@sjolystinnovation/app-kit 0.15.0 → 0.16.0

package/README.md

@@ -170,7 +170,7 @@ export { handler as GET, handler as POST };
 
 | Setting | Type | Description |
 | --- | --- | --- |
-| `apiUrl` | `string` | Base URL of the API. Sign-in posts to `/auth/login` and refresh to `/auth/refresh-token` under it. An empty value throws. |
+| `apiUrl` | `string` | Base URL of the API. Sign-in posts to `/auth/login`, refresh to `/auth/refresh-token` and sign-out to `/auth/logout` under it. An empty value throws. |
 | `env` | `Record<string, string \| undefined>` | The server environment, usually `process.env`. It supplies the secret named by `jwtSecretEnvVar`. |
 | `http` | `AxiosInstance` | In place of `apiUrl`, for tests. The client for sign-in and refresh, with its own base URL. |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjolystinnovation/app-kit",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Building blocks for Next.js apps that sign in against a JWT API through next-auth",
   "license": "Apache-2.0",
   "author": "Sjølyst Innovation AS",

package/src/auth/createAuthOptions.ts

@@ -73,6 +73,10 @@ const REMEMBER_ROTATION_MS = 60 * 1000;
 // Sign-in and session reads wait for the API, so a hung connection must not hold them forever.
 const API_TIMEOUT_MS = 10_000;
 
+// Sign-out waits for the API to drop the refresh token, but only briefly, because the cookie is
+// cleared either way.
+const SIGN_OUT_TIMEOUT_MS = 3_000;
+
 function rolesOf(claims: ApiClaims): string[] {
   const raw = claims.role;
   return Array.isArray(raw) ? raw : raw ? [raw] : [];
@@ -249,6 +253,19 @@ export function createAuthOptions(config: SessionConfig, settings: AuthOptionsSe
     session: {
       maxAge: ABSOLUTE_SESSION_MAX_AGE / 1000,
     },
+    events: {
+      // Sign-out also asks the API to delete the refresh token, so a copy of it cannot be used again.
+      // A failure leaves sign-out to the cookie alone.
+      async signOut({ token }) {
+        const refreshToken = (token as AppToken | null)?.refreshToken;
+        if (!refreshToken) return;
+        try {
+          await http.post("/auth/logout", { refreshToken }, { timeout: SIGN_OUT_TIMEOUT_MS });
+        } catch (error) {
+          console.error("Sign-out could not delete the refresh token at the API", failureShape(error));
+        }
+      },
+    },
     callbacks: {
       async jwt({ token: current, user }) {
         let token = current as AppToken;