@nihplod/sso-sdk 1.6.0 → 1.7.0

package/dist/react/index.d.mts

@@ -326,7 +326,7 @@ declare class SsoClient {
  * SSO SDK 错误类型
  */
 /** SSO 错误码 */
-type SsoErrorCode = "invalid_config" | "state_mismatch" | "pkce_required" | "token_request_failed" | "session_expired" | "no_refresh_token" | "userinfo_failed" | "not_authenticated" | "authorization_code_expired" | "authorization_code_used" | "client_disabled" | "user_denied_authorization" | "account_disabled" | "sso_server_error" | "rate_limited" | "network_error" | "popup_blocked" | "popup_closed" | "id_token_invalid" | "id_token_unsupported_alg" | "id_token_hs256_unsupported" | "id_token_missing_secret" | "id_token_invalid_signature" | "id_token_issuer_mismatch" | "id_token_audience_mismatch" | "id_token_expired" | "id_token_missing_sub" | "id_token_at_hash_mismatch" | "id_token_nonce_mismatch" | "logout_token_invalid" | "logout_token_unsupported_alg" | "logout_token_invalid_signature" | "logout_token_issuer_mismatch" | "logout_token_audience_mismatch" | "logout_token_expired" | "logout_token_replay";
+type SsoErrorCode = "invalid_config" | "state_mismatch" | "issuer_mismatch" | "pkce_required" | "token_request_failed" | "session_expired" | "no_refresh_token" | "userinfo_failed" | "not_authenticated" | "authorization_code_expired" | "authorization_code_used" | "client_disabled" | "user_denied_authorization" | "account_disabled" | "sso_server_error" | "rate_limited" | "network_error" | "popup_blocked" | "popup_closed" | "id_token_invalid" | "id_token_unsupported_alg" | "id_token_hs256_unsupported" | "id_token_missing_secret" | "id_token_invalid_signature" | "id_token_issuer_mismatch" | "id_token_audience_mismatch" | "id_token_expired" | "id_token_missing_sub" | "id_token_at_hash_mismatch" | "id_token_nonce_mismatch" | "logout_token_invalid" | "logout_token_unsupported_alg" | "logout_token_invalid_signature" | "logout_token_issuer_mismatch" | "logout_token_audience_mismatch" | "logout_token_expired" | "logout_token_replay";
 /**
  * SSO SDK 自定义错误
  */
@@ -456,6 +456,11 @@ interface RequireAuthProps {
      */
     renderLoginError?: (error: unknown, retry: () => void) => React.ReactNode;
 }
+interface LoginErrorContentProps {
+    loginError: unknown;
+    retry: () => void;
+    renderLoginError?: RequireAuthProps["renderLoginError"];
+}
 /**
  * 路由保护组件
  *
@@ -470,7 +475,7 @@ interface RequireAuthProps {
  * </RequireAuth>
  * ```
  */
-declare function RequireAuth({ children, fallback, autoLogin, usePopup, onError, renderLoginError, }: RequireAuthProps): string | number | bigint | true | React.ReactElement<unknown, string | React.JSXElementConstructor<any>> | Iterable<React.ReactNode> | Promise<string | number | bigint | boolean | React.ReactPortal | React.ReactElement<unknown, string | React.JSXElementConstructor<any>> | Iterable<React.ReactNode> | null | undefined> | React.FunctionComponentElement<React.FragmentProps>;
+declare function RequireAuth({ children, fallback, autoLogin, usePopup, onError, renderLoginError, }: RequireAuthProps): string | number | bigint | true | React.ReactElement<unknown, string | React.JSXElementConstructor<any>> | Iterable<React.ReactNode> | Promise<string | number | bigint | boolean | React.ReactPortal | React.ReactElement<unknown, string | React.JSXElementConstructor<any>> | Iterable<React.ReactNode> | null | undefined> | React.FunctionComponentElement<React.FragmentProps> | React.FunctionComponentElement<LoginErrorContentProps>;
 /**
  * 高阶组件：包装页面组件，要求认证后才能访问
  *

package/dist/react/index.d.ts

@@ -326,7 +326,7 @@ declare class SsoClient {
  * SSO SDK 错误类型
  */
 /** SSO 错误码 */
-type SsoErrorCode = "invalid_config" | "state_mismatch" | "pkce_required" | "token_request_failed" | "session_expired" | "no_refresh_token" | "userinfo_failed" | "not_authenticated" | "authorization_code_expired" | "authorization_code_used" | "client_disabled" | "user_denied_authorization" | "account_disabled" | "sso_server_error" | "rate_limited" | "network_error" | "popup_blocked" | "popup_closed" | "id_token_invalid" | "id_token_unsupported_alg" | "id_token_hs256_unsupported" | "id_token_missing_secret" | "id_token_invalid_signature" | "id_token_issuer_mismatch" | "id_token_audience_mismatch" | "id_token_expired" | "id_token_missing_sub" | "id_token_at_hash_mismatch" | "id_token_nonce_mismatch" | "logout_token_invalid" | "logout_token_unsupported_alg" | "logout_token_invalid_signature" | "logout_token_issuer_mismatch" | "logout_token_audience_mismatch" | "logout_token_expired" | "logout_token_replay";
+type SsoErrorCode = "invalid_config" | "state_mismatch" | "issuer_mismatch" | "pkce_required" | "token_request_failed" | "session_expired" | "no_refresh_token" | "userinfo_failed" | "not_authenticated" | "authorization_code_expired" | "authorization_code_used" | "client_disabled" | "user_denied_authorization" | "account_disabled" | "sso_server_error" | "rate_limited" | "network_error" | "popup_blocked" | "popup_closed" | "id_token_invalid" | "id_token_unsupported_alg" | "id_token_hs256_unsupported" | "id_token_missing_secret" | "id_token_invalid_signature" | "id_token_issuer_mismatch" | "id_token_audience_mismatch" | "id_token_expired" | "id_token_missing_sub" | "id_token_at_hash_mismatch" | "id_token_nonce_mismatch" | "logout_token_invalid" | "logout_token_unsupported_alg" | "logout_token_invalid_signature" | "logout_token_issuer_mismatch" | "logout_token_audience_mismatch" | "logout_token_expired" | "logout_token_replay";
 /**
  * SSO SDK 自定义错误
  */
@@ -456,6 +456,11 @@ interface RequireAuthProps {
      */
     renderLoginError?: (error: unknown, retry: () => void) => React.ReactNode;
 }
+interface LoginErrorContentProps {
+    loginError: unknown;
+    retry: () => void;
+    renderLoginError?: RequireAuthProps["renderLoginError"];
+}
 /**
  * 路由保护组件
  *
@@ -470,7 +475,7 @@ interface RequireAuthProps {
  * </RequireAuth>
  * ```
  */
-declare function RequireAuth({ children, fallback, autoLogin, usePopup, onError, renderLoginError, }: RequireAuthProps): string | number | bigint | true | React.ReactElement<unknown, string | React.JSXElementConstructor<any>> | Iterable<React.ReactNode> | Promise<string | number | bigint | boolean | React.ReactPortal | React.ReactElement<unknown, string | React.JSXElementConstructor<any>> | Iterable<React.ReactNode> | null | undefined> | React.FunctionComponentElement<React.FragmentProps>;
+declare function RequireAuth({ children, fallback, autoLogin, usePopup, onError, renderLoginError, }: RequireAuthProps): string | number | bigint | true | React.ReactElement<unknown, string | React.JSXElementConstructor<any>> | Iterable<React.ReactNode> | Promise<string | number | bigint | boolean | React.ReactPortal | React.ReactElement<unknown, string | React.JSXElementConstructor<any>> | Iterable<React.ReactNode> | null | undefined> | React.FunctionComponentElement<React.FragmentProps> | React.FunctionComponentElement<LoginErrorContentProps>;
 /**
  * 高阶组件：包装页面组件，要求认证后才能访问
  *

package/dist/react/index.js

@@ -124,24 +124,6 @@ var SILENT_PROBE_KEY = "silent_probe";
 function buildKey(base, clientId) {
   return clientId ? `${base}:${clientId}` : base;
 }
-function createMemoryStorageAdapter() {
-  const store = /* @__PURE__ */ new Map();
-  return {
-    get(key) {
-      return store.get(key) ?? null;
-    },
-    set(key, value) {
-      store.set(key, value);
-    },
-    remove(key) {
-      store.delete(key);
-    },
-    keys() {
-      return [...store.keys()];
-    }
-  };
-}
-var memoryStorageAdapter = createMemoryStorageAdapter();
 function createSessionStorageAdapter() {
   const fallback = /* @__PURE__ */ new Map();
   return {
@@ -409,7 +391,19 @@ async function fetchJwks(baseUrl, options = {}) {
     return cachedJwks.jwks;
   }
   const discovery = await fetchDiscoveryDoc(baseUrl);
-  const jwksUri = discovery?.jwks_uri || `${baseUrl}/api/oauth/jwks`;
+  let jwksUri = `${baseUrl}/api/oauth/jwks`;
+  if (discovery?.jwks_uri) {
+    try {
+      if (new URL(discovery.jwks_uri).origin === new URL(baseUrl).origin) {
+        jwksUri = discovery.jwks_uri;
+      } else {
+        console.warn(
+          "[SSO SDK] Discovery \u7684 jwks_uri \u4E0E ssoBaseUrl \u4E0D\u540C\u6E90\uFF0C\u5DF2\u5FFD\u7565\u5E76\u4F7F\u7528\u9ED8\u8BA4 JWKS \u7AEF\u70B9"
+        );
+      }
+    } catch {
+    }
+  }
   try {
     const res = await fetch(jwksUri, {
       signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
@@ -600,11 +594,7 @@ function assertValidTokenResponse(data, requireRefreshToken) {
     );
   }
 }
-var SILENT_PROBE_ERRORS = /* @__PURE__ */ new Set([
-  "login_required",
-  "consent_required",
-  "interaction_required"
-]);
+var SILENT_PROBE_ERRORS = /* @__PURE__ */ new Set(["login_required", "consent_required", "interaction_required"]);
 var _SsoClient = class _SsoClient {
   constructor(config) {
     this._discovery = null;
@@ -670,6 +660,22 @@ var _SsoClient = class _SsoClient {
     if (!authorizationOk) bad.push("authorization_endpoint");
     if (!sameOrigin(d.token_endpoint)) bad.push("token_endpoint");
     if (!sameOrigin(d.userinfo_endpoint)) bad.push("userinfo_endpoint");
+    if (d.jwks_uri && !sameOrigin(d.jwks_uri)) bad.push("jwks_uri");
+    if (d.revocation_endpoint && !sameOrigin(d.revocation_endpoint)) {
+      bad.push("revocation_endpoint");
+    }
+    if (d.introspection_endpoint && !sameOrigin(d.introspection_endpoint)) {
+      bad.push("introspection_endpoint");
+    }
+    if (d.end_session_endpoint) {
+      try {
+        if (new URL(d.end_session_endpoint).origin !== publicOrigin) {
+          bad.push("end_session_endpoint");
+        }
+      } catch {
+        bad.push("end_session_endpoint");
+      }
+    }
     if (bad.length > 0) {
       if (!this._discoveryOriginWarned) {
         this._discoveryOriginWarned = true;
@@ -695,16 +701,11 @@ var _SsoClient = class _SsoClient {
     const url = `${this._serverBase}/api/oauth/.well-known/openid-configuration`;
     try {
       const controller = new AbortController();
-      const timeoutId = setTimeout(
-        () => controller.abort(),
-        _SsoClient.DISCOVERY_TIMEOUT_MS
-      );
+      const timeoutId = setTimeout(() => controller.abort(), _SsoClient.DISCOVERY_TIMEOUT_MS);
       const res = await fetch(url, { signal: controller.signal });
       clearTimeout(timeoutId);
       if (!res.ok) {
-        console.warn(
-          `[SSO SDK] OIDC Discovery \u8BF7\u6C42\u5931\u8D25: HTTP ${res.status}, \u56DE\u9000\u5230\u9ED8\u8BA4\u7AEF\u70B9`
-        );
+        console.warn(`[SSO SDK] OIDC Discovery \u8BF7\u6C42\u5931\u8D25: HTTP ${res.status}, \u56DE\u9000\u5230\u9ED8\u8BA4\u7AEF\u70B9`);
         return null;
       }
       const doc = await res.json();
@@ -919,10 +920,7 @@ var _SsoClient = class _SsoClient {
       removeOAuthState(this.config.clientId);
       removeOAuthNonce(this.config.clientId);
       removePkceVerifier(`${this.config.clientId}_popup_nonce`);
-      throw new SsoError(
-        "popup_blocked",
-        "\u5F39\u7A97\u88AB\u6D4F\u89C8\u5668\u62E6\u622A\uFF0C\u8BF7\u5141\u8BB8\u5F39\u7A97\u540E\u91CD\u8BD5"
-      );
+      throw new SsoError("popup_blocked", "\u5F39\u7A97\u88AB\u6D4F\u89C8\u5668\u62E6\u622A\uFF0C\u8BF7\u5141\u8BB8\u5F39\u7A97\u540E\u91CD\u8BD5");
     }
     const redirectUriOrigin = new URL(this.config.redirectUri).origin;
     try {
@@ -951,9 +949,7 @@ var _SsoClient = class _SsoClient {
           }
           this.handleCallback(event.data.callbackUrl).then((tokenData) => {
             if (tokenData === null) {
-              reject(
-                new SsoError("not_authenticated", "SSO \u4F1A\u8BDD\u4E0D\u5B58\u5728\uFF08\u9759\u9ED8\u63A2\u6D4B\u65E0\u4F1A\u8BDD\uFF09")
-              );
+              reject(new SsoError("not_authenticated", "SSO \u4F1A\u8BDD\u4E0D\u5B58\u5728\uFF08\u9759\u9ED8\u63A2\u6D4B\u65E0\u4F1A\u8BDD\uFF09"));
               return;
             }
             resolve(tokenData);
@@ -964,12 +960,7 @@ var _SsoClient = class _SsoClient {
             if (!completed) {
               completed = true;
               cleanup();
-              reject(
-                new SsoError(
-                  "popup_closed",
-                  "\u767B\u5F55\u7A97\u53E3\u5DF2\u5173\u95ED"
-                )
-              );
+              reject(new SsoError("popup_closed", "\u767B\u5F55\u7A97\u53E3\u5DF2\u5173\u95ED"));
             }
           }
         }, 500);
@@ -1036,18 +1027,24 @@ var _SsoClient = class _SsoClient {
       removeOAuthNonce(this.config.clientId);
       removePkceVerifier(this.config.clientId);
       removeSilentProbe(this.config.clientId);
-      throw new SsoError(
-        "state_mismatch",
-        "State \u53C2\u6570\u4E0D\u5339\u914D\uFF0C\u53EF\u80FD\u5B58\u5728 CSRF \u653B\u51FB"
-      );
+      throw new SsoError("state_mismatch", "State \u53C2\u6570\u4E0D\u5339\u914D\uFF0C\u53EF\u80FD\u5B58\u5728 CSRF \u653B\u51FB");
+    }
+    const returnedIss = params.get("iss");
+    if (returnedIss) {
+      const discovery = await this._getDiscovery();
+      const expectedIssuer = (discovery?.issuer || this.config.ssoBaseUrl).replace(/\/+$/, "");
+      if (returnedIss.replace(/\/+$/, "") !== expectedIssuer) {
+        removeOAuthState(this.config.clientId);
+        removeOAuthNonce(this.config.clientId);
+        removePkceVerifier(this.config.clientId);
+        removeSilentProbe(this.config.clientId);
+        throw new SsoError("issuer_mismatch", "\u6388\u6743\u54CD\u5E94 issuer \u4E0D\u5339\u914D\uFF0C\u53EF\u80FD\u5B58\u5728 IdP \u6DF7\u53E0\u653B\u51FB");
+      }
     }
     const expectedNonce = getOAuthNonce(this.config.clientId) ?? void 0;
     const verifier = getPkceVerifier(this.config.clientId);
     if (!verifier) {
-      throw new SsoError(
-        "pkce_required",
-        "code_verifier \u4E0D\u5B58\u5728\uFF08\u53EF\u80FD\u5DF2\u8FC7\u671F\u6216\u6765\u81EA\u5176\u4ED6\u6807\u7B7E\u9875\uFF09"
-      );
+      throw new SsoError("pkce_required", "code_verifier \u4E0D\u5B58\u5728\uFF08\u53EF\u80FD\u5DF2\u8FC7\u671F\u6216\u6765\u81EA\u5176\u4ED6\u6807\u7B7E\u9875\uFF09");
     }
     const tokenEndpoint = await this._getTokenEndpoint();
     const body = new URLSearchParams();
@@ -1094,10 +1091,7 @@ var _SsoClient = class _SsoClient {
       removePkceVerifier(this.config.clientId);
       removeSilentProbe(this.config.clientId);
       removeTokenData(this.config.clientId);
-      throw new SsoError(
-        "id_token_invalid",
-        "Token \u54CD\u5E94\u7F3A\u5C11 id_token\uFF08scope \u542B openid \u65F6\u5FC5\u9700\uFF09"
-      );
+      throw new SsoError("id_token_invalid", "Token \u54CD\u5E94\u7F3A\u5C11 id_token\uFF08scope \u542B openid \u65F6\u5FC5\u9700\uFF09");
     }
     if (data.id_token) {
       try {
@@ -1162,19 +1156,14 @@ var _SsoClient = class _SsoClient {
     }
     let res = null;
     let lastErr;
-    for (let attempt = 0; attempt < 2; attempt++) {
-      try {
-        res = await fetchWithTimeout(tokenEndpoint, {
-          method: "POST",
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          body: body.toString()
-        });
-        lastErr = null;
-        break;
-      } catch (err) {
-        lastErr = err;
-        if (attempt < 1) await new Promise((r) => setTimeout(r, 1e3));
-      }
+    try {
+      res = await fetchWithTimeout(tokenEndpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString()
+      });
+    } catch (err) {
+      lastErr = err;
     }
     if (lastErr || !res) {
       throw new SsoError("network_error", "\u5237\u65B0 Token \u7F51\u7EDC\u8BF7\u6C42\u5931\u8D25", lastErr);
@@ -1256,10 +1245,7 @@ var _SsoClient = class _SsoClient {
         removeTokenData(this.config.clientId);
         throw new SsoError("not_authenticated", "Token \u5DF2\u5931\u6548");
       }
-      throw new SsoError(
-        "userinfo_failed",
-        `\u83B7\u53D6\u7528\u6237\u4FE1\u606F\u5931\u8D25: HTTP ${res.status}`
-      );
+      throw new SsoError("userinfo_failed", `\u83B7\u53D6\u7528\u6237\u4FE1\u606F\u5931\u8D25: HTTP ${res.status}`);
     }
     return await res.json();
   }
@@ -1319,7 +1305,7 @@ var _SsoClient = class _SsoClient {
         if (this.config.clientSecret) {
           revokeBody.set("client_secret", this.config.clientSecret);
         }
-        await fetchWithTimeout(
+        const doRevoke = () => fetchWithTimeout(
           revokeUrl,
           {
             method: "POST",
@@ -1328,6 +1314,14 @@ var _SsoClient = class _SsoClient {
           },
           REVOKE_TIMEOUT_MS
         );
+        let res = await doRevoke();
+        if (!res.ok && (res.status >= 500 || res.status === 429)) {
+          await new Promise((resolve) => setTimeout(resolve, 300));
+          res = await doRevoke();
+        }
+        if (!res.ok) {
+          this.debugLog("logout: \u670D\u52A1\u7AEF\u64A4\u9500 refresh_token \u5931\u8D25", { status: res.status });
+        }
       } catch {
       }
     }
@@ -1338,10 +1332,7 @@ var _SsoClient = class _SsoClient {
       logoutUrl.searchParams.set("client_id", this.config.clientId);
       const postLogoutUri = this.config.postLogoutRedirectUri || this.config.redirectUri;
       if (postLogoutUri) {
-        logoutUrl.searchParams.set(
-          "post_logout_redirect_uri",
-          postLogoutUri
-        );
+        logoutUrl.searchParams.set("post_logout_redirect_uri", postLogoutUri);
       }
       if (idTokenHint) {
         logoutUrl.searchParams.set("id_token_hint", idTokenHint);
@@ -1571,7 +1562,15 @@ function SsoProvider({
       const tokenData = getTokenData(client.config.clientId);
       if (!tokenData) return;
       const remainingSec = (tokenData.expires_at - Date.now()) / 1e3;
-      if (remainingSec <= 0 || remainingSec <= refreshThreshold) {
+      const lifetimeSec = Math.max(
+        1,
+        (tokenData.expires_at - tokenData.issued_at) / 1e3
+      );
+      const effectiveThreshold = Math.max(
+        1,
+        Math.min(refreshThreshold, Math.floor(lifetimeSec / 3))
+      );
+      if (remainingSec <= 0 || remainingSec <= effectiveThreshold) {
         refreshTimerRef.current = setTimeout(
           () => {
             if (active) void attemptRefresh();
@@ -1580,13 +1579,13 @@ function SsoProvider({
         );
         return;
       }
-      const delayMs = Math.max((remainingSec - refreshThreshold) * 1e3, minDelayMs, 1e3);
+      const delayMs = Math.max((remainingSec - effectiveThreshold) * 1e3, minDelayMs, 1e3);
       refreshTimerRef.current = setTimeout(() => {
         if (!active) return;
         const td = getTokenData(client.config.clientId);
         if (!td) return;
         const secLeft = (td.expires_at - Date.now()) / 1e3;
-        if (secLeft <= refreshThreshold) {
+        if (secLeft <= effectiveThreshold) {
           void attemptRefresh();
         } else {
           scheduleNextRefresh();
@@ -1601,7 +1600,7 @@ function SsoProvider({
         refreshTimerRef.current = null;
       }
     };
-  }, [client, loadUser, refreshThreshold, onTokenRefreshed]);
+  }, [client, loadUser, refreshThreshold, onTokenRefreshed, markSessionExpired]);
   (0, import_react.useEffect)(() => {
     const handleStorageChange = (e) => {
       if (e.key && e.key.startsWith("nihplod_sso_") && !e.key.startsWith(REFRESH_LOCK_PREFIX)) {
@@ -1696,6 +1695,26 @@ function useSso() {
 
 // src/react/RequireAuth.tsx
 var import_react2 = __toESM(require("react"));
+function LoginErrorContent({
+  loginError,
+  retry,
+  renderLoginError
+}) {
+  if (renderLoginError) {
+    return import_react2.default.createElement(
+      import_react2.default.Fragment,
+      null,
+      renderLoginError(loginError, retry)
+    );
+  }
+  const message = loginError instanceof Error ? loginError.message : "\u767B\u5F55\u5931\u8D25";
+  return import_react2.default.createElement(
+    "div",
+    null,
+    import_react2.default.createElement("p", null, `\u767B\u5F55\u672A\u5B8C\u6210\uFF1A${message}`),
+    import_react2.default.createElement("button", { onClick: retry }, "\u91CD\u8BD5\u767B\u5F55")
+  );
+}
 function RequireAuth({
   children,
   fallback,
@@ -1741,20 +1760,11 @@ function RequireAuth({
   }
   if (!isAuthenticated) {
     if (loginError) {
-      if (renderLoginError) {
-        return import_react2.default.createElement(
-          import_react2.default.Fragment,
-          null,
-          renderLoginError(loginError, retry)
-        );
-      }
-      const message = loginError instanceof Error ? loginError.message : "\u767B\u5F55\u5931\u8D25";
-      return import_react2.default.createElement(
-        "div",
-        null,
-        import_react2.default.createElement("p", null, `\u767B\u5F55\u672A\u5B8C\u6210\uFF1A${message}`),
-        import_react2.default.createElement("button", { onClick: retry }, "\u91CD\u8BD5\u767B\u5F55")
-      );
+      return import_react2.default.createElement(LoginErrorContent, {
+        loginError,
+        retry,
+        renderLoginError
+      });
     }
     if (fallback) return import_react2.default.createElement(import_react2.default.Fragment, null, fallback);
     return import_react2.default.createElement("div", null, "\u8BF7\u5148\u767B\u5F55");