@imtf/auth 2.0.0-beta.0 → 2.0.0

package/README.md

@@ -76,9 +76,12 @@ export const GET = getSignOutUrlRoute({
   auth,
   discoveryUrl: `${process.env.OIDC_ISSUER_URL}/.well-known/openid-configuration`,
   headers,
+  clientId: process.env.OIDC_CLIENT_ID,
 });
 ```
 
+> `clientId` lets the route build an end-session URL even when no ID token is available — for example when the OIDC provider's callback failed before better-auth stored an account cookie (missing email claim, denied consent, etc.). Without it, that case has no way to end the provider's SSO session, which otherwise leaves the user stuck in a silent re-authentication loop.
+
 ### Session check in a server component
 
 ```ts

package/lib/routes/getSignOutUrlRoute.esm.js

@@ -1,5 +1,5 @@
 //#region src/routes/getSignOutUrlRoute.ts
-function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout = true, headers }) {
+function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout = true, headers, clientId }) {
 	/**
 	* API route that constructs a federated logout URL for OIDC providers.
 	* Returns null if federated logout is disabled.
@@ -19,7 +19,14 @@ function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout = true, header
 				body: { useAccountCookie: true },
 				headers: await headers()
 			}).catch(() => null);
-			if (!token?.idToken) return Response.json({ error: "No ID token found for user" }, { status: 400 });
+			/**
+			* No ID token is available, e.g. when the OIDC provider redirected back
+			* with an error (missing email, denied consent, etc.) before better-auth
+			* ever stored an account cookie. Without `client_id`, we have no way to
+			* end the provider's SSO session, which would otherwise leave the user
+			* stuck in a silent re-authentication loop with no way to recover.
+			*/
+			if (!token?.idToken && !clientId) return Response.json({ error: "No ID token found for user" }, { status: 400 });
 			/**
 			* Fetch the well-known configuration from the OIDC provider to construct the
 			* logout URL.
@@ -33,12 +40,17 @@ function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout = true, header
 			* Construct the logout URL with parameters.
 			* - end_session_endpoint: The OIDC provider's end_session_endpoint.
 			* - post_logout_redirect_uri: The URL to redirect to after logout.
-			* - id_token_hint: The user's ID token.
+			* - id_token_hint: The user's ID token, when available.
+			* - client_id: Fallback identity hint when there's no ID token. The
+			*   provider uses its own browser session cookie to find the SSO
+			*   session to end, so this still works without a token, though it may
+			*   show a logout confirmation page instead of ending silently.
 			*/
 			const logoutUrl = new URL(endSessionEndpoint);
 			const postLogoutRedirectUri = request.nextUrl.searchParams.get("post_logout_redirect_uri") ?? "/auth/sign-in";
 			logoutUrl.searchParams.set("post_logout_redirect_uri", postLogoutRedirectUri);
-			logoutUrl.searchParams.set("id_token_hint", token.idToken);
+			if (token?.idToken) logoutUrl.searchParams.set("id_token_hint", token.idToken);
+			else if (clientId) logoutUrl.searchParams.set("client_id", clientId);
 			return Response.json({ url: logoutUrl.toString() });
 		} catch (error) {
 			console.error("Failed to construct logout URL:", error);

package/lib/types/routes/getSignOutUrlRoute.d.ts

@@ -1,9 +1,15 @@
 import type { Auth } from "better-auth";
 import { headers as nextHeaders } from "next/headers";
 import type { NextRequest } from "next/server";
-export declare function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout, headers, }: {
+export declare function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout, headers, clientId, }: {
     auth: Auth;
     discoveryUrl?: string;
     federatedLogout?: boolean;
     headers: typeof nextHeaders;
+    /**
+     * OIDC client ID, used to build the end-session URL when no ID token can be
+     * retrieved (for example, when the user never completed a sign-in, so no
+     * account cookie was ever stored). Required to recover from that case.
+     */
+    clientId?: string;
 }): (request: NextRequest) => Promise<Response>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@imtf/auth",
-  "version": "2.0.0-beta.0",
+  "version": "2.0.0",
   "description": "Better auth wrapper for imtf usage",
   "license": "UNLICENSED",
   "author": "",
@@ -18,19 +18,17 @@
     }
   },
   "dependencies": {
-    "@imtf/panache": "^5.10.2"
+    "@imtf/panache": "^6.0.0"
   },
   "peerDependencies": {
-    "@mui/lab": "^7.0.1-beta.18",
-    "@mui/material": "^7.1.0",
+    "@mui/material": "^7.1.0 || ^9.4.0",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
     "better-auth": "^1.7.1",
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@mui/lab": "^7.0.1-beta.18",
-    "@mui/material": "^7.1.0",
+    "@mui/material": "^9.4.0",
     "better-auth": "^1.7.1",
     "zod": "^4.3.6"
   },