@nihplod/sso-sdk 1.5.0 → 1.7.0

package/dist/next/index.mjs

@@ -74,15 +74,19 @@ async function computeCodeChallenge(verifier) {
 function matchesPath(pathname, paths) {
   return paths.some((path) => {
     if (pathname === path) return true;
-    if (path.endsWith("/:path*") && pathname.startsWith(path.replace("/:path*", ""))) return true;
-    if (pathname.startsWith(path + "/")) return true;
-    return false;
+    if (path.endsWith("/:path*")) {
+      const base = path.slice(0, -"/:path*".length);
+      return pathname === base || pathname.startsWith(base + "/");
+    }
+    return pathname.startsWith(path + "/");
   });
 }
 var introspectionCache = /* @__PURE__ */ new Map();
 var INTROSPECT_CACHE_TTL_MS = 3e4;
 var INTROSPECT_CACHE_MAX_ENTRIES = 500;
 var INTROSPECT_TIMEOUT_MS = 5e3;
+var warnedIntrospectClientAuthFailure = false;
+var warnedIntrospectRateLimited = false;
 async function introspectCacheKey(token, clientId) {
   const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token));
   const hex = Array.from(new Uint8Array(hash)).map((b) => b.toString(16).padStart(2, "0")).join("");
@@ -133,11 +137,25 @@ async function introspectAccessToken(token, ssoBaseUrl, clientId, clientSecret)
       signal: AbortSignal.timeout(INTROSPECT_TIMEOUT_MS)
     });
     if (!res.ok) {
+      if (res.status === 429) {
+        if (!warnedIntrospectRateLimited) {
+          warnedIntrospectRateLimited = true;
+          console.warn(
+            "[SSO SDK] introspection \u88AB\u9650\u6D41\uFF08HTTP 429\uFF09\uFF1A\u8BF7\u4E3A\u5B50\u7AD9 BFF \u914D\u7F6E\u72EC\u7ACB\u7684 client \u7EA7\u914D\u989D\uFF0C\u6216\u964D\u4F4E middleware introspection \u9891\u7387\u3002\u672C\u6B21\u6309 unreachable \u5904\u7406\uFF08\u9ED8\u8BA4 fail-open\uFF09\u3002"
+          );
+        }
+        return "unreachable";
+      }
       if (res.status !== 401 && res.status !== 403) {
         return "unreachable";
       }
-      introspectCacheSet(cacheKey, false);
-      return "inactive";
+      if (!warnedIntrospectClientAuthFailure) {
+        warnedIntrospectClientAuthFailure = true;
+        console.warn(
+          `[SSO SDK] introspection \u5BA2\u6237\u7AEF\u8BA4\u8BC1\u5931\u8D25\uFF08HTTP ${res.status}\uFF09\uFF1A\u8BF7\u68C0\u67E5 clientId/clientSecret \u4E0E\u4E3B\u7AD9\u6CE8\u518C\u4FE1\u606F\u662F\u5426\u4E00\u81F4\u3002\u8BE5\u6545\u969C\u4E0D\u4F1A\u88AB\u7F13\u5B58\u4E3A token \u5931\u6548\uFF0C\u4E5F\u4E0D\u4F1A\u89E6\u53D1\u9759\u9ED8\u91CD\u767B\u5F55\u5FAA\u73AF\u3002`
+        );
+      }
+      return "unreachable";
     }
     const data = await res.json();
     const active = data.active === true;
@@ -180,7 +198,7 @@ function createSsoMiddleware(config) {
   }
   return async function ssoMiddleware(request) {
     const { pathname } = request.nextUrl;
-    if (pathname.startsWith("/_next/") || pathname.startsWith("/favicon.ico") || pathname.match(/\.(ico|png|jpg|jpeg|svg|css|js|woff2?)$/)) {
+    if (!pathname.startsWith("/api/") && (pathname.startsWith("/_next/") || pathname.startsWith("/favicon.ico") || pathname.match(/\.(ico|png|jpg|jpeg|svg|css|js|woff2?)$/))) {
       return NextResponse.next();
     }
     if (pathname === callbackPath) {
@@ -369,7 +387,19 @@ async function fetchJwks(baseUrl, options = {}) {
     return cachedJwks.jwks;
   }
   const discovery = await fetchDiscoveryDoc(baseUrl);
-  const jwksUri = discovery?.jwks_uri || `${baseUrl}/api/oauth/jwks`;
+  let jwksUri = `${baseUrl}/api/oauth/jwks`;
+  if (discovery?.jwks_uri) {
+    try {
+      if (new URL(discovery.jwks_uri).origin === new URL(baseUrl).origin) {
+        jwksUri = discovery.jwks_uri;
+      } else {
+        console.warn(
+          "[SSO SDK] Discovery \u7684 jwks_uri \u4E0E ssoBaseUrl \u4E0D\u540C\u6E90\uFF0C\u5DF2\u5FFD\u7565\u5E76\u4F7F\u7528\u9ED8\u8BA4 JWKS \u7AEF\u70B9"
+        );
+      }
+    } catch {
+    }
+  }
   try {
     const res = await fetch(jwksUri, {
       signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
@@ -499,7 +529,10 @@ async function validateIdToken(idToken, accessToken, expectedIssuer, expectedCli
   if (Date.now() >= payload.exp * 1e3 + 6e4) {
     throw new SsoError("id_token_expired", "ID Token \u5DF2\u8FC7\u671F");
   }
-  if (typeof payload.iat === "number" && payload.iat * 1e3 > Date.now() + 6e4) {
+  if (typeof payload.iat !== "number") {
+    throw new SsoError("id_token_invalid", "ID Token \u7F3A\u5C11 iat \u58F0\u660E");
+  }
+  if (payload.iat * 1e3 > Date.now() + 6e4) {
     throw new SsoError("id_token_invalid", "ID Token iat \u5728\u672A\u6765\uFF0C\u7591\u4F3C\u4F2A\u9020\u6216\u65F6\u949F\u5F02\u5E38");
   }
   if (typeof payload.sub !== "string" || !payload.sub) {
@@ -516,10 +549,27 @@ async function validateIdToken(idToken, accessToken, expectedIssuer, expectedCli
     if (!tokenNonce || !timingSafeEqualString(expectedNonce, tokenNonce)) {
       throw new SsoError("id_token_nonce_mismatch", "ID Token nonce \u4E0D\u5339\u914D");
     }
+  } else if (typeof payload.nonce === "string" && payload.nonce) {
+    throw new SsoError(
+      "id_token_nonce_mismatch",
+      "ID Token \u643A\u5E26 nonce \u4F46\u672C\u5730\u65E0\u671F\u671B\u503C\uFF08\u53EF\u80FD\u975E\u672C\u6B21\u767B\u5F55\u4F1A\u8BDD\u7B7E\u53D1\uFF09"
+    );
   }
   return { sub: payload.sub };
 }
 
+// src/core/http.ts
+var REQUEST_TIMEOUT_MS = 1e4;
+async function fetchWithTimeout(input, init = {}, timeoutMs = REQUEST_TIMEOUT_MS) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetch(input, { ...init, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 // src/next/callback.ts
 function escapeHtml(value) {
   return value.replace(/[&<>"']/g, (ch) => {
@@ -620,8 +670,14 @@ function createCallbackRouteHandler(config) {
   const insecureLocalDev = resolveInsecureLocalDev(insecureLocalDevOpt, ssoBaseUrl);
   const secureCookies = !insecureLocalDev;
   const pickName = (explicit, fallback) => insecureLocalDev ? toInsecureCookieName(explicit ?? fallback) : explicit ?? fallback;
-  const accessTokenCookieName = pickName(config.accessTokenCookieName, DEFAULT_ACCESS_TOKEN_COOKIE_NAME);
-  const refreshTokenCookieName = pickName(config.refreshTokenCookieName, DEFAULT_REFRESH_TOKEN_COOKIE_NAME);
+  const accessTokenCookieName = pickName(
+    config.accessTokenCookieName,
+    DEFAULT_ACCESS_TOKEN_COOKIE_NAME
+  );
+  const refreshTokenCookieName = pickName(
+    config.refreshTokenCookieName,
+    DEFAULT_REFRESH_TOKEN_COOKIE_NAME
+  );
   const idTokenCookieName = pickName(config.idTokenCookieName, DEFAULT_ID_TOKEN_COOKIE_NAME);
   const stateCookieName = pickName(config.stateCookieName, DEFAULT_STATE_COOKIE_NAME);
   const nonceCookieName = pickName(config.nonceCookieName, DEFAULT_NONCE_COOKIE_NAME);
@@ -655,13 +711,7 @@ function createCallbackRouteHandler(config) {
     const error = searchParams.get("error");
     if (error) {
       const desc = searchParams.get("error_description") || error;
-      return buildErrorResponse(
-        request,
-        400,
-        "authorization_failed",
-        desc,
-        config.renderErrorPage
-      );
+      return buildErrorResponse(request, 400, "authorization_failed", desc, config.renderErrorPage);
     }
     const code = searchParams.get("code");
     const returnedState = searchParams.get("state");
@@ -715,6 +765,20 @@ function createCallbackRouteHandler(config) {
         config.renderErrorPage
       );
     }
+    const returnedIss = searchParams.get("iss");
+    if (returnedIss) {
+      const discovery = await fetchDiscoveryDoc(normalizedBase);
+      const expectedIssuer = (discovery?.issuer || normalizedBase).replace(/\/+$/, "");
+      if (returnedIss.replace(/\/+$/, "") !== expectedIssuer) {
+        return buildErrorResponse(
+          request,
+          400,
+          "issuer_mismatch",
+          "\u6388\u6743\u54CD\u5E94 issuer \u4E0D\u5339\u914D\uFF0C\u8BF7\u91CD\u65B0\u53D1\u8D77\u767B\u5F55",
+          config.renderErrorPage
+        );
+      }
+    }
     const expectedNonce = readTransientCookie(nonceCookieName);
     const verifier = readTransientCookie(verifierCookieName);
     if (!verifier) {
@@ -738,31 +802,18 @@ function createCallbackRouteHandler(config) {
     }
     let res = null;
     let lastError;
-    const maxRetries = 1;
-    for (let attempt = 0; attempt <= maxRetries; attempt++) {
-      if (attempt > 0) {
-        await new Promise((r) => setTimeout(r, 1e3 * Math.pow(2, attempt - 1)));
-      }
-      try {
-        res = await fetch(tokenEndpoint, {
+    try {
+      res = await fetchWithTimeout(
+        tokenEndpoint,
+        {
           method: "POST",
           headers: { "Content-Type": "application/x-www-form-urlencoded" },
           body: body.toString()
-        });
-        lastError = null;
-        break;
-      } catch (err) {
-        lastError = err;
-        if (attempt >= maxRetries) {
-          return buildErrorResponse(
-            request,
-            502,
-            "server_error",
-            "\u767B\u5F55\u670D\u52A1\u6682\u65F6\u4E0D\u53EF\u7528\uFF08Token \u8BF7\u6C42\u5931\u8D25\uFF09\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5",
-            config.renderErrorPage
-          );
-        }
-      }
+        },
+        1e4
+      );
+    } catch (err) {
+      lastError = err;
     }
     if (lastError || !res) {
       return buildErrorResponse(
@@ -873,8 +924,169 @@ function createCallbackRouteHandler(config) {
   }
 }
 
-// src/next/logout.ts
+// src/next/refresh.ts
 import { NextResponse as NextResponse3 } from "next/server";
+function noStoreJson(body, status = 200) {
+  return NextResponse3.json(body, {
+    status,
+    headers: { "Cache-Control": "no-store", Pragma: "no-cache" }
+  });
+}
+function clearAuthCookies(response, names, secureCookies) {
+  response.cookies.set(names.access, "", getHostCookieOptions(0, secureCookies));
+  response.cookies.set(names.refresh, "", getHostCookieOptions(0, secureCookies));
+  response.cookies.set(names.idToken, "", getHostCookieOptions(0, secureCookies));
+  return response;
+}
+function createRefreshRouteHandler(config) {
+  const {
+    clientId,
+    ssoBaseUrl,
+    redirectUri,
+    clientSecret,
+    insecureLocalDev: insecureLocalDevOpt = false,
+    debug = false
+  } = config;
+  const insecureLocalDev = resolveInsecureLocalDev(insecureLocalDevOpt, ssoBaseUrl);
+  const secureCookies = !insecureLocalDev;
+  const pickName = (explicit, fallback) => insecureLocalDev ? toInsecureCookieName(explicit ?? fallback) : explicit ?? fallback;
+  const accessTokenCookieName = pickName(
+    config.accessTokenCookieName,
+    DEFAULT_ACCESS_TOKEN_COOKIE_NAME
+  );
+  const refreshTokenCookieName = pickName(
+    config.refreshTokenCookieName,
+    DEFAULT_REFRESH_TOKEN_COOKIE_NAME
+  );
+  const idTokenCookieName = pickName(config.idTokenCookieName, DEFAULT_ID_TOKEN_COOKIE_NAME);
+  const normalizedBase = ssoBaseUrl.replace(/\/+$/, "");
+  const normalizedServerBase = (config.serverBaseUrl ?? ssoBaseUrl).replace(/\/+$/, "");
+  const callbackOrigin = new URL(redirectUri).origin;
+  const cookieNames = {
+    access: accessTokenCookieName,
+    refresh: refreshTokenCookieName,
+    idToken: idTokenCookieName
+  };
+  return async function POST(request) {
+    const requestOrigin = request.headers.get("origin");
+    if (requestOrigin && requestOrigin !== callbackOrigin) {
+      return noStoreJson({ error: "forbidden", error_description: "\u8DE8\u7AD9\u8BF7\u6C42\u88AB\u62D2\u7EDD" }, 403);
+    }
+    const secFetchSite = request.headers.get("sec-fetch-site");
+    if (!requestOrigin && secFetchSite && secFetchSite !== "same-origin" && secFetchSite !== "none") {
+      return noStoreJson({ error: "forbidden", error_description: "\u8DE8\u7AD9\u8BF7\u6C42\u88AB\u62D2\u7EDD" }, 403);
+    }
+    const refreshToken = request.cookies.get(refreshTokenCookieName)?.value;
+    if (!refreshToken) {
+      return noStoreJson({ error: "no_refresh_token", error_description: "\u7F3A\u5C11 refresh_token" }, 401);
+    }
+    const body = new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: clientId
+    });
+    if (clientSecret) body.set("client_secret", clientSecret);
+    let res = null;
+    let lastError;
+    try {
+      res = await fetchWithTimeout(
+        `${normalizedServerBase}/api/oauth/token`,
+        {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: body.toString()
+        },
+        1e4
+      );
+    } catch (err) {
+      lastError = err;
+    }
+    if (lastError || !res) {
+      if (debug) console.warn("[SSO SDK] refresh: token \u8BF7\u6C42\u5931\u8D25", lastError);
+      return noStoreJson(
+        { error: "server_error", error_description: "\u5237\u65B0\u670D\u52A1\u6682\u65F6\u4E0D\u53EF\u7528" },
+        502
+      );
+    }
+    let data = {};
+    try {
+      data = await res.json();
+    } catch {
+    }
+    if (!res.ok) {
+      const error = typeof data.error === "string" ? data.error : "";
+      const status = res.status === 429 ? 429 : res.status >= 500 ? 502 : 401;
+      const response2 = noStoreJson(
+        {
+          error: error || "refresh_failed",
+          error_description: data.error_description || "\u5237\u65B0\u767B\u5F55\u6001\u5931\u8D25\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55"
+        },
+        status
+      );
+      if (res.status === 400 || res.status === 401) {
+        return clearAuthCookies(response2, cookieNames, secureCookies);
+      }
+      return response2;
+    }
+    if (!data.access_token || typeof data.expires_in !== "number" || !Number.isFinite(data.expires_in) || data.expires_in <= 0) {
+      return clearAuthCookies(
+        noStoreJson({ error: "server_error", error_description: "\u5237\u65B0\u54CD\u5E94\u4E0D\u5B8C\u6574" }, 502),
+        cookieNames,
+        secureCookies
+      );
+    }
+    if (data.id_token) {
+      try {
+        await validateIdToken(
+          data.id_token,
+          data.access_token,
+          normalizedBase,
+          clientId
+        );
+      } catch (err) {
+        if (debug) console.warn("[SSO SDK] refresh: ID Token \u6821\u9A8C\u5931\u8D25", err);
+        return clearAuthCookies(
+          noStoreJson({ error: "id_token_invalid", error_description: "\u767B\u5F55\u6821\u9A8C\u5931\u8D25" }, 401),
+          cookieNames,
+          secureCookies
+        );
+      }
+    }
+    const response = noStoreJson({ success: true, expires_in: data.expires_in });
+    response.cookies.set(accessTokenCookieName, data.access_token, {
+      ...getHostCookieOptions(data.expires_in, secureCookies)
+    });
+    response.cookies.set(refreshTokenCookieName, data.refresh_token || refreshToken, {
+      ...getHostCookieOptions(
+        typeof data.refresh_expires_in === "number" && data.refresh_expires_in > 0 ? data.refresh_expires_in : 30 * 24 * 60 * 60,
+        secureCookies
+      )
+    });
+    if (data.id_token) {
+      let idTokenMaxAge = 3600;
+      try {
+        const payload = JSON.parse(
+          Buffer.from(data.id_token.split(".")[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString(
+            "utf8"
+          )
+        );
+        if (typeof payload.exp === "number") {
+          idTokenMaxAge = payload.exp - Math.floor(Date.now() / 1e3);
+        }
+      } catch {
+      }
+      if (idTokenMaxAge > 0) {
+        response.cookies.set(idTokenCookieName, data.id_token, {
+          ...getHostCookieOptions(idTokenMaxAge, secureCookies)
+        });
+      }
+    }
+    return response;
+  };
+}
+
+// src/next/logout.ts
+import { NextResponse as NextResponse4 } from "next/server";
 
 // src/core/discovery.ts
 var DISCOVERY_CACHE_TTL_MS = 5 * 60 * 1e3;
@@ -945,6 +1157,14 @@ function generateRandomString2(length) {
   }
   return result;
 }
+function trustedSameOriginEndpoint(endpoint, baseUrl) {
+  if (!endpoint) return null;
+  try {
+    return new URL(endpoint).origin === new URL(baseUrl).origin ? endpoint : null;
+  } catch {
+    return null;
+  }
+}
 function createLogoutRouteHandler(config) {
   const {
     clientId,
@@ -982,32 +1202,32 @@ function createLogoutRouteHandler(config) {
     const returnedState = request.nextUrl.searchParams.get("state");
     if (returnedState) {
       const savedState = request.cookies.get(logoutStateCookieName)?.value;
-      if (!savedState || savedState !== returnedState) {
-        return NextResponse3.json(
+      if (!savedState || !timingSafeEqualString(savedState, returnedState)) {
+        return NextResponse4.json(
           { error: "invalid_request", error_description: "Logout state \u4E0D\u5339\u914D" },
           { status: 400 }
         );
       }
-      const res = NextResponse3.redirect(callbackOrigin + "/");
+      const res = NextResponse4.redirect(callbackOrigin + "/");
       res.cookies.set(logoutStateCookieName, "", getHostCookieOptions(0, secureCookies));
       return res;
     }
     if (request.method === "GET") {
-      return new NextResponse3(buildLogoutConfirmHtml(), {
+      return new NextResponse4(buildLogoutConfirmHtml(), {
         status: 200,
         headers: { "content-type": "text/html; charset=utf-8" }
       });
     }
     const requestOrigin = request.headers.get("origin");
     if (requestOrigin && requestOrigin !== callbackOrigin) {
-      return NextResponse3.json(
+      return NextResponse4.json(
         { error: "forbidden", error_description: "\u8DE8\u7AD9\u8BF7\u6C42\u88AB\u62D2\u7EDD" },
         { status: 403 }
       );
     }
     const secFetchSite = request.headers.get("sec-fetch-site");
     if (!requestOrigin && secFetchSite && secFetchSite !== "same-origin" && secFetchSite !== "none") {
-      return NextResponse3.json(
+      return NextResponse4.json(
         { error: "forbidden", error_description: "\u8DE8\u7AD9\u8BF7\u6C42\u88AB\u62D2\u7EDD" },
         { status: 403 }
       );
@@ -1023,7 +1243,7 @@ function createLogoutRouteHandler(config) {
     if (refreshToken) {
       try {
         const discovery = config.serverBaseUrl ? null : await fetchDiscoveryCached(normalizedServerBase);
-        const revokeUrl = config.serverBaseUrl ? `${normalizedServerBase}/api/oauth/revoke` : discovery?.revocation_endpoint || `${normalizedBase}/api/oauth/revoke`;
+        const revokeUrl = (config.serverBaseUrl ? `${normalizedServerBase}/api/oauth/revoke` : trustedSameOriginEndpoint(discovery?.revocation_endpoint, normalizedBase)) || `${normalizedBase}/api/oauth/revoke`;
         const body = new URLSearchParams({
           token: refreshToken,
           token_type_hint: "refresh_token",
@@ -1032,12 +1252,20 @@ function createLogoutRouteHandler(config) {
         if (clientSecret) {
           body.set("client_secret", clientSecret);
         }
-        await fetch(revokeUrl, {
+        const doRevoke = () => fetch(revokeUrl, {
           method: "POST",
           headers: { "Content-Type": "application/x-www-form-urlencoded" },
           body: body.toString(),
           signal: AbortSignal.timeout(3e3)
         });
+        let revokeRes = await doRevoke();
+        if (!revokeRes.ok && (revokeRes.status >= 500 || revokeRes.status === 429)) {
+          await new Promise((resolve) => setTimeout(resolve, 300));
+          revokeRes = await doRevoke();
+        }
+        if (!revokeRes.ok) {
+          console.warn(`[SSO SDK] \u767B\u51FA\u64A4\u9500 refresh_token \u5931\u8D25\uFF08HTTP ${revokeRes.status}\uFF09`);
+        }
       } catch {
       }
     }
@@ -1069,7 +1297,7 @@ function createLogoutRouteHandler(config) {
     };
     if (effectiveScope === "global") {
       const discovery = await fetchDiscoveryCached(normalizedServerBase);
-      const endSessionEndpoint = discovery?.end_session_endpoint || `${normalizedBase}/api/oauth/end-session`;
+      const endSessionEndpoint = trustedSameOriginEndpoint(discovery?.end_session_endpoint, normalizedBase) || `${normalizedBase}/api/oauth/end-session`;
       const logoutUrl = new URL(endSessionEndpoint);
       logoutUrl.searchParams.set("client_id", clientId);
       logoutUrl.searchParams.set(
@@ -1081,25 +1309,36 @@ function createLogoutRouteHandler(config) {
       }
       const logoutState = generateRandomString2(32);
       logoutUrl.searchParams.set("state", logoutState);
-      const res = clearCookies(NextResponse3.redirect(logoutUrl.toString()));
+      const res = clearCookies(NextResponse4.redirect(logoutUrl.toString()));
       res.cookies.set(logoutStateCookieName, logoutState, getHostCookieOptions(600, secureCookies));
       return res;
     }
     return clearCookies(
-      NextResponse3.redirect(callbackOrigin + "/")
+      NextResponse4.redirect(callbackOrigin + "/")
     );
   };
 }
 
 // src/next/backchannel-logout.ts
-import { NextResponse as NextResponse4 } from "next/server";
+import { NextResponse as NextResponse5 } from "next/server";
 
 // src/core/logout-token.ts
 var BACKCHANNEL_LOGOUT_EVENT = "http://schemas.openid.net/event/backchannel-logout";
 var JTI_CACHE_CAPACITY = 1e3;
 var seenJti = /* @__PURE__ */ new Map();
-function releaseLogoutTokenJti(jti) {
-  seenJti.delete(jti);
+async function releaseLogoutTokenJti(replayKey, options = {}) {
+  const store = options.jtiStore;
+  if (store?.remove) {
+    await store.remove(replayKey);
+    return;
+  }
+  if (store) {
+    console.warn(
+      "[SSO SDK] \u81EA\u5B9A\u4E49 jtiStore \u672A\u5B9E\u73B0 remove()\uFF1AonLogout \u5931\u8D25\u540E\u65E0\u6CD5\u91CA\u653E jti\uFF0CIdP \u7528\u540C\u4E00 logout_token \u91CD\u6295\u5C06\u88AB\u91CD\u653E\u68C0\u67E5\u62D2\u7EDD\uFF08logout_token_replay\uFF09"
+    );
+    return;
+  }
+  seenJti.delete(replayKey);
 }
 function recordJti(jti, expiresAtMs) {
   const now = Date.now();
@@ -1116,7 +1355,7 @@ function recordJti(jti, expiresAtMs) {
   seenJti.set(jti, expiresAtMs);
   return true;
 }
-async function verifyLogoutTokenDetailed(logoutToken, ssoBaseUrl, clientId) {
+async function verifyLogoutTokenDetailed(logoutToken, ssoBaseUrl, clientId, options = {}) {
   const baseUrl = ssoBaseUrl.replace(/\/+$/, "");
   const header = decodeJwtHeader(logoutToken);
   if (!header) {
@@ -1193,6 +1432,12 @@ async function verifyLogoutTokenDetailed(logoutToken, ssoBaseUrl, clientId) {
   if (Date.now() >= payload.exp * 1e3 + 6e4) {
     throw new SsoError("logout_token_expired", "Logout Token \u5DF2\u8FC7\u671F");
   }
+  if (typeof payload.iat !== "number") {
+    throw new SsoError("logout_token_invalid", "Logout Token \u7F3A\u5C11 iat \u58F0\u660E");
+  }
+  if (payload.nonce !== void 0) {
+    throw new SsoError("logout_token_invalid", "Logout Token \u4E0D\u5F97\u643A\u5E26 nonce");
+  }
   if (payload.type !== "logout_token") {
     throw new SsoError(
       "logout_token_invalid",
@@ -1225,10 +1470,27 @@ async function verifyLogoutTokenDetailed(logoutToken, ssoBaseUrl, clientId) {
   if (!jti) {
     throw new SsoError("logout_token_invalid", "Logout Token \u7F3A\u5C11 jti \u58F0\u660E");
   }
-  if (!recordJti(jti, payload.exp * 1e3 + 6e4)) {
+  const replayKey = `${normalizedIssuer}:${jti}`;
+  const replayTtlSeconds = Math.max(
+    1,
+    Math.ceil((payload.exp * 1e3 + 6e4 - Date.now()) / 1e3)
+  );
+  const jtiStore = options.jtiStore;
+  if (jtiStore) {
+    if (jtiStore.addIfAbsent) {
+      if (!await jtiStore.addIfAbsent(replayKey, replayTtlSeconds)) {
+        throw new SsoError("logout_token_replay", "Logout Token jti \u91CD\u653E");
+      }
+    } else {
+      if (await jtiStore.has(replayKey)) {
+        throw new SsoError("logout_token_replay", "Logout Token jti \u91CD\u653E");
+      }
+      await jtiStore.add(replayKey, replayTtlSeconds);
+    }
+  } else if (!recordJti(replayKey, payload.exp * 1e3 + 6e4)) {
     throw new SsoError("logout_token_replay", "Logout Token jti \u91CD\u653E");
   }
-  return { payload: { sub, sid }, jti };
+  return { payload: { sub, sid }, jti, replayKey };
 }
 
 // src/next/backchannel-logout.ts
@@ -1254,7 +1516,7 @@ function createBackchannelLogoutRouteHandler(config) {
   );
   return async function handler(request) {
     if (request.method !== "POST") {
-      return NextResponse4.json(
+      return NextResponse5.json(
         { error: "method_not_allowed", error_description: "\u4EC5\u63A5\u53D7 POST \u8BF7\u6C42" },
         { status: 405 }
       );
@@ -1263,18 +1525,20 @@ function createBackchannelLogoutRouteHandler(config) {
       "logout_token"
     );
     if (!logoutToken) {
-      return NextResponse4.json(
+      return NextResponse5.json(
         { error: "invalid_request", error_description: "\u7F3A\u5C11 logout_token" },
         { status: 400 }
       );
     }
     let verified;
     try {
-      verified = await verifyLogoutTokenDetailed(logoutToken, ssoBaseUrl, clientId);
+      verified = await verifyLogoutTokenDetailed(logoutToken, ssoBaseUrl, clientId, {
+        jtiStore: config.jtiStore
+      });
     } catch (err) {
       const code = err instanceof SsoError ? err.code : "logout_token_invalid";
       const description = err instanceof SsoError ? err.description : "Logout Token \u9A8C\u8BC1\u5931\u8D25";
-      return NextResponse4.json(
+      return NextResponse5.json(
         { error: code, error_description: description },
         { status: 400 }
       );
@@ -1282,17 +1546,17 @@ function createBackchannelLogoutRouteHandler(config) {
     try {
       await onLogout?.(verified.payload, request);
     } catch (err) {
-      releaseLogoutTokenJti(verified.jti);
+      await releaseLogoutTokenJti(verified.replayKey, { jtiStore: config.jtiStore });
       console.error(
         "[SSO SDK] backchannel logout onLogout \u94A9\u5B50\u6267\u884C\u5931\u8D25:",
         err
       );
-      return NextResponse4.json(
+      return NextResponse5.json(
         { error: "server_error", error_description: "onLogout \u5904\u7406\u5931\u8D25" },
         { status: 500 }
       );
     }
-    const res = new NextResponse4(null, { status: 200 });
+    const res = new NextResponse5(null, { status: 200 });
     res.cookies.set(accessTokenCookieName, "", getHostCookieOptions(0, secureCookies));
     res.cookies.set(refreshTokenCookieName, "", getHostCookieOptions(0, secureCookies));
     res.cookies.set(idTokenCookieName, "", getHostCookieOptions(0, secureCookies));
@@ -1311,6 +1575,7 @@ export {
   createBackchannelLogoutRouteHandler,
   createCallbackRouteHandler,
   createLogoutRouteHandler,
+  createRefreshRouteHandler,
   createSsoMiddleware,
   getHostCookieOptions,
   getSecureCookieOptions,