@nihplod/sso-sdk 1.3.0 → 1.4.0

package/dist/next/index.d.ts

@@ -57,6 +57,8 @@ interface SsoMiddlewareConfig {
     accessTokenCookieName?: string;
     /** State Cookie 名称，默认 __Host-nihplod_sso_state */
     stateCookieName?: string;
+    /** OIDC Nonce Cookie 名称，默认 __Host-nihplod_sso_nonce */
+    nonceCookieName?: string;
     /** Return URL Cookie 名称，默认 __Host-nihplod_sso_return */
     returnUrlCookieName?: string;
     /** PKCE Verifier Cookie 名称，默认 __Secure-nihplod_sso_verifier */
@@ -129,6 +131,8 @@ interface CallbackRouteConfig {
     idTokenCookieName?: string;
     /** State Cookie 名称，默认 __Host-nihplod_sso_state */
     stateCookieName?: string;
+    /** OIDC Nonce Cookie 名称，默认 __Host-nihplod_sso_nonce（须与 createSsoMiddleware 一致） */
+    nonceCookieName?: string;
     /** Return URL Cookie 名称，默认 __Host-nihplod_sso_return */
     returnUrlCookieName?: string;
     /** PKCE Verifier Cookie 名称，默认 __Secure-nihplod_sso_verifier */
@@ -155,7 +159,9 @@ declare function createCallbackRouteHandler(config: CallbackRouteConfig): (reque
  * 在 /api/auth/logout 路由中处理本地登出 + RP-Initiated Logout：
  * 1. 从 cookie 读取 refresh_token 并调用 revocation_endpoint 撤销
  * 2. 清除所有 SSO cookie
- * 3. 可选重定向到 SSO 中心登出页
+ * 3. 按退出范围（defaultScope / 表单 global 字段）决定：
+ *    - "local"（默认）：仅退出本站，重定向回本站首页
+ *    - "global"：重定向到 SSO 中心 end-session，全局退出所有 NIHPLOD 平台
  *
  * 用法 (src/app/api/auth/logout/route.ts):
  * ```ts
@@ -169,7 +175,7 @@ declare function createCallbackRouteHandler(config: CallbackRouteConfig): (reque
  *   postLogoutRedirectUri: "https://myapp.com/",
  * });
  *
- * // 推荐使用 POST 触发登出（防登出 CSRF），GET 保留用于兼容 <a> 标签跳转
+ * // 推荐使用 POST 触发登出（防登出 CSRF）；GET 不执行登出，仅返回确认页
  * export const GET = handler;
  * export const POST = handler;
  * ```
@@ -189,7 +195,18 @@ interface LogoutRouteConfig {
     clientSecret?: string;
     /** 登出后跳转回子项目的地址，默认取 redirectUri 的 origin */
     postLogoutRedirectUri?: string;
-    /** 是否重定向到 SSO 中心登出页，默认 true */
+    /**
+     * 默认退出范围（默认 "local"）：
+     * - "local"：仅退出本站（撤销 refresh_token + 清本地 cookie），不跳转 SSO 中心；
+     * - "global"：同时跳转 SSO 中心 end-session 全局退出（RP-Initiated Logout）。
+     * 用户可在 GET 确认页勾选"同时退出所有 NIHPLOD 平台"后通过表单字段
+     * global=1 覆盖默认值；POST 表单携带 global 字段时以表单为准。
+     */
+    defaultScope?: "local" | "global";
+    /**
+     * @deprecated 请改用 defaultScope（true → "global"，false → "local"）。
+     * 仅为兼容保留；与 defaultScope 同时传入时以 defaultScope 为准。
+     */
     redirectToSso?: boolean;
     /** Access Token Cookie 名称 */
     accessTokenCookieName?: string;
@@ -199,6 +216,8 @@ interface LogoutRouteConfig {
     idTokenCookieName?: string;
     /** State Cookie 名称 */
     stateCookieName?: string;
+    /** OIDC Nonce Cookie 名称，默认 __Host-nihplod_sso_nonce（须与 middleware/callback 一致） */
+    nonceCookieName?: string;
     /** Return URL Cookie 名称 */
     returnUrlCookieName?: string;
     /** PKCE Verifier Cookie 名称 */
@@ -224,6 +243,63 @@ interface LogoutRouteConfig {
 }
 declare function createLogoutRouteHandler(config: LogoutRouteConfig): (request: NextRequest) => Promise<NextResponse<unknown>>;
 
+/** 验证通过的 logout_token 负载（仅暴露子站清会话所需的标识） */
+interface LogoutTokenPayload {
+    sub?: string;
+    sid?: string;
+}
+
+/**
+ * App Router Backchannel Logout 接收端 Route Handler
+ *
+ * 接收 SSO 中心在用户全局登出 / 撤销授权时推送的 logout_token
+ * （OIDC Back-Channel Logout 1.0），验证通过后清除本站 SSO cookie 并
+ * 调用 onLogout 钩子（子站在钩子里清除自己的本地会话，如数据库 session）。
+ *
+ * 前置条件：在 SSO 中心管理后台为本 client 注册 backchannelLogoutUri
+ * 指向本路由的公网地址（必须 HTTPS）。
+ *
+ * 用法 (src/app/api/auth/backchannel-logout/route.ts):
+ * ```ts
+ * import { createBackchannelLogoutRouteHandler } from "@nihplod/sso-sdk/next";
+ *
+ * export const POST = createBackchannelLogoutRouteHandler({
+ *   clientId: "my-app",
+ *   ssoBaseUrl: "https://nihplod.cn",
+ *   onLogout: async ({ sub, sid }) => {
+ *     // 清除子站本地会话（按 sub 或 sid 定位）
+ *   },
+ * });
+ * ```
+ */
+
+interface BackchannelLogoutRouteConfig {
+    /** OAuth Client ID（logout_token 的 aud 必须等于它） */
+    clientId: string;
+    /** SSO 中心地址（Discovery / JWKS 基准） */
+    ssoBaseUrl: string;
+    /**
+     * 登出通知钩子：logout_token 验证通过后调用，
+     * 子站在此处按 sub / sid 清除自己的本地会话（数据库 session 等）。
+     * 抛错时返回 500，让 IdP 重投。
+     */
+    onLogout?: (payload: LogoutTokenPayload, request: NextRequest) => void | Promise<void>;
+    /** Access Token Cookie 名称 */
+    accessTokenCookieName?: string;
+    /** Refresh Token Cookie 名称 */
+    refreshTokenCookieName?: string;
+    /** ID Token Cookie 名称，默认 __Host-nihplod_sso_id */
+    idTokenCookieName?: string;
+    /**
+     * 本地 HTTP 开发模式（默认 false）。关闭 Cookie 的 Secure 属性并去除
+     * __Host-/__Secure- 前缀；必须与 middleware / callback / logout 的配置保持一致。
+     * 生产严禁启用——生产环境（NODE_ENV=production 且 ssoBaseUrl 为 https）下
+     * 该开关会被强制忽略并告警。
+     */
+    insecureLocalDev?: boolean;
+}
+declare function createBackchannelLogoutRouteHandler(config: BackchannelLogoutRouteConfig): (request: NextRequest) => Promise<NextResponse<unknown>>;
+
 /**
  * Next.js 集成默认 Cookie 名称
  *
@@ -238,6 +314,7 @@ declare const DEFAULT_ACCESS_TOKEN_COOKIE_NAME = "__Host-nihplod_sso_at";
 declare const DEFAULT_REFRESH_TOKEN_COOKIE_NAME = "__Host-nihplod_sso_rt";
 declare const DEFAULT_ID_TOKEN_COOKIE_NAME = "__Host-nihplod_sso_id";
 declare const DEFAULT_STATE_COOKIE_NAME = "__Host-nihplod_sso_state";
+declare const DEFAULT_NONCE_COOKIE_NAME = "__Host-nihplod_sso_nonce";
 declare const DEFAULT_RETURN_COOKIE_NAME = "__Host-nihplod_sso_return";
 declare const DEFAULT_VERIFIER_COOKIE_NAME = "__Secure-nihplod_sso_verifier";
 declare const DEFAULT_LOGOUT_STATE_COOKIE_NAME = "__Host-nihplod_sso_logout_state";
@@ -264,4 +341,4 @@ declare function getSecureCookieOptions(maxAge?: number, path?: string, secure?:
     maxAge?: number;
 };
 
-export { type CallbackRouteConfig, DEFAULT_ACCESS_TOKEN_COOKIE_NAME, DEFAULT_ID_TOKEN_COOKIE_NAME, DEFAULT_LOGOUT_STATE_COOKIE_NAME, DEFAULT_REFRESH_TOKEN_COOKIE_NAME, DEFAULT_RETURN_COOKIE_NAME, DEFAULT_STATE_COOKIE_NAME, DEFAULT_VERIFIER_COOKIE_NAME, type LogoutRouteConfig, type SsoMiddlewareConfig, createCallbackRouteHandler, createLogoutRouteHandler, createSsoMiddleware, getHostCookieOptions, getSecureCookieOptions, toInsecureCookieName };
+export { type BackchannelLogoutRouteConfig, type CallbackRouteConfig, DEFAULT_ACCESS_TOKEN_COOKIE_NAME, DEFAULT_ID_TOKEN_COOKIE_NAME, DEFAULT_LOGOUT_STATE_COOKIE_NAME, DEFAULT_NONCE_COOKIE_NAME, DEFAULT_REFRESH_TOKEN_COOKIE_NAME, DEFAULT_RETURN_COOKIE_NAME, DEFAULT_STATE_COOKIE_NAME, DEFAULT_VERIFIER_COOKIE_NAME, type LogoutRouteConfig, type SsoMiddlewareConfig, createBackchannelLogoutRouteHandler, createCallbackRouteHandler, createLogoutRouteHandler, createSsoMiddleware, getHostCookieOptions, getSecureCookieOptions, toInsecureCookieName };

package/dist/next/index.js

@@ -23,10 +23,12 @@ __export(next_exports, {
   DEFAULT_ACCESS_TOKEN_COOKIE_NAME: () => DEFAULT_ACCESS_TOKEN_COOKIE_NAME,
   DEFAULT_ID_TOKEN_COOKIE_NAME: () => DEFAULT_ID_TOKEN_COOKIE_NAME,
   DEFAULT_LOGOUT_STATE_COOKIE_NAME: () => DEFAULT_LOGOUT_STATE_COOKIE_NAME,
+  DEFAULT_NONCE_COOKIE_NAME: () => DEFAULT_NONCE_COOKIE_NAME,
   DEFAULT_REFRESH_TOKEN_COOKIE_NAME: () => DEFAULT_REFRESH_TOKEN_COOKIE_NAME,
   DEFAULT_RETURN_COOKIE_NAME: () => DEFAULT_RETURN_COOKIE_NAME,
   DEFAULT_STATE_COOKIE_NAME: () => DEFAULT_STATE_COOKIE_NAME,
   DEFAULT_VERIFIER_COOKIE_NAME: () => DEFAULT_VERIFIER_COOKIE_NAME,
+  createBackchannelLogoutRouteHandler: () => createBackchannelLogoutRouteHandler,
   createCallbackRouteHandler: () => createCallbackRouteHandler,
   createLogoutRouteHandler: () => createLogoutRouteHandler,
   createSsoMiddleware: () => createSsoMiddleware,
@@ -44,6 +46,7 @@ var DEFAULT_ACCESS_TOKEN_COOKIE_NAME = "__Host-nihplod_sso_at";
 var DEFAULT_REFRESH_TOKEN_COOKIE_NAME = "__Host-nihplod_sso_rt";
 var DEFAULT_ID_TOKEN_COOKIE_NAME = "__Host-nihplod_sso_id";
 var DEFAULT_STATE_COOKIE_NAME = "__Host-nihplod_sso_state";
+var DEFAULT_NONCE_COOKIE_NAME = "__Host-nihplod_sso_nonce";
 var DEFAULT_RETURN_COOKIE_NAME = "__Host-nihplod_sso_return";
 var DEFAULT_VERIFIER_COOKIE_NAME = "__Secure-nihplod_sso_verifier";
 var DEFAULT_LOGOUT_STATE_COOKIE_NAME = "__Host-nihplod_sso_logout_state";
@@ -199,21 +202,20 @@ function createSsoMiddleware(config) {
   const secureCookies = !insecureLocalDev;
   const accessTokenCookieName = insecureLocalDev ? toInsecureCookieName(config.accessTokenCookieName ?? DEFAULT_ACCESS_TOKEN_COOKIE_NAME) : config.accessTokenCookieName ?? DEFAULT_ACCESS_TOKEN_COOKIE_NAME;
   const stateCookieName = insecureLocalDev ? toInsecureCookieName(config.stateCookieName ?? DEFAULT_STATE_COOKIE_NAME) : config.stateCookieName ?? DEFAULT_STATE_COOKIE_NAME;
+  const nonceCookieName = insecureLocalDev ? toInsecureCookieName(config.nonceCookieName ?? DEFAULT_NONCE_COOKIE_NAME) : config.nonceCookieName ?? DEFAULT_NONCE_COOKIE_NAME;
   const returnUrlCookieName = insecureLocalDev ? toInsecureCookieName(config.returnUrlCookieName ?? DEFAULT_RETURN_COOKIE_NAME) : config.returnUrlCookieName ?? DEFAULT_RETURN_COOKIE_NAME;
   const verifierCookieName = insecureLocalDev ? toInsecureCookieName(config.verifierCookieName ?? DEFAULT_VERIFIER_COOKIE_NAME) : config.verifierCookieName ?? DEFAULT_VERIFIER_COOKIE_NAME;
   const normalizedBase = ssoBaseUrl.replace(/\/+$/, "");
   const normalizedServerBase = (config.serverBaseUrl ?? ssoBaseUrl).replace(/\/+$/, "");
-  if (process.env.NODE_ENV !== "production") {
-    if (!validateSsoCookie) {
-      console.warn(
-        "[SSO SDK] validateSsoCookie=false\uFF1A\u4E2D\u95F4\u4EF6\u4EC5\u68C0\u67E5 Cookie \u5B58\u5728\u6027\uFF0C\u53EF\u80FD\u653E\u884C\u5DF2\u5931\u6548\u7684\u4F1A\u8BDD\u3002\u4E2D\u95F4\u4EF6\u53EA\u662F UX \u5C42\uFF0C\u654F\u611F\u6570\u636E\u7684\u9274\u6743\u5FC5\u987B\u5728 Route Handler / Server Component \u4E2D\u5B8C\u6210\u3002"
-      );
-    }
-    if (!clientSecret) {
-      console.warn(
-        "[SSO SDK] \u672A\u914D\u7F6E clientSecret\uFF08Public Client \u6A21\u5F0F\uFF09\uFF1Aintrospection \u65E0\u5BA2\u6237\u7AEF\u8BA4\u8BC1\uFF0C\u4E2D\u95F4\u4EF6\u5224\u5B9A\u7ED3\u679C\u4EC5\u4F5C UX \u53C2\u8003\u3002Confidential Client\uFF08BFF\uFF09\u8BF7\u914D\u7F6E clientSecret\u3002"
-      );
-    }
+  if (!validateSsoCookie) {
+    console.warn(
+      "[SSO SDK] validateSsoCookie=false\uFF1A\u4E2D\u95F4\u4EF6\u4EC5\u68C0\u67E5 Cookie \u5B58\u5728\u6027\uFF0C\u53EF\u80FD\u653E\u884C\u5DF2\u5931\u6548\u7684\u4F1A\u8BDD\u3002\u4E2D\u95F4\u4EF6\u53EA\u662F UX \u5C42\uFF0C\u654F\u611F\u6570\u636E\u7684\u9274\u6743\u5FC5\u987B\u5728 Route Handler / Server Component \u4E2D\u5B8C\u6210\u3002"
+    );
+  }
+  if (!clientSecret) {
+    console.warn(
+      "[SSO SDK] \u672A\u914D\u7F6E clientSecret\uFF08Public Client \u6A21\u5F0F\uFF09\uFF1Aintrospection \u65E0\u5BA2\u6237\u7AEF\u8BA4\u8BC1\uFF0C\u4E2D\u95F4\u4EF6\u5224\u5B9A\u7ED3\u679C\u4EC5\u4F5C UX \u53C2\u8003\u3002Confidential Client\uFF08BFF\uFF09\u8BF7\u914D\u7F6E clientSecret\u3002"
+    );
   }
   return async function ssoMiddleware(request) {
     const { pathname } = request.nextUrl;
@@ -256,6 +258,7 @@ function createSsoMiddleware(config) {
       }
     }
     const state = generateRandomString(32);
+    const nonce = generateRandomString(43);
     const verifier = generateRandomString(64);
     const challenge = await computeCodeChallenge(verifier);
     const authorizeParams = new URLSearchParams();
@@ -264,12 +267,14 @@ function createSsoMiddleware(config) {
     authorizeParams.set("redirect_uri", redirectUri);
     authorizeParams.set("scope", scopes);
     authorizeParams.set("state", state);
+    authorizeParams.set("nonce", nonce);
     authorizeParams.set("code_challenge", challenge);
     authorizeParams.set("code_challenge_method", "S256");
     const loginUrl = new URL("/api/oauth/authorize", normalizedBase);
     loginUrl.search = authorizeParams.toString();
     const response = import_server.NextResponse.redirect(loginUrl);
     response.cookies.set(stateCookieName, state, getHostCookieOptions(600, secureCookies));
+    response.cookies.set(nonceCookieName, nonce, getHostCookieOptions(600, secureCookies));
     response.cookies.set(verifierCookieName, verifier, getSecureCookieOptions(600, callbackPath, secureCookies));
     const safeReturnUrl = (request.nextUrl.pathname + request.nextUrl.search).slice(0, 2048);
     response.cookies.set(returnUrlCookieName, safeReturnUrl, getHostCookieOptions(600, secureCookies));
@@ -358,18 +363,21 @@ function normalizeIssuer(url) {
 var cachedJwks = null;
 var cachedDiscovery = null;
 var JWKS_CACHE_TTL_MS = 5 * 60 * 1e3;
+var FETCH_TIMEOUT_MS = 1e4;
 async function fetchDiscoveryDoc(baseUrl) {
   const now = Date.now();
   if (cachedDiscovery && cachedDiscovery.baseUrl === baseUrl && now - cachedDiscovery.fetchedAt < JWKS_CACHE_TTL_MS) {
     return cachedDiscovery.doc;
   }
   try {
-    const res = await fetch(`${baseUrl}/api/oauth/.well-known/openid-configuration`);
-    const doc = res.ok ? await res.json() : null;
+    const res = await fetch(`${baseUrl}/api/oauth/.well-known/openid-configuration`, {
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+    });
+    if (!res.ok) return null;
+    const doc = await res.json();
     cachedDiscovery = { baseUrl, doc, fetchedAt: now };
     return doc;
   } catch {
-    cachedDiscovery = { baseUrl, doc: null, fetchedAt: now };
     return null;
   }
 }
@@ -381,7 +389,10 @@ async function fetchJwks(baseUrl, options = {}) {
   const discovery = await fetchDiscoveryDoc(baseUrl);
   const jwksUri = discovery?.jwks_uri || `${baseUrl}/api/oauth/jwks`;
   try {
-    const res = await fetch(jwksUri, options.forceRefresh ? { cache: "no-cache" } : void 0);
+    const res = await fetch(jwksUri, {
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+      ...options.forceRefresh ? { cache: "no-cache" } : {}
+    });
     if (!res.ok) return null;
     const jwks = await res.json();
     cachedJwks = { baseUrl, jwks, fetchedAt: now };
@@ -428,7 +439,7 @@ async function computeAtHash(accessToken) {
   return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 async function validateIdToken(idToken, accessToken, expectedIssuer, expectedClientId, options = {}) {
-  const { rejectHs256WhenRs256Available = true } = options;
+  const { rejectHs256WhenRs256Available = true, expectedNonce } = options;
   const header = decodeJwtHeader(idToken);
   if (!header) {
     throw new SsoError("id_token_invalid", "ID Token \u683C\u5F0F\u9519\u8BEF");
@@ -518,6 +529,12 @@ async function validateIdToken(idToken, accessToken, expectedIssuer, expectedCli
       throw new SsoError("id_token_at_hash_mismatch", "ID Token at_hash \u4E0D\u5339\u914D");
     }
   }
+  if (expectedNonce !== void 0) {
+    const tokenNonce = typeof payload.nonce === "string" ? payload.nonce : "";
+    if (!tokenNonce || !timingSafeEqualString(expectedNonce, tokenNonce)) {
+      throw new SsoError("id_token_nonce_mismatch", "ID Token nonce \u4E0D\u5339\u914D");
+    }
+  }
   return { sub: payload.sub };
 }
 
@@ -538,11 +555,19 @@ function createCallbackRouteHandler(config) {
   const refreshTokenCookieName = pickName(config.refreshTokenCookieName, DEFAULT_REFRESH_TOKEN_COOKIE_NAME);
   const idTokenCookieName = pickName(config.idTokenCookieName, DEFAULT_ID_TOKEN_COOKIE_NAME);
   const stateCookieName = pickName(config.stateCookieName, DEFAULT_STATE_COOKIE_NAME);
+  const nonceCookieName = pickName(config.nonceCookieName, DEFAULT_NONCE_COOKIE_NAME);
   const returnUrlCookieName = pickName(config.returnUrlCookieName, DEFAULT_RETURN_COOKIE_NAME);
   const verifierCookieName = pickName(config.verifierCookieName, DEFAULT_VERIFIER_COOKIE_NAME);
   const normalizedBase = ssoBaseUrl.replace(/\/+$/, "");
   const normalizedServerBase = (config.serverBaseUrl ?? ssoBaseUrl).replace(/\/+$/, "");
   return async function GET(request) {
+    const response = await handleCallback(request);
+    if (response.status >= 400) {
+      response.cookies.set(nonceCookieName, "", getHostCookieOptions(0, secureCookies));
+    }
+    return response;
+  };
+  async function handleCallback(request) {
     const { searchParams } = request.nextUrl;
     const error = searchParams.get("error");
     if (error) {
@@ -573,7 +598,7 @@ function createCallbackRouteHandler(config) {
         { status: 400 }
       );
     }
-    if (returnedState !== savedState) {
+    if (!timingSafeEqualString(returnedState ?? "", savedState)) {
       return import_server2.NextResponse.json(
         {
           error: "invalid_request",
@@ -582,6 +607,7 @@ function createCallbackRouteHandler(config) {
         { status: 400 }
       );
     }
+    const expectedNonce = request.cookies.get(nonceCookieName)?.value;
     const verifier = request.cookies.get(verifierCookieName)?.value;
     if (!verifier) {
       return import_server2.NextResponse.json(
@@ -663,7 +689,8 @@ function createCallbackRouteHandler(config) {
           tokenData.id_token,
           tokenData.access_token,
           normalizedBase,
-          clientId
+          clientId,
+          { expectedNonce }
         );
       } catch (err) {
         return import_server2.NextResponse.json(
@@ -707,11 +734,12 @@ function createCallbackRouteHandler(config) {
       }
     }
     response.cookies.set(stateCookieName, "", getHostCookieOptions(0, secureCookies));
+    response.cookies.set(nonceCookieName, "", getHostCookieOptions(0, secureCookies));
     response.cookies.set(returnUrlCookieName, "", getHostCookieOptions(0, secureCookies));
     response.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, "/", secureCookies));
     response.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, request.nextUrl.pathname, secureCookies));
     return response;
-  };
+  }
 }
 
 // src/next/logout.ts
@@ -719,7 +747,7 @@ var import_server3 = require("next/server");
 
 // src/core/discovery.ts
 var DISCOVERY_CACHE_TTL_MS = 5 * 60 * 1e3;
-var FETCH_TIMEOUT_MS = 5e3;
+var FETCH_TIMEOUT_MS2 = 5e3;
 var cache = /* @__PURE__ */ new Map();
 var inflight = /* @__PURE__ */ new Map();
 function fetchDiscoveryCached(baseUrl) {
@@ -731,7 +759,7 @@ function fetchDiscoveryCached(baseUrl) {
   if (existing) return existing;
   const promise = (async () => {
     const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+    const timeoutId = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS2);
     try {
       const res = await fetch(`${baseUrl}/api/oauth/.well-known/openid-configuration`, {
         signal: controller.signal
@@ -752,6 +780,26 @@ function fetchDiscoveryCached(baseUrl) {
 }
 
 // src/next/logout.ts
+function buildLogoutConfirmHtml() {
+  return `<!doctype html>
+<html lang="zh-CN">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>\u786E\u8BA4\u9000\u51FA\u767B\u5F55</title>
+</head>
+<body style="display:flex;align-items:center;justify-content:center;min-height:100vh;font-family:system-ui,sans-serif;">
+  <form method="post" style="text-align:center;">
+    <p>\u786E\u5B9A\u8981\u9000\u51FA\u767B\u5F55\u5417\uFF1F</p>
+    <label style="display:flex;align-items:center;justify-content:center;gap:6px;margin:12px 0;font-size:14px;color:#374151;cursor:pointer;">
+      <input type="checkbox" name="global" value="1">\u540C\u65F6\u9000\u51FA\u6240\u6709 NIHPLOD \u5E73\u53F0
+    </label>
+    <button type="submit" style="padding:10px 20px;background-color:#ef4444;color:white;border:none;border-radius:8px;cursor:pointer;font-size:14px;">\u9000\u51FA\u767B\u5F55</button>
+    <p><a href="/" style="color:#2563eb;text-decoration:underline;">\u53D6\u6D88\u5E76\u8FD4\u56DE\u9996\u9875</a></p>
+  </form>
+</body>
+</html>`;
+}
 function generateRandomString2(length) {
   const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
   const maxValid = Math.floor(256 / chars.length) * chars.length;
@@ -773,10 +821,18 @@ function createLogoutRouteHandler(config) {
     redirectUri,
     clientSecret,
     postLogoutRedirectUri = new URL(redirectUri).origin + "/",
-    redirectToSso = true,
     callbackPath = "/api/auth/callback",
     insecureLocalDev: insecureLocalDevOpt = false
   } = config;
+  let defaultScope = config.defaultScope ?? "local";
+  if (config.redirectToSso !== void 0) {
+    console.warn(
+      '[SSO SDK] redirectToSso \u5DF2\u5F03\u7528\uFF0C\u8BF7\u6539\u7528 defaultScope\uFF08redirectToSso: true \u2192 defaultScope: "global"\uFF0Cfalse \u2192 "local"\uFF09\u3002\u6CE8\u610F\uFF1A\u9ED8\u8BA4\u9000\u51FA\u8303\u56F4\u5DF2\u53D8\u66F4\u4E3A "local"\uFF08\u4EC5\u9000\u51FA\u672C\u7AD9\uFF0C\u4E0D\u8DF3\u8F6C SSO \u4E2D\u5FC3\uFF09\u3002'
+    );
+    if (config.defaultScope === void 0) {
+      defaultScope = config.redirectToSso ? "global" : "local";
+    }
+  }
   const insecureLocalDev = resolveInsecureLocalDev(insecureLocalDevOpt, ssoBaseUrl);
   const secureCookies = !insecureLocalDev;
   const pickName = (explicit, fallback) => insecureLocalDev ? toInsecureCookieName(explicit ?? fallback) : explicit ?? fallback;
@@ -784,6 +840,7 @@ function createLogoutRouteHandler(config) {
   const refreshTokenCookieName = pickName(config.refreshTokenCookieName, DEFAULT_REFRESH_TOKEN_COOKIE_NAME);
   const idTokenCookieName = pickName(config.idTokenCookieName, DEFAULT_ID_TOKEN_COOKIE_NAME);
   const stateCookieName = pickName(config.stateCookieName, DEFAULT_STATE_COOKIE_NAME);
+  const nonceCookieName = pickName(config.nonceCookieName, DEFAULT_NONCE_COOKIE_NAME);
   const returnUrlCookieName = pickName(config.returnUrlCookieName, DEFAULT_RETURN_COOKIE_NAME);
   const verifierCookieName = pickName(config.verifierCookieName, DEFAULT_VERIFIER_COOKIE_NAME);
   const logoutStateCookieName = pickName(config.logoutStateCookieName, DEFAULT_LOGOUT_STATE_COOKIE_NAME);
@@ -804,6 +861,18 @@ function createLogoutRouteHandler(config) {
       res.cookies.set(logoutStateCookieName, "", getHostCookieOptions(0, secureCookies));
       return res;
     }
+    if (request.method === "GET") {
+      return new import_server3.NextResponse(buildLogoutConfirmHtml(), {
+        status: 200,
+        headers: { "content-type": "text/html; charset=utf-8" }
+      });
+    }
+    let formGlobal = null;
+    try {
+      formGlobal = new URLSearchParams(await request.text()).get("global");
+    } catch {
+    }
+    const effectiveScope = formGlobal !== null ? formGlobal === "1" || formGlobal === "true" ? "global" : "local" : defaultScope;
     const refreshToken = request.cookies.get(refreshTokenCookieName)?.value;
     const idTokenHint = request.cookies.get(idTokenCookieName)?.value;
     if (refreshToken) {
@@ -832,12 +901,13 @@ function createLogoutRouteHandler(config) {
       res.cookies.set(refreshTokenCookieName, "", getHostCookieOptions(0, secureCookies));
       res.cookies.set(idTokenCookieName, "", getHostCookieOptions(0, secureCookies));
       res.cookies.set(stateCookieName, "", getHostCookieOptions(0, secureCookies));
+      res.cookies.set(nonceCookieName, "", getHostCookieOptions(0, secureCookies));
       res.cookies.set(returnUrlCookieName, "", getHostCookieOptions(0, secureCookies));
       res.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, "/", secureCookies));
       res.cookies.set(verifierCookieName, "", getSecureCookieOptions(0, callbackPath, secureCookies));
       return res;
     };
-    if (redirectToSso) {
+    if (effectiveScope === "global") {
       const discovery = await fetchDiscoveryCached(normalizedServerBase);
       const endSessionEndpoint = discovery?.end_session_endpoint || `${normalizedBase}/api/oauth/end-session`;
       const logoutUrl = new URL(endSessionEndpoint);
@@ -860,15 +930,209 @@ function createLogoutRouteHandler(config) {
     );
   };
 }
+
+// src/next/backchannel-logout.ts
+var import_server4 = require("next/server");
+
+// src/core/logout-token.ts
+var BACKCHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
+var JTI_CACHE_CAPACITY = 1e3;
+var seenJti = /* @__PURE__ */ new Map();
+function recordJti(jti, expiresAtMs) {
+  const now = Date.now();
+  const existing = seenJti.get(jti);
+  if (existing !== void 0 && existing > now) return false;
+  for (const [key, exp] of seenJti) {
+    if (exp <= now) seenJti.delete(key);
+  }
+  while (seenJti.size >= JTI_CACHE_CAPACITY) {
+    const oldest = seenJti.keys().next().value;
+    if (oldest === void 0) break;
+    seenJti.delete(oldest);
+  }
+  seenJti.set(jti, expiresAtMs);
+  return true;
+}
+async function verifyLogoutToken(logoutToken, ssoBaseUrl, clientId) {
+  const baseUrl = ssoBaseUrl.replace(/\/+$/, "");
+  const header = decodeJwtHeader(logoutToken);
+  if (!header) {
+    throw new SsoError("logout_token_invalid", "Logout Token \u683C\u5F0F\u9519\u8BEF");
+  }
+  if (header.alg !== "RS256") {
+    throw new SsoError(
+      "logout_token_unsupported_alg",
+      `\u4E0D\u652F\u6301\u7684 Logout Token \u7B7E\u540D\u7B97\u6CD5: ${String(header.alg)}`
+    );
+  }
+  const discovery = await fetchDiscoveryDoc(baseUrl);
+  const normalizedIssuer = (discovery?.issuer || baseUrl).replace(/\/+$/, "");
+  const jwks = await fetchJwks(baseUrl);
+  if (!jwks) {
+    throw new SsoError(
+      "logout_token_invalid_signature",
+      "\u65E0\u6CD5\u83B7\u53D6 JWKS \u9A8C\u8BC1 Logout Token \u7B7E\u540D"
+    );
+  }
+  const kid = typeof header.kid === "string" ? header.kid : void 0;
+  const matchCandidates = (set) => set.keys.filter(
+    (k) => k.kty === "RSA" && k.alg === "RS256" && k.use === "sig" && (kid ? k.kid === kid : true)
+  );
+  const verifyAny = async (keys) => {
+    for (const key of keys) {
+      if (await verifyRs256Signature(logoutToken, key)) return true;
+    }
+    return false;
+  };
+  let candidates = matchCandidates(jwks);
+  let validSig = candidates.length > 0 ? await verifyAny(candidates) : false;
+  if (candidates.length === 0 || !validSig) {
+    const freshJwks = await fetchJwks(baseUrl, { forceRefresh: true });
+    if (freshJwks) {
+      candidates = matchCandidates(freshJwks);
+      validSig = candidates.length > 0 ? await verifyAny(candidates) : false;
+    }
+  }
+  if (candidates.length === 0) {
+    throw new SsoError(
+      "logout_token_invalid_signature",
+      "JWKS \u4E2D\u672A\u627E\u5230\u5339\u914D\u7684 RS256 \u516C\u94A5"
+    );
+  }
+  if (!validSig) {
+    throw new SsoError(
+      "logout_token_invalid_signature",
+      "Logout Token \u7B7E\u540D\u9A8C\u8BC1\u5931\u8D25"
+    );
+  }
+  const payload = decodeJwtPayload(logoutToken);
+  if (!payload) {
+    throw new SsoError("logout_token_invalid", "Logout Token payload \u89E3\u6790\u5931\u8D25");
+  }
+  const tokenIssuer = typeof payload.iss === "string" ? payload.iss.replace(/\/+$/, "") : "";
+  if (tokenIssuer !== normalizedIssuer) {
+    throw new SsoError(
+      "logout_token_issuer_mismatch",
+      "Logout Token issuer \u4E0D\u5339\u914D"
+    );
+  }
+  const aud = payload.aud;
+  const audList = Array.isArray(aud) ? aud : typeof aud === "string" ? [aud] : [];
+  if (!audList.includes(clientId)) {
+    throw new SsoError(
+      "logout_token_audience_mismatch",
+      "Logout Token audience \u4E0D\u5339\u914D"
+    );
+  }
+  if (typeof payload.exp !== "number") {
+    throw new SsoError("logout_token_invalid", "Logout Token \u7F3A\u5C11 exp \u58F0\u660E");
+  }
+  if (Date.now() >= payload.exp * 1e3 + 6e4) {
+    throw new SsoError("logout_token_expired", "Logout Token \u5DF2\u8FC7\u671F");
+  }
+  const events = payload.events;
+  if (!events || typeof events !== "object" || !(BACKCHANNEL_LOGOUT_EVENT in events)) {
+    throw new SsoError(
+      "logout_token_invalid",
+      "Logout Token \u7F3A\u5C11 backchannel-logout events \u58F0\u660E"
+    );
+  }
+  const sub = typeof payload.sub === "string" && payload.sub ? payload.sub : void 0;
+  const sid = typeof payload.sid === "string" && payload.sid ? payload.sid : void 0;
+  if (!sub && !sid) {
+    throw new SsoError(
+      "logout_token_invalid",
+      "Logout Token \u5FC5\u987B\u5305\u542B sub \u6216 sid \u81F3\u5C11\u5176\u4E00"
+    );
+  }
+  const jti = typeof payload.jti === "string" ? payload.jti : "";
+  if (!jti) {
+    throw new SsoError("logout_token_invalid", "Logout Token \u7F3A\u5C11 jti \u58F0\u660E");
+  }
+  if (!recordJti(jti, payload.exp * 1e3 + 6e4)) {
+    throw new SsoError("logout_token_replay", "Logout Token jti \u91CD\u653E");
+  }
+  return { sub, sid };
+}
+
+// src/next/backchannel-logout.ts
+function createBackchannelLogoutRouteHandler(config) {
+  const { clientId, ssoBaseUrl, onLogout } = config;
+  const insecureLocalDev = resolveInsecureLocalDev(
+    config.insecureLocalDev ?? false,
+    ssoBaseUrl
+  );
+  const secureCookies = !insecureLocalDev;
+  const pickName = (explicit, fallback) => insecureLocalDev ? toInsecureCookieName(explicit ?? fallback) : explicit ?? fallback;
+  const accessTokenCookieName = pickName(
+    config.accessTokenCookieName,
+    DEFAULT_ACCESS_TOKEN_COOKIE_NAME
+  );
+  const refreshTokenCookieName = pickName(
+    config.refreshTokenCookieName,
+    DEFAULT_REFRESH_TOKEN_COOKIE_NAME
+  );
+  const idTokenCookieName = pickName(
+    config.idTokenCookieName,
+    DEFAULT_ID_TOKEN_COOKIE_NAME
+  );
+  return async function handler(request) {
+    if (request.method !== "POST") {
+      return import_server4.NextResponse.json(
+        { error: "method_not_allowed", error_description: "\u4EC5\u63A5\u53D7 POST \u8BF7\u6C42" },
+        { status: 405 }
+      );
+    }
+    const logoutToken = new URLSearchParams(await request.text()).get(
+      "logout_token"
+    );
+    if (!logoutToken) {
+      return import_server4.NextResponse.json(
+        { error: "invalid_request", error_description: "\u7F3A\u5C11 logout_token" },
+        { status: 400 }
+      );
+    }
+    let payload;
+    try {
+      payload = await verifyLogoutToken(logoutToken, ssoBaseUrl, clientId);
+    } catch (err) {
+      const code = err instanceof SsoError ? err.code : "logout_token_invalid";
+      const description = err instanceof SsoError ? err.description : "Logout Token \u9A8C\u8BC1\u5931\u8D25";
+      return import_server4.NextResponse.json(
+        { error: code, error_description: description },
+        { status: 400 }
+      );
+    }
+    try {
+      await onLogout?.(payload, request);
+    } catch (err) {
+      console.error(
+        "[SSO SDK] backchannel logout onLogout \u94A9\u5B50\u6267\u884C\u5931\u8D25:",
+        err
+      );
+      return import_server4.NextResponse.json(
+        { error: "server_error", error_description: "onLogout \u5904\u7406\u5931\u8D25" },
+        { status: 500 }
+      );
+    }
+    const res = new import_server4.NextResponse(null, { status: 200 });
+    res.cookies.set(accessTokenCookieName, "", getHostCookieOptions(0, secureCookies));
+    res.cookies.set(refreshTokenCookieName, "", getHostCookieOptions(0, secureCookies));
+    res.cookies.set(idTokenCookieName, "", getHostCookieOptions(0, secureCookies));
+    return res;
+  };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   DEFAULT_ACCESS_TOKEN_COOKIE_NAME,
   DEFAULT_ID_TOKEN_COOKIE_NAME,
   DEFAULT_LOGOUT_STATE_COOKIE_NAME,
+  DEFAULT_NONCE_COOKIE_NAME,
   DEFAULT_REFRESH_TOKEN_COOKIE_NAME,
   DEFAULT_RETURN_COOKIE_NAME,
   DEFAULT_STATE_COOKIE_NAME,
   DEFAULT_VERIFIER_COOKIE_NAME,
+  createBackchannelLogoutRouteHandler,
   createCallbackRouteHandler,
   createLogoutRouteHandler,
   createSsoMiddleware,