@nihplod/sso-sdk 1.1.0 → 1.2.1

package/dist/react/index.mjs

@@ -84,6 +84,7 @@ var TOKEN_KEY = "token";
 var VERIFIER_KEY_PREFIX = "pkce_verifier_";
 var STATE_KEY = "oauth_state";
 var RETURN_URL_KEY = "return_url";
+var LOGOUT_STATE_KEY = "logout_state";
 function buildKey(base, clientId) {
   return clientId ? `${base}:${clientId}` : base;
 }
@@ -130,7 +131,7 @@ function createSessionStorageAdapter() {
   };
 }
 var _transient = createSessionStorageAdapter();
-var _storage = memoryStorageAdapter;
+var _storage = createSessionStorageAdapter();
 function saveTokenData(data, clientId) {
   _storage.set(buildKey(TOKEN_KEY, clientId), JSON.stringify(data));
 }
@@ -164,6 +165,15 @@ function getOAuthState(clientId) {
 function removeOAuthState(clientId) {
   _transient.remove(buildKey(STATE_KEY, clientId));
 }
+function saveLogoutState(state, clientId) {
+  _transient.set(buildKey(LOGOUT_STATE_KEY, clientId), state);
+}
+function getLogoutState(clientId) {
+  return _transient.get(buildKey(LOGOUT_STATE_KEY, clientId));
+}
+function removeLogoutState(clientId) {
+  _transient.remove(buildKey(LOGOUT_STATE_KEY, clientId));
+}
 function saveReturnUrl(url, clientId) {
   _transient.set(buildKey(RETURN_URL_KEY, clientId), url);
 }
@@ -178,6 +188,7 @@ function clearAllSsoData(clientId) {
     removeTokenData(clientId);
     removeOAuthState(clientId);
     removeReturnUrl(clientId);
+    removeLogoutState(clientId);
     removePkceVerifier(clientId);
     removePkceVerifier(`${clientId}_popup_nonce`);
     return;
@@ -185,6 +196,7 @@ function clearAllSsoData(clientId) {
   removeTokenData();
   removeOAuthState();
   removeReturnUrl();
+  removeLogoutState();
   const prefix = STORAGE_PREFIX + VERIFIER_KEY_PREFIX;
   const stores = [
     typeof sessionStorage !== "undefined" ? sessionStorage : null,
@@ -207,6 +219,7 @@ function clearAllSsoData(clientId) {
 // src/core/security.ts
 function isTrustedReturnUrl(url, currentOrigin) {
   if (!url) return false;
+  if (url.includes("\\")) return false;
   if (url.startsWith("/") && !url.startsWith("//")) return true;
   try {
     return new URL(url).origin === currentOrigin;
@@ -412,7 +425,7 @@ async function validateIdToken(idToken, accessToken, expectedIssuer, expectedCli
   if (typeof payload.exp !== "number") {
     throw new SsoError("id_token_invalid", "ID Token \u7F3A\u5C11 exp \u58F0\u660E");
   }
-  if (Date.now() >= payload.exp * 1e3) {
+  if (Date.now() >= payload.exp * 1e3 + 6e4) {
     throw new SsoError("id_token_expired", "ID Token \u5DF2\u8FC7\u671F");
   }
   if (typeof payload.iat === "number" && payload.iat * 1e3 > Date.now() + 6e4) {
@@ -505,7 +518,7 @@ var _SsoClient = class _SsoClient {
    */
   _saveReturnUrlIfTrusted(returnUrl) {
     if (isTrustedReturnUrl(returnUrl, window.location.origin)) {
-      saveReturnUrl(returnUrl);
+      saveReturnUrl(returnUrl, this.config.clientId);
     } else {
       console.warn(`[SSO SDK] returnUrl \u672A\u901A\u8FC7\u540C\u6E90\u6821\u9A8C\uFF0C\u5DF2\u5FFD\u7565: ${returnUrl}`);
     }
@@ -521,6 +534,10 @@ var _SsoClient = class _SsoClient {
    *
    * @param returnUrl - 登录成功后的返回地址（可选，保存到 sessionStorage；
    *   仅允许相对路径或同源绝对 URL，否则忽略并告警）
+   *
+   * ⚠️ 不要与 getLoginUrl() 混用：两者都会重新生成并覆盖 sessionStorage 中的
+   * state / PKCE verifier，先调用的那次授权流程将因 state 不匹配而失败。
+   * 同一次登录只使用其中一个入口。
    */
   async login(returnUrl) {
     const verifier = generateCodeVerifier();
@@ -546,6 +563,10 @@ var _SsoClient = class _SsoClient {
    * 构建登录 URL（不跳转，返回 URL 字符串）
    *
    * 适用于需要手动处理跳转的场景。
+   *
+   * ⚠️ 不要与 login() 混用：两者都会重新生成并覆盖 sessionStorage 中的
+   * state / PKCE verifier，先调用的那次授权流程将因 state 不匹配而失败。
+   * 同一次登录只使用其中一个入口。
    */
   async getLoginUrl(returnUrl) {
     const verifier = generateCodeVerifier();
@@ -698,7 +719,7 @@ var _SsoClient = class _SsoClient {
    * 处理 OAuth 回调
    *
    * 解析回调 URL，校验 state 参数，用授权码交换 token。
-   * 成功后 token 自动保存到 token 存储（默认内存，可通过 setTokenStorage 定制）。
+   * 成功后 token 自动保存到 token 存储（默认 sessionStorage，可通过 setTokenStorage 定制）。
    *
    * @param callbackUrl - 完整的回调 URL（window.location.href）
    * @returns TokenData 或 null
@@ -708,12 +729,16 @@ var _SsoClient = class _SsoClient {
     const params = url.searchParams;
     const error = params.get("error");
     if (error) {
+      removeOAuthState(this.config.clientId);
+      removePkceVerifier(this.config.clientId);
       const desc = params.get("error_description") || error;
-      throw new SsoError("token_request_failed", `\u6388\u6743\u5931\u8D25: ${desc}`);
+      throw new SsoError(mapOAuthErrorToSsoCode(error), `\u6388\u6743\u5931\u8D25: ${desc}`);
     }
     const code = params.get("code");
     const returnedState = params.get("state");
     if (!code) {
+      removeOAuthState(this.config.clientId);
+      removePkceVerifier(this.config.clientId);
       throw new SsoError("token_request_failed", "\u56DE\u8C03 URL \u4E2D\u7F3A\u5C11 authorization code");
     }
     const savedState = getOAuthState(this.config.clientId);
@@ -765,8 +790,6 @@ var _SsoClient = class _SsoClient {
       );
     }
     const data = await res.json();
-    removeOAuthState(this.config.clientId);
-    removePkceVerifier(this.config.clientId);
     if (data.id_token) {
       try {
         await validateIdToken(
@@ -780,6 +803,8 @@ var _SsoClient = class _SsoClient {
         throw err;
       }
     }
+    removeOAuthState(this.config.clientId);
+    removePkceVerifier(this.config.clientId);
     const now = Date.now();
     const tokenData = {
       access_token: data.access_token,
@@ -948,7 +973,9 @@ var _SsoClient = class _SsoClient {
    * 登出
    *
    * 清除本地所有 token 和临时数据，并尝试撤销服务端 refresh_token。
-   * @param redirectToSso - 是否重定向到 SSO 登出页（默认 false）
+   * @param redirectToSso - 是否重定向到 SSO 登出页（默认 false）。
+   *   为 true 时携带 state 参数（已保存到 sessionStorage），
+   *   回跳页面应调用 validateLogoutState() 校验防登出 CSRF。
    */
   async logout(redirectToSso = false) {
     const tokenData = getTokenData(this.config.clientId);
@@ -991,10 +1018,36 @@ var _SsoClient = class _SsoClient {
         logoutUrl.searchParams.set("id_token_hint", idTokenHint);
       }
       const state = generateState();
+      saveLogoutState(state, this.config.clientId);
       logoutUrl.searchParams.set("state", state);
       window.location.href = logoutUrl.toString();
     }
   }
+  /**
+   * 校验 RP-Initiated Logout 回跳的 state 参数（登出 CSRF 防护）
+   *
+   * 在 post_logout_redirect_uri 指向的页面加载时调用；
+   * 仅在 URL 携带 state 且与 logout(redirectToSso=true) 保存的值一致时返回 true，
+   * 校验后清除已保存的 logout state（一次性）。
+   *
+   * @param url - 当前页面完整 URL（window.location.href）
+   *
+   * @example
+   * ```typescript
+   * if (sso.validateLogoutState(window.location.href)) {
+   *   // 来自 SSO 登出的可信回跳
+   * }
+   * ```
+   */
+  validateLogoutState(url) {
+    const returnedState = new URL(url).searchParams.get("state");
+    if (!returnedState) return false;
+    const savedState = getLogoutState(this.config.clientId);
+    if (!savedState) return false;
+    if (!timingSafeEqualString(savedState, returnedState)) return false;
+    removeLogoutState(this.config.clientId);
+    return true;
+  }
   /**
    * 获取 OIDC Discovery 文档
    *
@@ -1078,6 +1131,7 @@ function SsoProvider({
   const [user, setUser] = useState(null);
   const [isLoading, setIsLoading] = useState(true);
   const [isAuthenticated, setIsAuthenticated] = useState(false);
+  const [error, setError] = useState(null);
   const [client] = useState(() => new SsoClient(config));
   const refreshTimerRef = useRef(null);
   const loadedRef = useRef(false);
@@ -1086,6 +1140,7 @@ function SsoProvider({
     if (!tokenData) {
       setUser(null);
       setIsAuthenticated(false);
+      setError(null);
       setIsLoading(false);
       return;
     }
@@ -1093,9 +1148,13 @@ function SsoProvider({
       const u = await client.getUserInfo();
       setUser(u);
       setIsAuthenticated(true);
-    } catch {
+      setError(null);
+    } catch (err) {
       setUser(null);
       setIsAuthenticated(false);
+      setError(
+        err instanceof SsoError ? err : new SsoError("userinfo_failed", err instanceof Error ? err.message : String(err))
+      );
       removeTokenData(client.config.clientId);
     } finally {
       setIsLoading(false);
@@ -1190,6 +1249,7 @@ function SsoProvider({
       await client.logout(redirectToSso);
       setUser(null);
       setIsAuthenticated(false);
+      setError(null);
     },
     [client]
   );
@@ -1203,6 +1263,7 @@ function SsoProvider({
     user,
     isAuthenticated,
     isLoading,
+    error,
     login,
     loginPopup,
     logout,
@@ -1221,34 +1282,67 @@ function useSso() {
 }
 
 // src/react/RequireAuth.tsx
-import React2, { useEffect as useEffect2, useRef as useRef2 } from "react";
+import React2, { useEffect as useEffect2, useRef as useRef2, useState as useState2 } from "react";
 function RequireAuth({
   children,
   fallback,
   autoLogin = true,
-  usePopup = false
+  usePopup = false,
+  onError,
+  renderLoginError
 }) {
   const { isAuthenticated, isLoading, login, loginPopup } = useSso();
   const loginTriggeredRef = useRef2(false);
+  const [loginError, setLoginError] = useState2(null);
+  const triggerLogin = () => {
+    loginTriggeredRef.current = true;
+    const currentPath = window.location.pathname + window.location.search;
+    const handleFailure = (err) => {
+      loginTriggeredRef.current = false;
+      setLoginError(err);
+      onError?.(err);
+    };
+    if (usePopup) {
+      loginPopup({ returnUrl: currentPath }).catch((err) => {
+        if (err.code === "popup_blocked") {
+          login(currentPath).catch(handleFailure);
+          return;
+        }
+        handleFailure(err);
+      });
+    } else {
+      login(currentPath).catch(handleFailure);
+    }
+  };
+  const retry = () => {
+    setLoginError(null);
+    triggerLogin();
+  };
   useEffect2(() => {
     if (!isLoading && !isAuthenticated && autoLogin && !loginTriggeredRef.current) {
-      loginTriggeredRef.current = true;
-      const currentPath = window.location.pathname + window.location.search;
-      if (usePopup) {
-        loginPopup({ returnUrl: currentPath }).catch((err) => {
-          if (err.code === "popup_blocked") {
-            login(currentPath);
-          }
-        });
-      } else {
-        login(currentPath);
-      }
+      triggerLogin();
     }
   }, [isLoading, isAuthenticated, autoLogin, usePopup, login, loginPopup]);
   if (isLoading) {
     return fallback || React2.createElement("div", null, "\u6B63\u5728\u9A8C\u8BC1\u767B\u5F55\u72B6\u6001...");
   }
   if (!isAuthenticated) {
+    if (loginError) {
+      if (renderLoginError) {
+        return React2.createElement(
+          React2.Fragment,
+          null,
+          renderLoginError(loginError, retry)
+        );
+      }
+      const message = loginError instanceof Error ? loginError.message : "\u767B\u5F55\u5931\u8D25";
+      return React2.createElement(
+        "div",
+        null,
+        React2.createElement("p", null, `\u767B\u5F55\u672A\u5B8C\u6210\uFF1A${message}`),
+        React2.createElement("button", { onClick: retry }, "\u91CD\u8BD5\u767B\u5F55")
+      );
+    }
     if (fallback) return React2.createElement(React2.Fragment, null, fallback);
     return React2.createElement("div", null, "\u8BF7\u5148\u767B\u5F55");
   }
@@ -1268,11 +1362,42 @@ function withAuth(Component) {
 }
 
 // src/react/CallbackPage.tsx
-import React3, { useEffect as useEffect3, useState as useState2 } from "react";
-function CallbackPage() {
+import React3, { useEffect as useEffect3, useRef as useRef3, useState as useState3 } from "react";
+function DefaultCallbackError({ error }) {
+  return React3.createElement(
+    "div",
+    {
+      style: {
+        display: "flex",
+        flexDirection: "column",
+        alignItems: "center",
+        justifyContent: "center",
+        minHeight: "100vh",
+        fontFamily: "system-ui, sans-serif"
+      }
+    },
+    React3.createElement(
+      "p",
+      { style: { color: "#dc2626", marginBottom: "1rem" } },
+      error
+    ),
+    React3.createElement(
+      "a",
+      { href: "/", style: { color: "#2563eb", textDecoration: "underline" } },
+      "\u8FD4\u56DE\u9996\u9875"
+    )
+  );
+}
+function CallbackPage({ onSuccess, onError, renderError } = {}) {
   const { client, refreshUser } = useSso();
-  const [error, setError] = useState2(null);
-  const [processing, setProcessing] = useState2(true);
+  const [error, setError] = useState3(null);
+  const [processing, setProcessing] = useState3(true);
+  const onSuccessRef = useRef3(onSuccess);
+  const onErrorRef = useRef3(onError);
+  useEffect3(() => {
+    onSuccessRef.current = onSuccess;
+    onErrorRef.current = onError;
+  });
   useEffect3(() => {
     if (window.opener && !window.opener.closed) {
       const nonce = new URL(window.location.href).searchParams.get("popup_nonce");
@@ -1291,22 +1416,27 @@ function CallbackPage() {
     let cancelled = false;
     async function handleCallback() {
       try {
-        await client.handleCallback(window.location.href);
+        const tokenData = await client.handleCallback(window.location.href);
         if (cancelled) return;
         await refreshUser();
-        const returnUrl = getReturnUrl();
-        removeReturnUrl();
+        if (cancelled) return;
+        const clientId = client.config.clientId;
+        const returnUrl = getReturnUrl(clientId);
+        removeReturnUrl(clientId);
+        const onSuccessCb = onSuccessRef.current;
+        if (onSuccessCb) {
+          onSuccessCb(tokenData);
+          return;
+        }
         window.location.href = returnUrl && isTrustedReturnUrl(returnUrl, window.location.origin) ? returnUrl : "/";
       } catch (err) {
         if (cancelled) return;
-        if (err instanceof SsoError) {
-          setError(err.description || `SSO \u9519\u8BEF (${err.code})`);
-        } else if (err instanceof TypeError && err.message.includes("fetch")) {
-          setError("\u7F51\u7EDC\u8FDE\u63A5\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u7F51\u7EDC\u540E\u91CD\u8BD5");
-        } else if (err instanceof Error) {
-          setError(`\u767B\u5F55\u56DE\u8C03\u5904\u7406\u5931\u8D25: ${err.message}`);
+        const errorObj = err instanceof Error ? err : new Error(String(err));
+        onErrorRef.current?.(errorObj);
+        if (errorObj instanceof SsoError) {
+          setError(errorObj.description || `SSO \u9519\u8BEF (${errorObj.code})`);
         } else {
-          setError("\u767B\u5F55\u56DE\u8C03\u5904\u7406\u5931\u8D25\uFF0C\u8BF7\u91CD\u8BD5");
+          setError(`\u767B\u5F55\u56DE\u8C03\u5904\u7406\u5931\u8D25: ${errorObj.message}`);
         }
         setProcessing(false);
       }
@@ -1317,29 +1447,8 @@ function CallbackPage() {
     };
   }, [client, refreshUser]);
   if (error) {
-    return React3.createElement(
-      "div",
-      {
-        style: {
-          display: "flex",
-          flexDirection: "column",
-          alignItems: "center",
-          justifyContent: "center",
-          minHeight: "100vh",
-          fontFamily: "system-ui, sans-serif"
-        }
-      },
-      React3.createElement(
-        "p",
-        { style: { color: "#dc2626", marginBottom: "1rem" } },
-        error
-      ),
-      React3.createElement(
-        "a",
-        { href: "/", style: { color: "#2563eb", textDecoration: "underline" } },
-        "\u8FD4\u56DE\u9996\u9875"
-      )
-    );
+    if (renderError) return React3.createElement(React3.Fragment, null, renderError(error));
+    return React3.createElement(DefaultCallbackError, { error });
   }
   if (processing) {
     return React3.createElement(
@@ -1360,6 +1469,7 @@ function CallbackPage() {
 }
 export {
   CallbackPage,
+  DefaultCallbackError,
   RequireAuth,
   SsoProvider,
   useSso,