@orsetra/shared-auth 1.1.5 → 1.1.7

package/ZitadelProvider.tsx

@@ -24,6 +24,7 @@ const ZitadelContext = createContext<ZitadelContextType | undefined>(undefined)
 export interface ZitadelProviderProps {
   children: ReactNode
   config: ZitadelConfig
+  /** Render the action button shown inside the session-expired modal. Receives the sign-in handler. */
   renderSessionExpiredAction?: (onReauthenticate: () => void) => ReactNode
 }
 
@@ -42,15 +43,11 @@ export function ZitadelProvider({ children, config, renderSessionExpiredAction }
       try { 
         ZitadelAuthService.configureAuth(config)
         ZitadelAuthService.onSessionExpired = () => setSessionExpired(true)
+        ZitadelAuthService.onUserSignedOut = () => ZitadelAuthService.signIn()
         setIsConfigured(true)
 
         const isAuthenticated = await ZitadelAuthService.isAuthenticated()
-        if (!isAuthenticated) {
-          await ZitadelAuthService.signIn()
-          return
-        }
-
-        const currentUser = await ZitadelAuthService.getUser()
+        const currentUser = isAuthenticated ? await ZitadelAuthService.getUser() : null
         setUser(currentUser)
       } catch (error) {
         console.error("Failed to configure Zitadel auth:", error)

package/index.ts

@@ -2,7 +2,8 @@
 export { ZitadelProvider, useZitadel } from './ZitadelProvider'
 export type { ZitadelProviderProps } from './ZitadelProvider'
 export { ProtectedRoute } from './ProtectedRoute'
-export { ZitadelAuthService } from './services/zitadel.auth.service'
+export { ZitadelAuthService, decodeJwt, isJwtExpired } from './services/zitadel.auth.service'
+export type { JwtPayload } from './services/zitadel.auth.service'
 export { createAuthConfig } from './config/zitadel.config'
 export type { ZitadelConfig } from './config/zitadel.config'
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orsetra/shared-auth",
-  "version": "1.1.5",
+  "version": "1.1.7",
   "description": "Shared authentication utilities for Orsetra platform using Zitadel",
   "main": "./index.ts",
   "types": "./index.ts",

package/services/zitadel.auth.service.ts

@@ -5,6 +5,28 @@ import { ZitadelConfig, createAuthConfig } from '../config/zitadel.config';
 
 export type { ZitadelConfig };
 
+export interface JwtPayload {
+  exp?: number
+  iat?: number
+  sub?: string
+  [key: string]: unknown
+}
+
+export function decodeJwt(token: string): JwtPayload {
+  const payload = token.split('.')[1]
+  if (!payload) throw new Error('Invalid JWT: missing payload segment')
+  return JSON.parse(atob(payload)) as JwtPayload
+}
+
+export function isJwtExpired(token: string): boolean {
+  try {
+    const { exp } = decodeJwt(token)
+    return typeof exp !== 'number' || exp <= Math.floor(Date.now() / 1000)
+  } catch {
+    return true
+  }
+}
+
 export interface ZitadelAuth {
   authorize(): Promise<void>;
   signout(): Promise<void>;
@@ -46,6 +68,9 @@ function createZitadelAuth(zitadelConfig: ZitadelConfig): ZitadelAuth {
         localStorage.removeItem(key);
       }
     });
+    // Session invalidated server-side (revocation, sign-out from another tab, IDP session ended)
+    // → redirect immediately, no modal
+    ZitadelAuthService.onUserSignedOut?.();
   });
 
   userManager.events.addAccessTokenExpired(() => {
@@ -73,7 +98,10 @@ function createZitadelAuth(zitadelConfig: ZitadelConfig): ZitadelAuth {
 
 export class ZitadelAuthService {
   private static zitadelAuth: ZitadelAuth | null = null;
+  /** Fired when the access token expires and silent renew fails — show a modal. */
   static onSessionExpired: (() => void) | null = null;
+  /** Fired when the IDP invalidates the session (server logout, revocation, other tab sign-out) — redirect immediately. */
+  static onUserSignedOut: (() => void) | null = null;
 
   static configureAuth(config: ZitadelConfig) {
     this.zitadelAuth = createZitadelAuth(config);
@@ -148,7 +176,8 @@ export class ZitadelAuthService {
 
   static async isAuthenticated(): Promise<boolean> {
     const user = await this.getUser();
-    return user !== null && !user.expired;
+    if (!user?.access_token) return false;
+    return !isJwtExpired(user.access_token);
   }
 
   static async getTokenRemainingTime(): Promise<number> {