@imtf/auth 0.0.1-alpha.0

package/lib/constants.js

@@ -0,0 +1,4 @@
+const PROVIDER_ID = "oidc-provider";
+export {
+  PROVIDER_ID
+};

package/lib/hooks/useSignOut.js

@@ -0,0 +1,54 @@
+"use client";
+import { useCallback } from "react";
+function useSignOut({
+  postLogoutRedirectPath = "/auth/sign-in?logout=success",
+  retrieveLogoutUrlPath = "/api/auth/sign-out-url",
+  navigate,
+  authClient,
+  origin = window.location.origin
+}) {
+  const standardSignOut = useCallback(() => {
+    void authClient.signOut({
+      fetchOptions: {
+        onSuccess: () => {
+          navigate(postLogoutRedirectPath);
+        }
+      }
+    });
+  }, [authClient, navigate, postLogoutRedirectPath]);
+  const handleSignOut = useCallback(async () => {
+    const postLogoutRedirectUri = `${origin}${postLogoutRedirectPath}`;
+    try {
+      const response = await fetch(
+        `${retrieveLogoutUrlPath}?post_logout_redirect_uri=${encodeURIComponent(postLogoutRedirectUri)}`
+      );
+      if (!response.ok) {
+        const { error } = await response.json().catch(() => ({ error: null }));
+        throw new Error(error ?? "Failed to create logout URL");
+      }
+      const { url } = await response.json();
+      if (!url) {
+        standardSignOut();
+        return;
+      }
+      await authClient.signOut();
+      window.location.href = url;
+    } catch (error) {
+      console.error(
+        "Error during federated logout, switching to standard logout:",
+        error
+      );
+      standardSignOut();
+    }
+  }, [
+    authClient,
+    origin,
+    postLogoutRedirectPath,
+    retrieveLogoutUrlPath,
+    standardSignOut
+  ]);
+  return { handleSignOut };
+}
+export {
+  useSignOut
+};

package/lib/index.js

@@ -0,0 +1,12 @@
+import { getBetterAuthOptions } from "./options/auth.js";
+import { getBetterAuthClientOptions } from "./options/auth-client.js";
+import { getSignOutUrlRoute } from "./routes/getSignOutUrlRoute.js";
+import { PROVIDER_ID } from "./constants.js";
+import { useSignOut } from "./hooks/useSignOut.js";
+export {
+  PROVIDER_ID,
+  getBetterAuthClientOptions,
+  getBetterAuthOptions,
+  getSignOutUrlRoute,
+  useSignOut
+};

package/lib/options/auth-client.js

@@ -0,0 +1,10 @@
+"use client";
+import { genericOAuthClient } from "better-auth/client/plugins";
+function getBetterAuthClientOptions() {
+  return {
+    plugins: [genericOAuthClient()]
+  };
+}
+export {
+  getBetterAuthClientOptions
+};

package/lib/options/auth.js

@@ -0,0 +1,61 @@
+import { nextCookies } from "better-auth/next-js";
+import { genericOAuth } from "better-auth/plugins";
+import { PROVIDER_ID } from "../constants.js";
+function getBetterAuthOptions({
+  oidcDiscoveryUrl,
+  authSecret,
+  authBaseURL,
+  authClientId,
+  authClientSecret,
+  providerId = PROVIDER_ID
+}) {
+  return {
+    secret: authSecret,
+    baseURL: authBaseURL,
+    session: {
+      cookieCache: {
+        enabled: true,
+        version: "1",
+        maxAge: 60 * 60 * 24,
+        // Cache duration in seconds (1 day)
+        strategy: "compact",
+        refreshCache: true
+        // Enable stateless refresh
+      },
+      expiresIn: 60 * 60 * 24,
+      // Session expiration (1 day)
+      updateAge: 60 * 60,
+      // How often to update the session (1 hour)
+      freshAge: 60 * 5
+      // Consider session fresh for 5 minutes
+    },
+    account: {
+      updateAccountOnSignIn: true,
+      storeStateStrategy: "cookie",
+      storeAccountCookie: true
+      // Store account data in cookie (required for database-less flows)
+    },
+    plugins: [
+      genericOAuth({
+        config: [
+          {
+            providerId,
+            clientId: authClientId,
+            clientSecret: authClientSecret,
+            discoveryUrl: oidcDiscoveryUrl,
+            scopes: ["openid"],
+            pkce: true
+          }
+        ]
+      }),
+      // Next.js cookie integration for server actions and middleware
+      nextCookies()
+    ],
+    onAPIError: {
+      errorURL: "/auth/error"
+    }
+  };
+}
+export {
+  getBetterAuthOptions
+};

package/lib/routes/getSignOutUrlRoute.js

@@ -0,0 +1,59 @@
+function getSignOutUrlRoute({
+  auth,
+  federatedLogout = true,
+  discoveryUrl,
+  providerId,
+  headers
+}) {
+  return async function GET(request) {
+    try {
+      if (!federatedLogout) {
+        return Response.json({ url: null }, { status: 200 });
+      }
+      const token = await auth.api.getAccessToken({
+        body: {
+          providerId
+        },
+        headers: await headers()
+      }).catch(() => null);
+      if (!token?.idToken) {
+        return Response.json(
+          { error: "No ID token found for user" },
+          { status: 400 }
+        );
+      }
+      const wellKnownResponse = await fetch(discoveryUrl);
+      if (!wellKnownResponse.ok) {
+        return Response.json(
+          { error: "Failed to fetch OIDC discovery document" },
+          { status: 500 }
+        );
+      }
+      const wellKnownConfig = await wellKnownResponse.json();
+      const endSessionEndpoint = wellKnownConfig.end_session_endpoint;
+      if (!endSessionEndpoint) {
+        return Response.json(
+          { error: "Could not determine end_session_endpoint" },
+          { status: 500 }
+        );
+      }
+      const logoutUrl = new URL(endSessionEndpoint);
+      const postLogoutRedirectUri = request.nextUrl.searchParams.get("post_logout_redirect_uri") ?? "/auth/sign-in";
+      logoutUrl.searchParams.set(
+        "post_logout_redirect_uri",
+        postLogoutRedirectUri
+      );
+      logoutUrl.searchParams.set("id_token_hint", token.idToken);
+      return Response.json({ url: logoutUrl.toString() });
+    } catch (error) {
+      console.error("Failed to construct logout URL:", error);
+      return Response.json(
+        { error: "Failed to construct logout URL" },
+        { status: 500 }
+      );
+    }
+  };
+}
+export {
+  getSignOutUrlRoute
+};

package/lib/types/constants.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Generic OIDC provider identifier used for authentication.
+ */
+export declare const PROVIDER_ID = "oidc-provider";

package/lib/types/hooks/useSignOut.d.ts

@@ -0,0 +1,23 @@
+import type { AuthClient } from "better-auth/client";
+import type { getBetterAuthClientOptions } from "../index";
+/**
+ * Custom hook for handling user sign-out with support for federated logout.
+ *
+ * @param params - Configuration options
+ * @param params.postLogoutRedirectPath - Path to redirect to after logout (defaults to "/auth/sign-in")
+ * @returns Object containing handleSignOut function to initiate the logout process
+ *
+ * @example
+ * ```tsx
+ * const { handleSignOut } = useSignOut({ postLogoutRedirectPath: "/auth/sign-in" });
+ * ```
+ */
+export declare function useSignOut({ postLogoutRedirectPath, retrieveLogoutUrlPath, navigate, authClient, origin, }: {
+    postLogoutRedirectPath?: string;
+    retrieveLogoutUrlPath?: string;
+    navigate: (path: string) => void;
+    authClient: AuthClient<ReturnType<typeof getBetterAuthClientOptions>>;
+    origin?: string;
+}): {
+    handleSignOut: () => Promise<void>;
+};

package/lib/types/index.d.ts

@@ -0,0 +1,5 @@
+export { getBetterAuthOptions } from "./options/auth";
+export { getBetterAuthClientOptions } from "./options/auth-client";
+export { getSignOutUrlRoute } from "./routes/getSignOutUrlRoute";
+export { PROVIDER_ID } from "./constants";
+export { useSignOut } from "./hooks/useSignOut";

package/lib/types/options/auth-client.d.ts

@@ -0,0 +1,2 @@
+import type { BetterAuthClientOptions } from "better-auth";
+export declare function getBetterAuthClientOptions(): BetterAuthClientOptions;

package/lib/types/options/auth.d.ts

@@ -0,0 +1,9 @@
+import { type BetterAuthOptions } from "better-auth";
+export declare function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, authBaseURL, authClientId, authClientSecret, providerId, }: {
+    oidcDiscoveryUrl: string;
+    authSecret: string;
+    authClientId: string;
+    authClientSecret: string;
+    providerId?: string;
+    authBaseURL?: string;
+}): BetterAuthOptions;

package/lib/types/routes/getSignOutUrlRoute.d.ts

@@ -0,0 +1,10 @@
+import type { Auth } from "better-auth";
+import { headers as nextHeaders } from "next/headers";
+import type { NextRequest } from "next/server";
+export declare function getSignOutUrlRoute({ auth, federatedLogout, discoveryUrl, providerId, headers, }: {
+    auth: Auth;
+    federatedLogout?: boolean;
+    discoveryUrl: string;
+    providerId: string;
+    headers: typeof nextHeaders;
+}): (request: NextRequest) => Promise<Response>;

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@imtf/auth",
+  "version": "0.0.1-alpha.0",
+  "description": "Better auth wrapper for imtf usage",
+  "license": "UNLICENSED",
+  "author": "",
+  "type": "module",
+  "scripts": {
+    "prebuild": "npm run build:clean",
+    "build:clean": "rimraf lib",
+    "build:js": "vite build",
+    "build:types": "tsc --project ./tsconfig.build.json && tsc-alias -p ./tsconfig.build.json",
+    "build": "concurrently npm:build:js npm:build:types",
+    "lint": "eslint src --cache --report-unused-disable-directives --max-warnings 0",
+    "test": "vitest",
+    "test:ui": "vitest --ui --coverage",
+    "test:coverage": "vitest run --coverage",
+    "typecheck": "tsc --noEmit",
+    "checks": "concurrently --kill-others-on-fail npm:lint npm:typecheck",
+    "prepublishOnly": "npm run build && npm run checks"
+  },
+  "files": [
+    "lib",
+    "schemas"
+  ],
+  "prettier": "@imtf/prettier-config",
+  "module": "./lib/index.js",
+  "types": "./lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "import": "./lib/index.js"
+    }
+  },
+  "dependencies": {
+    "@imtf/panache": "^5.5.0"
+  },
+  "peerDependencies": {
+    "@mui/lab": "^7.0.1-beta.18",
+    "@mui/material": "^7.1.0",
+    "react": "^18.0.0 || ^19.0.0",
+    "react-dom": "^18.0.0 || ^19.0.0",
+    "better-auth": "^1.4.18"
+  },
+  "devDependencies": {
+    "@mui/lab": "^7.0.1-beta.18",
+    "@mui/material": "^7.1.0",
+    "better-auth": "^1.4.18"
+  }
+}