@reflagged/shell 1.0.0 → 1.0.3

package/package.json

@@ -1,10 +1,14 @@
 {
   "name": "@reflagged/shell",
-  "version": "1.0.0",
+  "version": "1.0.3",
   "description": "Shared app shell for Reflagged services — OIDC auth, SSO, app switcher",
   "type": "module",
   "sideEffects": false,
-  "files": ["src", "tsconfig.json", "README.md"],
+  "files": [
+    "src",
+    "tsconfig.json",
+    "README.md"
+  ],
   "publishConfig": {
     "access": "public"
   },
@@ -14,6 +18,7 @@
     "./components/BrandSwitcher": "./src/components/BrandSwitcher.tsx",
     "./auth/oidc-config": "./src/lib/auth/oidc-config.ts",
     "./auth/oidc-cookie": "./src/lib/auth/oidc-cookie.ts",
+    "./auth/can-access": "./src/lib/auth/can-access.ts",
     "./auth/oidc-refresh": "./src/lib/auth/oidc-refresh.ts",
     "./auth/nextauth-strategy": "./src/lib/auth/nextauth-strategy.ts",
     "./api/oidc-signin": "./src/lib/api/oidc-signin.ts",

package/src/components/BrandSwitcher.tsx

@@ -295,7 +295,9 @@ export function BrandSwitcher() {
       <div style={sectionLabelStyle}>Apps</div>
       {error && !shell ? (
         <a
-          href="/api/oidc/signin"
+          href={`/api/oidc/signin?callbackUrl=${encodeURIComponent(
+            typeof window !== 'undefined' ? window.location.pathname + window.location.search : '/',
+          )}`}
           style={{ display: 'block', padding: '8px 12px 12px', fontSize: 13, color: '#B09A6A', textDecoration: 'none' }}
         >
           Anmelden, um Services zu sehen →
@@ -432,6 +434,35 @@ export function BrandSwitcher() {
               )
             })
           )}
+
+          {/* Single-logout — clears this service's session AND the platform
+              SSO session (via <provider>/api/sso/signout). Present for every
+              consumer so logout is always reachable from the app-switcher. */}
+          <hr
+            style={{
+              border: 'none',
+              borderTop: '1px solid rgba(176,154,106,0.12)',
+              margin: '6px 0',
+            }}
+          />
+          <a
+            href="/api/oidc/signout"
+            role="menuitem"
+            data-testid="brand-switcher-logout"
+            style={{
+              display: 'flex',
+              alignItems: 'center',
+              gap: 12,
+              padding: '10px 12px',
+              borderRadius: 8,
+              textDecoration: 'none',
+              color: '#B0413A',
+              fontWeight: 500,
+              fontSize: 13.5,
+            }}
+          >
+            Abmelden
+          </a>
         </>
       )}
     </div>

package/src/lib/api/oidc-callback.ts

@@ -1,7 +1,13 @@
 import { NextResponse } from 'next/server'
 import * as oauth from 'oauth4webapi'
 
-import { OIDC_COOKIE, OIDC_SESSION_TTL, OIDC_STATE_COOKIE, loadOidcEnv } from '../auth/oidc-config'
+import {
+  OIDC_COOKIE,
+  OIDC_SESSION_TTL,
+  OIDC_STATE_COOKIE,
+  loadOidcEnv,
+  secureCookies,
+} from '../auth/oidc-config'
 import { signSessionCookie } from '../auth/oidc-cookie'
 
 export const dynamic = 'force-dynamic'
@@ -55,6 +61,14 @@ export async function GET(req: Request): Promise<NextResponse> {
       ? Math.floor(Date.now() / 1000) + result.expires_in
       : null
 
+  // Membership/workspace claims (present when the rflgd:memberships scope was
+  // requested). Persisted into the session JWT so consumers can gate features
+  // via accessibleServices without a /api/shell/me roundtrip.
+  const asString = (v: unknown): string | null => (typeof v === 'string' ? v : null)
+  const accessibleServices = Array.isArray(claims.accessible_services)
+    ? (claims.accessible_services as unknown[]).filter((s): s is string => typeof s === 'string')
+    : null
+
   const session = await signSessionCookie(env.authSecret, {
     sub: String(claims.sub),
     email,
@@ -62,13 +76,19 @@ export async function GET(req: Request): Promise<NextResponse> {
     accessToken,
     refreshToken,
     accessTokenExpiresAt,
+    emailVerified: typeof claims.email_verified === 'boolean' ? claims.email_verified : null,
+    tenantId: asString(claims.tenant_id),
+    tenantSlug: asString(claims.tenant_slug),
+    orgSlug: asString(claims.org_slug),
+    orgRole: asString(claims.org_role),
+    accessibleServices,
   })
 
   const origin = env.baseUrl || url.origin
   const res = NextResponse.redirect(new URL(pkce.callback || '/admin', origin))
   res.cookies.set(OIDC_COOKIE, session, {
     httpOnly: true,
-    secure: req.url.startsWith('https'),
+    secure: secureCookies(),
     sameSite: 'lax',
     path: '/',
     maxAge: OIDC_SESSION_TTL,

package/src/lib/api/oidc-signin.ts

@@ -1,7 +1,7 @@
 import { NextResponse } from 'next/server'
 import * as oauth from 'oauth4webapi'
 
-import { OIDC_STATE_COOKIE, loadOidcEnv } from '../auth/oidc-config'
+import { OIDC_STATE_COOKIE, loadOidcEnv, oidcScopes, secureCookies } from '../auth/oidc-config'
 
 export const dynamic = 'force-dynamic'
 export const runtime = 'nodejs'
@@ -33,7 +33,7 @@ export async function GET(req: Request): Promise<NextResponse> {
   authUrl.searchParams.set('client_id', env.clientId)
   authUrl.searchParams.set('redirect_uri', env.redirectUri)
   authUrl.searchParams.set('response_type', 'code')
-  authUrl.searchParams.set('scope', 'openid profile email offline_access')
+  authUrl.searchParams.set('scope', oidcScopes())
   authUrl.searchParams.set('state', state)
   authUrl.searchParams.set('nonce', nonce)
   authUrl.searchParams.set('code_challenge', codeChallenge)
@@ -42,7 +42,7 @@ export async function GET(req: Request): Promise<NextResponse> {
   const res = NextResponse.redirect(authUrl)
   res.cookies.set(OIDC_STATE_COOKIE, JSON.stringify({ codeVerifier, state, nonce, callback }), {
     httpOnly: true,
-    secure: req.url.startsWith('https'),
+    secure: secureCookies(),
     sameSite: 'lax',
     path: '/',
     maxAge: 600,

package/src/lib/api/oidc-signout.ts

@@ -1,29 +1,44 @@
 import { NextResponse } from 'next/server'
-import { OIDC_COOKIE, loadOidcEnv } from '../auth/oidc-config'
+import {
+  OIDC_COOKIE,
+  loadOidcEnv,
+  providerOrigin,
+  secureCookies,
+  signedOutPath,
+} from '../auth/oidc-config'
 
 export const dynamic = 'force-dynamic'
 export const runtime = 'nodejs'
 
-const SIGNED_OUT_PATH = '/admin/login?signed-out=1'
+function clearSession(res: NextResponse): void {
+  // Explicit attributes so the delete actually matches the cookie set at login.
+  res.cookies.set(OIDC_COOKIE, '', {
+    httpOnly: true,
+    secure: secureCookies(),
+    sameSite: 'lax',
+    path: '/',
+    maxAge: 0,
+  })
+}
 
 export async function GET(req: Request): Promise<NextResponse> {
   const env = loadOidcEnv()
   const fallbackOrigin = new URL(req.url).origin
   const origin = (env?.baseUrl ?? fallbackOrigin).replace(/\/$/, '')
-  const localLanding = `${origin}${SIGNED_OUT_PATH}`
+  const localLanding = `${origin}${signedOutPath()}`
 
   if (!env) {
     const res = NextResponse.redirect(localLanding)
-    res.cookies.delete(OIDC_COOKIE)
+    clearSession(res)
     return res
   }
 
-  const baseUrl = env.issuer.replace(/\/oidc\/?$/, '')
-  const target = new URL(`${baseUrl}/api/sso/signout`)
+  // Provider single-logout endpoint lives at the issuer origin.
+  const target = new URL(`${providerOrigin(env)}/api/sso/signout`)
   target.searchParams.set('post_logout_redirect_uri', localLanding)
 
   const res = NextResponse.redirect(target)
-  res.cookies.delete(OIDC_COOKIE)
+  clearSession(res)
   return res
 }
 

package/src/lib/api/shell-info.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from 'next/server'
 
+import type { OidcSessionToken } from '../auth/oidc-config'
 import { OIDC_COOKIE, OIDC_SESSION_TTL, loadOidcEnv } from '../auth/oidc-config'
 import { signSessionCookie, verifySessionCookie } from '../auth/oidc-cookie'
 import { refreshAccessToken } from '../auth/oidc-refresh'
@@ -7,6 +8,41 @@ import { refreshAccessToken } from '../auth/oidc-refresh'
 export const runtime = 'nodejs'
 export const dynamic = 'force-dynamic'
 
+// Renew the access token this many seconds before its declared expiry, so a
+// token about to lapse mid-request is refreshed up front rather than after a
+// guaranteed 401 round-trip.
+const REFRESH_SKEW_SECONDS = 30
+
+type Refreshed = NonNullable<Awaited<ReturnType<typeof refreshAccessToken>>>
+
+/**
+ * Re-sign the session cookie after a token refresh, PRESERVING every
+ * membership/workspace claim from the existing session. Only the token fields
+ * change — dropping orgRole/accessibleServices/tenantSlug/... here would
+ * silently degrade per-service entitlement gating and the workspace header
+ * after each refresh.
+ */
+function reSignSession(
+  authSecret: string,
+  session: OidcSessionToken,
+  refreshed: Refreshed,
+): Promise<string> {
+  return signSessionCookie(authSecret, {
+    sub: session.sub,
+    email: session.email,
+    name: session.name,
+    emailVerified: session.emailVerified,
+    tenantId: session.tenantId,
+    tenantSlug: session.tenantSlug,
+    orgSlug: session.orgSlug,
+    orgRole: session.orgRole,
+    accessibleServices: session.accessibleServices,
+    accessToken: refreshed.accessToken,
+    refreshToken: refreshed.refreshToken,
+    accessTokenExpiresAt: refreshed.accessTokenExpiresAt,
+  })
+}
+
 export async function GET(req: Request): Promise<NextResponse> {
   const env = loadOidcEnv()
   if (!env) return NextResponse.json({ error: 'oidc-not-configured' }, { status: 503 })
@@ -32,22 +68,38 @@ export async function GET(req: Request): Promise<NextResponse> {
       cache: 'no-store',
     })
 
-  let upstream = await callUpstream(session.accessToken)
+  let accessToken: string = session.accessToken
   let refreshedCookie: string | null = null
 
+  // Proactive refresh: if the access token has expired (or is within the skew
+  // window), renew it BEFORE calling upstream. The access token lives ~1h and
+  // the refresh token ~14d, so the App-Switcher menu stays alive for the whole
+  // session without burning a 401 round-trip or forcing a manual re-login.
+  const nowSeconds = Math.floor(Date.now() / 1000)
+  if (
+    session.refreshToken &&
+    typeof session.accessTokenExpiresAt === 'number' &&
+    session.accessTokenExpiresAt - REFRESH_SKEW_SECONDS <= nowSeconds
+  ) {
+    const refreshed = await refreshAccessToken(env, session.refreshToken)
+    if (refreshed) {
+      refreshedCookie = await reSignSession(env.authSecret, session, refreshed)
+      session = { ...session, ...refreshed }
+      accessToken = refreshed.accessToken
+    }
+  }
+
+  let upstream = await callUpstream(accessToken)
+
+  // Reactive backstop: the token was rejected before its declared expiry
+  // (revoked, clock skew, rotated elsewhere) — try one refresh and retry.
   if (upstream.status === 401 && session.refreshToken) {
     const refreshed = await refreshAccessToken(env, session.refreshToken)
     if (refreshed) {
+      refreshedCookie = await reSignSession(env.authSecret, session, refreshed)
       session = { ...session, ...refreshed }
-      refreshedCookie = await signSessionCookie(env.authSecret, {
-        sub: session.sub,
-        email: session.email,
-        name: session.name,
-        accessToken: refreshed.accessToken,
-        refreshToken: refreshed.refreshToken,
-        accessTokenExpiresAt: refreshed.accessTokenExpiresAt,
-      })
-      upstream = await callUpstream(refreshed.accessToken)
+      accessToken = refreshed.accessToken
+      upstream = await callUpstream(accessToken)
     }
   }
 

package/src/lib/auth/can-access.ts

@@ -0,0 +1,30 @@
+import type { OidcSessionToken } from './oidc-config'
+
+/**
+ * Feature-gating helper for the `accessible_services` claim.
+ *
+ * Semantics (from the provider contract):
+ *   - `['*']`  → the user may access ALL services (platform/org admins).
+ *   - `[]`     → the user may access NO services.
+ *   - `[...]`  → the user may access exactly the listed product keys.
+ *   - `null`/absent → claim was not requested (no `rflgd:memberships` scope)
+ *                     OR a session minted before this field existed. We return
+ *                     `false` (fail-closed) so callers must opt into gating
+ *                     only once the claim is reliably present.
+ */
+export function hasService(
+  accessibleServices: string[] | null | undefined,
+  serviceKey: string,
+): boolean {
+  if (!Array.isArray(accessibleServices)) return false
+  if (accessibleServices.includes('*')) return true
+  return accessibleServices.includes(serviceKey)
+}
+
+/** Convenience overload taking the whole session token. */
+export function sessionHasService(
+  session: Pick<OidcSessionToken, 'accessibleServices'> | null | undefined,
+  serviceKey: string,
+): boolean {
+  return hasService(session?.accessibleServices, serviceKey)
+}

package/src/lib/auth/oidc-config.ts

@@ -9,10 +9,59 @@ export type OidcSessionToken = {
   accessToken?: string | null
   refreshToken?: string | null
   accessTokenExpiresAt?: number | null
+  // Membership/workspace claims (released by the provider when the
+  // `rflgd:memberships` scope is requested). All optional for backward
+  // compatibility with sessions minted before this was added.
+  emailVerified?: boolean | null
+  tenantId?: string | null
+  tenantSlug?: string | null
+  orgSlug?: string | null
+  orgRole?: string | null
+  /** Product keys the user may access; ['*'] = all, [] = none. */
+  accessibleServices?: string[] | null
   iat: number
   exp: number
 }
 
+/**
+ * Scopes requested at authorize time. Defaults include `rflgd:memberships`
+ * so the id_token carries org_slug/org_role/accessible_services. Override via
+ * the OIDC_SCOPES env var (space-separated) for clients that need less.
+ */
+export function oidcScopes(): string {
+  return (
+    process.env.OIDC_SCOPES?.trim() ||
+    'openid profile email offline_access rflgd:memberships'
+  )
+}
+
+/**
+ * Local landing after single-logout. Defaults to `/login?signed-out=1`
+ * (every consumer has a /login). Override per app via RFLGD_SIGNED_OUT_PATH
+ * (e.g. `/?signed-out=1`). Previously hardcoded to `/admin/login`, which
+ * 404'd in consumers without an /admin route.
+ */
+export function signedOutPath(): string {
+  return process.env.RFLGD_SIGNED_OUT_PATH?.trim() || '/login?signed-out=1'
+}
+
+/**
+ * Origin of the provider (where /api/sso/signout lives). Robustly derived
+ * from the issuer URL rather than string-stripping a trailing `/oidc`.
+ */
+export function providerOrigin(env: OidcEnv): string {
+  try {
+    return new URL(env.issuer).origin
+  } catch {
+    return env.issuer.replace(/\/oidc\/?$/, '')
+  }
+}
+
+/** True in production — used for the Secure cookie flag (don't infer from req.url behind a TLS-terminating proxy). */
+export function secureCookies(): boolean {
+  return process.env.NODE_ENV === 'production'
+}
+
 export type OidcEnv = {
   issuer: string
   clientId: string

package/src/lib/auth/oidc-cookie.ts

@@ -17,6 +17,12 @@ export async function signSessionCookie(
     accessToken?: string | null
     refreshToken?: string | null
     accessTokenExpiresAt?: number | null
+    emailVerified?: boolean | null
+    tenantId?: string | null
+    tenantSlug?: string | null
+    orgSlug?: string | null
+    orgRole?: string | null
+    accessibleServices?: string[] | null
   },
 ): Promise<string> {
   return new SignJWT({
@@ -25,6 +31,12 @@ export async function signSessionCookie(
     accessToken: payload.accessToken ?? null,
     refreshToken: payload.refreshToken ?? null,
     accessTokenExpiresAt: payload.accessTokenExpiresAt ?? null,
+    emailVerified: payload.emailVerified ?? null,
+    tenantId: payload.tenantId ?? null,
+    tenantSlug: payload.tenantSlug ?? null,
+    orgSlug: payload.orgSlug ?? null,
+    orgRole: payload.orgRole ?? null,
+    accessibleServices: payload.accessibleServices ?? null,
   })
     .setProtectedHeader({ alg: ALG })
     .setIssuedAt()
@@ -48,6 +60,14 @@ export async function verifySessionCookie(
       refreshToken: typeof payload.refreshToken === 'string' ? payload.refreshToken : null,
       accessTokenExpiresAt:
         typeof payload.accessTokenExpiresAt === 'number' ? payload.accessTokenExpiresAt : null,
+      emailVerified: typeof payload.emailVerified === 'boolean' ? payload.emailVerified : null,
+      tenantId: typeof payload.tenantId === 'string' ? payload.tenantId : null,
+      tenantSlug: typeof payload.tenantSlug === 'string' ? payload.tenantSlug : null,
+      orgSlug: typeof payload.orgSlug === 'string' ? payload.orgSlug : null,
+      orgRole: typeof payload.orgRole === 'string' ? payload.orgRole : null,
+      accessibleServices: Array.isArray(payload.accessibleServices)
+        ? (payload.accessibleServices as unknown[]).filter((s): s is string => typeof s === 'string')
+        : null,
       iat: payload.iat ?? 0,
       exp: payload.exp ?? 0,
     }