@imtf/auth 1.0.1-beta.3 → 1.1.0-beta.2

package/lib/constants.esm.js

@@ -1,4 +1,7 @@
-const PROVIDER_ID = "oidc-provider";
-export {
-  PROVIDER_ID
-};
+//#region src/constants.ts
+/**
+* Generic OIDC provider identifier used for authentication.
+*/
+var PROVIDER_ID = "oidc-provider";
+//#endregion
+export { PROVIDER_ID };

package/lib/hooks/useSignOut.esm.js

@@ -1,57 +1,68 @@
+"use client";
 import { useCallback } from "react";
-function useSignOut({
-  postSignOutRedirectPath = "/auth/sign-in?sign-out=success",
-  retrieveSignOutUrlPath = "/api/auth/sign-out-url",
-  onSignOutStart,
-  onSignOutSuccess,
-  authClient,
-  origin: providedOrigin
-}) {
-  const origin = providedOrigin ?? (typeof window !== "undefined" ? window.location.origin : "");
-  const standardSignOut = useCallback(() => {
-    onSignOutStart?.();
-    void authClient.signOut({
-      fetchOptions: {
-        onSuccess: onSignOutSuccess
-      }
-    });
-  }, [authClient, onSignOutStart, onSignOutSuccess]);
-  const handleSignOut = useCallback(async () => {
-    const postLogoutRedirectUri = `${origin}${postSignOutRedirectPath}`;
-    try {
-      const response = await fetch(
-        `${retrieveSignOutUrlPath}?post_logout_redirect_uri=${encodeURIComponent(postLogoutRedirectUri)}`
-      );
-      if (!response.ok) {
-        const { error } = await response.json().catch(() => ({ error: null }));
-        throw new Error(error ?? "Failed to create logout URL");
-      }
-      const { url } = await response.json();
-      if (!url) {
-        standardSignOut();
-        return;
-      }
-      await authClient.signOut();
-      if (typeof window === "undefined") {
-        return;
-      }
-      window.location.href = url;
-    } catch (error) {
-      console.error(
-        "Error during federated logout, switching to standard logout:",
-        error
-      );
-      standardSignOut();
-    }
-  }, [
-    authClient,
-    origin,
-    postSignOutRedirectPath,
-    retrieveSignOutUrlPath,
-    standardSignOut
-  ]);
-  return { handleSignOut };
+//#region src/hooks/useSignOut.tsx
+/**
+* Custom hook for handling user sign-out with support for federated logout.
+*
+* @example
+* ```tsx
+* const { handleSignOut } = useSignOut({ postSignOutRedirectPath: "/auth/sign-in?sign-out=success" });
+* ```
+*/
+function useSignOut({ postSignOutRedirectPath = "/auth/sign-in?sign-out=success", retrieveSignOutUrlPath = "/api/auth/sign-out-url", onSignOutStart, onSignOutSuccess, authClient, origin: providedOrigin }) {
+	const origin = providedOrigin ?? (typeof window !== "undefined" ? window.location.origin : "");
+	/**
+	* Performs a standard (non-federated) sign-out and redirects to the sign-in page.
+	*/
+	const standardSignOut = useCallback(() => {
+		onSignOutStart?.();
+		authClient.signOut({ fetchOptions: { onSuccess: onSignOutSuccess } });
+	}, [
+		authClient,
+		onSignOutStart,
+		onSignOutSuccess
+	]);
+	return { handleSignOut: useCallback(async () => {
+		const postLogoutRedirectUri = `${origin}${postSignOutRedirectPath}`;
+		/**
+		* Attempt federated logout. This is, surprisingly, not built into better-auth:
+		*/
+		try {
+			/**
+			* Create a logout URL before we invoke authClient.signOut(), since it clears critical tokens.
+			*/
+			const response = await fetch(`${retrieveSignOutUrlPath}?post_logout_redirect_uri=${encodeURIComponent(postLogoutRedirectUri)}`);
+			if (!response.ok) {
+				const { error } = await response.json().catch(() => ({ error: null }));
+				throw new Error(error ?? "Failed to create logout URL");
+			}
+			const { url } = await response.json();
+			if (!url) {
+				standardSignOut();
+				return;
+			}
+			/**
+			* Sign out from better-auth, then redirect the user to the OIDC provider's
+			* end_session_endpoint to terminate the federated session. The provider
+			* should automatically redirect back to the application after logout.
+			*/
+			await authClient.signOut();
+			if (typeof window === "undefined") return;
+			window.location.href = url;
+		} catch (error) {
+			console.error("Error during federated logout, switching to standard logout:", error);
+			/**
+			* Fallback: Standard logout
+			*/
+			standardSignOut();
+		}
+	}, [
+		authClient,
+		origin,
+		postSignOutRedirectPath,
+		retrieveSignOutUrlPath,
+		standardSignOut
+	]) };
 }
-export {
-  useSignOut
-};
+//#endregion
+export { useSignOut };

package/lib/index.esm.js

@@ -1,12 +1,6 @@
+import { PROVIDER_ID } from "./constants.esm.js";
 import { getBetterAuthOptions } from "./options/auth.esm.js";
 import { getBetterAuthClientOptions } from "./options/auth-client.esm.js";
 import { getSignOutUrlRoute } from "./routes/getSignOutUrlRoute.esm.js";
-import { PROVIDER_ID } from "./constants.esm.js";
 import { useSignOut } from "./hooks/useSignOut.esm.js";
-export {
-  PROVIDER_ID,
-  getBetterAuthClientOptions,
-  getBetterAuthOptions,
-  getSignOutUrlRoute,
-  useSignOut
-};
+export { PROVIDER_ID, getBetterAuthClientOptions, getBetterAuthOptions, getSignOutUrlRoute, useSignOut };

package/lib/options/auth-client.esm.js

@@ -1,9 +1,8 @@
+"use client";
 import { genericOAuthClient } from "better-auth/client/plugins";
+//#region src/options/auth-client.ts
 function getBetterAuthClientOptions() {
-  return {
-    plugins: [genericOAuthClient()]
-  };
+	return { plugins: [genericOAuthClient()] };
 }
-export {
-  getBetterAuthClientOptions
-};
+//#endregion
+export { getBetterAuthClientOptions };

package/lib/options/auth.esm.js

@@ -1,61 +1,42 @@
+import { PROVIDER_ID } from "../constants.esm.js";
 import { nextCookies } from "better-auth/next-js";
 import { genericOAuth } from "better-auth/plugins";
-import { PROVIDER_ID } from "../constants.esm.js";
-function getBetterAuthOptions({
-  oidcDiscoveryUrl,
-  authSecret,
-  authBaseURL,
-  authClientId,
-  authClientSecret,
-  providerId = PROVIDER_ID
-}) {
-  return {
-    secret: authSecret,
-    baseURL: authBaseURL,
-    session: {
-      cookieCache: {
-        enabled: true,
-        version: "1",
-        maxAge: 60 * 60 * 24,
-        // Cache duration in seconds (1 day)
-        strategy: "compact",
-        refreshCache: true
-        // Enable stateless refresh
-      },
-      expiresIn: 60 * 60 * 24,
-      // Session expiration (1 day)
-      updateAge: 60 * 60,
-      // How often to update the session (1 hour)
-      freshAge: 60 * 5
-      // Consider session fresh for 5 minutes
-    },
-    account: {
-      updateAccountOnSignIn: true,
-      storeStateStrategy: "cookie",
-      storeAccountCookie: true
-      // Store account data in cookie (required for database-less flows)
-    },
-    plugins: [
-      genericOAuth({
-        config: [
-          {
-            providerId,
-            clientId: authClientId,
-            clientSecret: authClientSecret,
-            discoveryUrl: oidcDiscoveryUrl,
-            scopes: ["openid"],
-            pkce: true
-          }
-        ]
-      }),
-      // Next.js cookie integration for server actions and middleware
-      nextCookies()
-    ],
-    onAPIError: {
-      errorURL: "/auth/error"
-    }
-  };
+//#region src/options/auth.ts
+function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, authBaseURL, authClientId, authClientSecret, providerId = PROVIDER_ID }) {
+	/**
+	* Better-auth configuration with OIDC/OAuth2 support.
+	* Uses cookie-based session storage for database-less authentication.
+	*/
+	return {
+		secret: authSecret,
+		baseURL: authBaseURL,
+		session: {
+			cookieCache: {
+				enabled: true,
+				version: "1",
+				maxAge: 3600 * 24,
+				strategy: "jwe",
+				refreshCache: true
+			},
+			expiresIn: 3600 * 24,
+			updateAge: 3600,
+			freshAge: 300
+		},
+		account: {
+			updateAccountOnSignIn: true,
+			storeStateStrategy: "cookie",
+			storeAccountCookie: true
+		},
+		plugins: [genericOAuth({ config: [{
+			providerId,
+			clientId: authClientId,
+			clientSecret: authClientSecret,
+			discoveryUrl: oidcDiscoveryUrl,
+			scopes: ["openid"],
+			pkce: true
+		}] }), nextCookies()],
+		onAPIError: { errorURL: "/auth/error" }
+	};
 }
-export {
-  getBetterAuthOptions
-};
+//#endregion
+export { getBetterAuthOptions };

package/lib/routes/getSignOutUrlRoute.esm.js

@@ -1,60 +1,48 @@
 import { PROVIDER_ID } from "../constants.esm.js";
-function getSignOutUrlRoute({
-  auth,
-  discoveryUrl,
-  federatedLogout = true,
-  providerId = PROVIDER_ID,
-  headers
-}) {
-  return async function GET(request) {
-    try {
-      if (!federatedLogout || !discoveryUrl) {
-        return Response.json({ url: null }, { status: 200 });
-      }
-      const token = await auth.api.getAccessToken({
-        body: {
-          providerId
-        },
-        headers: await headers()
-      }).catch(() => null);
-      if (!token?.idToken) {
-        return Response.json(
-          { error: "No ID token found for user" },
-          { status: 400 }
-        );
-      }
-      const wellKnownResponse = await fetch(discoveryUrl);
-      if (!wellKnownResponse.ok) {
-        return Response.json(
-          { error: "Failed to fetch OIDC discovery document" },
-          { status: 500 }
-        );
-      }
-      const wellKnownConfig = await wellKnownResponse.json();
-      const endSessionEndpoint = wellKnownConfig.end_session_endpoint;
-      if (!endSessionEndpoint) {
-        return Response.json(
-          { error: "Could not determine end_session_endpoint" },
-          { status: 500 }
-        );
-      }
-      const logoutUrl = new URL(endSessionEndpoint);
-      const postLogoutRedirectUri = request.nextUrl.searchParams.get("post_logout_redirect_uri") ?? "/auth/sign-in";
-      logoutUrl.searchParams.set(
-        "post_logout_redirect_uri",
-        postLogoutRedirectUri
-      );
-      logoutUrl.searchParams.set("id_token_hint", token.idToken);
-      return Response.json({ url: logoutUrl.toString() });
-    } catch (error) {
-      console.error("Failed to construct logout URL:", error);
-      return Response.json(
-        { error: "Failed to construct logout URL" },
-        { status: 500 }
-      );
-    }
-  };
+//#region src/routes/getSignOutUrlRoute.ts
+function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout = true, providerId = PROVIDER_ID, headers }) {
+	/**
+	* API route that constructs a federated logout URL for OIDC providers.
+	* Returns null if federated logout is disabled.
+	*
+	* @param request - Next.js request object with optional post_logout_redirect_uri parameter
+	* @returns JSON response with logout URL or error
+	*/
+	return async function GET(request) {
+		try {
+			if (!federatedLogout || !discoveryUrl) return Response.json({ url: null }, { status: 200 });
+			/**
+			* Retrieve the user's ID token, to produce a valid logout URL.
+			*/
+			const token = await auth.api.getAccessToken({
+				body: { providerId },
+				headers: await headers()
+			}).catch(() => null);
+			if (!token?.idToken) return Response.json({ error: "No ID token found for user" }, { status: 400 });
+			/**
+			* Fetch the well-known configuration from the OIDC provider to construct the
+			* logout URL.
+			*/
+			const wellKnownResponse = await fetch(discoveryUrl);
+			if (!wellKnownResponse.ok) return Response.json({ error: "Failed to fetch OIDC discovery document" }, { status: 500 });
+			const endSessionEndpoint = (await wellKnownResponse.json()).end_session_endpoint;
+			if (!endSessionEndpoint) return Response.json({ error: "Could not determine end_session_endpoint" }, { status: 500 });
+			/**
+			* Construct the logout URL with parameters.
+			* - end_session_endpoint: The OIDC provider's end_session_endpoint.
+			* - post_logout_redirect_uri: The URL to redirect to after logout.
+			* - id_token_hint: The user's ID token.
+			*/
+			const logoutUrl = new URL(endSessionEndpoint);
+			const postLogoutRedirectUri = request.nextUrl.searchParams.get("post_logout_redirect_uri") ?? "/auth/sign-in";
+			logoutUrl.searchParams.set("post_logout_redirect_uri", postLogoutRedirectUri);
+			logoutUrl.searchParams.set("id_token_hint", token.idToken);
+			return Response.json({ url: logoutUrl.toString() });
+		} catch (error) {
+			console.error("Failed to construct logout URL:", error);
+			return Response.json({ error: "Failed to construct logout URL" }, { status: 500 });
+		}
+	};
 }
-export {
-  getSignOutUrlRoute
-};
+//#endregion
+export { getSignOutUrlRoute };

package/lib/types/hooks/useSignOut.d.ts

@@ -33,6 +33,6 @@ export type UseSignOutOptions = {
  * const { handleSignOut } = useSignOut({ postSignOutRedirectPath: "/auth/sign-in?sign-out=success" });
  * ```
  */
-export declare function useSignOut({ postSignOutRedirectPath, retrieveSignOutUrlPath, onSignOutStart, onSignOutSuccess, authClient, origin: providedOrigin, }: UseSignOutOptions): {
+export declare function useSignOut({ postSignOutRedirectPath, retrieveSignOutUrlPath, onSignOutStart, onSignOutSuccess, authClient, origin: providedOrigin }: UseSignOutOptions): {
     handleSignOut: () => Promise<void>;
 };

package/lib/types/options/auth-client.d.ts

@@ -1,8 +1,10 @@
 export declare function getBetterAuthClientOptions(): {
     readonly plugins: [{
         id: "generic-oauth-client";
+        version: string;
         $InferServerPlugin: ReturnType<(options: import("better-auth/plugins").GenericOAuthOptions) => {
             id: "generic-oauth";
+            version: string;
             init: (ctx: import("better-auth").AuthContext) => {
                 context: {
                     socialProviders: import("better-auth").OAuthProvider<Record<string, any>, Partial<import("better-auth").ProviderOptions<any>>>[];
@@ -20,7 +22,7 @@ export declare function getBetterAuthClientOptions(): {
                         scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
                         requestSignUp: import("zod").ZodOptional<import("zod").ZodBoolean>;
                         additionalData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
-                    }, import("better-auth").$strip>;
+                    }, import("zod/v4/core").$strip>;
                     metadata: {
                         openapi: {
                             description: string;
@@ -58,7 +60,7 @@ export declare function getBetterAuthClientOptions(): {
                         error_description: import("zod").ZodOptional<import("zod").ZodString>;
                         state: import("zod").ZodOptional<import("zod").ZodString>;
                         iss: import("zod").ZodOptional<import("zod").ZodString>;
-                    }, import("better-auth").$strip>;
+                    }, import("zod/v4/core").$strip>;
                     metadata: {
                         allowedMediaTypes: string[];
                         openapi: {
@@ -91,7 +93,7 @@ export declare function getBetterAuthClientOptions(): {
                         callbackURL: import("zod").ZodString;
                         scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
                         errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                    }, import("better-auth").$strip>;
+                    }, import("zod/v4/core").$strip>;
                     use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
                         session: {
                             session: Record<string, any> & {

package/lib/types/options/auth.d.ts

@@ -1,4 +1,4 @@
-export declare function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, authBaseURL, authClientId, authClientSecret, providerId, }: {
+export declare function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, authBaseURL, authClientId, authClientSecret, providerId }: {
     oidcDiscoveryUrl: string;
     authSecret: string;
     authClientId: string;
@@ -13,7 +13,7 @@ export declare function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, aut
             readonly enabled: true;
             readonly version: "1";
             readonly maxAge: number;
-            readonly strategy: "compact";
+            readonly strategy: "jwe";
             readonly refreshCache: true;
         };
         readonly expiresIn: number;
@@ -27,6 +27,7 @@ export declare function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, aut
     };
     readonly plugins: [{
         id: "generic-oauth";
+        version: string;
         init: (ctx: import("better-auth").AuthContext) => {
             context: {
                 socialProviders: import("better-auth").OAuthProvider<Record<string, any>, Partial<import("better-auth").ProviderOptions<any>>>[];
@@ -44,7 +45,7 @@ export declare function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, aut
                     scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
                     requestSignUp: import("zod").ZodOptional<import("zod").ZodBoolean>;
                     additionalData: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodAny>>;
-                }, import("better-auth").$strip>;
+                }, import("zod/v4/core").$strip>;
                 metadata: {
                     openapi: {
                         description: string;
@@ -82,7 +83,7 @@ export declare function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, aut
                     error_description: import("zod").ZodOptional<import("zod").ZodString>;
                     state: import("zod").ZodOptional<import("zod").ZodString>;
                     iss: import("zod").ZodOptional<import("zod").ZodString>;
-                }, import("better-auth").$strip>;
+                }, import("zod/v4/core").$strip>;
                 metadata: {
                     allowedMediaTypes: string[];
                     openapi: {
@@ -115,7 +116,7 @@ export declare function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, aut
                     callbackURL: import("zod").ZodString;
                     scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString>>;
                     errorCallbackURL: import("zod").ZodOptional<import("zod").ZodString>;
-                }, import("better-auth").$strip>;
+                }, import("zod/v4/core").$strip>;
                 use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
                     session: {
                         session: Record<string, any> & {
@@ -187,6 +188,7 @@ export declare function getBetterAuthOptions({ oidcDiscoveryUrl, authSecret, aut
         };
     }, {
         id: "next-cookies";
+        version: string;
         hooks: {
             before: {
                 matcher(ctx: import("better-auth").HookEndpointContext): boolean;

package/lib/types/routes/getSignOutUrlRoute.d.ts

@@ -1,7 +1,7 @@
 import type { Auth } from "better-auth";
 import { headers as nextHeaders } from "next/headers";
 import type { NextRequest } from "next/server";
-export declare function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout, providerId, headers, }: {
+export declare function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout, providerId, headers }: {
     auth: Auth;
     discoveryUrl?: string;
     federatedLogout?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@imtf/auth",
-  "version": "1.0.1-beta.3",
+  "version": "1.1.0-beta.2",
   "description": "Better auth wrapper for imtf usage",
   "license": "UNLICENSED",
   "author": "",
@@ -9,13 +9,13 @@
     "prebuild": "npm run build:clean",
     "build:clean": "rimraf lib",
     "build:js": "vite build",
-    "build:types": "tsc --project ./tsconfig.build.json && tsc-alias -p ./tsconfig.build.json",
+    "build:types": "tsgo --project ./tsconfig.build.json && tsc-alias -p ./tsconfig.build.json",
     "build": "concurrently npm:build:js npm:build:types",
     "lint": "eslint src --cache --report-unused-disable-directives --max-warnings 0",
     "test": "vitest",
     "test:ui": "vitest --ui --coverage",
     "test:coverage": "vitest run --coverage",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsgo --noEmit",
     "checks": "concurrently --kill-others-on-fail npm:lint npm:typecheck",
     "prepublishOnly": "npm run build && npm run checks"
   },
@@ -33,18 +33,18 @@
     }
   },
   "dependencies": {
-    "@imtf/panache": "^5.6.0"
+    "@imtf/panache": "^5.9.0"
   },
   "peerDependencies": {
     "@mui/lab": "^7.0.1-beta.18",
     "@mui/material": "^7.1.0",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
-    "better-auth": "^1.4.18"
+    "better-auth": "^1.5.3"
   },
   "devDependencies": {
     "@mui/lab": "^7.0.1-beta.18",
     "@mui/material": "^7.1.0",
-    "better-auth": "^1.4.18"
+    "better-auth": "^1.5.3"
   }
 }