@sourceregistry/sveltekit-oidc 1.0.3 → 1.1.0

package/dist/server/cookies.js

@@ -10,6 +10,15 @@ export function createOIDCCookieStore(cookieSecret, sessionCookieName, stateCook
         clearSession(cookies) {
             cookies.delete(sessionCookieName, cookieOptions);
         },
+        readSessionReference(cookies) {
+            return parseSignedCookie(cookies.get(sessionCookieName), cookieSecret);
+        },
+        writeSessionReference(cookies, reference) {
+            cookies.set(sessionCookieName, serializeSignedCookie(reference, cookieSecret), cookieOptions);
+        },
+        clearSessionReference(cookies) {
+            cookies.delete(sessionCookieName, cookieOptions);
+        },
         readState(cookies) {
             return parseSignedCookie(cookies.get(stateCookieName), cookieSecret);
         },

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
 import type { OIDCOptions, OIDCInstance } from './types.js';
 export type * from './types.js';
-export { createInMemoryBackChannelLogoutStore } from './store.js';
+export { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
 export declare function createOIDC(options: OIDCOptions): OIDCInstance;
 export declare const OpenIDConnect: typeof createOIDC;

package/dist/server/index.js

@@ -5,7 +5,7 @@ import { createOIDCCookieStore } from './cookies.js';
 import { asAuthorizationHeader, createClientSecretJwtAssertion, createPrivateKeyJwtAssertion, fetchJson } from './jwt.js';
 import { normalizeTokens, shouldRefresh } from './session.js';
 import { absoluteUrl, base64UrlEncode, buildCookieOptions, collectGroups, createPKCEPair, normalizeIssuer, normalizeScope, parseProviderError, toPublicSession } from './utils.js';
-export { createInMemoryBackChannelLogoutStore } from './store.js';
+export { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
 export function createOIDC(options) {
     const cookieOptions = buildCookieOptions(options.cookieOptions);
     const refreshToleranceSeconds = options.refreshToleranceSeconds ?? 30;
@@ -18,6 +18,45 @@ export function createOIDC(options) {
     const cookieStore = createOIDCCookieStore(options.cookieSecret, sessionCookieName, stateCookieName, cookieOptions);
     let metadataPromise;
     let jwksPromise;
+    async function readPersistedSession(cookies) {
+        if (!options.sessionStore) {
+            const session = cookieStore.readSession(cookies);
+            return session ? { session } : null;
+        }
+        const reference = cookieStore.readSessionReference(cookies);
+        if (!reference?.id) {
+            return null;
+        }
+        const session = await options.sessionStore.get(reference.id);
+        if (!session) {
+            cookieStore.clearSessionReference(cookies);
+            return null;
+        }
+        return {
+            id: reference.id,
+            session
+        };
+    }
+    async function writePersistedSession(cookies, session, sessionId) {
+        if (!options.sessionStore) {
+            cookieStore.writeSession(cookies, session);
+            return;
+        }
+        const id = sessionId ?? base64UrlEncode(randomBytes(24));
+        await options.sessionStore.set(id, session);
+        cookieStore.writeSessionReference(cookies, { id });
+    }
+    async function clearPersistedSession(cookies, sessionId) {
+        if (!options.sessionStore) {
+            cookieStore.clearSession(cookies);
+            return;
+        }
+        const id = sessionId ?? cookieStore.readSessionReference(cookies)?.id;
+        if (id) {
+            await options.sessionStore.delete(id);
+        }
+        cookieStore.clearSessionReference(cookies);
+    }
     async function getMetadata() {
         if (!metadataPromise) {
             metadataPromise = (async () => {
@@ -49,7 +88,7 @@ export function createOIDC(options) {
                 if (!metadata.jwks_uri) {
                     throw error(500, { message: 'OIDC jwks_uri is required to validate id_token values' });
                 }
-                return fromWeb(metadata.jwks_uri);
+                return fromWeb(metadata.jwks_uri, { overrideEndpointCheck: true });
             });
         }
         return jwksPromise;
@@ -198,12 +237,13 @@ export function createOIDC(options) {
         }
         return options.backChannelLogoutStore.isRevoked(session);
     }
-    async function maybeRefreshSession(event, session) {
+    async function maybeRefreshSession(event, persisted) {
+        const session = persisted?.session ?? null;
         if (!session) {
             return null;
         }
         if (await isRevoked(session)) {
-            cookieStore.clearSession(event.cookies);
+            await clearPersistedSession(event.cookies, persisted?.id);
             return null;
         }
         if (!shouldRefresh(session, refreshToleranceSeconds)) {
@@ -235,16 +275,16 @@ export function createOIDC(options) {
                     isRefresh: true
                 })
                 : nextSession;
-            cookieStore.writeSession(event.cookies, finalSession);
+            await writePersistedSession(event.cookies, finalSession, persisted?.id);
             return finalSession;
         }
         catch {
-            cookieStore.clearSession(event.cookies);
+            await clearPersistedSession(event.cookies, persisted?.id);
             return null;
         }
     }
     async function getSession(event) {
-        return maybeRefreshSession(event, cookieStore.readSession(event.cookies));
+        return maybeRefreshSession(event, await readPersistedSession(event.cookies));
     }
     async function signIn(event, loginOptions = {}) {
         const metadata = await getMetadata();
@@ -330,7 +370,7 @@ export function createOIDC(options) {
                 isRefresh: false
             })
             : session;
-        cookieStore.writeSession(event.cookies, finalSession);
+        await writePersistedSession(event.cookies, finalSession);
         return {
             session: finalSession,
             returnTo: stateCookie.returnTo
@@ -338,9 +378,10 @@ export function createOIDC(options) {
     }
     async function signOut(event, logoutOptions = {}) {
         const metadata = await getMetadata();
-        const session = cookieStore.readSession(event.cookies);
+        const persisted = await readPersistedSession(event.cookies);
+        const session = persisted?.session ?? null;
         cookieStore.clearState(event.cookies);
-        cookieStore.clearSession(event.cookies);
+        await clearPersistedSession(event.cookies, persisted?.id);
         if (logoutOptions.clearSessionOnly || !metadata.end_session_endpoint) {
             throw redirect(302, logoutOptions.postLogoutRedirectUri ??
                 options.defaultLogoutRedirect ??
@@ -386,8 +427,8 @@ export function createOIDC(options) {
         });
         return new Response(null, { status: 200 });
     }
-    function requireAuth(event, returnTo) {
-        const session = cookieStore.readSession(event.cookies);
+    async function requireAuth(event, returnTo) {
+        const session = await getSession(event);
         if (session) {
             return session;
         }
@@ -400,12 +441,13 @@ export function createOIDC(options) {
             session,
             user: session?.user,
             claims: session?.claims,
-            requireAuth: () => {
+            requireAuth: async () => {
                 if (!session) {
                     throw error(401, { message: 'Authentication required' });
                 }
+                return session;
             },
-            clearSession: () => cookieStore.clearSession(event.cookies)
+            clearSession: async () => clearPersistedSession(event.cookies)
         };
         return resolve(event);
     };
@@ -499,7 +541,7 @@ export function createOIDC(options) {
         backChannelLogoutHandler,
         createActions,
         requireAuth,
-        clearSession: cookieStore.clearSession
+        clearSession: async (cookies) => clearPersistedSession(cookies)
     };
 }
 export const OpenIDConnect = createOIDC;

package/dist/server/store.d.ts

@@ -1,2 +1,3 @@
-import type { OIDCBackChannelLogoutStore } from './types.js';
+import type { OIDCBackChannelLogoutStore, OIDCSessionStore } from './types.js';
 export declare function createInMemoryBackChannelLogoutStore(): OIDCBackChannelLogoutStore;
+export declare function createInMemorySessionStore(): OIDCSessionStore;

package/dist/server/store.js

@@ -16,3 +16,17 @@ export function createInMemoryBackChannelLogoutStore() {
         }
     };
 }
+export function createInMemorySessionStore() {
+    const sessions = new Map();
+    return {
+        async get(sessionId) {
+            return sessions.get(sessionId) ?? null;
+        },
+        async set(sessionId, session) {
+            sessions.set(sessionId, session);
+        },
+        async delete(sessionId) {
+            sessions.delete(sessionId);
+        }
+    };
+}

package/dist/server/types.d.ts

@@ -118,6 +118,11 @@ export type OIDCBackChannelLogoutStore = {
     revoke(record: OIDCBackChannelLogoutRecord): MaybePromise<void>;
     isRevoked(session: OIDCSession): MaybePromise<boolean>;
 };
+export type OIDCSessionStore = {
+    get(sessionId: string): MaybePromise<OIDCSession | null>;
+    set(sessionId: string, session: OIDCSession): MaybePromise<void>;
+    delete(sessionId: string): MaybePromise<void>;
+};
 export type OIDCSessionManagementConfig = {
     clientId: string;
     loginPath: string;
@@ -149,6 +154,7 @@ export type OIDCOptions = {
     refreshToleranceSeconds?: number;
     defaultLoginRedirect?: string;
     defaultLogoutRedirect?: string;
+    sessionStore?: OIDCSessionStore;
     backChannelLogoutStore?: OIDCBackChannelLogoutStore;
     transformClaims?: (claims: OIDCUserClaims) => MaybePromise<OIDCUserClaims>;
     transformUser?: (user: OIDCUserClaims | undefined, context: {
@@ -183,8 +189,8 @@ export type OIDCHandleLocals = {
     session: OIDCSession | null;
     user?: OIDCUserClaims;
     claims?: OIDCUserClaims;
-    requireAuth: () => void;
-    clearSession: () => void;
+    requireAuth: () => Promise<OIDCSession>;
+    clearSession: () => Promise<void>;
 };
 export type OIDCStateCookie = {
     state: string;
@@ -211,10 +217,21 @@ export type OIDCCookies = {
     readSession(cookies: Cookies): OIDCSession | null;
     writeSession(cookies: Cookies, session: OIDCSession): void;
     clearSession(cookies: Cookies): void;
+    readSessionReference(cookies: Cookies): {
+        id: string;
+    } | null;
+    writeSessionReference(cookies: Cookies, reference: {
+        id: string;
+    }): void;
+    clearSessionReference(cookies: Cookies): void;
     readState(cookies: Cookies): OIDCStateCookie | null;
     writeState(cookies: Cookies, state: OIDCStateCookie): void;
     clearState(cookies: Cookies): void;
 };
+export type OIDCPersistedSession = {
+    id?: string;
+    session: OIDCSession;
+};
 export type OIDCInstance = {
     handle: Handle;
     getMetadata: () => Promise<OIDCDiscoveryDocument>;
@@ -233,6 +250,6 @@ export type OIDCInstance = {
         login: Action;
         logout: Action;
     }>;
-    requireAuth: (event: RequestEvent, returnTo?: string) => OIDCSession;
-    clearSession: (cookies: Cookies) => void;
+    requireAuth: (event: RequestEvent, returnTo?: string) => Promise<OIDCSession>;
+    clearSession: (cookies: Cookies) => Promise<void>;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sourceregistry/sveltekit-oidc",
-  "version": "1.0.3",
+  "version": "1.1.0",
   "description": "OIDC authentication helpers for SvelteKit applications.",
   "license": "Apache-2.0",
   "scripts": {