@imtf/auth 2.0.0-beta.0 → 3.0.0-beta.0

package/README.md

@@ -27,7 +27,7 @@ This package supplies IMTF's `better-auth` configuration and a couple of OIDC-fl
 ```ts
 import "server-only";
 
-import { getBetterAuthOptions } from "@imtf/auth";
+import { getBetterAuthOptions } from "@imtf/auth/server";
 import { betterAuth, type BetterAuthOptions } from "better-auth";
 
 export const auth = betterAuth({
@@ -68,7 +68,7 @@ export const POST = handler;
 ### Federated sign-out route: `app/api/auth/sign-out-url/route.ts`
 
 ```ts
-import { getSignOutUrlRoute } from "@imtf/auth";
+import { getSignOutUrlRoute } from "@imtf/auth/server";
 import { headers } from "next/headers";
 import { auth } from "@/auth";
 
@@ -76,9 +76,12 @@ export const GET = getSignOutUrlRoute({
   auth,
   discoveryUrl: `${process.env.OIDC_ISSUER_URL}/.well-known/openid-configuration`,
   headers,
+  clientId: process.env.OIDC_CLIENT_ID,
 });
 ```
 
+> `clientId` lets the route build an end-session URL even when no ID token is available — for example when the OIDC provider's callback failed before better-auth stored an account cookie (missing email claim, denied consent, etc.). Without it, that case has no way to end the provider's SSO session, which otherwise leaves the user stuck in a silent re-authentication loop.
+
 ### Session check in a server component
 
 ```ts
@@ -121,14 +124,14 @@ function SignOutButton() {
 
 ### Full export list
 
+The package has two entry points. `@imtf/auth` is safe to import from client components; `@imtf/auth/server` must only be imported from server code.
+
 ```ts
-import {
-  getBetterAuthOptions,
-  getBetterAuthClientOptions,
-  getSignOutUrlRoute,
-  useSignOut,
-  PROVIDER_ID,
-} from "@imtf/auth";
+// Client-safe — no `better-auth` server code in the module graph.
+import { getBetterAuthClientOptions, useSignOut, PROVIDER_ID } from "@imtf/auth";
+
+// Server only — pulls in `better-auth/next-js`, `better-auth/plugins` and `next/headers`.
+import { getBetterAuthOptions, getSignOutUrlRoute, PROVIDER_ID } from "@imtf/auth/server";
 ```
 
 > `getBetterAuthClientOptions` is deprecated as of `better-auth` 1.7 — generic OAuth sign-in no longer needs a client plugin, so `createAuthClient()` can be called with no options as shown above.
@@ -161,4 +164,5 @@ pnpm run test:coverage
 
 - **OAuth callback URL path changed.** The redirect URI that `better-auth` exposes for the generic OIDC provider moved from `{baseURL}/oauth2/callback/{providerId}` to `{baseURL}/callback/{providerId}` (e.g. `https://app.example.com/api/auth/oauth2/callback/oidc-provider` → `https://app.example.com/api/auth/callback/oidc-provider`). **You must update the redirect URI registered with your OIDC provider/IdP client** before deploying this upgrade, or sign-in will fail.
 - **`getSignOutUrlRoute` dropped its `providerId` option.** `better-auth`'s `getAccessToken` API no longer accepts `providerId` to select an account; it now resolves the account from the signed account cookie (`useAccountCookie: true`), matching this package's database-less, `storeAccountCookie: true` configuration. If you were passing `providerId` to `getSignOutUrlRoute`, remove it — it is no longer read.
+- **Server helpers moved to `@imtf/auth/server`.** `getBetterAuthOptions` and `getSignOutUrlRoute` are no longer exported from the package root; update those two imports to `@imtf/auth/server`. The root entry now exposes only the client-safe surface (`PROVIDER_ID`, `useSignOut`, `getBetterAuthClientOptions`). Previously the single barrel re-exported both halves, so any client component importing even a constant from `@imtf/auth` dragged `better-auth`'s server router into the browser bundle — including an unused OpenAPI reference page that loads a script from `cdn.jsdelivr.net`, which reads as a remote-script inclusion to security scanners.
 - **No client plugin is required for generic OAuth sign-in anymore.** `getBetterAuthClientOptions()` no longer registers `genericOAuthClient()` (removed upstream). Generic/custom OAuth providers now sign in through the standard `authClient.signIn.social({ provider })` / `authClient.linkSocial({ provider })` methods. No action needed on your end beyond upgrading — this package's exported options already reflect the change.

package/lib/index.esm.js

@@ -1,6 +1,4 @@
-import { PROVIDER_ID } from "./constants.esm.js";
-import { getBetterAuthOptions } from "./options/auth.esm.js";
 import { getBetterAuthClientOptions } from "./options/auth-client.esm.js";
-import { getSignOutUrlRoute } from "./routes/getSignOutUrlRoute.esm.js";
+import { PROVIDER_ID } from "./constants.esm.js";
 import { useSignOut } from "./hooks/useSignOut.esm.js";
-export { PROVIDER_ID, getBetterAuthClientOptions, getBetterAuthOptions, getSignOutUrlRoute, useSignOut };
+export { PROVIDER_ID, getBetterAuthClientOptions, useSignOut };

package/lib/routes/getSignOutUrlRoute.esm.js

@@ -1,5 +1,5 @@
 //#region src/routes/getSignOutUrlRoute.ts
-function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout = true, headers }) {
+function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout = true, headers, clientId }) {
 	/**
 	* API route that constructs a federated logout URL for OIDC providers.
 	* Returns null if federated logout is disabled.
@@ -19,7 +19,14 @@ function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout = true, header
 				body: { useAccountCookie: true },
 				headers: await headers()
 			}).catch(() => null);
-			if (!token?.idToken) return Response.json({ error: "No ID token found for user" }, { status: 400 });
+			/**
+			* No ID token is available, e.g. when the OIDC provider redirected back
+			* with an error (missing email, denied consent, etc.) before better-auth
+			* ever stored an account cookie. Without `client_id`, we have no way to
+			* end the provider's SSO session, which would otherwise leave the user
+			* stuck in a silent re-authentication loop with no way to recover.
+			*/
+			if (!token?.idToken && !clientId) return Response.json({ error: "No ID token found for user" }, { status: 400 });
 			/**
 			* Fetch the well-known configuration from the OIDC provider to construct the
 			* logout URL.
@@ -33,12 +40,17 @@ function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout = true, header
 			* Construct the logout URL with parameters.
 			* - end_session_endpoint: The OIDC provider's end_session_endpoint.
 			* - post_logout_redirect_uri: The URL to redirect to after logout.
-			* - id_token_hint: The user's ID token.
+			* - id_token_hint: The user's ID token, when available.
+			* - client_id: Fallback identity hint when there's no ID token. The
+			*   provider uses its own browser session cookie to find the SSO
+			*   session to end, so this still works without a token, though it may
+			*   show a logout confirmation page instead of ending silently.
 			*/
 			const logoutUrl = new URL(endSessionEndpoint);
 			const postLogoutRedirectUri = request.nextUrl.searchParams.get("post_logout_redirect_uri") ?? "/auth/sign-in";
 			logoutUrl.searchParams.set("post_logout_redirect_uri", postLogoutRedirectUri);
-			logoutUrl.searchParams.set("id_token_hint", token.idToken);
+			if (token?.idToken) logoutUrl.searchParams.set("id_token_hint", token.idToken);
+			else if (clientId) logoutUrl.searchParams.set("client_id", clientId);
 			return Response.json({ url: logoutUrl.toString() });
 		} catch (error) {
 			console.error("Failed to construct logout URL:", error);

package/lib/server.esm.js

@@ -0,0 +1,4 @@
+import { PROVIDER_ID } from "./constants.esm.js";
+import { getBetterAuthOptions } from "./options/auth.esm.js";
+import { getSignOutUrlRoute } from "./routes/getSignOutUrlRoute.esm.js";
+export { PROVIDER_ID, getBetterAuthOptions, getSignOutUrlRoute };

package/lib/types/index.d.ts

@@ -1,5 +1,3 @@
-export { getBetterAuthOptions } from "./options/auth";
 export { getBetterAuthClientOptions } from "./options/auth-client";
-export { getSignOutUrlRoute } from "./routes/getSignOutUrlRoute";
 export { PROVIDER_ID } from "./constants";
 export { useSignOut } from "./hooks/useSignOut";

package/lib/types/routes/getSignOutUrlRoute.d.ts

@@ -1,9 +1,15 @@
 import type { Auth } from "better-auth";
 import { headers as nextHeaders } from "next/headers";
 import type { NextRequest } from "next/server";
-export declare function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout, headers, }: {
+export declare function getSignOutUrlRoute({ auth, discoveryUrl, federatedLogout, headers, clientId, }: {
     auth: Auth;
     discoveryUrl?: string;
     federatedLogout?: boolean;
     headers: typeof nextHeaders;
+    /**
+     * OIDC client ID, used to build the end-session URL when no ID token can be
+     * retrieved (for example, when the user never completed a sign-in, so no
+     * account cookie was ever stored). Required to recover from that case.
+     */
+    clientId?: string;
 }): (request: NextRequest) => Promise<Response>;

package/lib/types/server.d.ts

@@ -0,0 +1,3 @@
+export { getBetterAuthOptions } from "./options/auth";
+export { getSignOutUrlRoute } from "./routes/getSignOutUrlRoute";
+export { PROVIDER_ID } from "./constants";

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@imtf/auth",
-  "version": "2.0.0-beta.0",
+  "version": "3.0.0-beta.0",
   "description": "Better auth wrapper for imtf usage",
   "license": "UNLICENSED",
   "author": "",
   "type": "module",
+  "sideEffects": false,
   "files": [
     "lib",
     "schemas"
@@ -15,22 +16,24 @@
     ".": {
       "types": "./lib/types/index.d.ts",
       "import": "./lib/index.esm.js"
+    },
+    "./server": {
+      "types": "./lib/types/server.d.ts",
+      "import": "./lib/server.esm.js"
     }
   },
   "dependencies": {
-    "@imtf/panache": "^5.10.2"
+    "@imtf/panache": "^6.0.1"
   },
   "peerDependencies": {
-    "@mui/lab": "^7.0.1-beta.18",
-    "@mui/material": "^7.1.0",
+    "@mui/material": "^7.1.0 || ^9.4.0",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
     "better-auth": "^1.7.1",
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@mui/lab": "^7.0.1-beta.18",
-    "@mui/material": "^7.1.0",
+    "@mui/material": "^9.4.0",
     "better-auth": "^1.7.1",
     "zod": "^4.3.6"
   },