@quanticjs/auth-web-bff 5.7.0 → 5.8.0

package/dist/bff.controller.js

@@ -81,13 +81,17 @@ let BffController = class BffController {
         }
         const cookieName = this.bffService.getCookieName();
         const sessionId = req.cookies?.[cookieName];
+        let idToken;
         if (sessionId) {
+            const session = await this.bffService.getSession(sessionId);
+            idToken = session?.idToken;
             await this.bffService.destroySession(sessionId);
         }
+        const endSessionUrl = this.bffService.getEndSessionUrl(idToken);
         res
             .clearCookie(cookieName, this.bffService.getCookieOptions())
             .clearCookie(this.bffService.getCsrfCookieName(), this.bffService.getCsrfCookieOptions())
-            .json({ success: true });
+            .json({ success: true, endSessionUrl });
     }
     async me(req, res) {
         const cookieName = this.bffService.getCookieName();

package/dist/bff.service.d.ts

@@ -25,6 +25,7 @@ export declare class BffService implements OnModuleInit {
     getAccessToken(sessionId: string): Promise<string | null>;
     refreshSession(sessionId: string, session?: SessionData): Promise<string | null>;
     destroySession(sessionId: string): Promise<void>;
+    getEndSessionUrl(idToken?: string): string | null;
     getUserInfo(sessionId: string): Promise<Record<string, unknown> | null>;
     getCookieOptions(): Record<string, unknown>;
     getCookieName(): string;

package/dist/bff.service.js

@@ -143,9 +143,19 @@ let BffService = class BffService {
         const session = await this.getSession(sessionId);
         if (!this.redis)
             return;
-        if (session?.accessToken) {
+        if (session) {
             try {
-                await this.client.revoke(session.accessToken, 'access_token');
+                if (session.refreshToken) {
+                    await this.client.revoke(session.refreshToken, 'refresh_token');
+                }
+            }
+            catch {
+                // best-effort revocation
+            }
+            try {
+                if (session.accessToken) {
+                    await this.client.revoke(session.accessToken, 'access_token');
+                }
             }
             catch {
                 // best-effort revocation
@@ -153,6 +163,20 @@ let BffService = class BffService {
         }
         await this.redis.del(this.sessionPrefix + sessionId);
     }
+    getEndSessionUrl(idToken) {
+        const endSessionEndpoint = this.client.issuer.metadata.end_session_endpoint;
+        if (!endSessionEndpoint)
+            return null;
+        const publicUrl = endSessionEndpoint.replace(this.internalKeycloakBase, this.publicKeycloakBase);
+        const redirectUri = this.options.publicUrl ?? 'http://localhost:5173';
+        const params = new URLSearchParams({
+            client_id: this.options.keycloak.clientId,
+            post_logout_redirect_uri: redirectUri,
+        });
+        if (idToken)
+            params.set('id_token_hint', idToken);
+        return `${publicUrl}?${params.toString()}`;
+    }
     async getUserInfo(sessionId) {
         const session = await this.getSession(sessionId);
         if (!session)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quanticjs/auth-web-bff",
-  "version": "5.7.0",
+  "version": "5.8.0",
   "description": "BFF authentication module — Keycloak OIDC, Redis sessions, httpOnly cookies",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -9,7 +9,7 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "@quanticjs/core": "^5.7.0"
+    "@quanticjs/core": "^5.8.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^10.0.0 || ^11.0.0",