@plitzi/sdk-auth 0.37.2 → 0.37.4

package/dist/AuthContextProvider.mjs

@@ -1,15 +1,16 @@
 import { AuthContext as e } from "./AuthContext.mjs";
-import t from "./hooks/useAuth/index.mjs";
-import n from "./hooks/useSessionQueryReset/index.mjs";
-import { use as r, useMemo as i, useRef as a } from "react";
-import { QueryBuilderEvaluator as o } from "@plitzi/plitzi-ui/QueryBuilder";
-import s from "@plitzi/sdk-navigation/hooks/useNavigation";
-import { processTwig as c } from "@plitzi/sdk-shared/helpers/twigWrapper";
-import l from "@plitzi/sdk-shared/network/NetworkContext";
-import { useCommonStore as u, useRenderSettings as d } from "@plitzi/sdk-shared/store";
-import { jsx as f } from "react/jsx-runtime";
+import { publishedSession as t } from "./helpers/publishedSession.mjs";
+import n from "./hooks/useAuth/index.mjs";
+import r from "./hooks/useSessionQueryReset/index.mjs";
+import { use as i, useMemo as a, useRef as o } from "react";
+import { QueryBuilderEvaluator as s } from "@plitzi/plitzi-ui/QueryBuilder";
+import c from "@plitzi/sdk-navigation/hooks/useNavigation";
+import { processTwig as l } from "@plitzi/sdk-shared/helpers/twigWrapper";
+import u from "@plitzi/sdk-shared/network/NetworkContext";
+import { useCommonStore as d, useRenderSettings as f } from "@plitzi/sdk-shared/store";
+import { jsx as p } from "react/jsx-runtime";
 //#region src/AuthContextProvider.tsx
-var p = [
+var m = [
 	"loginUrl",
 	"userUrl",
 	"refreshUrl",
@@ -20,28 +21,29 @@ var p = [
 	"expirationTimePath",
 	"refreshExpirationTimePath",
 	"sessionHintCookie",
-	"sessionExchangeUrl"
-], m = (e, t) => {
+	"sessionExchangeUrl",
+	"mfaUrl"
+], h = (e, t) => {
 	if (e === t) return !0;
 	if (!e || !t) return !1;
 	let n = e, r = t;
 	return [.../* @__PURE__ */ new Set([...Object.keys(n), ...Object.keys(r)])].every((e) => JSON.stringify(n[e]) === JSON.stringify(r[e]));
-}, h = ({ children: h, server: g }) => {
-	let { previewMode: _, isHydrating: v, environment: y } = d(), { webKey: b } = r(l), [[x, S]] = u(["schema.settings", "schema.variables"]), { queryParams: C, hostname: w } = s({ server: g }), T = i(() => ({
-		queryParams: C,
-		hostname: w,
-		environment: y
+}, g = ({ children: g, server: _ }) => {
+	let { previewMode: v, isHydrating: y, environment: b } = f(), { webKey: x } = i(u), [[S, C]] = d(["schema.settings", "schema.variables"]), { queryParams: w, hostname: T } = c({ server: _ }), E = a(() => ({
+		queryParams: w,
+		hostname: T,
+		environment: b
 	}), [
-		C,
 		w,
-		y
-	]), E = i(() => Array.isArray(S) ? S.reduce((e, t) => {
+		T,
+		b
+	]), D = a(() => Array.isArray(C) ? C.reduce((e, t) => {
 		let { name: n, value: r, subValues: i } = t;
 		if (!Array.isArray(i) || i.length === 0) return {
 			...e,
 			[n]: r
 		};
-		let a = i.find((e) => o(e.when, T));
+		let a = i.find((e) => s(e.when, E));
 		return a ? {
 			...e,
 			[n]: a.value
@@ -49,57 +51,71 @@ var p = [
 			...e,
 			[n]: r
 		};
-	}, {}) : {}, [S, T]), D = i(() => {
-		let e = Object.fromEntries(p.map((e) => [e, x[e]]));
+	}, {}) : {}, [C, E]), O = a(() => {
+		let e = Object.fromEntries(m.map((e) => [e, S[e]]));
 		try {
-			return JSON.parse(c(JSON.stringify(e), E));
+			return JSON.parse(l(JSON.stringify(e), D));
 		} catch {
 			return e;
 		}
-	}, [x, E]), O = i(() => ({
-		...D,
-		spaceKey: b,
-		tokenStorage: x.tokenStorage ?? "localStorage",
-		sessionGate: x.sessionGate,
-		sessionRevalidateSeconds: x.sessionRevalidateSeconds
+	}, [S, D]), k = a(() => ({
+		...O,
+		spaceKey: x,
+		tokenStorage: S.tokenStorage ?? "localStorage",
+		sessionGate: S.sessionGate,
+		sessionRevalidateSeconds: S.sessionRevalidateSeconds
 	}), [
-		D,
-		x,
-		b
-	]), { manager: k, loading: A, authenticated: j, state: M, bootstrapUser: N, bootstrapToken: P, peekedUser: F, peekedToken: I } = t({
-		server: g,
-		isHydrating: v,
-		provider: x.userProvider ?? "",
-		settings: O
-	}), L = k.getProvider()?.user, R = L ?? N ?? F, z = L ? k.getProvider()?.token?.accessToken : N ? P : I, B = a(void 0), V = i(() => {
-		let e = R ? {
-			details: R,
-			accessToken: z
-		} : void 0, t = B.current;
-		return t?.accessToken === e?.accessToken && m(t?.details, e?.details) || (B.current = e), B.current;
-	}, [R, z]);
-	n(j ? String(V?.details?.id ?? "") : "");
-	let H = i(() => ({
-		login: k.login.bind(k),
-		refresh: k.refresh.bind(k),
-		revalidate: k.revalidate.bind(k),
-		invalidate: k.invalidate.bind(k),
-		can: k.can.bind(k),
-		logout: k.logout.bind(k),
-		state: M,
-		authenticated: j || !_,
-		user: V
+		O,
+		S,
+		x
+	]), { manager: A, loading: j, authenticated: M, state: N, bootstrapUser: P, bootstrapToken: F, peekedUser: I, peekedToken: L } = n({
+		server: _,
+		isHydrating: y,
+		provider: S.userProvider ?? "",
+		settings: k
+	}), R = A.getProvider(), { user: z, accessToken: B } = t({
+		state: N,
+		provider: {
+			user: R?.user,
+			accessToken: R?.token?.accessToken
+		},
+		bootstrap: {
+			user: P,
+			accessToken: F
+		},
+		peeked: {
+			user: I,
+			accessToken: L
+		}
+	}), V = o(void 0), H = a(() => {
+		let e = z ? {
+			details: z,
+			accessToken: B
+		} : void 0, t = V.current;
+		return t?.accessToken === e?.accessToken && h(t?.details, e?.details) || (V.current = e), V.current;
+	}, [z, B]);
+	r(M ? String(H?.details?.id ?? "") : "");
+	let U = a(() => ({
+		login: A.login.bind(A),
+		refresh: A.refresh.bind(A),
+		revalidate: A.revalidate.bind(A),
+		invalidate: A.invalidate.bind(A),
+		can: A.can.bind(A),
+		logout: A.logout.bind(A),
+		state: N,
+		authenticated: M || !v,
+		user: H
 	}), [
-		k,
+		A,
+		N,
 		M,
-		j,
-		_,
-		V
+		v,
+		H
 	]);
-	return /* @__PURE__ */ f(e, {
-		value: H,
-		children: !A && h
+	return /* @__PURE__ */ p(e, {
+		value: U,
+		children: !j && g
 	});
 };
 //#endregion
-export { h as default };
+export { g as default };

package/dist/AuthManager.mjs

@@ -1,15 +1,16 @@
 import e from "./providers/BasicAuthProvider.mjs";
+import t from "./providers/ServerAuthProvider.mjs";
 //#region src/AuthManager.ts
-var t = /* @__PURE__ */ new Map([["basic", (t) => new e(t)]]), n = (e, n) => {
-	t.set(e, n);
-}, r = () => [...t.keys()], i = class {
+var n = /* @__PURE__ */ new Map([["basic", (t) => new e(t)], ["server", (e) => new t(e)]]), r = (e, t) => {
+	n.set(e, t);
+}, i = () => [...n.keys()], a = class {
 	providerType;
 	provider;
 	settings;
 	listeners;
-	constructor(e, n, r) {
-		this.providerType = e, this.settings = r, this.listeners = Array.isArray(n) ? n : [n];
-		let i = t.get(e);
+	constructor(e, t, r) {
+		this.providerType = e, this.settings = r, this.listeners = Array.isArray(t) ? t : [t];
+		let i = n.get(e);
 		i && (this.provider = i(r), this.provider.on(this.listeners));
 	}
 	getProviderType() {
@@ -67,4 +68,4 @@ var t = /* @__PURE__ */ new Map([["basic", (t) => new e(t)]]), n = (e, n) => {
 	}
 };
 //#endregion
-export { i as AuthManager, r as getAuthProviderNames, n as registerAuthProvider };
+export { a as AuthManager, i as getAuthProviderNames, r as registerAuthProvider };

package/dist/AuthProvider.d.ts

@@ -1,4 +1,4 @@
-import { AuthFailureReason, AuthResult, AuthState, LoginResult, Schema, TokenResult } from '@plitzi/sdk-shared';
+import { AuthFailureReason, AuthResult, AuthState, LoginResult, MfaChallenge, Schema, TokenResult } from '@plitzi/sdk-shared';
 /** Why a state changed. Not control flow — it is what makes an auth trace readable, and every transition below
  *  names one, because "it went to guest" is not a diagnosis and "the hint cookie was gone" is. */
 export type AuthStateReason = 'bootstrap' | 'restored' | 'granted' | 'renewed' | 'identity' | 'redirect' | 'exchanged' | 'no-provider' | 'skip-auth' | 'hint-missing' | 'no-evidence' | 'signed-out' | 'another-tab' | 'settled' | 'authenticating';
@@ -52,6 +52,15 @@ declare abstract class AuthProvider<U = Record<string, unknown>> {
     private readonly revalidateSeconds;
     private readonly listeners;
     private renewal?;
+    /**
+     * Which session an answer belongs to. Moved on by every change of WHO is signed in — a sign-out, a sign-in, another
+     * tab's — and read around each request that can adopt or end a session.
+     *
+     * An identity asked for before a sign-out and answered after it carried the old cookie, so it came back `ok` and
+     * signed the person straight back in: the router then read a session on the guest's own page and answered "Access
+     * Denied". Under load that is not a corner case — the account screen asks who is there while its button is pressed.
+     */
+    private epoch;
     private renewalTimer?;
     private detachListeners?;
     /** Set when a request failed to reach the backend, so the next `online` event retries instead of waiting. */
@@ -65,7 +74,8 @@ declare abstract class AuthProvider<U = Record<string, unknown>> {
     /** The backend's endpoints. Refusals reported from elsewhere are matched against these, so a session only reacts
      *  to the API that issued it. Empty means "unknown", and then every refusal is taken as ours. */
     protected get endpoints(): string[];
-    protected abstract requestLogin(params: Record<string, unknown>): Promise<AuthResult<U>>;
+    /** A session, why there is none — or, for an account with a second factor, the challenge its code completes. */
+    protected abstract requestLogin(params: Record<string, unknown>): Promise<AuthResult<U> | MfaChallenge>;
     protected abstract requestRenewal(refreshToken?: string): Promise<AuthResult<U>>;
     protected abstract requestIdentity(): Promise<AuthResult<U>>;
     protected abstract requestLogout(): Promise<void>;

package/dist/AuthProvider.mjs

@@ -12,6 +12,7 @@ var s = 60, c = 300, l = 2147483647, u = class {
 	revalidateSeconds;
 	listeners = /* @__PURE__ */ new Set();
 	renewal;
+	epoch = 0;
 	renewalTimer;
 	detachListeners;
 	offline = !1;
@@ -126,8 +127,9 @@ var s = 60, c = 300, l = 2147483647, u = class {
 		clearTimeout(this.renewalTimer), this.renewalTimer = void 0, this.detachListeners?.(), this.detachListeners = void 0;
 	}
 	async login(e) {
-		this.setState("authenticating", "authenticating");
+		this.epoch += 1, this.setState("authenticating", "authenticating");
 		let t = await this.requestLogin(e);
+		if (!t.ok && t.reason === "mfa") return this.endSession(), t;
 		if (!t.ok) return this.endSession(t.reason), {
 			ok: !1,
 			reason: t.reason
@@ -206,12 +208,12 @@ var s = 60, c = 300, l = 2147483647, u = class {
 		}), this.renewal;
 	}
 	async performRenewal() {
-		let e = await this.requestRenewal(this.session.token?.refreshToken ?? void 0);
-		return e.ok ? (this.adopt(e), !this.session.user && this.capabilities.identity ? this.loadIdentity() : this.state === "authenticated") : (this.handleFailure(e.reason), !1);
+		let e = this.epoch, t = await this.requestRenewal(this.session.token?.refreshToken ?? void 0);
+		return e === this.epoch ? t.ok ? (this.adopt(t), !this.session.user && this.capabilities.identity ? this.loadIdentity() : this.state === "authenticated") : (this.handleFailure(t.reason), !1) : this.state === "authenticated";
 	}
 	async loadIdentity() {
-		let e = await this.requestIdentity();
-		return e.ok ? (this.adopt(e), this.state === "authenticated") : e.reason === "expired" && this.capabilities.renew && !this.renewal ? this.renew() : (this.handleFailure(e.reason), !1);
+		let e = this.epoch, t = await this.requestIdentity();
+		return e === this.epoch ? t.ok ? (this.adopt(t), this.state === "authenticated") : t.reason === "expired" && this.capabilities.renew && !this.renewal ? this.renew() : (this.handleFailure(t.reason), !1) : this.state === "authenticated";
 	}
 	handleFailure(e) {
 		if (e === "network") {
@@ -228,7 +230,7 @@ var s = 60, c = 300, l = 2147483647, u = class {
 		}, this.offline = !1, t && this.store.write(this.session), this.scheduleRenewal(), this.setState(this.session.user || this.hasLiveToken() ? "authenticated" : "guest", r);
 	}
 	endSession(e, t = "signed-out") {
-		clearTimeout(this.renewalTimer), this.renewalTimer = void 0, this.session = { validatedAt: n() }, this.store.write(this.session), this.setState("guest", t), e && this.emit({
+		this.epoch += 1, clearTimeout(this.renewalTimer), this.renewalTimer = void 0, this.session = { validatedAt: n() }, this.store.write(this.session), this.setState("guest", t), e && this.emit({
 			type: "expired",
 			reason: e
 		});
@@ -282,7 +284,7 @@ var s = 60, c = 300, l = 2147483647, u = class {
 		};
 	}
 	adoptFromStorage(e) {
-		if (!e?.token && !e?.user) {
+		if (this.epoch += 1, !e?.token && !e?.user) {
 			clearTimeout(this.renewalTimer), this.renewalTimer = void 0, this.session = { validatedAt: n() }, this.setState("guest", "another-tab"), this.emit({ type: "logout" });
 			return;
 		}

package/dist/helpers/publishedSession.d.ts

@@ -0,0 +1,31 @@
+import { AuthState } from '@plitzi/sdk-shared';
+/**
+ * Who the page says is signed in, from what is known about them at this moment.
+ *
+ * The provider is authoritative once it has settled. Before that — the first commit of a server-rendered page, a reload
+ * with a session in storage — it holds nothing yet, and the page falls back to what it already knows: the user the
+ * server rendered with (`bootstrap`), then the one peeked from storage (`peeked`).
+ *
+ * Only before. Once the provider says `guest` there is nobody, whatever the page was rendered with: the fallback used
+ * to outlive a sign-out, so the page went on publishing the previous person and every flow that asked "is anybody
+ * signed in?" was told yes — a sign-in screen that sends signed-in visitors to their account sent this one there, the
+ * account (rightly) sent them back, and the two bounced off each other hundreds of times a second.
+ */
+export declare const publishedSession: <U>(input: {
+    state: AuthState;
+    provider?: {
+        user?: U;
+        accessToken?: string;
+    };
+    bootstrap?: {
+        user?: U;
+        accessToken?: string;
+    };
+    peeked?: {
+        user?: U;
+        accessToken?: string;
+    };
+}) => {
+    user?: U;
+    accessToken?: string;
+};

package/dist/helpers/publishedSession.mjs

@@ -0,0 +1,16 @@
+//#region src/helpers/publishedSession.ts
+var e = (e) => {
+	let { state: t, provider: n, bootstrap: r, peeked: i } = e;
+	return n?.user ? {
+		user: n.user,
+		accessToken: n.accessToken
+	} : t === "guest" ? {} : r?.user ? {
+		user: r.user,
+		accessToken: r.accessToken
+	} : i?.user ? {
+		user: i.user,
+		accessToken: i.accessToken
+	} : {};
+};
+//#endregion
+export { e as publishedSession };

package/dist/providers/BasicAuthProvider.d.ts

@@ -1,11 +1,12 @@
 import { default as AuthProvider, AuthProviderProps } from '../AuthProvider';
-import { AuthResult, Schema } from '@plitzi/sdk-shared';
+import { AuthResult, MfaChallenge, Schema } from '@plitzi/sdk-shared';
 export type BasicAuthProviderProps = AuthProviderProps & {
     loginUrl?: string;
     userUrl?: string;
     refreshUrl?: string;
     logoutUrl?: string;
     sessionExchangeUrl?: Schema['settings']['sessionExchangeUrl'];
+    mfaUrl?: Schema['settings']['mfaUrl'];
     detailsPath?: Schema['settings']['detailsPath'];
     tokenPath?: Schema['settings']['tokenPath'];
     refreshTokenPath?: Schema['settings']['refreshTokenPath'];
@@ -15,7 +16,7 @@ export type BasicAuthProviderProps = AuthProviderProps & {
 declare class BasicAuthProvider<U = Record<string, unknown>> extends AuthProvider<U> {
     readonly name = "basic";
     private readonly options;
-    constructor({ loginUrl, userUrl, refreshUrl, logoutUrl, sessionExchangeUrl, detailsPath, tokenPath, refreshTokenPath, expirationTimePath, refreshExpirationTimePath, ...providerProps }?: BasicAuthProviderProps);
+    constructor({ loginUrl, userUrl, refreshUrl, logoutUrl, sessionExchangeUrl, mfaUrl, detailsPath, tokenPath, refreshTokenPath, expirationTimePath, refreshExpirationTimePath, ...providerProps }?: BasicAuthProviderProps);
     protected get capabilities(): {
         renew: boolean;
         identity: boolean;
@@ -29,7 +30,7 @@ declare class BasicAuthProvider<U = Record<string, unknown>> extends AuthProvide
      * taken on trust: an unusable token is refused here rather than becoming a session that fails on its first real
      * request. `mode: 'normal'` (the default) posts the credentials.
      */
-    protected requestLogin(params: Record<string, unknown>): Promise<AuthResult<U>>;
+    protected requestLogin(params: Record<string, unknown>): Promise<AuthResult<U> | MfaChallenge>;
     /** Confirms a token by asking who it belongs to, and only then reports it as a session. */
     private adoptToken;
     /**
@@ -46,6 +47,11 @@ declare class BasicAuthProvider<U = Record<string, unknown>> extends AuthProvide
     protected requestIdentity(): Promise<AuthResult<U>>;
     protected requestLogout(): Promise<void>;
     private request;
+    /**
+     * A right password on an account with a second factor: a challenge, not a session with nobody in it. Read as the
+     * latter it ended as `inactive`, and told somebody with a perfectly good account that it could not be used.
+     */
+    private challengeOf;
     private toResult;
     private tokenFrom;
 }

package/dist/providers/BasicAuthProvider.mjs

@@ -11,18 +11,19 @@ var r = (e, n) => t(e, n, void 0), i = (e, t) => {
 }, o = (e) => typeof e == "string" ? e : typeof e == "number" && Number.isFinite(e) ? String(e) : "", s = class extends e {
 	name = "basic";
 	options;
-	constructor({ loginUrl: e = "", userUrl: t = "", refreshUrl: n = "", logoutUrl: r = "", sessionExchangeUrl: i = "", detailsPath: a = "details", tokenPath: o = "access_token", refreshTokenPath: s = "refresh_token", expirationTimePath: c = "expire_at", refreshExpirationTimePath: l = "refresh_expire_at", ...u } = {}) {
-		super(u), this.options = {
+	constructor({ loginUrl: e = "", userUrl: t = "", refreshUrl: n = "", logoutUrl: r = "", sessionExchangeUrl: i = "", mfaUrl: a = "", detailsPath: o = "details", tokenPath: s = "access_token", refreshTokenPath: c = "refresh_token", expirationTimePath: l = "expire_at", refreshExpirationTimePath: u = "refresh_expire_at", ...d } = {}) {
+		super(d), this.options = {
 			loginUrl: e,
 			userUrl: t,
 			refreshUrl: n,
 			logoutUrl: r,
 			sessionExchangeUrl: i,
-			detailsPath: a,
-			tokenPath: o,
-			refreshTokenPath: s,
-			expirationTimePath: c,
-			refreshExpirationTimePath: l
+			mfaUrl: a,
+			detailsPath: o,
+			tokenPath: s,
+			refreshTokenPath: c,
+			expirationTimePath: l,
+			refreshExpirationTimePath: u
 		};
 	}
 	get capabilities() {
@@ -46,6 +47,19 @@ var r = (e, n) => t(e, n, void 0), i = (e, t) => {
 			ok: !1,
 			reason: "missing"
 		};
+		if (e.mode === "mfa") {
+			let t = o(e.mfaToken).trim();
+			return !this.options.mfaUrl || !t ? {
+				ok: !1,
+				reason: "missing"
+			} : this.toResult(await this.request(this.options.mfaUrl, {
+				method: "POST",
+				body: JSON.stringify({
+					mfaToken: t,
+					code: o(e.code).trim()
+				})
+			}));
+		}
 		if (!this.options.loginUrl) return {
 			ok: !1,
 			reason: "missing"
@@ -57,7 +71,7 @@ var r = (e, n) => t(e, n, void 0), i = (e, t) => {
 				password: o(e.password)
 			})
 		});
-		return this.toResult(n);
+		return this.challengeOf(n) ?? this.toResult(n);
 	}
 	async adoptToken(e) {
 		if (!this.options.userUrl) return {
@@ -145,6 +159,14 @@ var r = (e, n) => t(e, n, void 0), i = (e, t) => {
 			reason: r.ok ? void 0 : n(r.status, i) ?? "network"
 		};
 	}
+	challengeOf(e) {
+		let t = r(e.data, "mfaToken");
+		return !e.reason && r(e.data, "mfaRequired") === !0 && typeof t == "string" && t ? {
+			ok: !1,
+			reason: "mfa",
+			mfaToken: t
+		} : void 0;
+	}
 	toResult(e) {
 		if (e.reason) return {
 			ok: !1,

package/dist/providers/ServerAuthProvider.d.ts

@@ -0,0 +1,41 @@
+import { default as AuthProvider, AuthProviderProps } from '../AuthProvider';
+import { AuthResult, MfaChallenge } from '@plitzi/sdk-shared';
+export type ServerAuthProviderProps = AuthProviderProps & {
+    /** Where the page server starts a sign-in by redirect. Default `/auth/sign-in` (`createServer({ signIn })`). */
+    loginUrl?: string;
+    /** Where the page server ends the session on its host. Default `/auth/logout`. */
+    logoutUrl?: string;
+};
+/**
+ * A space whose people sign in THROUGH the server that renders it: signing in is a redirect out and back
+ * (`createServer({ signIn })` — "Sign in with Plitzi" on the platform), and the session is a cookie on the space's
+ * own host that the page never holds.
+ *
+ * So there is nothing here to store, renew or ask about. Who is signed in is what the server rendered the page for —
+ * it resolves the visitor on every request and hands the answer over with the page — and it is the server that ends a
+ * session. What this provider does is the two things only a browser can: go and sign in, and ask to sign out.
+ */
+declare class ServerAuthProvider<U = Record<string, unknown>> extends AuthProvider<U> {
+    readonly name = "server";
+    private readonly loginUrl;
+    private readonly logoutUrl;
+    constructor({ loginUrl, logoutUrl, ...providerProps }?: ServerAuthProviderProps);
+    protected get capabilities(): {
+        renew: boolean;
+        identity: boolean;
+    };
+    /**
+     * Off to sign in, and back to this very page. The promise never settles: the page is being left, and whatever it
+     * said next would be said to nobody.
+     */
+    protected requestLogin(): Promise<AuthResult<U> | MfaChallenge>;
+    protected requestRenewal(): Promise<AuthResult<U>>;
+    protected requestIdentity(): Promise<AuthResult<U>>;
+    protected requestLogout(): Promise<void>;
+    /**
+     * Nothing to confirm from here: the page cannot see its own session, and the server answers who is signed in on
+     * every page it serves. The session stands as the server rendered it until the server says otherwise.
+     */
+    revalidate(): Promise<boolean>;
+}
+export default ServerAuthProvider;

package/dist/providers/ServerAuthProvider.mjs

@@ -0,0 +1,46 @@
+import e from "../AuthProvider.mjs";
+//#region src/providers/ServerAuthProvider.ts
+var t = class extends e {
+	name = "server";
+	loginUrl;
+	logoutUrl;
+	constructor({ loginUrl: e = "", logoutUrl: t = "", ...n } = {}) {
+		super({
+			...n,
+			tokenStorage: ""
+		}), this.loginUrl = e || "/auth/sign-in", this.logoutUrl = t || "/auth/logout";
+	}
+	get capabilities() {
+		return {
+			renew: !1,
+			identity: !1
+		};
+	}
+	requestLogin() {
+		let e = `${window.location.pathname}${window.location.search}`;
+		return window.location.assign(`${this.loginUrl}?return=${encodeURIComponent(e)}`), new Promise(() => void 0);
+	}
+	requestRenewal() {
+		return Promise.resolve({
+			ok: !1,
+			reason: "expired"
+		});
+	}
+	requestIdentity() {
+		return Promise.resolve({
+			ok: !1,
+			reason: "missing"
+		});
+	}
+	async requestLogout() {
+		await fetch(this.logoutUrl, {
+			method: "POST",
+			credentials: "same-origin"
+		});
+	}
+	revalidate() {
+		return Promise.resolve(this.getState() === "authenticated");
+	}
+};
+//#endregion
+export { t as default };

package/dist/types.d.ts

@@ -3,4 +3,4 @@ import { Schema } from '@plitzi/sdk-shared';
  * Everything a space declares about its auth backend, handed to whichever provider it selected. Derived from the
  * schema rather than restated, so a setting added there reaches providers without a second definition to keep in step.
  */
-export type AuthProviderSettings = Pick<Schema['settings'], 'tokenStorage' | 'loginUrl' | 'userUrl' | 'refreshUrl' | 'logoutUrl' | 'detailsPath' | 'tokenPath' | 'refreshTokenPath' | 'expirationTimePath' | 'refreshExpirationTimePath' | 'sessionHintCookie' | 'sessionExchangeUrl' | 'sessionGate' | 'sessionRevalidateSeconds'>;
+export type AuthProviderSettings = Pick<Schema['settings'], 'tokenStorage' | 'loginUrl' | 'userUrl' | 'refreshUrl' | 'logoutUrl' | 'detailsPath' | 'tokenPath' | 'refreshTokenPath' | 'expirationTimePath' | 'refreshExpirationTimePath' | 'sessionHintCookie' | 'sessionExchangeUrl' | 'mfaUrl' | 'sessionGate' | 'sessionRevalidateSeconds'>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plitzi/sdk-auth",
-  "version": "0.37.2",
+  "version": "0.37.4",
   "license": "AGPL-3.0",
   "files": [
     "dist"
@@ -30,6 +30,10 @@
       "types": "./dist/helpers/SessionStore.d.ts",
       "import": "./dist/helpers/SessionStore.mjs"
     },
+    "./helpers/publishedSession": {
+      "types": "./dist/helpers/publishedSession.d.ts",
+      "import": "./dist/helpers/publishedSession.mjs"
+    },
     "./helpers/sessionHint": {
       "types": "./dist/helpers/sessionHint.d.ts",
       "import": "./dist/helpers/sessionHint.mjs"
@@ -70,6 +74,10 @@
       "types": "./dist/providers/BasicAuthProvider.d.ts",
       "import": "./dist/providers/BasicAuthProvider.mjs"
     },
+    "./providers/ServerAuthProvider": {
+      "types": "./dist/providers/ServerAuthProvider.d.ts",
+      "import": "./dist/providers/ServerAuthProvider.mjs"
+    },
     "./types": {
       "types": "./dist/types.d.ts"
     }
@@ -87,16 +95,16 @@
     "build:prod": "vite build && node ../sdk-shared/scripts/generate-exports.mjs"
   },
   "dependencies": {
-    "@plitzi/nexus": "^1.2.2",
-    "@plitzi/plitzi-ui": "^1.6.22",
-    "@plitzi/sdk-navigation": "0.37.2",
-    "@plitzi/sdk-schema": "0.37.2",
-    "@plitzi/sdk-shared": "0.37.2"
+    "@plitzi/nexus": "^1.3.1",
+    "@plitzi/plitzi-ui": "^1.6.24",
+    "@plitzi/sdk-navigation": "0.37.4",
+    "@plitzi/sdk-schema": "0.37.4",
+    "@plitzi/sdk-shared": "0.37.4"
   },
   "devDependencies": {
     "eslint": "^9.39.5",
     "typescript": "^6.0.3",
-    "vite": "^8.3.0",
+    "vite": "^8.3.1",
     "vitest": "^5.0.1"
   }
 }