@fluixi/oauth2 1.0.0-alpha.11 → 1.0.0-alpha.12

package/dist/index.cjs

@@ -1,4 +1,4 @@
-/*! @fluixi/oauth2 v1.0.0-alpha.11 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+/*! @fluixi/oauth2 v1.0.0-alpha.12 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
 "use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -51,7 +51,8 @@ __export(index_exports, {
   paramsFromUrl: () => paramsFromUrl,
   proofFor: () => proofFor,
   safeReturnTo: () => safeReturnTo,
-  thumbprintOf: () => thumbprintOf
+  thumbprintOf: () => thumbprintOf,
+  watchProviderSession: () => watchProviderSession
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -364,8 +365,12 @@ async function discover(issuer, fetcher = fetch) {
     try {
       response = await fetcher(documentUrl(issuer));
     } catch (cause) {
+      const why = cause instanceof Error ? cause.message : String(cause);
       throw new OAuthError(
-        `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${cause instanceof Error ? cause.message : String(cause)})`,
+        typeof window === "undefined" ? (
+          // On a server nothing blocks the read: the provider is down, or the address is wrong.
+          `Could not reach the provider at ${documentUrl(issuer)}: is it running, and is the issuer right? (${why})`
+        ) : `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${why})`,
         "discovery_unreachable"
       );
     }
@@ -390,6 +395,7 @@ async function discover(issuer, fetcher = fetch) {
       jwks: doc.jwks_uri,
       introspection: doc.introspection_endpoint,
       revocation: doc.revocation_endpoint,
+      checkSession: doc.check_session_iframe,
       issuer: doc.issuer ?? issuer
     };
   })();
@@ -848,6 +854,81 @@ function createServerClient(config, fetcher = fetch) {
   };
 }
 
+// src/session-monitor.ts
+var SETTLE_MS = 15e3;
+var GUARD_KEY = "fx-session-check";
+function recentlyActed() {
+  try {
+    return Date.now() - Number(sessionStorage.getItem(GUARD_KEY) ?? 0) < SETTLE_MS;
+  } catch {
+    return false;
+  }
+}
+function markActed() {
+  try {
+    sessionStorage.setItem(GUARD_KEY, String(Date.now()));
+  } catch {
+  }
+}
+function watchProviderSession(options = {}) {
+  if (typeof window === "undefined" || typeof document === "undefined") return () => {
+  };
+  const base = (options.basePath ?? "/auth").replace(/\/$/, "");
+  const fetcher = options.fetcher ?? fetch;
+  const onChange = options.onChange ?? (() => {
+    const login = new URLSearchParams({ prompt: "none", returnTo: location.pathname + location.search });
+    location.assign(`${base}/login?${login}`);
+  });
+  let stopped = false;
+  const cleanups = [];
+  const stop = () => {
+    stopped = true;
+    for (const cleanup of cleanups.splice(0)) cleanup();
+  };
+  void (async () => {
+    const check = await fetcher(`${base}/session-check`, { credentials: "same-origin" }).then((response) => response.ok ? response.json() : null).catch(() => null);
+    if (stopped || !check?.frame || !check.state) return;
+    const origin = new URL(check.frame).origin;
+    const frame = document.createElement("iframe");
+    frame.src = check.frame;
+    frame.title = "session check";
+    frame.setAttribute("aria-hidden", "true");
+    frame.tabIndex = -1;
+    frame.style.cssText = "position:absolute;width:0;height:0;border:0;visibility:hidden";
+    const message = `${check.clientId} ${check.state}`;
+    const ask = () => {
+      if (!stopped && document.visibilityState === "visible") frame.contentWindow?.postMessage(message, origin);
+    };
+    let confirmed = false;
+    const answer = (event) => {
+      if (event.origin !== origin || event.source !== frame.contentWindow) return;
+      if (event.data === "unchanged") confirmed = true;
+      else if (event.data === "changed") {
+        stop();
+        if (!confirmed && recentlyActed()) return;
+        markActed();
+        onChange();
+      } else if (event.data === "error") {
+        stop();
+      }
+    };
+    window.addEventListener("message", answer);
+    frame.addEventListener("load", ask);
+    document.addEventListener("visibilitychange", ask);
+    window.addEventListener("focus", ask);
+    const timer = setInterval(ask, options.intervalMs ?? 3e3);
+    document.body.appendChild(frame);
+    cleanups.push(() => {
+      window.removeEventListener("message", answer);
+      document.removeEventListener("visibilitychange", ask);
+      window.removeEventListener("focus", ask);
+      clearInterval(timer);
+      frame.remove();
+    });
+  })();
+  return stop;
+}
+
 // src/service.ts
 function paramsFromUrl(url) {
   const href = url ?? (typeof location === "undefined" ? null : location.href);
@@ -874,16 +955,19 @@ function createAuthService(options) {
 function buildAuthService(options) {
   const client = clientFor(options);
   let latest = null;
+  const fetchUserFor = async (token) => {
+    if (options.fetchUser) return options.fetchUser(token);
+    return client.fetchUser(token === COOKIE_SESSION ? void 0 : token);
+  };
+  const resumesFromCookie = options.config.tokens === "server" && typeof window !== "undefined";
+  const [ready, setReady] = (0, import_signal.createSignal)(!resumesFromCookie);
   const session = (0, import_session.createSession)({
     /** The credential is the callback, so this is the code exchange. */
     async login(params) {
       latest = await client.handleCallback(params);
       return { token: latest.accessToken, expiresAt: latest.expiresAt };
     },
-    async fetchUser(token) {
-      if (options.fetchUser) return options.fetchUser(token);
-      return client.fetchUser(token === COOKIE_SESSION ? void 0 : token);
-    },
+    fetchUser: fetchUserFor,
     async refresh() {
       latest = await client.refresh();
       return { token: latest.accessToken, expiresAt: latest.expiresAt };
@@ -906,11 +990,27 @@ function buildAuthService(options) {
   });
   const hooks = (0, import_client.createAuthHooks)({
     session,
+    ready,
     navigate: options.navigate,
     loginPath: options.loginPath ?? "/login",
     homePath: options.homePath ?? "/",
     forbiddenPath: options.forbiddenPath ?? "/403"
   });
+  if (resumesFromCookie && options.config.tokens === "server" && options.config.watchSession !== false) {
+    watchProviderSession({ basePath: options.config.basePath });
+  }
+  const renderedSignedOut = hooks.store.seeded && hooks.store.value().user == null;
+  if (resumesFromCookie && renderedSignedOut) setReady(true);
+  else if (resumesFromCookie) {
+    void (async () => {
+      try {
+        await session.adopt(COOKIE_SESSION, await fetchUserFor(COOKIE_SESSION));
+      } catch {
+      } finally {
+        setReady(true);
+      }
+    })();
+  }
   return Object.assign(session, {
     client,
     protectedRoute: hooks.protectedRoute,

package/dist/index.d.ts

@@ -93,6 +93,8 @@ export type { AuthService, AuthServiceOptions, AuthCredentials } from './service
 export { createBrowserClient } from './browser.js';
 export { createServerClient, COOKIE_SESSION } from './server-client.js';
 export { discover, clearDiscoveryCache } from './discovery.js';
+export { watchProviderSession } from './session-monitor.js';
+export type { SessionCheck, WatchOptions } from './session-monitor.js';
 export { createPkcePair, createVerifier, createChallenge, createStateValue, expiryFromJwt, } from './pkce.js';
 export { createDpopKey, proofFor, thumbprintOf, boundKeyOf } from './dpop.js';
 export type { DpopKey, ProofOptions } from './dpop.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AACH,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAChE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAErF,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAExE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EACL,cAAc,EACd,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9E,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,YAAY,EACV,UAAU,EACV,UAAU,EACV,UAAU,EACV,aAAa,EACb,cAAc,EACd,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,MAAM,GACP,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AACH,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAChE,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAErF,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAExE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EACL,cAAc,EACd,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,aAAa,GACd,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC9E,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,YAAY,EACV,UAAU,EACV,UAAU,EACV,UAAU,EACV,aAAa,EACb,cAAc,EACd,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,MAAM,GACP,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -92,6 +92,7 @@ export { createAuthService, paramsFromUrl } from './service.js';
 export { createBrowserClient } from './browser.js';
 export { createServerClient, COOKIE_SESSION } from './server-client.js';
 export { discover, clearDiscoveryCache } from './discovery.js';
+export { watchProviderSession } from './session-monitor.js';
 export { createPkcePair, createVerifier, createChallenge, createStateValue, expiryFromJwt, } from './pkce.js';
 export { createDpopKey, proofFor, thumbprintOf, boundKeyOf } from './dpop.js';
 export { safeReturnTo } from './return-to.js';

package/dist/index.mjs

@@ -1,8 +1,8 @@
-/*! @fluixi/oauth2 v1.0.0-alpha.11 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
-import "./chunk-4TPZVJSR.mjs";
+/*! @fluixi/oauth2 v1.0.0-alpha.12 | (c) 2026 Ibrahima Touré and Fluixi contributors | MIT */
+import "./chunk-MT6KXLLJ.mjs";
 
 // src/service.ts
-import { markReactiveScope, openReactiveScope, withReactiveScope } from "@fluixi/reactive/signal";
+import { createSignal, markReactiveScope, openReactiveScope, withReactiveScope } from "@fluixi/reactive/signal";
 import { createSession } from "@fluixi/session";
 import { createAuthHooks } from "@fluixi/auth/client";
 
@@ -112,7 +112,7 @@ function resolveMethod(auth) {
 }
 async function loadJose() {
   try {
-    return await import("./browser-N432SMC3.mjs");
+    return await import("./browser-VTMW33ZW.mjs");
   } catch {
     throw new OAuthError(
       "private_key_jwt needs `jose`. Install it: npm i jose. It is an optional peer, so a client using a secret does not carry it.",
@@ -152,7 +152,7 @@ async function applyClientAuth(auth, endpoint, headers, form) {
 // src/dpop.ts
 async function loadJose2() {
   try {
-    return await import("./browser-N432SMC3.mjs");
+    return await import("./browser-VTMW33ZW.mjs");
   } catch {
     throw new OAuthError(
       "DPoP needs `jose`. Install it: npm i jose. It is an optional peer, so a client not using DPoP does not carry it.",
@@ -310,8 +310,12 @@ async function discover(issuer, fetcher = fetch) {
     try {
       response = await fetcher(documentUrl(issuer));
     } catch (cause) {
+      const why = cause instanceof Error ? cause.message : String(cause);
       throw new OAuthError(
-        `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${cause instanceof Error ? cause.message : String(cause)})`,
+        typeof window === "undefined" ? (
+          // On a server nothing blocks the read: the provider is down, or the address is wrong.
+          `Could not reach the provider at ${documentUrl(issuer)}: is it running, and is the issuer right? (${why})`
+        ) : `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${why})`,
         "discovery_unreachable"
       );
     }
@@ -336,6 +340,7 @@ async function discover(issuer, fetcher = fetch) {
       jwks: doc.jwks_uri,
       introspection: doc.introspection_endpoint,
       revocation: doc.revocation_endpoint,
+      checkSession: doc.check_session_iframe,
       issuer: doc.issuer ?? issuer
     };
   })();
@@ -794,6 +799,81 @@ function createServerClient(config, fetcher = fetch) {
   };
 }
 
+// src/session-monitor.ts
+var SETTLE_MS = 15e3;
+var GUARD_KEY = "fx-session-check";
+function recentlyActed() {
+  try {
+    return Date.now() - Number(sessionStorage.getItem(GUARD_KEY) ?? 0) < SETTLE_MS;
+  } catch {
+    return false;
+  }
+}
+function markActed() {
+  try {
+    sessionStorage.setItem(GUARD_KEY, String(Date.now()));
+  } catch {
+  }
+}
+function watchProviderSession(options = {}) {
+  if (typeof window === "undefined" || typeof document === "undefined") return () => {
+  };
+  const base = (options.basePath ?? "/auth").replace(/\/$/, "");
+  const fetcher = options.fetcher ?? fetch;
+  const onChange = options.onChange ?? (() => {
+    const login = new URLSearchParams({ prompt: "none", returnTo: location.pathname + location.search });
+    location.assign(`${base}/login?${login}`);
+  });
+  let stopped = false;
+  const cleanups = [];
+  const stop = () => {
+    stopped = true;
+    for (const cleanup of cleanups.splice(0)) cleanup();
+  };
+  void (async () => {
+    const check = await fetcher(`${base}/session-check`, { credentials: "same-origin" }).then((response) => response.ok ? response.json() : null).catch(() => null);
+    if (stopped || !check?.frame || !check.state) return;
+    const origin = new URL(check.frame).origin;
+    const frame = document.createElement("iframe");
+    frame.src = check.frame;
+    frame.title = "session check";
+    frame.setAttribute("aria-hidden", "true");
+    frame.tabIndex = -1;
+    frame.style.cssText = "position:absolute;width:0;height:0;border:0;visibility:hidden";
+    const message = `${check.clientId} ${check.state}`;
+    const ask = () => {
+      if (!stopped && document.visibilityState === "visible") frame.contentWindow?.postMessage(message, origin);
+    };
+    let confirmed = false;
+    const answer = (event) => {
+      if (event.origin !== origin || event.source !== frame.contentWindow) return;
+      if (event.data === "unchanged") confirmed = true;
+      else if (event.data === "changed") {
+        stop();
+        if (!confirmed && recentlyActed()) return;
+        markActed();
+        onChange();
+      } else if (event.data === "error") {
+        stop();
+      }
+    };
+    window.addEventListener("message", answer);
+    frame.addEventListener("load", ask);
+    document.addEventListener("visibilitychange", ask);
+    window.addEventListener("focus", ask);
+    const timer = setInterval(ask, options.intervalMs ?? 3e3);
+    document.body.appendChild(frame);
+    cleanups.push(() => {
+      window.removeEventListener("message", answer);
+      document.removeEventListener("visibilitychange", ask);
+      window.removeEventListener("focus", ask);
+      clearInterval(timer);
+      frame.remove();
+    });
+  })();
+  return stop;
+}
+
 // src/service.ts
 function paramsFromUrl(url) {
   const href = url ?? (typeof location === "undefined" ? null : location.href);
@@ -820,16 +900,19 @@ function createAuthService(options) {
 function buildAuthService(options) {
   const client = clientFor(options);
   let latest = null;
+  const fetchUserFor = async (token) => {
+    if (options.fetchUser) return options.fetchUser(token);
+    return client.fetchUser(token === COOKIE_SESSION ? void 0 : token);
+  };
+  const resumesFromCookie = options.config.tokens === "server" && typeof window !== "undefined";
+  const [ready, setReady] = createSignal(!resumesFromCookie);
   const session = createSession({
     /** The credential is the callback, so this is the code exchange. */
     async login(params) {
       latest = await client.handleCallback(params);
       return { token: latest.accessToken, expiresAt: latest.expiresAt };
     },
-    async fetchUser(token) {
-      if (options.fetchUser) return options.fetchUser(token);
-      return client.fetchUser(token === COOKIE_SESSION ? void 0 : token);
-    },
+    fetchUser: fetchUserFor,
     async refresh() {
       latest = await client.refresh();
       return { token: latest.accessToken, expiresAt: latest.expiresAt };
@@ -852,11 +935,27 @@ function buildAuthService(options) {
   });
   const hooks = createAuthHooks({
     session,
+    ready,
     navigate: options.navigate,
     loginPath: options.loginPath ?? "/login",
     homePath: options.homePath ?? "/",
     forbiddenPath: options.forbiddenPath ?? "/403"
   });
+  if (resumesFromCookie && options.config.tokens === "server" && options.config.watchSession !== false) {
+    watchProviderSession({ basePath: options.config.basePath });
+  }
+  const renderedSignedOut = hooks.store.seeded && hooks.store.value().user == null;
+  if (resumesFromCookie && renderedSignedOut) setReady(true);
+  else if (resumesFromCookie) {
+    void (async () => {
+      try {
+        await session.adopt(COOKIE_SESSION, await fetchUserFor(COOKIE_SESSION));
+      } catch {
+      } finally {
+        setReady(true);
+      }
+    })();
+  }
   return Object.assign(session, {
     client,
     protectedRoute: hooks.protectedRoute,
@@ -930,5 +1029,6 @@ export {
   paramsFromUrl,
   proofFor,
   safeReturnTo,
-  thumbprintOf
+  thumbprintOf,
+  watchProviderSession
 };