@orsetra/shared-auth 1.0.12 → 1.1.0

package/config/zitadel.config.ts

@@ -29,7 +29,7 @@ export function createAuthConfig(zitadelConfig: ZitadelConfig): UserManagerSetti
     client_id: `${zitadelConfig.client_id}`,
     redirect_uri: zitadelConfig.redirect_uri ?? `${baseUrl}/callback`,
     response_type: zitadelConfig.response_type ?? 'code',
-    scope: zitadelConfig.scope ?? `openid profile email ${
+    scope: zitadelConfig.scope ?? `openid profile email offline_access ${
       zitadelConfig.project_resource_id
         ? `urn:zitadel:iam:org:project:id:${zitadelConfig.project_resource_id}:aud urn:zitadel:iam:org:projects:roles access_offline`
         : ''

package/hooks/useSession.ts

@@ -6,6 +6,7 @@ interface SessionUser {
   access_token: string
   id_token?: string
   expires_at?: number
+  refresh_token?: string
   profile: {
     sub: string
     email?: string
@@ -25,6 +26,7 @@ interface SessionState {
 /**
  * Hook pour récupérer la session utilisateur dans les micro-apps
  * Lit depuis localStorage (partagé via même domaine)
+ * Vérifie automatiquement l'expiration et redirige vers login si nécessaire
  */
 export function useSession(): SessionState {
   const [state, setState] = useState<SessionState>({
@@ -54,6 +56,14 @@ export function useSession(): SessionState {
             accessToken: userData.access_token,
           })
           return
+        } else {
+          // Token expiré - nettoyer et rediriger
+          localStorage.removeItem(storageKey)
+          
+          // Rediriger vers l'app principale pour reconnexion
+          const mainAppUrl = process.env.NEXT_PUBLIC_MAIN_APP_URL || window.location.origin
+          window.location.href = `${mainAppUrl}/?redirect=${encodeURIComponent(window.location.pathname)}`
+          return
         }
       }
     } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orsetra/shared-auth",
-  "version": "1.0.12",
+  "version": "1.1.0",
   "description": "Shared authentication utilities for Orsetra platform using Zitadel",
   "main": "./index.ts",
   "types": "./index.ts",

package/services/zitadel.auth.service.ts

@@ -26,6 +26,8 @@ function createZitadelAuth(zitadelConfig: ZitadelConfig): ZitadelAuth {
   const userManager = new UserManager({
     userStore: new WebStorageStateStore({ store: window.localStorage }),
     loadUserInfo: true,
+    automaticSilentRenew: true,
+    silent_redirect_uri: authConfig.redirect_uri?.replace('/callback', '/silent-refresh'),
     ...authConfig,
   });
 
@@ -37,6 +39,15 @@ function createZitadelAuth(zitadelConfig: ZitadelConfig): ZitadelAuth {
     document.cookie = 'auth_session=; path=/; max-age=0';
   });
 
+  userManager.events.addUserSignedOut(() => {
+    document.cookie = 'auth_session=; path=/; max-age=0';
+    Object.keys(localStorage).forEach(key => {
+      if (key.startsWith('oidc.user:')) {
+        localStorage.removeItem(key);
+      }
+    });
+  });
+
   return {
     authorize: () => userManager.signinRedirect(),
     signout: () => userManager.signoutRedirect(),
@@ -68,7 +79,27 @@ export class ZitadelAuthService {
 
   static async signOut() {
     try {
+      // Nettoyer le cookie d'auth
       document.cookie = 'auth_session=; path=/; max-age=0';
+      
+      // Nettoyer toutes les sessions localStorage (pour les micro-apps)
+      const authority = process.env.NEXT_PUBLIC_ZITADEL_AUTHORITY;
+      const clientId = process.env.NEXT_PUBLIC_ZITADEL_CLIENT_ID;
+      
+      // Nettoyer la session de l'app courante
+      if (authority && clientId) {
+        const storageKey = `oidc.user:${authority}:${clientId}`;
+        localStorage.removeItem(storageKey);
+      }
+      
+      // Nettoyer toutes les autres sessions Zitadel potentielles
+      Object.keys(localStorage).forEach(key => {
+        if (key.startsWith('oidc.user:')) {
+          localStorage.removeItem(key);
+        }
+      });
+      
+      // Signout redirect vers Zitadel
       await this.getAuth().signout();
     } catch (error) {
       throw this.handleAuthError(error);