@nihplod/sso-sdk 1.3.0 → 1.4.0

package/dist/react/index.mjs

@@ -83,8 +83,10 @@ var STORAGE_PREFIX = "nihplod_sso_";
 var TOKEN_KEY = "token";
 var VERIFIER_KEY_PREFIX = "pkce_verifier_";
 var STATE_KEY = "oauth_state";
+var NONCE_KEY = "oidc_nonce";
 var RETURN_URL_KEY = "return_url";
 var LOGOUT_STATE_KEY = "logout_state";
+var SILENT_PROBE_KEY = "silent_probe";
 function buildKey(base, clientId) {
   return clientId ? `${base}:${clientId}` : base;
 }
@@ -165,6 +167,15 @@ function getOAuthState(clientId) {
 function removeOAuthState(clientId) {
   _transient.remove(buildKey(STATE_KEY, clientId));
 }
+function saveOAuthNonce(nonce, clientId) {
+  _transient.set(buildKey(NONCE_KEY, clientId), nonce);
+}
+function getOAuthNonce(clientId) {
+  return _transient.get(buildKey(NONCE_KEY, clientId));
+}
+function removeOAuthNonce(clientId) {
+  _transient.remove(buildKey(NONCE_KEY, clientId));
+}
 function saveLogoutState(state, clientId) {
   _transient.set(buildKey(LOGOUT_STATE_KEY, clientId), state);
 }
@@ -183,20 +194,33 @@ function getReturnUrl(clientId) {
 function removeReturnUrl(clientId) {
   _transient.remove(buildKey(RETURN_URL_KEY, clientId));
 }
+function saveSilentProbe(state, clientId) {
+  _transient.set(buildKey(SILENT_PROBE_KEY, clientId), state);
+}
+function getSilentProbe(clientId) {
+  return _transient.get(buildKey(SILENT_PROBE_KEY, clientId));
+}
+function removeSilentProbe(clientId) {
+  _transient.remove(buildKey(SILENT_PROBE_KEY, clientId));
+}
 function clearAllSsoData(clientId) {
   if (clientId) {
     removeTokenData(clientId);
     removeOAuthState(clientId);
+    removeOAuthNonce(clientId);
     removeReturnUrl(clientId);
     removeLogoutState(clientId);
+    removeSilentProbe(clientId);
     removePkceVerifier(clientId);
     removePkceVerifier(`${clientId}_popup_nonce`);
     return;
   }
   removeTokenData();
   removeOAuthState();
+  removeOAuthNonce();
   removeReturnUrl();
   removeLogoutState();
+  removeSilentProbe();
   const prefix = STORAGE_PREFIX + VERIFIER_KEY_PREFIX;
   const stores = [
     typeof sessionStorage !== "undefined" ? sessionStorage : null,
@@ -280,18 +304,21 @@ function normalizeIssuer(url) {
 var cachedJwks = null;
 var cachedDiscovery = null;
 var JWKS_CACHE_TTL_MS = 5 * 60 * 1e3;
+var FETCH_TIMEOUT_MS = 1e4;
 async function fetchDiscoveryDoc(baseUrl) {
   const now = Date.now();
   if (cachedDiscovery && cachedDiscovery.baseUrl === baseUrl && now - cachedDiscovery.fetchedAt < JWKS_CACHE_TTL_MS) {
     return cachedDiscovery.doc;
   }
   try {
-    const res = await fetch(`${baseUrl}/api/oauth/.well-known/openid-configuration`);
-    const doc = res.ok ? await res.json() : null;
+    const res = await fetch(`${baseUrl}/api/oauth/.well-known/openid-configuration`, {
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+    });
+    if (!res.ok) return null;
+    const doc = await res.json();
     cachedDiscovery = { baseUrl, doc, fetchedAt: now };
     return doc;
   } catch {
-    cachedDiscovery = { baseUrl, doc: null, fetchedAt: now };
     return null;
   }
 }
@@ -303,7 +330,10 @@ async function fetchJwks(baseUrl, options = {}) {
   const discovery = await fetchDiscoveryDoc(baseUrl);
   const jwksUri = discovery?.jwks_uri || `${baseUrl}/api/oauth/jwks`;
   try {
-    const res = await fetch(jwksUri, options.forceRefresh ? { cache: "no-cache" } : void 0);
+    const res = await fetch(jwksUri, {
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+      ...options.forceRefresh ? { cache: "no-cache" } : {}
+    });
     if (!res.ok) return null;
     const jwks = await res.json();
     cachedJwks = { baseUrl, jwks, fetchedAt: now };
@@ -350,7 +380,7 @@ async function computeAtHash(accessToken) {
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 async function validateIdToken(idToken, accessToken, expectedIssuer, expectedClientId, options = {}) {
-  const { rejectHs256WhenRs256Available = true } = options;
+  const { rejectHs256WhenRs256Available = true, expectedNonce } = options;
   const header = decodeJwtHeader(idToken);
   if (!header) {
     throw new SsoError("id_token_invalid", "ID Token \u683C\u5F0F\u9519\u8BEF");
@@ -440,10 +470,21 @@ async function validateIdToken(idToken, accessToken, expectedIssuer, expectedCli
       throw new SsoError("id_token_at_hash_mismatch", "ID Token at_hash \u4E0D\u5339\u914D");
     }
   }
+  if (expectedNonce !== void 0) {
+    const tokenNonce = typeof payload.nonce === "string" ? payload.nonce : "";
+    if (!tokenNonce || !timingSafeEqualString(expectedNonce, tokenNonce)) {
+      throw new SsoError("id_token_nonce_mismatch", "ID Token nonce \u4E0D\u5339\u914D");
+    }
+  }
   return { sub: payload.sub };
 }
 
 // src/core/SsoClient.ts
+var SILENT_PROBE_ERRORS = /* @__PURE__ */ new Set([
+  "login_required",
+  "consent_required",
+  "interaction_required"
+]);
 var _SsoClient = class _SsoClient {
   constructor(config) {
     this._discovery = null;
@@ -537,17 +578,27 @@ var _SsoClient = class _SsoClient {
    *
    * @param returnUrl - 登录成功后的返回地址（可选，保存到 sessionStorage；
    *   仅允许相对路径或同源绝对 URL，否则忽略并告警）
+   * @param options.prompt - OIDC prompt 参数。传 "none" 为静默探测：
+   *   额外在存储中记录探测标记（该次请求的 state），回调无会话时
+   *   handleCallback() 返回 null 而不抛错。
    *
    * ⚠️ 不要与 getLoginUrl() 混用：两者都会重新生成并覆盖 sessionStorage 中的
    * state / PKCE verifier，先调用的那次授权流程将因 state 不匹配而失败。
    * 同一次登录只使用其中一个入口。
    */
-  async login(returnUrl) {
+  async login(returnUrl, options = {}) {
     const verifier = generateCodeVerifier();
     const challenge = await generateCodeChallenge(verifier);
     const state = generateState();
+    const nonce = generateState();
     savePkceVerifier(this.config.clientId, verifier);
     saveOAuthState(state, this.config.clientId);
+    saveOAuthNonce(nonce, this.config.clientId);
+    if (options.prompt === "none") {
+      saveSilentProbe(state, this.config.clientId);
+    } else {
+      removeSilentProbe(this.config.clientId);
+    }
     if (returnUrl) {
       this._saveReturnUrlIfTrusted(returnUrl);
     }
@@ -558,8 +609,12 @@ var _SsoClient = class _SsoClient {
     params.set("redirect_uri", this.config.redirectUri);
     params.set("scope", this.config.scopes || "openid profile");
     params.set("state", state);
+    params.set("nonce", nonce);
     params.set("code_challenge", challenge);
     params.set("code_challenge_method", "S256");
+    if (options.prompt) {
+      params.set("prompt", options.prompt);
+    }
     window.location.href = `${authorizeEndpoint}?${params.toString()}`;
   }
   /**
@@ -571,12 +626,19 @@ var _SsoClient = class _SsoClient {
    * state / PKCE verifier，先调用的那次授权流程将因 state 不匹配而失败。
    * 同一次登录只使用其中一个入口。
    */
-  async getLoginUrl(returnUrl) {
+  async getLoginUrl(returnUrl, options = {}) {
     const verifier = generateCodeVerifier();
     const challenge = await generateCodeChallenge(verifier);
     const state = generateState();
+    const nonce = generateState();
     savePkceVerifier(this.config.clientId, verifier);
     saveOAuthState(state, this.config.clientId);
+    saveOAuthNonce(nonce, this.config.clientId);
+    if (options.prompt === "none") {
+      saveSilentProbe(state, this.config.clientId);
+    } else {
+      removeSilentProbe(this.config.clientId);
+    }
     if (returnUrl) this._saveReturnUrlIfTrusted(returnUrl);
     const authorizeEndpoint = await this._getAuthorizeEndpoint();
     const params = new URLSearchParams();
@@ -585,8 +647,12 @@ var _SsoClient = class _SsoClient {
     params.set("redirect_uri", this.config.redirectUri);
     params.set("scope", this.config.scopes || "openid profile");
     params.set("state", state);
+    params.set("nonce", nonce);
     params.set("code_challenge", challenge);
     params.set("code_challenge_method", "S256");
+    if (options.prompt) {
+      params.set("prompt", options.prompt);
+    }
     return `${authorizeEndpoint}?${params.toString()}`;
   }
   /**
@@ -626,9 +692,11 @@ var _SsoClient = class _SsoClient {
     const verifier = generateCodeVerifier();
     const challenge = await generateCodeChallenge(verifier);
     const state = generateState();
+    const nonce = generateState();
     const popupNonce = generateState();
     savePkceVerifier(this.config.clientId, verifier);
     saveOAuthState(state, this.config.clientId);
+    saveOAuthNonce(nonce, this.config.clientId);
     savePkceVerifier(`${this.config.clientId}_popup_nonce`, popupNonce);
     if (options.returnUrl) {
       this._saveReturnUrlIfTrusted(options.returnUrl);
@@ -640,6 +708,7 @@ var _SsoClient = class _SsoClient {
     params.set("redirect_uri", this.config.redirectUri);
     params.set("scope", this.config.scopes || "openid profile");
     params.set("state", state);
+    params.set("nonce", nonce);
     params.set("code_challenge", challenge);
     params.set("code_challenge_method", "S256");
     params.set("popup_nonce", popupNonce);
@@ -664,6 +733,7 @@ var _SsoClient = class _SsoClient {
     if (!popup) {
       removePkceVerifier(this.config.clientId);
       removeOAuthState(this.config.clientId);
+      removeOAuthNonce(this.config.clientId);
       removePkceVerifier(`${this.config.clientId}_popup_nonce`);
       throw new SsoError(
         "popup_blocked",
@@ -683,12 +753,27 @@ var _SsoClient = class _SsoClient {
           const savedNonce = getPkceVerifier(`${this.config.clientId}_popup_nonce`);
           if (!savedNonce || !timingSafeEqualString(event.data.nonce ?? "", savedNonce)) return;
           removePkceVerifier(`${this.config.clientId}_popup_nonce`);
+          try {
+            event.source?.postMessage(
+              { type: "nihplod_sso_popup_ack", nonce: savedNonce },
+              event.origin
+            );
+          } catch {
+          }
           completed = true;
           cleanup();
           if (popup && !popup.closed) {
             popup.close();
           }
-          this.handleCallback(event.data.callbackUrl).then(resolve).catch(reject);
+          this.handleCallback(event.data.callbackUrl).then((tokenData) => {
+            if (tokenData === null) {
+              reject(
+                new SsoError("not_authenticated", "SSO \u4F1A\u8BDD\u4E0D\u5B58\u5728\uFF08\u9759\u9ED8\u63A2\u6D4B\u65E0\u4F1A\u8BDD\uFF09")
+              );
+              return;
+            }
+            resolve(tokenData);
+          }).catch(reject);
         };
         const pollTimer = setInterval(() => {
           if (popup.closed) {
@@ -714,6 +799,7 @@ var _SsoClient = class _SsoClient {
     } catch (err) {
       removePkceVerifier(this.config.clientId);
       removeOAuthState(this.config.clientId);
+      removeOAuthNonce(this.config.clientId);
       removePkceVerifier(`${this.config.clientId}_popup_nonce`);
       throw err;
     }
@@ -725,15 +811,29 @@ var _SsoClient = class _SsoClient {
    * 成功后 token 自动保存到 token 存储（默认 sessionStorage，可通过 setTokenStorage 定制）。
    *
    * @param callbackUrl - 完整的回调 URL（window.location.href）
-   * @returns TokenData 或 null
+   * @returns TokenData；prompt=none 静默探测且无 SSO 会话时返回 null
+   *   （IdP 回跳 login_required / consent_required / interaction_required
+   *   且回调 state 与探测标记匹配），此时临时数据已清理，调用方按"未登录"处理即可
    */
   async handleCallback(callbackUrl) {
     const url = new URL(callbackUrl);
     const params = url.searchParams;
     const error = params.get("error");
     if (error) {
+      const returnedErrorState = params.get("state");
+      const probeState = getSilentProbe(this.config.clientId);
+      const savedStateForProbe = getOAuthState(this.config.clientId);
+      if (SILENT_PROBE_ERRORS.has(error) && probeState && savedStateForProbe && timingSafeEqualString(savedStateForProbe, returnedErrorState ?? "") && timingSafeEqualString(probeState, returnedErrorState ?? "")) {
+        removeOAuthState(this.config.clientId);
+        removeOAuthNonce(this.config.clientId);
+        removePkceVerifier(this.config.clientId);
+        removeSilentProbe(this.config.clientId);
+        return null;
+      }
       removeOAuthState(this.config.clientId);
+      removeOAuthNonce(this.config.clientId);
       removePkceVerifier(this.config.clientId);
+      removeSilentProbe(this.config.clientId);
       const desc = params.get("error_description") || error;
       throw new SsoError(mapOAuthErrorToSsoCode(error), `\u6388\u6743\u5931\u8D25: ${desc}`);
     }
@@ -741,18 +841,23 @@ var _SsoClient = class _SsoClient {
     const returnedState = params.get("state");
     if (!code) {
       removeOAuthState(this.config.clientId);
+      removeOAuthNonce(this.config.clientId);
       removePkceVerifier(this.config.clientId);
+      removeSilentProbe(this.config.clientId);
       throw new SsoError("token_request_failed", "\u56DE\u8C03 URL \u4E2D\u7F3A\u5C11 authorization code");
     }
     const savedState = getOAuthState(this.config.clientId);
     if (!savedState || !timingSafeEqualString(savedState, returnedState ?? "")) {
       removeOAuthState(this.config.clientId);
+      removeOAuthNonce(this.config.clientId);
       removePkceVerifier(this.config.clientId);
+      removeSilentProbe(this.config.clientId);
       throw new SsoError(
         "state_mismatch",
         "State \u53C2\u6570\u4E0D\u5339\u914D\uFF0C\u53EF\u80FD\u5B58\u5728 CSRF \u653B\u51FB"
       );
     }
+    const expectedNonce = getOAuthNonce(this.config.clientId) ?? void 0;
     const verifier = getPkceVerifier(this.config.clientId);
     if (!verifier) {
       throw new SsoError(
@@ -799,7 +904,8 @@ var _SsoClient = class _SsoClient {
           data.id_token,
           data.access_token,
           this.config.ssoBaseUrl,
-          this.config.clientId
+          this.config.clientId,
+          { expectedNonce }
         );
       } catch (err) {
         removeTokenData(this.config.clientId);
@@ -807,7 +913,9 @@ var _SsoClient = class _SsoClient {
       }
     }
     removeOAuthState(this.config.clientId);
+    removeOAuthNonce(this.config.clientId);
     removePkceVerifier(this.config.clientId);
+    removeSilentProbe(this.config.clientId);
     const now = Date.now();
     const tokenData = {
       access_token: data.access_token,
@@ -1158,7 +1266,9 @@ function SsoProvider({
       setError(
         err instanceof SsoError ? err : new SsoError("userinfo_failed", err instanceof Error ? err.message : String(err))
       );
-      removeTokenData(client.config.clientId);
+      if (err instanceof SsoError && (err.code === "not_authenticated" || err.code === "session_expired")) {
+        removeTokenData(client.config.clientId);
+      }
     } finally {
       setIsLoading(false);
     }
@@ -1395,6 +1505,7 @@ function CallbackPage({ onSuccess, onError, renderError } = {}) {
   const { client, refreshUser } = useSso();
   const [error, setError] = useState3(null);
   const [processing, setProcessing] = useState3(true);
+  const [awaitingManualClose, setAwaitingManualClose] = useState3(false);
   const onSuccessRef = useRef3(onSuccess);
   const onErrorRef = useRef3(onError);
   useEffect3(() => {
@@ -1409,18 +1520,52 @@ function CallbackPage({ onSuccess, onError, renderError } = {}) {
         targetOrigin = window.opener.location.origin;
       } catch {
       }
-      window.opener.postMessage(
-        { type: "nihplod_sso_popup_callback", callbackUrl: window.location.href, nonce: nonce || void 0 },
-        targetOrigin
-      );
+      const message = {
+        type: "nihplod_sso_popup_callback",
+        callbackUrl: window.location.href,
+        nonce: nonce || void 0
+      };
+      let acked = false;
+      const send = () => {
+        if (acked || !window.opener || window.opener.closed) return;
+        window.opener.postMessage(message, targetOrigin);
+      };
+      send();
+      const resendTimer = setInterval(send, 500);
+      const ackTimeout = setTimeout(() => {
+        if (acked) return;
+        clearInterval(resendTimer);
+        setAwaitingManualClose(true);
+      }, 1e4);
+      const handleAck = (event) => {
+        if (event.origin !== targetOrigin) return;
+        if (!event.data || event.data.type !== "nihplod_sso_popup_ack") return;
+        if (nonce && event.data.nonce !== nonce) return;
+        acked = true;
+        clearInterval(resendTimer);
+        clearTimeout(ackTimeout);
+      };
+      window.addEventListener("message", handleAck);
       Promise.resolve().then(() => setProcessing(false));
-      return;
+      return () => {
+        clearInterval(resendTimer);
+        clearTimeout(ackTimeout);
+        window.removeEventListener("message", handleAck);
+      };
     }
     let cancelled = false;
     async function handleCallback() {
       try {
         const tokenData = await client.handleCallback(window.location.href);
         if (cancelled) return;
+        if (tokenData === null) {
+          const clientId2 = client.config.clientId;
+          const probeReturnUrl = getReturnUrl(clientId2);
+          removeReturnUrl(clientId2);
+          const target = probeReturnUrl && isTrustedReturnUrl(probeReturnUrl, window.location.origin) ? probeReturnUrl : "/";
+          window.location.href = target + (target.includes("?") ? "&" : "?") + "sso_probe=no_session";
+          return;
+        }
         await refreshUser();
         if (cancelled) return;
         const clientId = client.config.clientId;
@@ -1453,6 +1598,21 @@ function CallbackPage({ onSuccess, onError, renderError } = {}) {
     if (renderError) return React3.createElement(React3.Fragment, null, renderError(error));
     return React3.createElement(DefaultCallbackError, { error });
   }
+  if (awaitingManualClose) {
+    return React3.createElement(
+      "div",
+      {
+        style: {
+          display: "flex",
+          alignItems: "center",
+          justifyContent: "center",
+          minHeight: "100vh",
+          fontFamily: "system-ui, sans-serif"
+        }
+      },
+      React3.createElement("p", null, "\u767B\u5F55\u5DF2\u5B8C\u6210\uFF0C\u8BF7\u624B\u52A8\u5173\u95ED\u6B64\u7A97\u53E3")
+    );
+  }
   if (processing) {
     return React3.createElement(
       "div",