headers: [["Location", redirectTo], ...clearHeaders]
+      });
+    }
+    const accept = request.headers.get("accept");
+    const isAjax = accept?.includes("application/json") || accept?.includes("text/javascript");
+    if (isAjax) {
+      return new Response(JSON.stringify({ success: true, message: "Logged out" }), {
+        status: 200,
+        headers: [["Content-Type", "application/json"], ...clearHeaders]
+      });
+    } else {
+      return new Response(`
+          <!DOCTYPE html><html lang="en"><body>
+            <h1>Logout Complete</h1>
+            <div style="display: none">
+              It is not recommended to show the default logout page. Include '?redirect=/someHomePage' or logout asynchronously.
+              Check the <a href="https://EnterpriseStandard.com/sso#logout">Enterprise Standard Packages</a> for more information.
+            </div>
+          </body></html>
+        `, {
+        status: 200,
+        headers: [["Content-Type", "text/html"], ...clearHeaders]
+      });
+    }
+  }
+  async function logoutBackChannel(request) {
+    if (!configWithDefaults.session_store) {
+      return new Response("Back-Channel Logout requires session_store configuration", {
+        status: 400,
+        statusText: "Bad Request"
+      });
+    }
+    try {
+      const contentType = request.headers.get("content-type");
+      if (!contentType || !contentType.includes("application/x-www-form-urlencoded")) {
+        return new Response("Invalid Content-Type, expected application/x-www-form-urlencoded", {
+          status: 400
+        });
+      }
+      const body = await request.text();
+      const params = new URLSearchParams(body);
+      const logoutToken = params.get("logout_token");
+      if (!logoutToken) {
+        return new Response("Missing logout_token parameter", { status: 400 });
+      }
+      const claims = await parseJwt(logoutToken);
+      const sid = claims.sid;
+      if (!sid) {
+        console.warn("Back-Channel Logout: logout_token missing sid claim");
+        return new Response("Invalid logout_token: missing sid claim", { status: 400 });
+      }
+      await configWithDefaults.session_store.delete(sid);
+      console.log(`Back-Channel Logout: successfully deleted session ${sid}`);
+      return new Response("OK", { status: 200 });
+    } catch (error) {
+      console.error("Error during back-channel logout:", error);
+      return new Response("Internal Server Error", { status: 500 });
+    }
+  }
+  async function callbackHandler(request, validation) {
     if (!configWithDefaults) {
       console.error("SSO Manager not initialized");
       return Promise.resolve(new Response("SSO Manager not initialized", { status: 503 }));
     }
     const url = new URL(request.url);
     const params = new URLSearchParams(url.search);
+    const callbackParamsValidator = validation?.callbackParams ?? oidcCallbackSchema("builtin");
+    const paramsObject = Object.fromEntries(params.entries());
+    const paramsResult = await callbackParamsValidator["~standard"].validate(paramsObject);
+    if ("issues" in paramsResult) {
+      return new Response(JSON.stringify({
+        error: "validation_failed",
+        message: "OIDC callback parameters validation failed",
+        issues: paramsResult.issues?.map((i) => ({
+          path: i.path?.join("."),
+          message: i.message
+        }))
+      }), {
+        status: 400,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    const { code: codeFromUrl, state: stateFromUrl } = paramsResult.value;
     try {
-      const codeFromUrl = must(params.get("code"), 'OIDC "code" was not passed as a search param, ensure that the SSO login completed successfully');
-      const stateFromUrl = must(params.get("state"), 'OIDC "state" was not passed as a search param, ensure that the SSO login completed successfully');
       const cookie = getCookie("state", request, true);
       const { codeVerifier, state, landingUrl } = cookie ?? {};
       must(codeVerifier, 'OIDC "codeVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');
@@ -111,8 +503,27 @@ function sso(config) {
       if (stateFromUrl !== state) {
         throw new Error('SSO State Verifier failed, the "state" request parameter does not equal the "state" in the SSO cookie');
       }
-      const tokenResponse = await exchangeCodeForToken(codeFromUrl, codeVerifier);
-      const user = await parseUser(tokenResponse);
+      const tokenResponse = await exchangeCodeForToken(codeFromUrl, codeVerifier, validation);
+      const user = await parseUser(tokenResponse, validation);
+      if (config.session_store) {
+        try {
+          const sid = user.sso.profile.sid;
+          const sub = user.id;
+          if (sid && sub) {
+            const session = {
+              sid,
+              sub,
+              createdAt: new Date,
+              lastActivityAt: new Date
+            };
+            await config.session_store.create(session);
+          } else {
+            console.warn("Session creation skipped: missing sid or sub in ID token claims");
+          }
+        } catch (error) {
+          console.warn("Failed to create session:", error);
+        }
+      }
       return new Response("Authentication successful, redirecting", {
         status: 302,
         headers: [
@@ -141,13 +552,14 @@ function sso(config) {
       });
     }
   }
-  async function parseUser(token) {
+  async function parseUser(token, validation) {
     if (!configWithDefaults)
       throw new Error("SSO Manager not initialized");
-    const idToken = await parseJwt(token.id_token);
+    const idToken = await parseJwt(token.id_token, validation);
     const expiresIn = Number(token.refresh_expires_in ?? token.expires_in ?? 3600);
     const expires = token.expires ? new Date(token.expires) : new Date(Date.now() + expiresIn * 1000);
     return {
+      id: idToken.sub,
       userName: idToken.preferred_username || "",
       name: idToken.name || "",
       email: idToken.email || "",
@@ -175,7 +587,7 @@ function sso(config) {
       }
     };
   }
-  async function exchangeCodeForToken(code, codeVerifier) {
+  async function exchangeCodeForToken(code, codeVerifier, validation) {
     if (!configWithDefaults)
       throw new Error("SSO Manager not initialized");
     const tokenUrl = configWithDefaults.token_url;
@@ -199,10 +611,16 @@ function sso(config) {
         console.error("Token exchange error:", data);
         throw new Error(`Token exchange failed: ${data.error || response.statusText} - ${data.error_description || ""}`.trim());
       }
-      return data;
+      const tokenResponseValidator = validation?.tokenResponse ?? tokenResponseSchema("builtin");
+      const tokenResult = await tokenResponseValidator["~standard"].validate(data);
+      if ("issues" in tokenResult) {
+        console.error("Token response validation failed:", tokenResult.issues);
+        throw new Error(`Token response validation failed: ${tokenResult.issues?.map((i) => i.message).join("; ")}`);
+      }
+      return tokenResult.value;
     } catch (error) {
       console.error("Error during token exchange:", error);
-      throw new Error("Error during token exchange");
+      throw error;
     }
   }
   async function refreshToken(refreshToken2) {
@@ -230,6 +648,33 @@ function sso(config) {
       return data;
     });
   }
+  async function revokeToken(token) {
+    try {
+      if (!configWithDefaults)
+        throw new Error("SSO Manager not initialized");
+      if (!configWithDefaults.revocation_endpoint) {
+        return;
+      }
+      const body = new URLSearchParams;
+      body.append("token", token);
+      body.append("token_type_hint", "refresh_token");
+      body.append("client_id", configWithDefaults.client_id);
+      const response = await fetch(configWithDefaults.revocation_endpoint, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded"
+        },
+        body: body.toString()
+      });
+      if (!response.ok) {
+        console.warn("Token revocation failed:", response.status, response.statusText);
+      } else {
+        console.log("Token revoked successfully");
+      }
+    } catch (error) {
+      console.warn("Error revoking token:", error);
+    }
+  }
   async function fetchJwks() {
     const url = configWithDefaults.jwks_uri || `${configWithDefaults.authority}/protocol/openid-connect/certs`;
     const cached = jwksCache.get(url);
@@ -267,7 +712,7 @@ function sso(config) {
     }
     throw lastError;
   }
-  async function parseJwt(token) {
+  async function parseJwt(token, validation) {
     try {
       const parts = token.split(".");
       if (parts.length !== 3)
@@ -281,7 +726,13 @@ function sso(config) {
       const isValid = await crypto.subtle.verify("RSASSA-PKCS1-v1_5", publicKey, Uint8Array.from(atob(signature), (c) => c.charCodeAt(0)), data);
       if (!isValid)
         throw new Error("Invalid JWT signature");
-      return payload;
+      const idTokenClaimsValidator = validation?.idTokenClaims ?? idTokenClaimsSchema("builtin");
+      const claimsResult = await idTokenClaimsValidator["~standard"].validate(payload);
+      if ("issues" in claimsResult) {
+        console.error("ID token claims validation failed:", claimsResult.issues);
+        throw new Error(`ID token claims validation failed: ${claimsResult.issues?.map((i) => i.message).join("; ")}`);
+      }
+      return claimsResult.value;
     } catch (e) {
       console.error("Error verifying JWT:", e);
       throw e;
@@ -357,7 +808,7 @@ function sso(config) {
     return tokens.access_token;
   }
   function createCookie(name, value, expires) {
-    name = `${configWithDefaults.cookiePrefix}.${name}`;
+    name = `${configWithDefaults.cookies_prefix}.${name}`;
     if (typeof value !== "string") {
       value = btoa(JSON.stringify(value));
     }
@@ -372,16 +823,16 @@ function sso(config) {
     if (value.length > 4000) {
       throw new Error(`Error setting cookie: ${name}. Cookie length is: ${value.length}`);
     }
-    return `${name}=${value}; ${exp}; Path=${configWithDefaults.cookiePath}; HttpOnly;${configWithDefaults.secure ? " Secure;" : ""} SameSite=${configWithDefaults.sameSite};`;
+    return `${name}=${value}; ${exp}; Path=${configWithDefaults.cookies_path}; HttpOnly;${configWithDefaults.cookies_secure ? " Secure;" : ""} SameSite=${configWithDefaults.cookies_same_site};`;
   }
   function clearCookie(name) {
-    return `${configWithDefaults.cookiePrefix}.${name}=; Max-Age=0; Path=${configWithDefaults.cookiePath}; HttpOnly;${configWithDefaults.secure ? " Secure;" : ""} SameSite=${configWithDefaults.sameSite};`;
+    return `${configWithDefaults.cookies_prefix}.${name}=; Max-Age=0; Path=${configWithDefaults.cookies_path}; HttpOnly;${configWithDefaults.cookies_secure ? " Secure;" : ""} SameSite=${configWithDefaults.cookies_same_site};`;
   }
   function getCookie(name, req, parse = false) {
     const header = req.headers.get("cookie");
     if (!header)
       return null;
-    const cookie = header.split(";").find((row) => row.trim().startsWith(`${configWithDefaults.cookiePrefix}.${name}=`));
+    const cookie = header.split(";").find((row) => row.trim().startsWith(`${configWithDefaults.cookies_prefix}.${name}=`));
     if (!cookie)
       return null;
     const val = cookie.split("=")[1].trim();
@@ -391,12 +842,19 @@ function sso(config) {
     return JSON.parse(str);
   }
   async function handler(request, handlerConfig) {
-    let { loginUrl, userUrl, errorUrl, landingUrl, tokenUrl, refreshUrl } = handlerConfig ?? {};
-    if (!loginUrl)
-      loginUrl = "*";
+    const { loginUrl, userUrl, errorUrl, landingUrl, tokenUrl, refreshUrl, logoutUrl, logoutBackChannelUrl, jwksUrl, validation } = handlerConfig ?? {};
+    if (!loginUrl) {
+      console.error("loginUrl is required");
+    }
     const path = new URL(request.url).pathname;
-    if (new URL(config.redirect_uri).pathname === path) {
-      return callbackHandler(request);
+    if (new URL(configWithDefaults.redirect_uri).pathname === path) {
+      return callbackHandler(request, validation);
+    }
+    if (loginUrl === path) {
+      return initiateLogin({
+        landingUrl: landingUrl || "/",
+        errorUrl
+      });
     }
     if (userUrl === path) {
       const { tokens, refreshHeaders } = await getTokenFromCookies(request);
@@ -433,10 +891,16 @@ function sso(config) {
         headers: refreshHeaders
       });
     }
-    if (loginUrl === "*" || loginUrl === path) {
-      return initiateLogin({
-        landingUrl: landingUrl || "/",
-        errorUrl
+    if (logoutUrl === path) {
+      return logout(request, { landingUrl: landingUrl || "/" });
+    }
+    if (logoutBackChannelUrl === path) {
+      return logoutBackChannel(request);
+    }
+    if (jwksUrl === path) {
+      const jwks = await fetchJwks();
+      return new Response(JSON.stringify(jwks), {
+        headers: [["Content-Type", "application/json"]]
       });
     }
     return new Response("Not Found", { status: 404 });
@@ -446,14 +910,15 @@ function sso(config) {
     getRequiredUser,
     getJwt,
     initiateLogin,
+    logout,
     callbackHandler,
     handler
   };
 }
 
 // src/vault.ts
-function vault(url, token) {
-  async function getFullSecret(path) {
+function vault(url) {
+  async function getFullSecret(path, token) {
     const resp = await fetch(`${url}/${path}`, { headers: { "X-Vault-Token": token } });
     if (resp.status !== 200) {
       throw new Error(`Vault returned invalid status, ${resp.status}: '${resp.statusText}' from URL: ${url}`);
@@ -468,111 +933,8 @@ function vault(url, token) {
   return {
     url,
     getFullSecret,
-    getSecret: async (path) => {
-      return (await getFullSecret(path)).data;
-    }
-  };
-}
-
-// src/oidc-schema.ts
-function oidcCallbackSchema(vendor) {
-  return {
-    "~standard": {
-      version: 1,
-      vendor,
-      validate: (value) => {
-        if (typeof value !== "object" || value === null) {
-          return {
-            issues: [
-              {
-                message: "Expected an object"
-              }
-            ]
-          };
-        }
-        const params = value;
-        const issues = [];
-        const result = {};
-        if ("code" in params) {
-          if (typeof params.code === "string") {
-            result.code = params.code;
-          } else {
-            issues.push({
-              message: "code must be a string",
-              path: ["code"]
-            });
-          }
-        } else if (!("error" in params)) {
-          issues.push({
-            message: "code is required",
-            path: ["code"]
-          });
-        }
-        if ("state" in params) {
-          if (typeof params.state === "string" || params.state === undefined) {
-            result.state = params.state;
-          } else {
-            issues.push({
-              message: "state must be a string",
-              path: ["state"]
-            });
-          }
-        }
-        if ("session_state" in params) {
-          if (typeof params.session_state === "string" || params.session_state === undefined) {
-            result.session_state = params.session_state;
-          } else {
-            issues.push({
-              message: "session_state must be a string",
-              path: ["session_state"]
-            });
-          }
-        }
-        if ("error" in params) {
-          if (typeof params.error === "string") {
-            result.error = params.error;
-          } else {
-            issues.push({
-              message: "error must be a string",
-              path: ["error"]
-            });
-          }
-          if ("error_description" in params) {
-            if (typeof params.error_description === "string" || params.error_description === undefined) {
-              result.error_description = params.error_description;
-            } else {
-              issues.push({
-                message: "error_description must be a string",
-                path: ["error_description"]
-              });
-            }
-          }
-          if ("error_uri" in params) {
-            if (typeof params.error_uri === "string" || params.error_uri === undefined) {
-              result.error_uri = params.error_uri;
-            } else {
-              issues.push({
-                message: "error_uri must be a string",
-                path: ["error_uri"]
-              });
-            }
-          }
-        }
-        if ("iss" in params) {
-          if (typeof params.iss === "string" || params.iss === undefined) {
-            result.iss = params.iss;
-          } else {
-            issues.push({
-              message: "iss must be a string",
-              path: ["iss"]
-            });
-          }
-        }
-        if (issues.length > 0) {
-          return { issues };
-        }
-        return { value: result };
-      }
+    getSecret: async (path, token) => {
+      return (await getFullSecret(path, token)).data;
     }
   };
 }
@@ -619,6 +981,30 @@ async function handler(request, config) {
     throw unavailable();
   return sso2.handler(request, config);
 }
+// src/session-store.ts
+class InMemorySessionStore {
+  sessions = new Map;
+  async create(session) {
+    if (this.sessions.has(session.sid)) {
+      throw new Error(`Session with sid ${session.sid} already exists`);
+    }
+    this.sessions.set(session.sid, session);
+  }
+  async get(sid) {
+    return this.sessions.get(sid) ?? null;
+  }
+  async update(sid, data) {
+    const session = this.sessions.get(sid);
+    if (!session) {
+      throw new Error(`Session with sid ${sid} not found`);
+    }
+    const updated = { ...session, ...data };
+    this.sessions.set(sid, updated);
+  }
+  async delete(sid) {
+    this.sessions.delete(sid);
+  }
+}
 // src/ui/sign-in-loading.tsx
 import { jsxDEV, Fragment } from "react/jsx-dev-runtime";
 function SignInLoading({ complete = false, children }) {
@@ -774,9 +1160,14 @@ function SSOProvider({
         }
       }
     };
+    const handleLogout = () => {
+      setUserState(null);
+    };
     window.addEventListener("storage", handleStorageChange);
+    window.addEventListener("es-sso-logout", handleLogout);
     return () => {
       window.removeEventListener("storage", handleStorageChange);
+      window.removeEventListener("es-sso-logout", handleLogout);
     };
   }, [disableListener, storage, actualStorageKey, isValidUser]);
   const contextValue = {
@@ -875,34 +1266,76 @@ function useToken() {
     refresh
   };
 }
+async function logout(logoutUrl) {
+  try {
+    const response = await fetch(logoutUrl, {
+      headers: { Accept: "application/json" }
+    });
+    if (!response.ok) {
+      return { success: false, error: `HTTP ${response.status}` };
+    }
+    const data = await response.json();
+    if (!data.success) {
+      return { success: false, error: data.message || "Logout failed" };
+    }
+    if (typeof window !== "undefined") {
+      for (let i = localStorage.length - 1;i >= 0; i--) {
+        const key = localStorage.key(i);
+        if (key?.startsWith("es-sso-user")) {
+          localStorage.removeItem(key);
+        }
+      }
+      for (let i = sessionStorage.length - 1;i >= 0; i--) {
+        const key = sessionStorage.key(i);
+        if (key?.startsWith("es-sso-user")) {
+          sessionStorage.removeItem(key);
+        }
+      }
+      window.dispatchEvent(new CustomEvent("es-sso-logout"));
+    }
+    return { success: true };
+  } catch (error) {
+    return {
+      success: false,
+      error: error instanceof Error ? error.message : "Network error"
+    };
+  }
+}
 
 // src/index.ts
-async function enterpriseStandard(appId, appKey, initConfig) {
+async function enterpriseStandard(appKey, initConfig) {
   let vaultUrl;
   let vaultToken;
-  let paths;
+  let secrets;
   const ioniteUrl = initConfig?.ioniteUrl ?? "https://ionite.com";
-  if (appId === "IONITE_PUBLIC_DEMO") {
+  if (appKey?.startsWith("IONITE_PUBLIC_DEMO_")) {
     vaultUrl = "https://vault-ionite.ionite.dev/v1/secret/data";
-    vaultToken = "hvs.NuiBSLuFk5Ju4JDOUwTOlSlP";
-    paths = { sso: "ionite/IONITE_PUBLIC_DEMO" };
+    const port = appKey.slice("IONITE_PUBLIC_DEMO_".length);
+    secrets = {
+      sso: {
+        path: `public/IONITE_PUBLIC_DEMO_SSO_${port}`,
+        token: "hvs.VGhD2hmXDH9PmZjTacZx0G5K"
+      }
+    };
   } else if (appKey) {
     if (!vaultUrl || !vaultToken) {
       throw new Error("TODO something is wrong with the ionite config, handle this error");
     }
-    paths = {};
+    secrets = {};
   } else {
     throw new Error("TODO tell them how to connect to ionite");
   }
   const defaultInstance2 = getDefaultInstance();
-  const vaultClient = await vault(vaultUrl, vaultToken);
+  const vaultClient = vault(vaultUrl);
   const result = {
-    appId,
     ioniteUrl,
     defaultInstance: initConfig?.defaultInstance || initConfig?.defaultInstance !== false && !defaultInstance2,
     vault: vaultClient,
-    sso: paths.sso ? sso(await vaultClient.getSecret(paths.sso)) : undefined,
-    iam: paths.iam ? await iam(await vaultClient.getSecret(paths.iam)) : undefined
+    sso: secrets.sso ? sso({
+      ...await vaultClient.getSecret(secrets.sso.path, secrets.sso.token),
+      ...initConfig
+    }) : undefined,
+    iam: secrets.iam ? await iam(await vaultClient.getSecret(secrets.iam.path, secrets.iam.token)) : undefined
   };
   if (result.defaultInstance) {
     if (defaultInstance2) {
@@ -915,8 +1348,11 @@ async function enterpriseStandard(appId, appKey, initConfig) {
 export {
   useUser,
   useToken,
+  tokenResponseSchema,
   oidcCallbackSchema,
+  logout,
   initiateLogin,
+  idTokenClaimsSchema,
   handler,
   getUser,
   getRequiredUser,
@@ -925,5 +1361,6 @@ export {
   SignedOut,
   SignedIn,
   SignInLoading,
-  SSOProvider
+  SSOProvider,
+  InMemorySessionStore
 };