@lpshanley/oidc-start-react 0.5.0 → 0.7.0

package/README.md

@@ -51,6 +51,8 @@ export const startInstance = createStart(() => ({
 }))
 ```
 
+`oidcMiddleware` serves one core. The `core` function takes no arguments and runs once, on the first request; its result is reused for every request after. It cannot pick a configuration per request.
+
 ## 3. Add the callback route
 
 Create `src/routes/callback.ts`. The handler checks the provider response, establishes the session, and redirects to the local path chosen at sign-in.

package/dist/client.d.ts

@@ -1,5 +1,5 @@
 import { type ReactElement, type ReactNode } from "react";
-import { type AuthSession, type SignInOptions, type SignOutOptions } from "@lpshanley/oidc-start-core/models";
+import type { AuthSession, SignInOptions, SignOutOptions } from "@lpshanley/oidc-start-core/models";
 /** Supply the root loader's getAuth() result for SSR and client navigation. */
 export declare function AuthProvider({ auth, children }: {
     auth: AuthSession;

package/dist/client.js

@@ -1,6 +1,6 @@
 import { createContext, createElement, Fragment, useContext } from "react";
 import { useServerFn } from "@tanstack/react-start";
-import { hasRole } from "@lpshanley/oidc-start-core/models";
+import { hasRole } from "@lpshanley/oidc-start-core/helpers";
 import { getSignInUrl, signOut } from "./functions.js";
 const AuthContext = createContext(undefined);
 /** Supply the root loader's getAuth() result for SSR and client navigation. */

package/dist/functions.d.ts

@@ -40,7 +40,10 @@ export declare function requireRecentAuth(options: GuardOptions & {
         roles?: string[] | undefined;
     };
 }>;
-/** An authorization URL; also queues the flow's verifier cookie. */
+/**
+ * An authorization URL; also starts a flow and queues its verifier cookie.
+ * That is a state change, so it is a POST and the CSRF middleware covers it.
+ */
 export declare const getSignInUrl: import("@tanstack/react-start").OptionalFetcher<undefined, z.ZodOptional<z.ZodObject<{
     returnPathname: z.ZodOptional<z.ZodString>;
     maxAge: z.ZodOptional<z.ZodNumber>;

package/dist/functions.js

@@ -1,7 +1,8 @@
 import { createServerFn } from "@tanstack/react-start";
 import { redirect } from "@tanstack/react-router";
 import { z } from "zod";
-import { sanitizeReturnPath, signInOptionsSchema, signOutOptionsSchema } from "@lpshanley/oidc-start-core/models";
+import { sanitizeReturnPath } from "@lpshanley/oidc-start-core/helpers";
+import { signInOptionsSchema, signOutOptionsSchema } from "@lpshanley/oidc-start-core/models";
 // Server functions after WorkOS's server-functions.ts; bodies load lazily so
 // server code stays out of the client bundle.
 /** The signed-in user, or null. Never returns tokens. */
@@ -36,8 +37,11 @@ export async function requireRecentAuth(options) {
         redirectToSignIn(options, options.maxAge);
     return { user };
 }
-/** An authorization URL; also queues the flow's verifier cookie. */
-export const getSignInUrl = createServerFn({ method: "GET" })
+/**
+ * An authorization URL; also starts a flow and queues its verifier cookie.
+ * That is a state change, so it is a POST and the CSRF middleware covers it.
+ */
+export const getSignInUrl = createServerFn({ method: "POST" })
     .validator(signInOptionsSchema.optional())
     .handler(async ({ data }) => {
     const { getSignInUrlBody } = await import("./functions.server.js");

package/dist/functions.server.js

@@ -20,6 +20,7 @@ export function getRecentAuthBody(maxAge) {
     return checkRecentAuth({ maxAge }).isStale ? { user: null } : auth;
 }
 export async function getSignInUrlBody(options) {
+    setResponseHeader("Cache-Control", "no-store");
     const context = getOidcContext();
     const { url, setCookies } = await context.core.signIn(context.request, context.cookies, options, context.call);
     for (const line of setCookies)

package/dist/middleware.d.ts

@@ -3,10 +3,12 @@ import type { OidcContext } from "./context.js";
 import type { OidcCore } from "@lpshanley/oidc-start-core";
 export type OidcMiddlewareSetup = OidcMiddlewareOptions | {
     /**
-     * A core the app composed itself, resolved on first request from
-     * the context earlier request middleware provided.
+     * A core the app composed itself. One middleware serves one core:
+     * this is called once, on the first request, and the result is
+     * reused for every request after. It cannot choose a core per
+     * request. For several tenants, create one middleware per tenant.
      */
-    core: (context: unknown) => OidcCore;
+    core: () => OidcCore;
 };
 /**
  * Request middleware after WorkOS's authkitMiddleware: resolves the session

package/dist/middleware.js

@@ -22,7 +22,7 @@ export function oidcMiddleware(setup) {
     let core;
     return createMiddleware({ type: "request" }).server(async ({ request, next, context }) => {
         if ("core" in setup)
-            core ??= setup.core(context);
+            core ??= setup.core();
         else {
             const { createOidcCore } = await import("@lpshanley/oidc-start-core");
             core ??= createOidcCore(setup);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lpshanley/oidc-start-react",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -40,7 +40,7 @@
     "node": ">=22.12.0"
   },
   "dependencies": {
-    "@lpshanley/oidc-start-core": "0.5.0",
+    "@lpshanley/oidc-start-core": "0.7.0",
     "zod": "4.6.7"
   },
   "devDependencies": {