@lpshanley/oidc-start-react 0.4.2 → 0.4.3

package/dist/context.d.ts

@@ -12,6 +12,8 @@ export type OidcContext = {
     auth: () => OidcAuth;
     /** Queue a Set-Cookie line for the final response. */
     appendSetCookie: (line: string) => void;
+    /** Drop cookie writes from resolving the incoming session when a handler supersedes it. */
+    discardSessionUpdates?: () => void;
 };
 /** The current request's OIDC context; throws outside the middleware. */
 export declare function getOidcContext(): OidcContext;

package/dist/middleware.js

@@ -29,7 +29,8 @@ export function oidcMiddleware(setup) {
         }
         const call = callContext(context);
         const { cookies, session, setCookies } = await core.resolve(request, call);
-        const pending = [...setCookies];
+        let sessionUpdates = setCookies;
+        const appended = [];
         const oidc = {
             core,
             request,
@@ -37,9 +38,11 @@ export function oidcMiddleware(setup) {
             session,
             call,
             auth: () => ({ user: session?.user ?? null }),
-            appendSetCookie: (line) => pending.push(line),
+            appendSetCookie: (line) => appended.push(line),
+            discardSessionUpdates: () => { sessionUpdates = []; },
         };
         const result = await next({ context: { oidc } });
+        const pending = [...sessionUpdates, ...appended];
         if (pending.length) {
             // Start must receive its original response to serialize RPC redirects.
             const { appendResponseHeader } = await import("@tanstack/react-start/server");

package/dist/routes.server.js

@@ -46,6 +46,8 @@ export async function signInRoute(request, options) {
 export async function callbackRoute(request, options) {
     const context = getOidcContext();
     const result = await context.core.callback(request, context.cookies, context.call);
+    if (result.ok)
+        context.discardSessionUpdates?.();
     for (const line of result.setCookies)
         context.appendSetCookie(line);
     if (result.ok)

package/dist/sign-out.server.js

@@ -1,6 +1,9 @@
 import { getOidcContext } from "./context.js";
 export async function endSession(everywhere = false) {
     const context = getOidcContext();
+    // A failed revocation must leave the incoming cookie available for retry.
+    // A successful sign-out supplies all deletions for that same incoming jar.
+    context.discardSessionUpdates?.();
     let result;
     try {
         result = await context.core.signOut(context.request, context.cookies, context.session, context.call, everywhere);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lpshanley/oidc-start-react",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -40,7 +40,7 @@
     "node": ">=22.12.0"
   },
   "dependencies": {
-    "@lpshanley/oidc-start-core": "0.4.2",
+    "@lpshanley/oidc-start-core": "0.4.3",
     "zod": "4.6.7"
   },
   "devDependencies": {