@sourceregistry/sveltekit-oidc 1.0.3

package/dist/server/types.d.ts

@@ -0,0 +1,238 @@
+import type { Action, Cookies, Handle, RequestEvent, RequestHandler } from '@sveltejs/kit';
+import type { KeyObject } from 'node:crypto';
+export type MaybePromise<T> = Promise<T> | T;
+export type SupportedAlgorithm = 'HS256' | 'HS384' | 'HS512' | 'RS256' | 'RS384' | 'RS512' | 'ES256' | 'ES384' | 'ES512' | 'ES256K' | 'PS256' | 'PS384' | 'PS512' | 'EdDSA';
+export type OIDCDiscoveryDocument = {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint?: string;
+    end_session_endpoint?: string;
+    revocation_endpoint?: string;
+    check_session_iframe?: string;
+    backchannel_logout_supported?: boolean;
+    backchannel_logout_session_supported?: boolean;
+    jwks_uri: string;
+    response_types_supported?: string[];
+    subject_types_supported?: string[];
+    id_token_signing_alg_values_supported?: string[];
+    scopes_supported?: string[];
+    token_endpoint_auth_methods_supported?: string[];
+    token_endpoint_auth_signing_alg_values_supported?: string[];
+    claims_supported?: string[];
+    code_challenge_methods_supported?: string[];
+    grant_types_supported?: string[];
+};
+export type OIDCTokenResponse = {
+    access_token: string;
+    token_type: string;
+    expires_in?: number;
+    refresh_token?: string;
+    scope?: string;
+    id_token?: string;
+    refresh_expires_in?: number;
+    session_state?: string;
+};
+export type OIDCSessionTokens = {
+    accessToken: string;
+    tokenType: string;
+    idToken?: string;
+    refreshToken?: string;
+    scope: string[];
+    expiresAt?: number;
+    refreshExpiresAt?: number;
+};
+export type OIDCUserClaims = Record<string, unknown> & {
+    sub: string;
+    email?: string;
+    name?: string;
+    preferred_username?: string;
+    picture?: string;
+    groups?: string[];
+    sid?: string;
+    iss?: string;
+    aud?: string | string[];
+    exp?: number;
+    nbf?: number;
+    nonce?: string;
+};
+export type OIDCSession = {
+    issuer: string;
+    clientId: string;
+    nonce?: string;
+    sub?: string;
+    sid?: string;
+    sessionState?: string;
+    groups: string[];
+    user?: OIDCUserClaims;
+    claims?: OIDCUserClaims;
+    tokens: OIDCSessionTokens;
+    createdAt: number;
+    refreshedAt: number;
+};
+export type OIDCPublicSession = {
+    isAuthenticated: boolean;
+    user?: OIDCUserClaims;
+    claims?: OIDCUserClaims;
+    groups: string[];
+    scope: string[];
+    expiresAt?: number;
+    issuer?: string;
+    sessionState?: string;
+    sid?: string;
+    sub?: string;
+};
+export type OIDCBackChannelLogoutClaims = Record<string, unknown> & {
+    iss: string;
+    aud: string | string[];
+    iat: number;
+    jti: string;
+    sub?: string;
+    sid?: string;
+    events: {
+        'http://schemas.openid.net/event/backchannel-logout': Record<string, never>;
+    };
+    nonce?: never;
+};
+export type OIDCClientAuthMethod = 'client_secret_basic' | 'client_secret_post' | 'client_secret_jwt' | 'private_key_jwt' | 'none';
+export type CookieOptions = NonNullable<Parameters<Cookies['set']>[2]>;
+export type OIDCClientSecretJwtOptions = {
+    algorithm?: 'HS256' | 'HS384' | 'HS512';
+    expiresInSeconds?: number;
+};
+export type OIDCPrivateKeyJwtOptions = {
+    privateKey: string | KeyObject;
+    algorithm?: 'RS256' | 'RS384' | 'RS512';
+    keyId?: string;
+    expiresInSeconds?: number;
+};
+export type OIDCBackChannelLogoutRecord = {
+    issuer: string;
+    clientId: string;
+    sid?: string;
+    sub?: string;
+    jti: string;
+    iat: number;
+};
+export type OIDCBackChannelLogoutStore = {
+    revoke(record: OIDCBackChannelLogoutRecord): MaybePromise<void>;
+    isRevoked(session: OIDCSession): MaybePromise<boolean>;
+};
+export type OIDCSessionManagementConfig = {
+    clientId: string;
+    loginPath: string;
+    redirectPath: string;
+    metadata: Pick<OIDCDiscoveryDocument, 'issuer' | 'check_session_iframe' | 'end_session_endpoint' | 'backchannel_logout_supported' | 'backchannel_logout_session_supported'>;
+    checkSessionIframe?: string;
+    supportsSessionIframe: boolean;
+    backChannelLogoutSupported: boolean;
+    backChannelLogoutSessionSupported: boolean;
+};
+export type OIDCOptions = {
+    issuer?: string;
+    discoveryUrl?: string;
+    clientId: string;
+    clientSecret?: string;
+    clientAuthMethod?: OIDCClientAuthMethod;
+    clientSecretJwt?: OIDCClientSecretJwtOptions;
+    privateKeyJwt?: OIDCPrivateKeyJwtOptions;
+    loginPath?: string;
+    redirectPath?: string;
+    postLogoutRedirectUri?: string;
+    scope?: string[];
+    audience?: string;
+    fetchUserInfo?: boolean;
+    sessionCookieName?: string;
+    stateCookieName?: string;
+    cookieSecret: string;
+    cookieOptions?: Partial<CookieOptions>;
+    refreshToleranceSeconds?: number;
+    defaultLoginRedirect?: string;
+    defaultLogoutRedirect?: string;
+    backChannelLogoutStore?: OIDCBackChannelLogoutStore;
+    transformClaims?: (claims: OIDCUserClaims) => MaybePromise<OIDCUserClaims>;
+    transformUser?: (user: OIDCUserClaims | undefined, context: {
+        claims?: OIDCUserClaims;
+    }) => MaybePromise<OIDCUserClaims | undefined>;
+    transformSession?: (session: OIDCSession, context: {
+        event?: RequestEvent;
+        tokenResponse?: OIDCTokenResponse;
+        claims?: OIDCUserClaims;
+        user?: OIDCUserClaims;
+        isRefresh: boolean;
+    }) => MaybePromise<OIDCSession>;
+    endpoints?: Partial<OIDCDiscoveryDocument>;
+};
+export type OIDCLoginOptions = {
+    returnTo?: string;
+    prompt?: 'login' | 'consent' | 'none' | 'select_account';
+    scope?: string[];
+    extraParams?: Record<string, string>;
+};
+export type OIDCLogoutOptions = {
+    postLogoutRedirectUri?: string;
+    state?: string;
+    clearSessionOnly?: boolean;
+};
+export type OIDCCallbackResult = {
+    session: OIDCSession;
+    returnTo: string;
+};
+export type OIDCHandleLocals = {
+    isAuthenticated: boolean;
+    session: OIDCSession | null;
+    user?: OIDCUserClaims;
+    claims?: OIDCUserClaims;
+    requireAuth: () => void;
+    clearSession: () => void;
+};
+export type OIDCStateCookie = {
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    returnTo: string;
+    createdAt: number;
+};
+export type OIDCCallbackHandlerOptions = {
+    onsuccess?: (event: RequestEvent, result: OIDCCallbackResult) => MaybePromise<Response | void>;
+    onfailure?: (event: RequestEvent, err: unknown) => MaybePromise<Response | void>;
+    redirectTo?: string;
+};
+export type OIDCActionOptions = {
+    defaultReturnTo?: string;
+    defaultPostLogoutRedirectUri?: string;
+};
+export type OIDCClientAssertionOptions = {
+    tokenEndpoint: string;
+    clientId: string;
+    clientSecret?: string;
+};
+export type OIDCCookies = {
+    readSession(cookies: Cookies): OIDCSession | null;
+    writeSession(cookies: Cookies, session: OIDCSession): void;
+    clearSession(cookies: Cookies): void;
+    readState(cookies: Cookies): OIDCStateCookie | null;
+    writeState(cookies: Cookies, state: OIDCStateCookie): void;
+    clearState(cookies: Cookies): void;
+};
+export type OIDCInstance = {
+    handle: Handle;
+    getMetadata: () => Promise<OIDCDiscoveryDocument>;
+    getSession: (event: RequestEvent) => Promise<OIDCSession | null>;
+    getPublicSession: (event: RequestEvent) => Promise<OIDCPublicSession | null>;
+    getSessionManagementConfig: () => Promise<OIDCSessionManagementConfig>;
+    login: (event: RequestEvent, loginOptions?: OIDCLoginOptions) => Promise<never>;
+    logout: (event: RequestEvent, logoutOptions?: OIDCLogoutOptions) => Promise<never>;
+    handleCallback: (event: RequestEvent) => Promise<OIDCCallbackResult>;
+    handleBackChannelLogout: (event: RequestEvent) => Promise<Response>;
+    loginHandler: (defaults?: OIDCLoginOptions) => RequestHandler;
+    callbackHandler: (handlerOptions?: OIDCCallbackHandlerOptions) => RequestHandler;
+    logoutHandler: (defaults?: OIDCLogoutOptions) => RequestHandler;
+    backChannelLogoutHandler: () => RequestHandler;
+    createActions: (actionOptions?: OIDCActionOptions) => Readonly<{
+        login: Action;
+        logout: Action;
+    }>;
+    requireAuth: (event: RequestEvent, returnTo?: string) => OIDCSession;
+    clearSession: (cookies: Cookies) => void;
+};

package/dist/server/types.js

@@ -0,0 +1 @@
+export {};

package/dist/server/utils.d.ts

@@ -0,0 +1,19 @@
+import { type RequestEvent } from '@sveltejs/kit';
+import type { CookieOptions, OIDCPublicSession, OIDCSession, OIDCUserClaims } from './types.js';
+export declare function base64UrlEncode(value: string | Uint8Array): string;
+export declare function createPKCEPair(length?: number): {
+    verifier: string;
+    challenge: string;
+};
+export declare function normalizeIssuer(issuer: string): string;
+export declare function normalizeScope(scope?: string[]): string[];
+export declare function normalizeStringArray(value: unknown): string[];
+export declare function collectGroups(...sources: Array<OIDCUserClaims | undefined>): string[];
+export declare function createSignedValue(value: string, secret: string): string;
+export declare function verifySignedValue(value: string, secret: string): string | null;
+export declare function serializeSignedCookie(payload: unknown, secret: string): string;
+export declare function parseSignedCookie<T>(value: string | undefined, secret: string): T | null;
+export declare function buildCookieOptions(options?: Partial<CookieOptions>): CookieOptions;
+export declare function parseProviderError(event: RequestEvent): null;
+export declare function absoluteUrl(event: RequestEvent, pathOrUrl: string): string;
+export declare function toPublicSession(session: OIDCSession | null): OIDCPublicSession | null;

package/dist/server/utils.js

@@ -0,0 +1,104 @@
+import { error } from '@sveltejs/kit';
+import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
+export function base64UrlEncode(value) {
+    const buffer = typeof value === 'string' ? Buffer.from(value, 'utf8') : Buffer.from(value);
+    return buffer.toString('base64url');
+}
+export function createPKCEPair(length = 64) {
+    const verifier = base64UrlEncode(randomBytes(length)).slice(0, length);
+    const challenge = createHash('sha256').update(verifier).digest('base64url');
+    return { verifier, challenge };
+}
+export function normalizeIssuer(issuer) {
+    return issuer.endsWith('/') ? issuer.slice(0, -1) : issuer;
+}
+export function normalizeScope(scope) {
+    return scope?.length ? [...new Set(scope)] : ['openid', 'profile', 'email'];
+}
+export function normalizeStringArray(value) {
+    if (!value)
+        return [];
+    if (Array.isArray(value)) {
+        return value.filter((item) => typeof item === 'string');
+    }
+    if (typeof value === 'string') {
+        return value.trim() ? [value] : [];
+    }
+    return [];
+}
+export function collectGroups(...sources) {
+    return [
+        ...new Set(sources.flatMap((source) => normalizeStringArray(source?.groups).concat(normalizeStringArray(source?.roles))))
+    ];
+}
+export function createSignedValue(value, secret) {
+    const mac = createHmac('sha256', secret).update(value).digest('base64url');
+    return `${value}.${mac}`;
+}
+export function verifySignedValue(value, secret) {
+    const lastDot = value.lastIndexOf('.');
+    if (lastDot === -1)
+        return null;
+    const payload = value.slice(0, lastDot);
+    const signature = value.slice(lastDot + 1);
+    const expected = createHmac('sha256', secret).update(payload).digest();
+    const actual = Buffer.from(signature, 'base64url');
+    if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) {
+        return null;
+    }
+    return payload;
+}
+export function serializeSignedCookie(payload, secret) {
+    return createSignedValue(base64UrlEncode(JSON.stringify(payload)), secret);
+}
+export function parseSignedCookie(value, secret) {
+    if (!value)
+        return null;
+    const payload = verifySignedValue(value, secret);
+    if (!payload)
+        return null;
+    try {
+        return JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+export function buildCookieOptions(options) {
+    return {
+        httpOnly: true,
+        path: '/',
+        sameSite: 'lax',
+        secure: true,
+        ...options
+    };
+}
+export function parseProviderError(event) {
+    const code = event.url.searchParams.get('error');
+    if (!code)
+        return null;
+    return error(400, {
+        message: event.url.searchParams.get('error_description') ?? code
+    });
+}
+export function absoluteUrl(event, pathOrUrl) {
+    if (/^https?:\/\//i.test(pathOrUrl))
+        return pathOrUrl;
+    return new URL(pathOrUrl, event.url).toString();
+}
+export function toPublicSession(session) {
+    if (!session)
+        return null;
+    return {
+        isAuthenticated: true,
+        user: session.user,
+        claims: session.claims,
+        groups: session.groups,
+        scope: session.tokens.scope,
+        expiresAt: session.tokens.expiresAt,
+        issuer: session.issuer,
+        sessionState: session.sessionState,
+        sid: session.sid,
+        sub: session.sub
+    };
+}

package/package.json

@@ -0,0 +1,112 @@
+{
+  "name": "@sourceregistry/sveltekit-oidc",
+  "version": "1.0.3",
+  "description": "OIDC authentication helpers for SvelteKit applications.",
+  "license": "Apache-2.0",
+  "scripts": {
+    "dev": "vite dev",
+    "build": "vite build && npm run prepack",
+    "preview": "vite preview",
+    "prepare": "svelte-kit sync || echo ''",
+    "prepack": "svelte-kit sync && svelte-package && publint",
+    "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
+    "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
+    "test": "vitest run",
+    "docs:build": "typedoc --options typedoc.json"
+  },
+  "files": [
+    "dist",
+    "!dist/demo/**",
+    "!dist/**/*.test.*",
+    "!dist/**/*.spec.*"
+  ],
+  "sideEffects": [
+    "**/*.css"
+  ],
+  "author": "A.P.A. Slaa (a.p.a.slaa@projectsource.nl)",
+  "bugs": {
+    "url": "https://github.com/SourceRegistry/sveltekit-oidc/issues"
+  },
+  "homepage": "https://sourceregistry.github.io/sveltekit-oidc/",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SourceRegistry/sveltekit-oidc.git"
+  },
+  "svelte": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "svelte": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/client/index.d.ts",
+      "svelte": "./dist/client/index.js"
+    },
+    "./server": {
+      "types": "./dist/server/index.d.ts",
+      "default": "./dist/server/index.js"
+    }
+  },
+  "peerDependencies": {
+    "@sveltejs/kit": "^2.50.2",
+    "svelte": "^5.0.0"
+  },
+  "devDependencies": {
+    "@sveltejs/adapter-auto": "^7.0.0",
+    "@sveltejs/kit": "^2.50.2",
+    "@sveltejs/package": "^2.5.7",
+    "@sveltejs/vite-plugin-svelte": "^6.2.4",
+    "@types/node": "^25.5.2",
+    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/git": "^10.0.1",
+    "publint": "^0.3.17",
+    "svelte": "^5.54.0",
+    "svelte-check": "^4.4.2",
+    "typescript": "^5.9.3",
+    "vite": "^7.3.1",
+    "@vitest/coverage-v8": "^4.1.2",
+    "vitest": "^4.1.2",
+    "@sourceregistry/semantic-release-jsr": "^1.0.1",
+    "typedoc": "^0.28.18"
+  },
+  "keywords": [
+    "sveltekit",
+    "svelte",
+    "oidc",
+    "openid-connect",
+    "authentication",
+    "oauth"
+  ],
+  "dependencies": {
+    "@sourceregistry/node-jwt": "^1.5.9"
+  },
+  "release": {
+    "branches": [
+      "main"
+    ],
+    "plugins": [
+      "@semantic-release/commit-analyzer",
+      "@semantic-release/release-notes-generator",
+      "@semantic-release/changelog",
+      "@semantic-release/npm",
+      "@sourceregistry/semantic-release-jsr",
+      [
+        "@semantic-release/git",
+        {
+          "assets": [
+            "package.json",
+            "package-lock.json",
+            "jsr.json",
+            "CHANGELOG.md"
+          ],
+          "message": "sveltekit-oidc(release): v${nextRelease.version}\n\n${nextRelease.notes}"
+        }
+      ]
+    ]
+  }
+}