@enterprisestandard/react 0.0.4 → 0.0.5

package/dist/index.js

@@ -1,9 +1,287 @@
 // src/iam.ts
 async function iam(config) {
+  return {};
+}
+
+// src/oidc-schema.ts
+function oidcCallbackSchema(vendor) {
+  return {
+    "~standard": {
+      version: 1,
+      vendor,
+      validate: (value) => {
+        if (typeof value !== "object" || value === null) {
+          return {
+            issues: [
+              {
+                message: "Expected an object"
+              }
+            ]
+          };
+        }
+        const params = value;
+        const issues = [];
+        const result = {};
+        if ("code" in params) {
+          if (typeof params.code === "string") {
+            result.code = params.code;
+          } else {
+            issues.push({
+              message: "code must be a string",
+              path: ["code"]
+            });
+          }
+        } else if (!("error" in params)) {
+          issues.push({
+            message: "code is required",
+            path: ["code"]
+          });
+        }
+        if ("state" in params) {
+          if (typeof params.state === "string" || params.state === undefined) {
+            result.state = params.state;
+          } else {
+            issues.push({
+              message: "state must be a string",
+              path: ["state"]
+            });
+          }
+        }
+        if ("session_state" in params) {
+          if (typeof params.session_state === "string" || params.session_state === undefined) {
+            result.session_state = params.session_state;
+          } else {
+            issues.push({
+              message: "session_state must be a string",
+              path: ["session_state"]
+            });
+          }
+        }
+        if ("error" in params) {
+          if (typeof params.error === "string") {
+            result.error = params.error;
+          } else {
+            issues.push({
+              message: "error must be a string",
+              path: ["error"]
+            });
+          }
+          if ("error_description" in params) {
+            if (typeof params.error_description === "string" || params.error_description === undefined) {
+              result.error_description = params.error_description;
+            } else {
+              issues.push({
+                message: "error_description must be a string",
+                path: ["error_description"]
+              });
+            }
+          }
+          if ("error_uri" in params) {
+            if (typeof params.error_uri === "string" || params.error_uri === undefined) {
+              result.error_uri = params.error_uri;
+            } else {
+              issues.push({
+                message: "error_uri must be a string",
+                path: ["error_uri"]
+              });
+            }
+          }
+        }
+        if ("iss" in params) {
+          if (typeof params.iss === "string" || params.iss === undefined) {
+            result.iss = params.iss;
+          } else {
+            issues.push({
+              message: "iss must be a string",
+              path: ["iss"]
+            });
+          }
+        }
+        if (issues.length > 0) {
+          return { issues };
+        }
+        return { value: result };
+      }
+    }
+  };
+}
+function tokenResponseSchema(vendor) {
+  return {
+    "~standard": {
+      version: 1,
+      vendor,
+      validate: (value) => {
+        if (typeof value !== "object" || value === null) {
+          return {
+            issues: [
+              {
+                message: "Expected an object"
+              }
+            ]
+          };
+        }
+        const response = value;
+        const issues = [];
+        const result = {};
+        if ("access_token" in response) {
+          if (typeof response.access_token === "string") {
+            result.access_token = response.access_token;
+          } else {
+            issues.push({
+              message: "access_token must be a string",
+              path: ["access_token"]
+            });
+          }
+        } else {
+          issues.push({
+            message: "access_token is required",
+            path: ["access_token"]
+          });
+        }
+        if ("id_token" in response) {
+          if (typeof response.id_token === "string") {
+            result.id_token = response.id_token;
+          } else {
+            issues.push({
+              message: "id_token must be a string",
+              path: ["id_token"]
+            });
+          }
+        } else {
+          issues.push({
+            message: "id_token is required",
+            path: ["id_token"]
+          });
+        }
+        if ("token_type" in response) {
+          if (typeof response.token_type === "string") {
+            result.token_type = response.token_type;
+          } else {
+            issues.push({
+              message: "token_type must be a string",
+              path: ["token_type"]
+            });
+          }
+        } else {
+          issues.push({
+            message: "token_type is required",
+            path: ["token_type"]
+          });
+        }
+        if ("refresh_token" in response) {
+          if (typeof response.refresh_token === "string" || response.refresh_token === undefined) {
+            result.refresh_token = response.refresh_token;
+          } else {
+            issues.push({
+              message: "refresh_token must be a string",
+              path: ["refresh_token"]
+            });
+          }
+        }
+        if ("scope" in response) {
+          if (typeof response.scope === "string" || response.scope === undefined) {
+            result.scope = response.scope;
+          } else {
+            issues.push({
+              message: "scope must be a string",
+              path: ["scope"]
+            });
+          }
+        }
+        if ("session_state" in response) {
+          if (typeof response.session_state === "string" || response.session_state === undefined) {
+            result.session_state = response.session_state;
+          } else {
+            issues.push({
+              message: "session_state must be a string",
+              path: ["session_state"]
+            });
+          }
+        }
+        if ("expires" in response) {
+          if (typeof response.expires === "string" || response.expires === undefined) {
+            result.expires = response.expires;
+          } else {
+            issues.push({
+              message: "expires must be a string",
+              path: ["expires"]
+            });
+          }
+        }
+        if ("expires_in" in response) {
+          if (typeof response.expires_in === "number" || response.expires_in === undefined) {
+            result.expires_in = response.expires_in;
+          } else {
+            issues.push({
+              message: "expires_in must be a number",
+              path: ["expires_in"]
+            });
+          }
+        }
+        if ("refresh_expires_in" in response) {
+          if (typeof response.refresh_expires_in === "number" || response.refresh_expires_in === undefined) {
+            result.refresh_expires_in = response.refresh_expires_in;
+          } else {
+            issues.push({
+              message: "refresh_expires_in must be a number",
+              path: ["refresh_expires_in"]
+            });
+          }
+        }
+        if (issues.length > 0) {
+          return { issues };
+        }
+        return { value: result };
+      }
+    }
+  };
+}
+function idTokenClaimsSchema(vendor) {
   return {
-    url: config.url,
-    userEndpoint: config.userEndpoint,
-    groupEndpoint: config.groupEndpoint
+    "~standard": {
+      version: 1,
+      vendor,
+      validate: (value) => {
+        if (typeof value !== "object" || value === null) {
+          return {
+            issues: [
+              {
+                message: "Expected an object"
+              }
+            ]
+          };
+        }
+        const claims = value;
+        const issues = [];
+        const result = { ...claims };
+        const stringFields = ["iss", "aud", "sub", "sid", "name", "email", "preferred_username", "picture"];
+        for (const field of stringFields) {
+          if (field in claims && claims[field] !== undefined) {
+            if (typeof claims[field] !== "string") {
+              issues.push({
+                message: `${field} must be a string`,
+                path: [field]
+              });
+            }
+          }
+        }
+        const numberFields = ["exp", "iat"];
+        for (const field of numberFields) {
+          if (field in claims && claims[field] !== undefined) {
+            if (typeof claims[field] !== "number") {
+              issues.push({
+                message: `${field} must be a number`,
+                path: [field]
+              });
+            }
+          }
+        }
+        if (issues.length > 0) {
+          return { issues };
+        }
+        return { value: result };
+      }
+    }
   };
 }
 
@@ -31,10 +309,16 @@ function getES(es) {
 
 // src/sso.ts
 var jwksCache = new Map;
-var _logoutTokenJtis = new Set;
 function sso(config) {
   const configWithDefaults = {
     ...config,
+    authority: must(config.authority, "Missing 'authority' from SSO Config"),
+    token_url: must(config.token_url, "Missing 'token_url' from SSO Config"),
+    authorization_url: must(config.authorization_url, "Missing 'authorization_url' from SSO Config"),
+    client_id: must(config.client_id, "Missing 'client_id' from SSO Config"),
+    redirect_uri: must(config.redirect_uri, "Missing 'redirect_uri' from SSO Config"),
+    scope: must(config.scope, "Missing 'scope' from SSO Config"),
+    response_type: config.response_type ?? "code",
     cookies_secure: config.cookies_secure !== undefined ? config.cookies_secure : true,
     cookies_same_site: config.cookies_same_site !== undefined ? config.cookies_same_site : "Strict",
     cookies_prefix: config.cookies_prefix ?? `es.sso.${config.client_id}`,
@@ -103,6 +387,18 @@ function sso(config) {
     } catch (error) {
       console.warn("Failed to revoke token:", error);
     }
+    if (config.session_store) {
+      try {
+        const user = await getUser(request);
+        if (user?.sso?.profile.sid) {
+          const sid = user.sso.profile.sid;
+          await config.session_store.delete(sid);
+          console.log(`Session ${sid} deleted from store`);
+        }
+      } catch (error) {
+        console.warn("Failed to delete session:", error);
+      }
+    }
     const clearHeaders = [
       ["Set-Cookie", clearCookie("access")],
       ["Set-Cookie", clearCookie("id")],
@@ -140,16 +436,65 @@ function sso(config) {
       });
     }
   }
-  async function callbackHandler(request) {
+  async function logoutBackChannel(request) {
+    if (!configWithDefaults.session_store) {
+      return new Response("Back-Channel Logout requires session_store configuration", {
+        status: 400,
+        statusText: "Bad Request"
+      });
+    }
+    try {
+      const contentType = request.headers.get("content-type");
+      if (!contentType || !contentType.includes("application/x-www-form-urlencoded")) {
+        return new Response("Invalid Content-Type, expected application/x-www-form-urlencoded", {
+          status: 400
+        });
+      }
+      const body = await request.text();
+      const params = new URLSearchParams(body);
+      const logoutToken = params.get("logout_token");
+      if (!logoutToken) {
+        return new Response("Missing logout_token parameter", { status: 400 });
+      }
+      const claims = await parseJwt(logoutToken);
+      const sid = claims.sid;
+      if (!sid) {
+        console.warn("Back-Channel Logout: logout_token missing sid claim");
+        return new Response("Invalid logout_token: missing sid claim", { status: 400 });
+      }
+      await configWithDefaults.session_store.delete(sid);
+      console.log(`Back-Channel Logout: successfully deleted session ${sid}`);
+      return new Response("OK", { status: 200 });
+    } catch (error) {
+      console.error("Error during back-channel logout:", error);
+      return new Response("Internal Server Error", { status: 500 });
+    }
+  }
+  async function callbackHandler(request, validation) {
     if (!configWithDefaults) {
       console.error("SSO Manager not initialized");
       return Promise.resolve(new Response("SSO Manager not initialized", { status: 503 }));
     }
     const url = new URL(request.url);
     const params = new URLSearchParams(url.search);
+    const callbackParamsValidator = validation?.callbackParams ?? oidcCallbackSchema("builtin");
+    const paramsObject = Object.fromEntries(params.entries());
+    const paramsResult = await callbackParamsValidator["~standard"].validate(paramsObject);
+    if ("issues" in paramsResult) {
+      return new Response(JSON.stringify({
+        error: "validation_failed",
+        message: "OIDC callback parameters validation failed",
+        issues: paramsResult.issues?.map((i) => ({
+          path: i.path?.join("."),
+          message: i.message
+        }))
+      }), {
+        status: 400,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
+    const { code: codeFromUrl, state: stateFromUrl } = paramsResult.value;
     try {
-      const codeFromUrl = must(params.get("code"), 'OIDC "code" was not passed as a search param, ensure that the SSO login completed successfully');
-      const stateFromUrl = must(params.get("state"), 'OIDC "state" was not passed as a search param, ensure that the SSO login completed successfully');
       const cookie = getCookie("state", request, true);
       const { codeVerifier, state, landingUrl } = cookie ?? {};
       must(codeVerifier, 'OIDC "codeVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');
@@ -158,8 +503,27 @@ function sso(config) {
       if (stateFromUrl !== state) {
         throw new Error('SSO State Verifier failed, the "state" request parameter does not equal the "state" in the SSO cookie');
       }
-      const tokenResponse = await exchangeCodeForToken(codeFromUrl, codeVerifier);
-      const user = await parseUser(tokenResponse);
+      const tokenResponse = await exchangeCodeForToken(codeFromUrl, codeVerifier, validation);
+      const user = await parseUser(tokenResponse, validation);
+      if (config.session_store) {
+        try {
+          const sid = user.sso.profile.sid;
+          const sub = user.id;
+          if (sid && sub) {
+            const session = {
+              sid,
+              sub,
+              createdAt: new Date,
+              lastActivityAt: new Date
+            };
+            await config.session_store.create(session);
+          } else {
+            console.warn("Session creation skipped: missing sid or sub in ID token claims");
+          }
+        } catch (error) {
+          console.warn("Failed to create session:", error);
+        }
+      }
       return new Response("Authentication successful, redirecting", {
         status: 302,
         headers: [
@@ -188,10 +552,10 @@ function sso(config) {
       });
     }
   }
-  async function parseUser(token) {
+  async function parseUser(token, validation) {
     if (!configWithDefaults)
       throw new Error("SSO Manager not initialized");
-    const idToken = await parseJwt(token.id_token);
+    const idToken = await parseJwt(token.id_token, validation);
     const expiresIn = Number(token.refresh_expires_in ?? token.expires_in ?? 3600);
     const expires = token.expires ? new Date(token.expires) : new Date(Date.now() + expiresIn * 1000);
     return {
@@ -223,7 +587,7 @@ function sso(config) {
       }
     };
   }
-  async function exchangeCodeForToken(code, codeVerifier) {
+  async function exchangeCodeForToken(code, codeVerifier, validation) {
     if (!configWithDefaults)
       throw new Error("SSO Manager not initialized");
     const tokenUrl = configWithDefaults.token_url;
@@ -247,10 +611,16 @@ function sso(config) {
         console.error("Token exchange error:", data);
         throw new Error(`Token exchange failed: ${data.error || response.statusText} - ${data.error_description || ""}`.trim());
       }
-      return data;
+      const tokenResponseValidator = validation?.tokenResponse ?? tokenResponseSchema("builtin");
+      const tokenResult = await tokenResponseValidator["~standard"].validate(data);
+      if ("issues" in tokenResult) {
+        console.error("Token response validation failed:", tokenResult.issues);
+        throw new Error(`Token response validation failed: ${tokenResult.issues?.map((i) => i.message).join("; ")}`);
+      }
+      return tokenResult.value;
     } catch (error) {
       console.error("Error during token exchange:", error);
-      throw new Error("Error during token exchange");
+      throw error;
     }
   }
   async function refreshToken(refreshToken2) {
@@ -282,12 +652,14 @@ function sso(config) {
     try {
       if (!configWithDefaults)
         throw new Error("SSO Manager not initialized");
-      const revokeUrl = `${configWithDefaults.authority}/protocol/openid-connect/revoke`;
+      if (!configWithDefaults.revocation_endpoint) {
+        return;
+      }
       const body = new URLSearchParams;
       body.append("token", token);
       body.append("token_type_hint", "refresh_token");
       body.append("client_id", configWithDefaults.client_id);
-      const response = await fetch(revokeUrl, {
+      const response = await fetch(configWithDefaults.revocation_endpoint, {
         method: "POST",
         headers: {
           "Content-Type": "application/x-www-form-urlencoded"
@@ -340,7 +712,7 @@ function sso(config) {
     }
     throw lastError;
   }
-  async function parseJwt(token) {
+  async function parseJwt(token, validation) {
     try {
       const parts = token.split(".");
       if (parts.length !== 3)
@@ -354,7 +726,13 @@ function sso(config) {
       const isValid = await crypto.subtle.verify("RSASSA-PKCS1-v1_5", publicKey, Uint8Array.from(atob(signature), (c) => c.charCodeAt(0)), data);
       if (!isValid)
         throw new Error("Invalid JWT signature");
-      return payload;
+      const idTokenClaimsValidator = validation?.idTokenClaims ?? idTokenClaimsSchema("builtin");
+      const claimsResult = await idTokenClaimsValidator["~standard"].validate(payload);
+      if ("issues" in claimsResult) {
+        console.error("ID token claims validation failed:", claimsResult.issues);
+        throw new Error(`ID token claims validation failed: ${claimsResult.issues?.map((i) => i.message).join("; ")}`);
+      }
+      return claimsResult.value;
     } catch (e) {
       console.error("Error verifying JWT:", e);
       throw e;
@@ -464,13 +842,13 @@ function sso(config) {
     return JSON.parse(str);
   }
   async function handler(request, handlerConfig) {
-    const { loginUrl, userUrl, errorUrl, landingUrl, tokenUrl, refreshUrl, logoutUrl, jwksUrl } = handlerConfig ?? {};
+    const { loginUrl, userUrl, errorUrl, landingUrl, tokenUrl, refreshUrl, logoutUrl, logoutBackChannelUrl, jwksUrl, validation } = handlerConfig ?? {};
     if (!loginUrl) {
       console.error("loginUrl is required");
     }
     const path = new URL(request.url).pathname;
-    if (new URL(config.redirect_uri).pathname === path) {
-      return callbackHandler(request);
+    if (new URL(configWithDefaults.redirect_uri).pathname === path) {
+      return callbackHandler(request, validation);
     }
     if (loginUrl === path) {
       return initiateLogin({
@@ -516,6 +894,9 @@ function sso(config) {
     if (logoutUrl === path) {
       return logout(request, { landingUrl: landingUrl || "/" });
     }
+    if (logoutBackChannelUrl === path) {
+      return logoutBackChannel(request);
+    }
     if (jwksUrl === path) {
       const jwks = await fetchJwks();
       return new Response(JSON.stringify(jwks), {
@@ -557,109 +938,6 @@ function vault(url) {
     }
   };
 }
-
-// src/oidc-schema.ts
-function oidcCallbackSchema(vendor) {
-  return {
-    "~standard": {
-      version: 1,
-      vendor,
-      validate: (value) => {
-        if (typeof value !== "object" || value === null) {
-          return {
-            issues: [
-              {
-                message: "Expected an object"
-              }
-            ]
-          };
-        }
-        const params = value;
-        const issues = [];
-        const result = {};
-        if ("code" in params) {
-          if (typeof params.code === "string") {
-            result.code = params.code;
-          } else {
-            issues.push({
-              message: "code must be a string",
-              path: ["code"]
-            });
-          }
-        } else if (!("error" in params)) {
-          issues.push({
-            message: "code is required",
-            path: ["code"]
-          });
-        }
-        if ("state" in params) {
-          if (typeof params.state === "string" || params.state === undefined) {
-            result.state = params.state;
-          } else {
-            issues.push({
-              message: "state must be a string",
-              path: ["state"]
-            });
-          }
-        }
-        if ("session_state" in params) {
-          if (typeof params.session_state === "string" || params.session_state === undefined) {
-            result.session_state = params.session_state;
-          } else {
-            issues.push({
-              message: "session_state must be a string",
-              path: ["session_state"]
-            });
-          }
-        }
-        if ("error" in params) {
-          if (typeof params.error === "string") {
-            result.error = params.error;
-          } else {
-            issues.push({
-              message: "error must be a string",
-              path: ["error"]
-            });
-          }
-          if ("error_description" in params) {
-            if (typeof params.error_description === "string" || params.error_description === undefined) {
-              result.error_description = params.error_description;
-            } else {
-              issues.push({
-                message: "error_description must be a string",
-                path: ["error_description"]
-              });
-            }
-          }
-          if ("error_uri" in params) {
-            if (typeof params.error_uri === "string" || params.error_uri === undefined) {
-              result.error_uri = params.error_uri;
-            } else {
-              issues.push({
-                message: "error_uri must be a string",
-                path: ["error_uri"]
-              });
-            }
-          }
-        }
-        if ("iss" in params) {
-          if (typeof params.iss === "string" || params.iss === undefined) {
-            result.iss = params.iss;
-          } else {
-            issues.push({
-              message: "iss must be a string",
-              path: ["iss"]
-            });
-          }
-        }
-        if (issues.length > 0) {
-          return { issues };
-        }
-        return { value: result };
-      }
-    }
-  };
-}
 // src/server.ts
 function getSSO(config) {
   const es = getES(config?.es);
@@ -703,39 +981,63 @@ async function handler(request, config) {
     throw unavailable();
   return sso2.handler(request, config);
 }
+// src/session-store.ts
+class InMemorySessionStore {
+  sessions = new Map;
+  async create(session) {
+    if (this.sessions.has(session.sid)) {
+      throw new Error(`Session with sid ${session.sid} already exists`);
+    }
+    this.sessions.set(session.sid, session);
+  }
+  async get(sid) {
+    return this.sessions.get(sid) ?? null;
+  }
+  async update(sid, data) {
+    const session = this.sessions.get(sid);
+    if (!session) {
+      throw new Error(`Session with sid ${sid} not found`);
+    }
+    const updated = { ...session, ...data };
+    this.sessions.set(sid, updated);
+  }
+  async delete(sid) {
+    this.sessions.delete(sid);
+  }
+}
 // src/ui/sign-in-loading.tsx
-import { jsx, Fragment } from "react/jsx-runtime";
+import { jsxDEV, Fragment } from "react/jsx-dev-runtime";
 function SignInLoading({ complete = false, children }) {
   const { isLoading } = useUser();
   if (isLoading && !complete)
-    return /* @__PURE__ */ jsx(Fragment, {
+    return /* @__PURE__ */ jsxDEV(Fragment, {
       children
-    });
+    }, undefined, false, undefined, this);
   return null;
 }
 // src/ui/signed-in.tsx
-import { jsx as jsx2, Fragment as Fragment2 } from "react/jsx-runtime";
+import { jsxDEV as jsxDEV2, Fragment as Fragment2 } from "react/jsx-dev-runtime";
 function SignedIn({ children }) {
   const { user } = useUser();
   if (user)
-    return /* @__PURE__ */ jsx2(Fragment2, {
+    return /* @__PURE__ */ jsxDEV2(Fragment2, {
       children
-    });
+    }, undefined, false, undefined, this);
   return null;
 }
 // src/ui/signed-out.tsx
-import { jsx as jsx3, Fragment as Fragment3 } from "react/jsx-runtime";
+import { jsxDEV as jsxDEV3, Fragment as Fragment3 } from "react/jsx-dev-runtime";
 function SignedOut({ children }) {
   const { user, isLoading } = useUser();
   if (user || isLoading)
     return null;
-  return /* @__PURE__ */ jsx3(Fragment3, {
+  return /* @__PURE__ */ jsxDEV3(Fragment3, {
     children
-  });
+  }, undefined, false, undefined, this);
 }
 // src/ui/sso-provider.tsx
 import { createContext, useCallback, useContext, useEffect, useState } from "react";
-import { jsx as jsx4 } from "react/jsx-runtime";
+import { jsxDEV as jsxDEV4 } from "react/jsx-dev-runtime";
 var CTX = createContext(undefined);
 var generateStorageKey = (tenantId) => {
   return `es-sso-user-${tenantId.replace(/[^a-zA-Z0-9]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "")}`;
@@ -875,10 +1177,10 @@ function SSOProvider({
     tokenUrl,
     refreshUrl
   };
-  return /* @__PURE__ */ jsx4(CTX.Provider, {
+  return /* @__PURE__ */ jsxDEV4(CTX.Provider, {
     value: contextValue,
     children
-  });
+  }, undefined, false, undefined, this);
 }
 function useUser() {
   const context = useContext(CTX);
@@ -1001,16 +1303,17 @@ async function logout(logoutUrl) {
 }
 
 // src/index.ts
-async function enterpriseStandard(appId, appKey, initConfig) {
+async function enterpriseStandard(appKey, initConfig) {
   let vaultUrl;
   let vaultToken;
   let secrets;
   const ioniteUrl = initConfig?.ioniteUrl ?? "https://ionite.com";
-  if (appId === "IONITE_PUBLIC_DEMO") {
+  if (appKey?.startsWith("IONITE_PUBLIC_DEMO_")) {
     vaultUrl = "https://vault-ionite.ionite.dev/v1/secret/data";
+    const port = appKey.slice("IONITE_PUBLIC_DEMO_".length);
     secrets = {
       sso: {
-        path: "public/IONITE_PUBLIC_DEMO_SSO",
+        path: `public/IONITE_PUBLIC_DEMO_SSO_${port}`,
         token: "hvs.VGhD2hmXDH9PmZjTacZx0G5K"
       }
     };
@@ -1023,13 +1326,15 @@ async function enterpriseStandard(appId, appKey, initConfig) {
     throw new Error("TODO tell them how to connect to ionite");
   }
   const defaultInstance2 = getDefaultInstance();
-  const vaultClient = await vault(vaultUrl);
+  const vaultClient = vault(vaultUrl);
   const result = {
-    appId,
     ioniteUrl,
     defaultInstance: initConfig?.defaultInstance || initConfig?.defaultInstance !== false && !defaultInstance2,
     vault: vaultClient,
-    sso: secrets.sso ? sso(await vaultClient.getSecret(secrets.sso.path, secrets.sso.token)) : undefined,
+    sso: secrets.sso ? sso({
+      ...await vaultClient.getSecret(secrets.sso.path, secrets.sso.token),
+      ...initConfig
+    }) : undefined,
     iam: secrets.iam ? await iam(await vaultClient.getSecret(secrets.iam.path, secrets.iam.token)) : undefined
   };
   if (result.defaultInstance) {
@@ -1043,9 +1348,11 @@ async function enterpriseStandard(appId, appKey, initConfig) {
 export {
   useUser,
   useToken,
+  tokenResponseSchema,
   oidcCallbackSchema,
   logout,
   initiateLogin,
+  idTokenClaimsSchema,
   handler,
   getUser,
   getRequiredUser,
@@ -1054,5 +1361,6 @@ export {
   SignedOut,
   SignedIn,
   SignInLoading,
-  SSOProvider
+  SSOProvider,
+  InMemorySessionStore
 };