@sourceregistry/sveltekit-oidc 1.0.4 → 1.1.1

package/README.md

@@ -33,6 +33,7 @@ export const oidc = createOIDC({
 	loginPath: '/auth/login',
 	redirectPath: '/auth/callback',
 	scope: ['openid', 'profile', 'email', 'offline_access'],
+	clockSkewSeconds: 30,
 	fetchUserInfo: true,
 	backChannelLogoutStore: createInMemoryBackChannelLogoutStore(),
 	transformSession(session) {
@@ -175,6 +176,7 @@ Set these environment variables to enable it:
 ## Notes
 
 - `cookieSecret` should be a strong random secret and must stay stable across instances.
+- `clockSkewSeconds` defaults to `30` and tolerates small clock drift between your app and the identity provider.
 - `createInMemoryBackChannelLogoutStore()` is suitable for local development or single-instance deployments. Use Redis, SQL, or another shared store for production.
 - The library validates `id_token` and `logout_token` values through `@sourceregistry/node-jwt` and provider JWKS metadata.
 - `groups` are normalized onto the session from `groups` and `roles` claims when present.

package/dist/server/cookies.js

@@ -10,6 +10,15 @@ export function createOIDCCookieStore(cookieSecret, sessionCookieName, stateCook
         clearSession(cookies) {
             cookies.delete(sessionCookieName, cookieOptions);
         },
+        readSessionReference(cookies) {
+            return parseSignedCookie(cookies.get(sessionCookieName), cookieSecret);
+        },
+        writeSessionReference(cookies, reference) {
+            cookies.set(sessionCookieName, serializeSignedCookie(reference, cookieSecret), cookieOptions);
+        },
+        clearSessionReference(cookies) {
+            cookies.delete(sessionCookieName, cookieOptions);
+        },
         readState(cookies) {
             return parseSignedCookie(cookies.get(stateCookieName), cookieSecret);
         },

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
 import type { OIDCOptions, OIDCInstance } from './types.js';
 export type * from './types.js';
-export { createInMemoryBackChannelLogoutStore } from './store.js';
+export { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
 export declare function createOIDC(options: OIDCOptions): OIDCInstance;
 export declare const OpenIDConnect: typeof createOIDC;

package/dist/server/index.js

@@ -5,9 +5,10 @@ import { createOIDCCookieStore } from './cookies.js';
 import { asAuthorizationHeader, createClientSecretJwtAssertion, createPrivateKeyJwtAssertion, fetchJson } from './jwt.js';
 import { normalizeTokens, shouldRefresh } from './session.js';
 import { absoluteUrl, base64UrlEncode, buildCookieOptions, collectGroups, createPKCEPair, normalizeIssuer, normalizeScope, parseProviderError, toPublicSession } from './utils.js';
-export { createInMemoryBackChannelLogoutStore } from './store.js';
+export { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
 export function createOIDC(options) {
     const cookieOptions = buildCookieOptions(options.cookieOptions);
+    const clockSkewSeconds = options.clockSkewSeconds ?? 30;
     const refreshToleranceSeconds = options.refreshToleranceSeconds ?? 30;
     const sessionCookieName = options.sessionCookieName ?? 'oidc_session';
     const stateCookieName = options.stateCookieName ?? 'oidc_auth_state';
@@ -18,6 +19,45 @@ export function createOIDC(options) {
     const cookieStore = createOIDCCookieStore(options.cookieSecret, sessionCookieName, stateCookieName, cookieOptions);
     let metadataPromise;
     let jwksPromise;
+    async function readPersistedSession(cookies) {
+        if (!options.sessionStore) {
+            const session = cookieStore.readSession(cookies);
+            return session ? { session } : null;
+        }
+        const reference = cookieStore.readSessionReference(cookies);
+        if (!reference?.id) {
+            return null;
+        }
+        const session = await options.sessionStore.get(reference.id);
+        if (!session) {
+            cookieStore.clearSessionReference(cookies);
+            return null;
+        }
+        return {
+            id: reference.id,
+            session
+        };
+    }
+    async function writePersistedSession(cookies, session, sessionId) {
+        if (!options.sessionStore) {
+            cookieStore.writeSession(cookies, session);
+            return;
+        }
+        const id = sessionId ?? base64UrlEncode(randomBytes(24));
+        await options.sessionStore.set(id, session);
+        cookieStore.writeSessionReference(cookies, { id });
+    }
+    async function clearPersistedSession(cookies, sessionId) {
+        if (!options.sessionStore) {
+            cookieStore.clearSession(cookies);
+            return;
+        }
+        const id = sessionId ?? cookieStore.readSessionReference(cookies)?.id;
+        if (id) {
+            await options.sessionStore.delete(id);
+        }
+        cookieStore.clearSessionReference(cookies);
+    }
     async function getMetadata() {
         if (!metadataPromise) {
             metadataPromise = (async () => {
@@ -156,7 +196,8 @@ export function createOIDC(options) {
         const claims = await verifyJwtWithJwks(idToken, {
             issuer: metadata.issuer,
             audience: options.clientId,
-            algorithms: metadata.id_token_signing_alg_values_supported
+            algorithms: metadata.id_token_signing_alg_values_supported,
+            clockSkew: clockSkewSeconds
         });
         const transformedClaims = options.transformClaims ? await options.transformClaims(claims) : claims;
         if (transformedClaims.nonce !== nonce) {
@@ -168,7 +209,8 @@ export function createOIDC(options) {
         const metadata = await getMetadata();
         const claims = await verifyJwtWithJwks(logoutToken, {
             issuer: metadata.issuer,
-            audience: options.clientId
+            audience: options.clientId,
+            clockSkew: clockSkewSeconds
         });
         if (!claims.events?.['http://schemas.openid.net/event/backchannel-logout']) {
             throw error(400, { message: 'Invalid logout_token events claim' });
@@ -198,12 +240,13 @@ export function createOIDC(options) {
         }
         return options.backChannelLogoutStore.isRevoked(session);
     }
-    async function maybeRefreshSession(event, session) {
+    async function maybeRefreshSession(event, persisted) {
+        const session = persisted?.session ?? null;
         if (!session) {
             return null;
         }
         if (await isRevoked(session)) {
-            cookieStore.clearSession(event.cookies);
+            await clearPersistedSession(event.cookies, persisted?.id);
             return null;
         }
         if (!shouldRefresh(session, refreshToleranceSeconds)) {
@@ -235,16 +278,16 @@ export function createOIDC(options) {
                     isRefresh: true
                 })
                 : nextSession;
-            cookieStore.writeSession(event.cookies, finalSession);
+            await writePersistedSession(event.cookies, finalSession, persisted?.id);
             return finalSession;
         }
         catch {
-            cookieStore.clearSession(event.cookies);
+            await clearPersistedSession(event.cookies, persisted?.id);
             return null;
         }
     }
     async function getSession(event) {
-        return maybeRefreshSession(event, cookieStore.readSession(event.cookies));
+        return maybeRefreshSession(event, await readPersistedSession(event.cookies));
     }
     async function signIn(event, loginOptions = {}) {
         const metadata = await getMetadata();
@@ -330,7 +373,7 @@ export function createOIDC(options) {
                 isRefresh: false
             })
             : session;
-        cookieStore.writeSession(event.cookies, finalSession);
+        await writePersistedSession(event.cookies, finalSession);
         return {
             session: finalSession,
             returnTo: stateCookie.returnTo
@@ -338,9 +381,10 @@ export function createOIDC(options) {
     }
     async function signOut(event, logoutOptions = {}) {
         const metadata = await getMetadata();
-        const session = cookieStore.readSession(event.cookies);
+        const persisted = await readPersistedSession(event.cookies);
+        const session = persisted?.session ?? null;
         cookieStore.clearState(event.cookies);
-        cookieStore.clearSession(event.cookies);
+        await clearPersistedSession(event.cookies, persisted?.id);
         if (logoutOptions.clearSessionOnly || !metadata.end_session_endpoint) {
             throw redirect(302, logoutOptions.postLogoutRedirectUri ??
                 options.defaultLogoutRedirect ??
@@ -386,8 +430,8 @@ export function createOIDC(options) {
         });
         return new Response(null, { status: 200 });
     }
-    function requireAuth(event, returnTo) {
-        const session = cookieStore.readSession(event.cookies);
+    async function requireAuth(event, returnTo) {
+        const session = await getSession(event);
         if (session) {
             return session;
         }
@@ -400,12 +444,13 @@ export function createOIDC(options) {
             session,
             user: session?.user,
             claims: session?.claims,
-            requireAuth: () => {
+            requireAuth: async () => {
                 if (!session) {
                     throw error(401, { message: 'Authentication required' });
                 }
+                return session;
             },
-            clearSession: () => cookieStore.clearSession(event.cookies)
+            clearSession: async () => clearPersistedSession(event.cookies)
         };
         return resolve(event);
     };
@@ -499,7 +544,7 @@ export function createOIDC(options) {
         backChannelLogoutHandler,
         createActions,
         requireAuth,
-        clearSession: cookieStore.clearSession
+        clearSession: async (cookies) => clearPersistedSession(cookies)
     };
 }
 export const OpenIDConnect = createOIDC;

package/dist/server/store.d.ts

@@ -1,2 +1,3 @@
-import type { OIDCBackChannelLogoutStore } from './types.js';
+import type { OIDCBackChannelLogoutStore, OIDCSessionStore } from './types.js';
 export declare function createInMemoryBackChannelLogoutStore(): OIDCBackChannelLogoutStore;
+export declare function createInMemorySessionStore(): OIDCSessionStore;

package/dist/server/store.js

@@ -16,3 +16,17 @@ export function createInMemoryBackChannelLogoutStore() {
         }
     };
 }
+export function createInMemorySessionStore() {
+    const sessions = new Map();
+    return {
+        async get(sessionId) {
+            return sessions.get(sessionId) ?? null;
+        },
+        async set(sessionId, session) {
+            sessions.set(sessionId, session);
+        },
+        async delete(sessionId) {
+            sessions.delete(sessionId);
+        }
+    };
+}

package/dist/server/types.d.ts

@@ -118,6 +118,11 @@ export type OIDCBackChannelLogoutStore = {
     revoke(record: OIDCBackChannelLogoutRecord): MaybePromise<void>;
     isRevoked(session: OIDCSession): MaybePromise<boolean>;
 };
+export type OIDCSessionStore = {
+    get(sessionId: string): MaybePromise<OIDCSession | null>;
+    set(sessionId: string, session: OIDCSession): MaybePromise<void>;
+    delete(sessionId: string): MaybePromise<void>;
+};
 export type OIDCSessionManagementConfig = {
     clientId: string;
     loginPath: string;
@@ -146,9 +151,11 @@ export type OIDCOptions = {
     stateCookieName?: string;
     cookieSecret: string;
     cookieOptions?: Partial<CookieOptions>;
+    clockSkewSeconds?: number;
     refreshToleranceSeconds?: number;
     defaultLoginRedirect?: string;
     defaultLogoutRedirect?: string;
+    sessionStore?: OIDCSessionStore;
     backChannelLogoutStore?: OIDCBackChannelLogoutStore;
     transformClaims?: (claims: OIDCUserClaims) => MaybePromise<OIDCUserClaims>;
     transformUser?: (user: OIDCUserClaims | undefined, context: {
@@ -183,8 +190,8 @@ export type OIDCHandleLocals = {
     session: OIDCSession | null;
     user?: OIDCUserClaims;
     claims?: OIDCUserClaims;
-    requireAuth: () => void;
-    clearSession: () => void;
+    requireAuth: () => Promise<OIDCSession>;
+    clearSession: () => Promise<void>;
 };
 export type OIDCStateCookie = {
     state: string;
@@ -211,10 +218,21 @@ export type OIDCCookies = {
     readSession(cookies: Cookies): OIDCSession | null;
     writeSession(cookies: Cookies, session: OIDCSession): void;
     clearSession(cookies: Cookies): void;
+    readSessionReference(cookies: Cookies): {
+        id: string;
+    } | null;
+    writeSessionReference(cookies: Cookies, reference: {
+        id: string;
+    }): void;
+    clearSessionReference(cookies: Cookies): void;
     readState(cookies: Cookies): OIDCStateCookie | null;
     writeState(cookies: Cookies, state: OIDCStateCookie): void;
     clearState(cookies: Cookies): void;
 };
+export type OIDCPersistedSession = {
+    id?: string;
+    session: OIDCSession;
+};
 export type OIDCInstance = {
     handle: Handle;
     getMetadata: () => Promise<OIDCDiscoveryDocument>;
@@ -233,6 +251,6 @@ export type OIDCInstance = {
         login: Action;
         logout: Action;
     }>;
-    requireAuth: (event: RequestEvent, returnTo?: string) => OIDCSession;
-    clearSession: (cookies: Cookies) => void;
+    requireAuth: (event: RequestEvent, returnTo?: string) => Promise<OIDCSession>;
+    clearSession: (cookies: Cookies) => Promise<void>;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sourceregistry/sveltekit-oidc",
-  "version": "1.0.4",
+  "version": "1.1.1",
   "description": "OIDC authentication helpers for SvelteKit applications.",
   "license": "Apache-2.0",
   "scripts": {