@nihplod/sso-sdk 1.4.0 → 1.5.0

package/README.md

@@ -84,7 +84,7 @@ if (params.get("sso_probe") === "no_session") {
 
 ### `sso.handleCallback(callbackUrl)`
 
-Handle the OAuth callback. Parses `code` and `state` from the URL, validates state, and exchanges the code for tokens. When an `id_token` is present, the SDK verifies its signature, issuer, audience, expiry and `at_hash`, and — when the login was initiated via `login()` / `getLoginUrl()` / `loginPopup()` — also validates the OIDC `nonce` claim against the value generated at login time (constant-time comparison, fail-closed, protecting against ID Token replay).
+Handle the OAuth callback. Parses `code` and `state` from the URL, validates state, and exchanges the code for tokens. When the requested scope includes `openid`, the token response **must** contain an `id_token` (fail-closed: a missing `id_token` is rejected instead of silently skipping validation). The SDK verifies the ID Token's signature, issuer, audience, expiry and `at_hash`, and — when the login was initiated via `login()` / `getLoginUrl()` / `loginPopup()` — also validates the OIDC `nonce` claim against the value generated at login time (constant-time comparison, protecting against ID Token replay; the check is skipped if no nonce is stored, e.g. when the Next.js nonce cookie has expired).
 
 | Parameter | Type | Description |
 |------|------|------|
@@ -225,8 +225,11 @@ import { SsoProvider } from "@nihplod/sso-sdk/react";
     redirectUri: "...",
     ssoBaseUrl: "...",
     scopes: "openid profile",
+    debug: false,            // Optional: verbose SDK logs ([SSO SDK] prefix)
   }}
-  refreshThreshold={60}  // Auto-refresh 60s before expiry
+  refreshThreshold={60}      // Auto-refresh 60s before expiry
+  onTokenRefreshed={(token) => { /* sync token elsewhere */ }}
+  onSessionExpired={(err) => { /* show "session expired, please sign in again" */ }}
 >
   <App />
 </SsoProvider>
@@ -242,7 +245,9 @@ const {
   isAuthenticated,   // boolean
   isLoading,         // boolean
   error,             // SsoError | null — set when loading user info fails (e.g. session revoked)
+  sessionExpired,    // boolean — refresh_token revoked/expired; survives "no local token" reloads
   login,             // (returnUrl?: string) => Promise<void>
+  loginPopup,        // (options?: { returnUrl?; width?; height? }) => Promise<TokenData>
   logout,            // (redirectToSso?: boolean) => Promise<void>
   refreshUser,       // () => Promise<void>
   getAccessToken,    // () => Promise<string | null>
@@ -252,6 +257,12 @@ const {
 
 Authentication state is three-valued: `isLoading` (initializing/refreshing) → `error` (load failed, e.g. session expired) → `user` (authenticated). Render your UI accordingly.
 
+`sessionExpired` turns `true` when refresh fails because the token was revoked/expired; unlike `error` it is **not** cleared when the local token has already been removed, so you can reliably show a "登录已过期，请重新登录" banner. It resets on successful login or explicit `logout()`.
+
+`loginPopup` keeps the current page state (no full-page redirect) and returns the exchanged token data; the callback tab notifies the opener via `postMessage` with a one-time nonce. If the browser blocks the popup, catch the `popup_blocked` error and fall back to `login()`.
+
+Cross-tab sync: `logout()` and silent token rotation broadcast over `BroadcastChannel`, so other tabs update immediately even though the default token storage is `sessionStorage` (a raw `storage` event does not fire for `sessionStorage`; the listener only helps when you opt into `createSecureStorage({ persist: true })`).
+
 ### `<RequireAuth>`
 
 ```tsx
@@ -332,11 +343,15 @@ export const middleware = createSsoMiddleware({
   publicPaths: ["/", "/public", "/api/auth/logout"],
   // Confidential Client (BFF) can pass clientSecret
   // clientSecret: process.env.SSO_CLIENT_SECRET,
-  // validateSsoCookie defaults to true: the middleware calls the introspection
-  // endpoint to verify the SSO session cookie. Set to false only if you accept
-  // "cookie exists = logged in" semantics (lowest latency, but may pass revoked
-  // sessions). Either way, the middleware is only a UX gate — always re-verify
-  // tokens in Route Handlers / Server Components before serving sensitive data.
+  // ⚠️ The middleware is only a UX gate — always re-verify tokens in
+  // Route Handlers / Server Components (e.g. with @nihplod/sso-verify)
+  // before serving sensitive data.
+  // failClosedOnIntrospectionError: false by default. When introspection is
+  // *unreachable* (network error / timeout / 5xx — as opposed to a
+  // confirmed-invalid token), requests carrying an SSO access_token cookie are
+  // let through (fail-open), because redirecting to an SSO center that is down
+  // helps no one. Set to true to return 502 instead (fail-closed) if your app
+  // prefers rejecting over passing during an SSO outage.
   // insecureLocalDev: false by default; set true ONLY for http://localhost
   // development (disables the Secure cookie attribute and strips __Host-/__Secure-
   // prefixes, which browsers refuse to write over HTTP). Must be set consistently
@@ -357,6 +372,23 @@ export const config = {
 > code (silent re-auth), and the callback handler issues new cookies — the user typically
 > only sees a quick redirect loop through the SSO center. No client-side action is needed.
 
+> **Introspection outage behavior (since 1.4.1):** introspection requests time out after
+> 5s. When introspection is *unreachable* (network error, timeout, or 5xx — as opposed to
+> a confirmed-invalid token), the middleware fails open for requests that already carry an
+> SSO `access_token` cookie: it lets the request through (with one `console.warn`) instead
+> of redirecting to an SSO center that is likely down. This is safe because the middleware
+> is only a UX gate — Route Handlers / Server Components must still re-verify the token.
+> Confirmed-invalid tokens (401/403 or `active:false`) still trigger the redirect, and
+> requests without any SSO cookie still redirect as before. Set
+> `failClosedOnIntrospectionError: true` to return **502** instead of failing open.
+>
+> **Removed fast path:** the former "main-site session cookie" (`__Host-user_token` /
+> `ssoCookieName` / `validateSsoCookie`) shortcut has been removed — it was dead code
+> (`__Host-user_token` holds the main site's *internal* token, which introspection
+> always rejects, and `__Host-` cookies are never sent to subdomains), yet cost every
+> request a wasted introspection round-trip. Both options are now deprecated no-ops
+> (kept for config compatibility; setting either logs a warning).
+
 ```typescript
 // src/app/api/auth/callback/route.ts
 import { createCallbackRouteHandler } from "@nihplod/sso-sdk/next";
@@ -366,6 +398,12 @@ export const GET = createCallbackRouteHandler({
   ssoBaseUrl: "https://nihplod.cn",
   redirectUri: "https://yourapp.com/api/auth/callback",
   defaultReturnPath: "/dashboard",
+  // Optional but recommended: keep in sync with createSsoMiddleware's `scopes`.
+  // Only when explicitly set AND it includes `openid` does the callback require an
+  // id_token (fail-closed). If omitted, legacy-compatible behavior applies: the ID
+  // token is validated when present but its absence is not rejected, so upgrading
+  // apps that didn't configure scopes keep working.
+  scopes: "openid profile",
   // Same as middleware; Confidential Client can pass clientSecret
 });
 ```
@@ -431,16 +469,33 @@ Default cookie names:
 | access_token | `__Host-nihplod_sso_at` | Requires Secure + Path=/ + no Domain |
 | refresh_token | `__Host-nihplod_sso_rt` | Requires Secure + Path=/ + no Domain |
 | state | `__Host-nihplod_sso_state` | Requires Secure + Path=/ + no Domain |
-| nonce | `__Host-nihplod_sso_nonce` | OIDC nonce for ID Token replay protection (validated fail-closed in the callback); Requires Secure + Path=/ + no Domain |
+| nonce | `__Host-nihplod_sso_nonce` | OIDC nonce for ID Token replay protection. Validated when the nonce cookie is present (cookie TTL 10 minutes); if the cookie has expired, the nonce check is skipped. Requires Secure + Path=/ + no Domain |
+| id_token | `__Host-nihplod_sso_id` | ID token cookie used as `id_token_hint` for RP-Initiated Logout. Requires Secure + Path=/ + no Domain |
+| logout_state | `__Host-nihplod_sso_logout_state` | One-time logout state for CSRF protection on the RP-Initiated Logout callback. Requires Secure + Path=/ + no Domain |
 | return_url | `__Host-nihplod_sso_return` | Requires Secure + Path=/ + no Domain |
 | verifier | `__Secure-nihplod_sso_verifier` | Requires Secure + no Domain; Path is the callback path, therefore uses `__Secure-` prefix |
 
+> In the Next.js BFF flow, the transient cookies above (`state`, `nonce`, `return_url`, `verifier`) are written with the per-login `state` as a name suffix (e.g. `__Host-nihplod_sso_state_<state>`) and looked up by the `state` returned from the IdP. This keeps concurrent tabs from overwriting each other's login attempt. The legacy unsuffixed names are still accepted as a fallback during rolling upgrades.
+
 > For local development with `http://localhost`, browsers reject `Secure` cookies — and cookies named with `__Host-`/`__Secure-` prefixes are refused outright when `Secure` is missing (Chrome, Edge and Firefox all enforce this; behavior on `localhost` varies by browser, some treat it as a secure context for `Secure` cookies, none accept prefixed names without `Secure`). The visible symptom: the login callback appears to succeed but the cookies are never written, so the middleware keeps judging you as logged out and redirects to the SSO authorize page in an infinite loop. Fix: set `insecureLocalDev: true` on `createSsoMiddleware`, `createCallbackRouteHandler` and `createLogoutRouteHandler` (it disables `Secure` and strips the prefixes, with a startup warning), or serve local dev over HTTPS. HTTPS is mandatory in production — and as a production guard, all three helpers force-ignore `insecureLocalDev` (keeping `Secure` and the `__Host-`/`__Secure-` prefixes, with a warning) when `NODE_ENV=production` and `ssoBaseUrl` uses HTTPS.
 
 ---
 
 ## Security Recommendations and Token Storage
 
+> ⚠️ **The Next.js middleware is only a UX gate.** It decides whether to redirect
+> unauthenticated visitors to the SSO login page; it is NOT a security boundary.
+> Any route serving sensitive data MUST re-verify the token in the Route Handler /
+> Server Component itself (e.g. with `@nihplod/sso-verify`, or the `getSessionUser`
+> pattern in `examples/nextjs-app`). This applies regardless of
+> `failClosedOnIntrospectionError` — that option only changes how the middleware
+> behaves when the SSO introspection endpoint is unreachable.
+
+> ℹ️ HS256 ID Tokens are **always rejected** (symmetric secrets cannot be safely
+> distributed to public clients). The `rejectHs256WhenRs256Available` option of
+> `validateIdToken` is deprecated and has no effect — it only chooses which error
+> code is thrown. The SSO center must be configured with an RS256 key pair.
+
 By default, the SDK stores tokens in **sessionStorage** (tab-scoped persistence). This keeps the login state across page reloads and the full-page redirect that `CallbackPage` performs after the token exchange, while the data is cleared automatically when the tab closes and is never shared with other tabs. In SSR environments or privacy modes where `sessionStorage` is unavailable/unwritable, it falls back to an in-memory map (login state is lost on reload in that case).
 
 > ⚠️ XSS note: any token readable by JavaScript can be stolen by XSS. sessionStorage narrows the exposure compared with `localStorage` (tab-scoped, auto-cleared), but a `refresh_token` readable by JS is still exfiltratable while the tab is open. If you need stronger guarantees, use the Next.js BFF pattern below (tokens in `httpOnly` cookies) or keep the refresh token inside a Service Worker.
@@ -459,6 +514,33 @@ In production, it is more secure to keep the refresh token in a Service Worker o
 
 ---
 
+## Error Codes
+
+All SDK failures are thrown as `SsoError` (`error.code` / `error.description`; `error.message` is `[SSO SDK] <code>: <description>`).
+
+| Code | Meaning | Typical handling |
+| --- | --- | --- |
+| `invalid_config` | Missing/invalid config (clientId, redirectUri, ssoBaseUrl), or middleware/callback config mismatch | Fix configuration; check `insecureLocalDev` and cookie names are identical everywhere |
+| `state_mismatch` | OAuth `state` mismatch (CSRF protection) | Restart login; never ignore |
+| `pkce_required` | PKCE verifier missing (expired tab / different tab) | Restart login |
+| `authorization_code_expired` / `authorization_code_used` | Code expired or already redeemed | Restart login |
+| `user_denied_authorization` | User cancelled on the SSO page | Show a neutral "login cancelled" message |
+| `client_disabled` | Client disabled in admin console | Contact administrator |
+| `account_disabled` | User account disabled | Show reason, contact support |
+| `session_expired` / `no_refresh_token` | Refresh token revoked/expired | Clear local state and ask the user to sign in again (`sessionExpired` is set on `SsoProvider`) |
+| `network_error` | Network failure or request timeout (10s; revoke 3s) | Show retry; keep local tokens for retryable cases |
+| `rate_limited` | Server rate limit | Back off and retry later |
+| `sso_server_error` | SSO server error | Retry later |
+| `popup_blocked` | `window.open` blocked | Fall back to full-page `login()` |
+| `popup_closed` | User closed the login popup | Offer retry |
+| `id_token_*` (`id_token_invalid`, `..._signature`, `..._nonce_mismatch`, `..._at_hash_mismatch`, …) | ID token missing or failed validation (fail-closed) | Restart login; if persistent, check `scopes` parity between middleware and callback |
+| `logout_token_*` | Back-channel logout token validation failed | Return 400/500 so the IdP retries; check clock skew/JWKS |
+| `not_authenticated` | No local token when calling user APIs | Trigger login |
+
+Next.js callback errors are rendered as a branded HTML page for browser navigations (with a "重新登录" action). Programmatic callers can force JSON with `?format=json` or an `Accept` header that excludes `text/html`. Customize the page with the `renderErrorPage` option; enable `debug: true` for server-side error logs.
+
+---
+
 ## Utility Functions
 
 ```typescript

package/dist/index.d.mts

@@ -32,6 +32,12 @@ interface TokenStorage {
     get(key: string): string | null;
     set(key: string, value: string): void;
     remove(key: string): void;
+    /**
+     * 可选：枚举当前存储中的 key（不含 SDK 内部前缀）。
+     * 供 clearAllSsoData() 清理 client 级残留（`token:<clientId>` 等）。
+     * 自定义存储若不实现，clearAllSsoData() 仅能按已知 key 清理。
+     */
+    keys?(): string[];
 }
 /**
  * 创建存储实现
@@ -110,6 +116,11 @@ interface SsoClientConfig {
     scopes?: string;
     /** RP-Initiated Logout 返回地址（可选）。不传时回退到 redirectUri */
     postLogoutRedirectUri?: string;
+    /**
+     * 调试日志开关（默认 false）。开启后输出登录/回调/刷新/登出等关键流程日志，
+     * 便于接入方定位问题（生产默认关闭，避免日志噪音）。
+     */
+    debug?: boolean;
     /**
      * 服务端到服务端调用的内网地址（可选，如 http://127.0.0.1:3000）。
      * 仅用于 discovery / token / userinfo / revocation 等服务器间请求；
@@ -154,6 +165,11 @@ interface TokenResponse {
     access_token: string;
     token_type: string;
     expires_in: number;
+    /**
+     * authorization_code 交换主站必然返回（缺失时 handleCallback 抛
+     * token_request_failed）；refresh 响应按 RFC 6749 §6 可省略，
+     * 此时 SDK 沿用旧 refresh_token。
+     */
     refresh_token: string;
     id_token?: string;
 }
@@ -184,6 +200,12 @@ declare class SsoClient {
     /** Discovery fetch 超时（10 秒） */
     private static readonly DISCOVERY_TIMEOUT_MS;
     constructor(config: SsoClientConfig);
+    /**
+     * 调试日志（config.debug=true 时输出，前缀 [SSO SDK]）：
+     * 覆盖登录发起 / 回调结果 / 刷新失败 / 登出等关键节点，便于接入方定位问题。
+     * 不会输出 token/授权码等敏感值。
+     */
+    debugLog(...args: unknown[]): void;
     /**
      * 获取 OIDC Discovery 文档（带缓存 + 超时）
      *
@@ -417,9 +439,11 @@ declare class OAuthError extends Error {
  */
 /**
  * 校验 returnUrl 是否可信（防开放重定向）。
- * 仅允许：相对路径（且不以 // 开头）或与 currentOrigin 完全同源的绝对 URL。
- * 拒绝一切含反斜杠 \ 的值：浏览器会把 "/\evil.com" 归一化为 "//evil.com"，
- * 形成协议相对 URL 开放重定向。
+ * 仅允许：
+ * - 站内相对路径（以单个 "/" 开头且不以 "//" 开头）
+ * - 与 currentOrigin 完全同源的 http(s) 绝对 URL
+ * 拒绝一切含反斜杠/控制字符的值（浏览器会将 "/\evil.com" 解析为跨站 URL），
+ * 拒绝 userinfo 与危险 scheme。
  */
 declare function isTrustedReturnUrl(url: string, currentOrigin: string): boolean;
 /**

package/dist/index.d.ts

@@ -32,6 +32,12 @@ interface TokenStorage {
     get(key: string): string | null;
     set(key: string, value: string): void;
     remove(key: string): void;
+    /**
+     * 可选：枚举当前存储中的 key（不含 SDK 内部前缀）。
+     * 供 clearAllSsoData() 清理 client 级残留（`token:<clientId>` 等）。
+     * 自定义存储若不实现，clearAllSsoData() 仅能按已知 key 清理。
+     */
+    keys?(): string[];
 }
 /**
  * 创建存储实现
@@ -110,6 +116,11 @@ interface SsoClientConfig {
     scopes?: string;
     /** RP-Initiated Logout 返回地址（可选）。不传时回退到 redirectUri */
     postLogoutRedirectUri?: string;
+    /**
+     * 调试日志开关（默认 false）。开启后输出登录/回调/刷新/登出等关键流程日志，
+     * 便于接入方定位问题（生产默认关闭，避免日志噪音）。
+     */
+    debug?: boolean;
     /**
      * 服务端到服务端调用的内网地址（可选，如 http://127.0.0.1:3000）。
      * 仅用于 discovery / token / userinfo / revocation 等服务器间请求；
@@ -154,6 +165,11 @@ interface TokenResponse {
     access_token: string;
     token_type: string;
     expires_in: number;
+    /**
+     * authorization_code 交换主站必然返回（缺失时 handleCallback 抛
+     * token_request_failed）；refresh 响应按 RFC 6749 §6 可省略，
+     * 此时 SDK 沿用旧 refresh_token。
+     */
     refresh_token: string;
     id_token?: string;
 }
@@ -184,6 +200,12 @@ declare class SsoClient {
     /** Discovery fetch 超时（10 秒） */
     private static readonly DISCOVERY_TIMEOUT_MS;
     constructor(config: SsoClientConfig);
+    /**
+     * 调试日志（config.debug=true 时输出，前缀 [SSO SDK]）：
+     * 覆盖登录发起 / 回调结果 / 刷新失败 / 登出等关键节点，便于接入方定位问题。
+     * 不会输出 token/授权码等敏感值。
+     */
+    debugLog(...args: unknown[]): void;
     /**
      * 获取 OIDC Discovery 文档（带缓存 + 超时）
      *
@@ -417,9 +439,11 @@ declare class OAuthError extends Error {
  */
 /**
  * 校验 returnUrl 是否可信（防开放重定向）。
- * 仅允许：相对路径（且不以 // 开头）或与 currentOrigin 完全同源的绝对 URL。
- * 拒绝一切含反斜杠 \ 的值：浏览器会把 "/\evil.com" 归一化为 "//evil.com"，
- * 形成协议相对 URL 开放重定向。
+ * 仅允许：
+ * - 站内相对路径（以单个 "/" 开头且不以 "//" 开头）
+ * - 与 currentOrigin 完全同源的 http(s) 绝对 URL
+ * 拒绝一切含反斜杠/控制字符的值（浏览器会将 "/\evil.com" 解析为跨站 URL），
+ * 拒绝 userinfo 与危险 scheme。
  */
 declare function isTrustedReturnUrl(url: string, currentOrigin: string): boolean;
 /**

package/dist/index.js

@@ -154,18 +154,25 @@ function createMemoryStorageAdapter() {
     },
     remove(key) {
       store.delete(key);
+    },
+    keys() {
+      return [...store.keys()];
     }
   };
 }
 var memoryStorageAdapter = createMemoryStorageAdapter();
 var localStorageAdapter = {
   get(key) {
-    if (typeof localStorage === "undefined") return null;
-    return localStorage.getItem(STORAGE_PREFIX + key);
+    try {
+      if (typeof localStorage === "undefined") return null;
+      return localStorage.getItem(STORAGE_PREFIX + key);
+    } catch {
+      return null;
+    }
   },
   set(key, value) {
-    if (typeof localStorage === "undefined") return;
     try {
+      if (typeof localStorage === "undefined") return;
       localStorage.setItem(STORAGE_PREFIX + key, value);
     } catch (err) {
       console.warn(
@@ -174,34 +181,68 @@ var localStorageAdapter = {
     }
   },
   remove(key) {
-    if (typeof localStorage === "undefined") return;
-    localStorage.removeItem(STORAGE_PREFIX + key);
+    try {
+      if (typeof localStorage === "undefined") return;
+      localStorage.removeItem(STORAGE_PREFIX + key);
+    } catch {
+    }
+  },
+  keys() {
+    try {
+      if (typeof localStorage === "undefined") return [];
+      const result = [];
+      for (let i = 0; i < localStorage.length; i++) {
+        const key = localStorage.key(i);
+        if (key?.startsWith(STORAGE_PREFIX)) result.push(key.slice(STORAGE_PREFIX.length));
+      }
+      return result;
+    } catch {
+      return [];
+    }
   }
 };
 function createSessionStorageAdapter() {
   const fallback = /* @__PURE__ */ new Map();
   return {
     get(key) {
-      if (typeof sessionStorage !== "undefined") {
-        return sessionStorage.getItem(STORAGE_PREFIX + key) ?? fallback.get(key) ?? null;
+      try {
+        if (typeof sessionStorage !== "undefined") {
+          return sessionStorage.getItem(STORAGE_PREFIX + key) ?? fallback.get(key) ?? null;
+        }
+      } catch {
       }
       return fallback.get(key) ?? null;
     },
     set(key, value) {
-      if (typeof sessionStorage === "undefined") {
-        fallback.set(key, value);
-        return;
-      }
       try {
-        sessionStorage.setItem(STORAGE_PREFIX + key, value);
+        if (typeof sessionStorage !== "undefined") {
+          sessionStorage.setItem(STORAGE_PREFIX + key, value);
+          return;
+        }
       } catch {
-        fallback.set(key, value);
       }
+      fallback.set(key, value);
     },
     remove(key) {
       fallback.delete(key);
-      if (typeof sessionStorage === "undefined") return;
-      sessionStorage.removeItem(STORAGE_PREFIX + key);
+      try {
+        if (typeof sessionStorage === "undefined") return;
+        sessionStorage.removeItem(STORAGE_PREFIX + key);
+      } catch {
+      }
+    },
+    keys() {
+      const result = new Set(fallback.keys());
+      try {
+        if (typeof sessionStorage !== "undefined") {
+          for (let i = 0; i < sessionStorage.length; i++) {
+            const key = sessionStorage.key(i);
+            if (key?.startsWith(STORAGE_PREFIX)) result.add(key.slice(STORAGE_PREFIX.length));
+          }
+        }
+      } catch {
+      }
+      return [...result];
     }
   };
 }
@@ -303,23 +344,44 @@ function clearAllSsoData(clientId) {
   removeReturnUrl();
   removeLogoutState();
   removeSilentProbe();
-  const prefix = STORAGE_PREFIX + VERIFIER_KEY_PREFIX;
-  const stores = [
-    typeof sessionStorage !== "undefined" ? sessionStorage : null,
-    typeof localStorage !== "undefined" ? localStorage : null
-  ];
+  const stores = [];
+  try {
+    if (typeof sessionStorage !== "undefined") stores.push(sessionStorage);
+  } catch {
+  }
+  try {
+    if (typeof localStorage !== "undefined") stores.push(localStorage);
+  } catch {
+  }
+  const abstractKeys = /* @__PURE__ */ new Set();
   for (const store of stores) {
-    if (!store) continue;
     const keys = [];
-    for (let i = 0; i < store.length; i++) {
-      const key = store.key(i);
-      if (key?.startsWith(prefix)) keys.push(key);
+    try {
+      for (let i = 0; i < store.length; i++) {
+        const key = store.key(i);
+        if (key?.startsWith(STORAGE_PREFIX)) keys.push(key);
+      }
+    } catch {
+      continue;
     }
     for (const key of keys) {
-      _transient.remove(key.slice(STORAGE_PREFIX.length));
-      store.removeItem(key);
+      abstractKeys.add(key.slice(STORAGE_PREFIX.length));
+      try {
+        store.removeItem(key);
+      } catch {
+      }
+    }
+  }
+  for (const store of [_transient, _storage]) {
+    try {
+      for (const key of store.keys?.() ?? []) abstractKeys.add(key);
+    } catch {
     }
   }
+  for (const key of abstractKeys) {
+    _transient.remove(key);
+    _storage.remove(key);
+  }
 }
 function clearVerifiersForClients(clientIds) {
   for (const clientId of clientIds) {
@@ -328,12 +390,17 @@ function clearVerifiersForClients(clientIds) {
 }
 
 // src/core/security.ts
+var UNSAFE_URL_CHAR_PATTERN = /[\\\u0000-\u001F\u007F]/;
 function isTrustedReturnUrl(url, currentOrigin) {
   if (!url) return false;
-  if (url.includes("\\")) return false;
-  if (url.startsWith("/") && !url.startsWith("//")) return true;
+  if (UNSAFE_URL_CHAR_PATTERN.test(url)) return false;
+  if (url.startsWith("//")) return false;
+  if (url.startsWith("/")) return true;
   try {
-    return new URL(url).origin === currentOrigin;
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+    if (parsed.username || parsed.password) return false;
+    return parsed.origin === currentOrigin;
   } catch {
     return false;
   }
@@ -567,6 +634,34 @@ async function validateIdToken(idToken, accessToken, expectedIssuer, expectedCli
 }
 
 // src/core/SsoClient.ts
+var REQUEST_TIMEOUT_MS = 1e4;
+var REVOKE_TIMEOUT_MS = 3e3;
+async function fetchWithTimeout(input, init = {}, timeoutMs = REQUEST_TIMEOUT_MS) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetch(input, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function assertValidTokenResponse(data, requireRefreshToken) {
+  if (typeof data.access_token !== "string" || !data.access_token) {
+    throw new SsoError("token_request_failed", "Token \u54CD\u5E94\u7F3A\u5C11 access_token");
+  }
+  if (typeof data.expires_in !== "number" || !Number.isFinite(data.expires_in) || data.expires_in <= 0) {
+    throw new SsoError(
+      "token_request_failed",
+      `Token \u54CD\u5E94 expires_in \u975E\u6CD5: ${String(data.expires_in)}`
+    );
+  }
+  if (requireRefreshToken && (typeof data.refresh_token !== "string" || !data.refresh_token)) {
+    throw new SsoError(
+      "token_request_failed",
+      "Token \u54CD\u5E94\u7F3A\u5C11 refresh_token\uFF08authorization_code \u4EA4\u6362\u5FC5\u987B\u8FD4\u56DE\uFF09"
+    );
+  }
+}
 var SILENT_PROBE_ERRORS = /* @__PURE__ */ new Set([
   "login_required",
   "consent_required",
@@ -585,6 +680,19 @@ var _SsoClient = class _SsoClient {
     this._serverBase = (config.serverBaseUrl ?? base).replace(/\/+$/, "");
   }
   // ============================================
+  // 调试日志
+  // ============================================
+  /**
+   * 调试日志（config.debug=true 时输出，前缀 [SSO SDK]）：
+   * 覆盖登录发起 / 回调结果 / 刷新失败 / 登出等关键节点，便于接入方定位问题。
+   * 不会输出 token/授权码等敏感值。
+   */
+  debugLog(...args) {
+    if (this.config.debug) {
+      console.warn("[SSO SDK]", ...args);
+    }
+  }
+  // ============================================
   // 内部方法
   // ============================================
   /**
@@ -964,7 +1072,7 @@ var _SsoClient = class _SsoClient {
     }
     let res;
     try {
-      res = await fetch(tokenEndpoint, {
+      res = await fetchWithTimeout(tokenEndpoint, {
         method: "POST",
         headers: { "Content-Type": "application/x-www-form-urlencoded" },
         body: body.toString()
@@ -985,6 +1093,15 @@ var _SsoClient = class _SsoClient {
       );
     }
     const data = await res.json();
+    assertValidTokenResponse(data, true);
+    const requestedScopes = (this.config.scopes || "openid profile").split(" ").filter(Boolean);
+    if (requestedScopes.includes("openid") && !data.id_token) {
+      removeTokenData(this.config.clientId);
+      throw new SsoError(
+        "id_token_invalid",
+        "Token \u54CD\u5E94\u7F3A\u5C11 id_token\uFF08scope \u542B openid \u65F6\u5FC5\u9700\uFF09"
+      );
+    }
     if (data.id_token) {
       try {
         await validateIdToken(
@@ -1014,6 +1131,7 @@ var _SsoClient = class _SsoClient {
       expires_at: now + data.expires_in * 1e3
     };
     saveTokenData(tokenData, this.config.clientId);
+    this.debugLog("handleCallback: token \u4EA4\u6362\u6210\u529F", { clientId: this.config.clientId });
     return tokenData;
   }
   /**
@@ -1049,7 +1167,7 @@ var _SsoClient = class _SsoClient {
     let lastErr;
     for (let attempt = 0; attempt < 2; attempt++) {
       try {
-        res = await fetch(tokenEndpoint, {
+        res = await fetchWithTimeout(tokenEndpoint, {
           method: "POST",
           headers: { "Content-Type": "application/x-www-form-urlencoded" },
           body: body.toString()
@@ -1071,15 +1189,20 @@ var _SsoClient = class _SsoClient {
       } catch {
       }
       const errorCode = errData.error || "";
-      if (errorCode === "invalid_grant" || res.status === 401) {
+      if (errorCode === "invalid_grant") {
         removeTokenData(this.config.clientId);
       }
+      this.debugLog("refreshToken: \u5237\u65B0\u5931\u8D25", { status: res.status, error: errorCode });
+      if (!errorCode && res.status === 401) {
+        throw new SsoError("sso_server_error", "\u5237\u65B0 Token \u5931\u8D25\uFF08\u7F51\u5173\u5F02\u5E38\uFF09\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5");
+      }
       throw new SsoError(
         mapOAuthErrorToSsoCode(errorCode, "refresh"),
         errData.error_description || `\u5237\u65B0 Token \u5931\u8D25: HTTP ${res.status}`
       );
     }
     const data = await res.json();
+    assertValidTokenResponse(data, false);
     if (data.id_token) {
       try {
         await validateIdToken(
@@ -1123,7 +1246,7 @@ var _SsoClient = class _SsoClient {
     const userinfoEndpoint = await this._getUserinfoEndpoint();
     let res;
     try {
-      res = await fetch(userinfoEndpoint, {
+      res = await fetchWithTimeout(userinfoEndpoint, {
         headers: {
           Authorization: `Bearer ${tokenData.access_token}`
         }
@@ -1180,6 +1303,10 @@ var _SsoClient = class _SsoClient {
     const refreshToken = tokenData?.refresh_token;
     const idTokenHint = tokenData?.id_token;
     clearAllSsoData(this.config.clientId);
+    this.debugLog("logout: \u672C\u5730\u6570\u636E\u5DF2\u6E05\u9664", {
+      clientId: this.config.clientId,
+      redirectToSso
+    });
     if (refreshToken && this.config.clientId) {
       try {
         const discovery = this.config.serverBaseUrl ? null : await this._getDiscovery();
@@ -1192,11 +1319,15 @@ var _SsoClient = class _SsoClient {
         if (this.config.clientSecret) {
           revokeBody.set("client_secret", this.config.clientSecret);
         }
-        await fetch(revokeUrl, {
-          method: "POST",
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          body: revokeBody.toString()
-        });
+        await fetchWithTimeout(
+          revokeUrl,
+          {
+            method: "POST",
+            headers: { "Content-Type": "application/x-www-form-urlencoded" },
+            body: revokeBody.toString()
+          },
+          REVOKE_TIMEOUT_MS
+        );
       } catch {
       }
     }