@sourceregistry/sveltekit-oidc 1.1.1 → 1.3.0

package/README.md

@@ -160,6 +160,127 @@ export async function load(event) {
 - periodic `invalidateAll()` revalidation so revoked server sessions are detected
 - a client context for nested auth-aware components through `useOIDC()` / `getOIDCContext()`
 
+## Typed Custom Claims
+
+`createOIDC` infers a `TClaims` type from whatever `transformClaims` / `transformUser` / `transformSession` return, and threads it through the session, `event.locals.oidc`, `OIDCPublicSession`, and the client context — no casts needed.
+
+```ts
+// src/lib/server/auth.ts
+export const oidc = createOIDC({
+	issuer: 'https://your-idp.example.com',
+	clientId: process.env.OIDC_CLIENT_ID!,
+	cookieSecret: process.env.OIDC_COOKIE_SECRET!,
+	transformClaims: (claims) => ({
+		...claims,
+		roles: (claims.roles as string[]) ?? [],
+		tenant: claims.tenant as string | undefined
+	})
+});
+```
+
+Extract the inferred type with `OIDCInferClaims` and apply it to `App.Locals` so `event.locals.oidc` is typed everywhere:
+
+```ts
+// src/app.d.ts
+import type { OIDCHandleLocals, OIDCInferClaims } from 'sveltekit-oidc/server';
+import { oidc } from '$lib/server/auth';
+
+export type AppClaims = OIDCInferClaims<typeof oidc>;
+
+declare global {
+	namespace App {
+		interface Locals {
+			oidc?: OIDCHandleLocals<AppClaims>;
+		}
+	}
+}
+
+export {};
+```
+
+Now `event.locals.oidc?.claims?.roles` is `string[]` and `?.tenant` is `string | undefined` in every hook, load function, and action.
+
+`OIDCContext` is a generic component, but Svelte doesn't support passing explicit type arguments in markup — `TClaims` is inferred from the `session` prop instead. Since `data.session` comes from `oidc.getPublicSession(event)`, it's already typed `OIDCPublicSession<AppClaims> | null`, so the inference flows through automatically:
+
+```html
+<!-- src/routes/+layout.svelte -->
+<script lang="ts">
+	import { OIDCContext } from 'sveltekit-oidc';
+	let { data, children } = $props();
+</script>
+
+<OIDCContext session={data.session} config={data.sessionManagement}>
+	{@render children()}
+</OIDCContext>
+```
+
+```html
+<!-- src/lib/Account.svelte -->
+<script lang="ts">
+	import { useOIDC } from 'sveltekit-oidc';
+	import type { AppClaims } from '../../app.d.ts';
+
+	const oidc = useOIDC<AppClaims>();
+</script>
+
+{#if oidc.isAuthenticated}
+	<p>Roles: {oidc.claims?.roles.join(', ')}</p>
+{/if}
+```
+
+If `transformClaims` (and friends) are omitted, `TClaims` defaults to `OIDCUserClaims` — existing setups keep working unchanged.
+
+## Typed Custom Session
+
+Backend apps commonly stash application-specific data on the session itself (e.g. `tenantId`, `permissions`) — not just inside `claims`/`user`. A second generic, `TSession`, is inferred from `transformSession`'s return type and threads through the session store, cookies, `event.locals.oidc`, and `handleCallback`'s result — again with no casts:
+
+```ts
+// src/lib/server/auth.ts
+import { createOIDC, type OIDCSession } from 'sveltekit-oidc/server';
+
+type AppSession = OIDCSession<AppClaims> & {
+	tenantId: string;
+	permissions: string[];
+};
+
+export const oidc = createOIDC({
+	issuer: 'https://your-idp.example.com',
+	clientId: process.env.OIDC_CLIENT_ID!,
+	cookieSecret: process.env.OIDC_COOKIE_SECRET!,
+	transformClaims: (claims) => ({ ...claims, tenant: claims.tenant as string | undefined }),
+	transformSession: (session): AppSession => ({
+		...session,
+		tenantId: session.claims?.tenant ?? 'default',
+		permissions: session.user?.roles ?? []
+	})
+});
+```
+
+Extract the inferred type with `OIDCInferSession` and apply it alongside `OIDCInferClaims`:
+
+```ts
+// src/app.d.ts
+import type { OIDCHandleLocals, OIDCInferClaims, OIDCInferSession } from 'sveltekit-oidc/server';
+import { oidc } from '$lib/server/auth';
+
+export type AppClaims = OIDCInferClaims<typeof oidc>;
+export type AppSession = OIDCInferSession<typeof oidc>;
+
+declare global {
+	namespace App {
+		interface Locals {
+			oidc?: OIDCHandleLocals<AppClaims, AppSession>;
+		}
+	}
+}
+
+export {};
+```
+
+Now `event.locals.oidc?.session?.tenantId` is `string` and `?.permissions` is `string[]` everywhere — and `oidc.requireAuth(event)` / `handleCallback`'s `onsuccess` resolve to `AppSession` directly.
+
+If `transformSession` is omitted, `TSession` defaults to `OIDCSession<TClaims>` — existing setups keep working unchanged.
+
 ## Example App
 
 This repository now includes a runnable example under [src/routes](C:/Users/alexa/WebstormProjects/github.com/SourceRegistry/sveltekit-oidc/src/routes) and [src/hooks.server.ts](C:/Users/alexa/WebstormProjects/github.com/SourceRegistry/sveltekit-oidc/src/hooks.server.ts).
@@ -183,4 +304,4 @@ Set these environment variables to enable it:
 - Use `transformClaims`, `transformUser`, and `transformSession` to project provider-specific claims into your own session shape.
 - `check_session_iframe` monitoring only runs when the provider advertises that endpoint and the session includes `session_state`.
 - Refresh token handling is automatic when a valid refresh token is present.
-- `event.locals.oidc` is attached by the hook, but you should add your own `app.d.ts` augmentation in the consuming app for full typing.
+- `event.locals.oidc` is attached by the hook and typed via `OIDCHandleLocals<TClaims>`; see [Typed Custom Claims](#typed-custom-claims) for wiring your own claim shapes through `app.d.ts`.

package/dist/client/OIDCContext.svelte

@@ -1,208 +1,214 @@
-<script lang="ts">
-	import { goto, invalidateAll } from '$app/navigation';
-	import type { Snippet } from 'svelte';
-
-	import { setOIDCContext } from './context.js';
-	import type { OIDCPublicSession, OIDCSessionManagementConfig } from '../server/index.js';
-
-	type RedirectMode = 'login' | 'logout' | 'reload' | 'none';
-
-	let {
-		session = null,
-		config,
-		loginPath,
-		logoutPath = '/auth/logout',
-		checkSessionIntervalMs = 5000,
-		revalidateIntervalMs = 30000,
-		redirectOnExpired = 'login',
-		redirectOnRevoked = 'login',
-		redirectIfUnauthenticated = false,
-		children
-	}: {
-		session?: OIDCPublicSession | null;
-		config: OIDCSessionManagementConfig;
-		loginPath?: string;
-		logoutPath?: string;
-		checkSessionIntervalMs?: number;
-		revalidateIntervalMs?: number;
-		redirectOnExpired?: RedirectMode;
-		redirectOnRevoked?: RedirectMode;
-		redirectIfUnauthenticated?: boolean;
-		children?: Snippet;
-	} = $props();
-
-	let iframe = $state<HTMLIFrameElement | undefined>(undefined);
-	let status = $state<'authenticated' | 'unauthenticated' | 'expired' | 'revoked'>('unauthenticated');
-	let handledUnauthenticated = $state(false);
-
-	const metadata = $derived(config.metadata);
-	const resolvedLoginPath = $derived(loginPath ?? config.loginPath ?? '/auth/login');
-	const iframeUrl = $derived(
-		config.metadata.check_session_iframe ?? config.checkSessionIframe ?? undefined
-	);
-	const canMonitorIframe = $derived(
-		Boolean(session?.isAuthenticated && session?.sessionState && iframeUrl)
-	);
-
-	const context = setOIDCContext({
-		get isAuthenticated() {
-			return Boolean(session?.isAuthenticated);
-		},
-		get session() {
-			return session;
-		},
-		get user() {
-			return session?.user;
-		},
-		get claims() {
-			return session?.claims;
-		},
-		get groups() {
-			return session?.groups ?? [];
-		},
-		get metadata() {
-			return metadata;
-		},
-		get status() {
-			return status;
-		},
-		login: (returnTo?: string) => login(returnTo),
-		logout,
-		revalidate
-	});
-
-	void context;
-
-	function buildLoginUrl(returnTo = `${window.location.pathname}${window.location.search}`) {
-		return `${resolvedLoginPath}?returnTo=${encodeURIComponent(returnTo)}`;
-	}
-
-	async function logout(clearSessionOnly = false) {
-		const body = new URLSearchParams();
-		if (clearSessionOnly) {
-			body.set('clearSessionOnly', '1');
-		}
-
-		await fetch(logoutPath, {
-			method: 'POST',
-			headers: {
-				'content-type': 'application/x-www-form-urlencoded'
-			},
-			body
-		});
-	}
-
-	function login(returnTo?: string) {
-		void goto(buildLoginUrl(returnTo), { invalidateAll: false });
-	}
-
-	async function revalidate() {
-		await invalidateAll();
-	}
-
-	async function handleRedirect(mode: RedirectMode) {
-		if (mode === 'none') {
-			return;
-		}
-		if (mode === 'reload') {
-			window.location.reload();
-			return;
-		}
-		if (mode === 'logout') {
-			await logout(true);
-			window.location.reload();
-			return;
-		}
-
-		login();
-	}
-
-	$effect(() => {
-		const isAuthenticated = Boolean(session?.isAuthenticated);
-		status = isAuthenticated ? 'authenticated' : status === 'authenticated' ? 'unauthenticated' : status;
-	});
-
-	$effect(() => {
-		if (!session?.isAuthenticated || !session.expiresAt) {
-			return;
-		}
-
-		const timeoutMs = Math.max(0, session.expiresAt * 1000 - Date.now());
-		const timer = window.setTimeout(() => {
-			status = 'expired';
-			void handleRedirect(redirectOnExpired);
-		}, timeoutMs);
-
-		return () => window.clearTimeout(timer);
-	});
-
-	$effect(() => {
-		if (!session?.isAuthenticated || !revalidateIntervalMs) {
-			return;
-		}
-
-		const timer = window.setInterval(() => {
-			void revalidate();
-		}, revalidateIntervalMs);
-
-		return () => window.clearInterval(timer);
-	});
-
-	$effect(() => {
-		if (session?.isAuthenticated) {
-			handledUnauthenticated = false;
-			return;
-		}
-		if (!redirectIfUnauthenticated || handledUnauthenticated) {
-			return;
-		}
-
-		handledUnauthenticated = true;
-		status = status === 'expired' || status === 'revoked' ? status : 'unauthenticated';
-		void handleRedirect(status === 'revoked' ? redirectOnRevoked : redirectOnExpired);
-	});
-
-	$effect(() => {
-		if (!canMonitorIframe || !iframeUrl || !iframe) {
-			return;
-		}
-
-		const targetOrigin = new URL(iframeUrl).origin;
-		const poll = window.setInterval(() => {
-			if (!iframe?.contentWindow || !session?.sessionState) {
-				return;
-			}
-
-			iframe.contentWindow.postMessage(`${config.clientId} ${session.sessionState}`, targetOrigin);
-		}, checkSessionIntervalMs);
-
-		const onMessage = (event: MessageEvent) => {
-			if (event.origin !== targetOrigin || typeof event.data !== 'string') {
-				return;
-			}
-			if (event.data === 'changed' || event.data === 'error') {
-				status = 'revoked';
-				void logout(true).then(() => handleRedirect(redirectOnRevoked));
-			}
-		};
-
-		window.addEventListener('message', onMessage);
-
-		return () => {
-			window.clearInterval(poll);
-			window.removeEventListener('message', onMessage);
-		};
-	});
+<script lang="ts" module>
+    import type {
+        OIDCPublicSession,
+        OIDCSessionManagementConfig, OIDCUserClaims
+    } from '../server/index.js';
+</script>
+
+<script lang="ts" generics="TClaims extends OIDCUserClaims = OIDCUserClaims">
+    import {goto, invalidateAll} from '$app/navigation';
+    import type {Snippet} from 'svelte';
+
+    import {setOIDCContext} from './context.js';
+
+    type RedirectMode = 'login' | 'logout' | 'reload' | 'none';
+
+    let {
+        session = null,
+        config,
+        loginPath,
+        logoutPath = '/auth/logout',
+        checkSessionIntervalMs = 5000,
+        revalidateIntervalMs = 30000,
+        redirectOnExpired = 'login',
+        redirectOnRevoked = 'login',
+        redirectIfUnauthenticated = false,
+        children
+    }: {
+        session?: OIDCPublicSession<TClaims> | null;
+        config: OIDCSessionManagementConfig;
+        loginPath?: string;
+        logoutPath?: string;
+        checkSessionIntervalMs?: number;
+        revalidateIntervalMs?: number;
+        redirectOnExpired?: RedirectMode;
+        redirectOnRevoked?: RedirectMode;
+        redirectIfUnauthenticated?: boolean;
+        children?: Snippet;
+    } = $props();
+
+    let iframe = $state<HTMLIFrameElement | undefined>(undefined);
+    let status = $state<'authenticated' | 'unauthenticated' | 'expired' | 'revoked'>('unauthenticated');
+    let handledUnauthenticated = $state(false);
+
+    const metadata = $derived(config.metadata);
+    const resolvedLoginPath = $derived(loginPath ?? config.loginPath ?? '/auth/login');
+    const iframeUrl = $derived(
+        config.metadata.check_session_iframe ?? config.checkSessionIframe ?? undefined
+    );
+    const canMonitorIframe = $derived(
+        Boolean(session?.isAuthenticated && session?.sessionState && iframeUrl)
+    );
+
+    const context = setOIDCContext<TClaims>({
+        get isAuthenticated() {
+            return Boolean(session?.isAuthenticated);
+        },
+        get session() {
+            return session;
+        },
+        get user() {
+            return session?.user;
+        },
+        get claims() {
+            return session?.claims;
+        },
+        get groups() {
+            return session?.groups ?? [];
+        },
+        get metadata() {
+            return metadata;
+        },
+        get status() {
+            return status;
+        },
+        login: (returnTo?: string) => login(returnTo),
+        logout,
+        revalidate
+    });
+
+    void context;
+
+    function buildLoginUrl(returnTo = `${window.location.pathname}${window.location.search}`) {
+        return `${resolvedLoginPath}?returnTo=${encodeURIComponent(returnTo)}`;
+    }
+
+    async function logout(clearSessionOnly = false) {
+        const body = new URLSearchParams();
+        if (clearSessionOnly) {
+            body.set('clearSessionOnly', '1');
+        }
+
+        await fetch(logoutPath, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/x-www-form-urlencoded'
+            },
+            body
+        });
+    }
+
+    function login(returnTo?: string) {
+        void goto(buildLoginUrl(returnTo), {invalidateAll: false});
+    }
+
+    async function revalidate() {
+        await invalidateAll();
+    }
+
+    async function handleRedirect(mode: RedirectMode) {
+        if (mode === 'none') {
+            return;
+        }
+        if (mode === 'reload') {
+            window.location.reload();
+            return;
+        }
+        if (mode === 'logout') {
+            await logout(true);
+            window.location.reload();
+            return;
+        }
+
+        login();
+    }
+
+    $effect(() => {
+        const isAuthenticated = Boolean(session?.isAuthenticated);
+        status = isAuthenticated ? 'authenticated' : status === 'authenticated' ? 'unauthenticated' : status;
+    });
+
+    $effect(() => {
+        if (!session?.isAuthenticated || !session.expiresAt) {
+            return;
+        }
+
+        const timeoutMs = Math.max(0, session.expiresAt * 1000 - Date.now());
+        const timer = window.setTimeout(() => {
+            status = 'expired';
+            void handleRedirect(redirectOnExpired);
+        }, timeoutMs);
+
+        return () => window.clearTimeout(timer);
+    });
+
+    $effect(() => {
+        if (!session?.isAuthenticated || !revalidateIntervalMs) {
+            return;
+        }
+
+        const timer = window.setInterval(() => {
+            void revalidate();
+        }, revalidateIntervalMs);
+
+        return () => window.clearInterval(timer);
+    });
+
+    $effect(() => {
+        if (session?.isAuthenticated) {
+            handledUnauthenticated = false;
+            return;
+        }
+        if (!redirectIfUnauthenticated || handledUnauthenticated) {
+            return;
+        }
+
+        handledUnauthenticated = true;
+        status = status === 'expired' || status === 'revoked' ? status : 'unauthenticated';
+        void handleRedirect(status === 'revoked' ? redirectOnRevoked : redirectOnExpired);
+    });
+
+    $effect(() => {
+        if (!canMonitorIframe || !iframeUrl || !iframe) {
+            return;
+        }
+
+        const targetOrigin = new URL(iframeUrl).origin;
+        const poll = window.setInterval(() => {
+            if (!iframe?.contentWindow || !session?.sessionState) {
+                return;
+            }
+
+            iframe.contentWindow.postMessage(`${config.clientId} ${session.sessionState}`, targetOrigin);
+        }, checkSessionIntervalMs);
+
+        const onMessage = (event: MessageEvent) => {
+            if (event.origin !== targetOrigin || typeof event.data !== 'string') {
+                return;
+            }
+            if (event.data === 'changed' || event.data === 'error') {
+                status = 'revoked';
+                void logout(true).then(() => handleRedirect(redirectOnRevoked));
+            }
+        };
+
+        window.addEventListener('message', onMessage);
+
+        return () => {
+            window.clearInterval(poll);
+            window.removeEventListener('message', onMessage);
+        };
+    });
 </script>
 
 {#if canMonitorIframe && iframeUrl}
-	<iframe
-		bind:this={iframe}
-		title="OIDC session monitor"
-		src={iframeUrl}
-		hidden
-		aria-hidden="true"
-	></iframe>
+    <iframe
+            bind:this={iframe}
+            title="OIDC session monitor"
+            src={iframeUrl}
+            hidden
+            aria-hidden="true"
+    ></iframe>
 {/if}
 
 {@render children?.()}

package/dist/client/OIDCContext.svelte.d.ts

@@ -1,18 +1,37 @@
+import type { OIDCPublicSession, OIDCSessionManagementConfig, OIDCUserClaims } from '../server/index.js';
 import type { Snippet } from 'svelte';
-import type { OIDCPublicSession, OIDCSessionManagementConfig } from '../server/index.js';
-type RedirectMode = 'login' | 'logout' | 'reload' | 'none';
-type $$ComponentProps = {
-    session?: OIDCPublicSession | null;
-    config: OIDCSessionManagementConfig;
-    loginPath?: string;
-    logoutPath?: string;
-    checkSessionIntervalMs?: number;
-    revalidateIntervalMs?: number;
-    redirectOnExpired?: RedirectMode;
-    redirectOnRevoked?: RedirectMode;
-    redirectIfUnauthenticated?: boolean;
-    children?: Snippet;
+declare function $$render<TClaims extends OIDCUserClaims = OIDCUserClaims>(): {
+    props: {
+        session?: OIDCPublicSession<TClaims> | null;
+        config: OIDCSessionManagementConfig;
+        loginPath?: string;
+        logoutPath?: string;
+        checkSessionIntervalMs?: number;
+        revalidateIntervalMs?: number;
+        redirectOnExpired?: "none" | "login" | "logout" | "reload";
+        redirectOnRevoked?: "none" | "login" | "logout" | "reload";
+        redirectIfUnauthenticated?: boolean;
+        children?: Snippet;
+    };
+    exports: {};
+    bindings: "";
+    slots: {};
+    events: {};
 };
-declare const OIDCContext: import("svelte").Component<$$ComponentProps, {}, "">;
-type OIDCContext = ReturnType<typeof OIDCContext>;
+declare class __sveltets_Render<TClaims extends OIDCUserClaims = OIDCUserClaims> {
+    props(): ReturnType<typeof $$render<TClaims>>['props'];
+    events(): ReturnType<typeof $$render<TClaims>>['events'];
+    slots(): ReturnType<typeof $$render<TClaims>>['slots'];
+    bindings(): "";
+    exports(): {};
+}
+interface $$IsomorphicComponent {
+    new <TClaims extends OIDCUserClaims = OIDCUserClaims>(options: import('svelte').ComponentConstructorOptions<ReturnType<__sveltets_Render<TClaims>['props']>>): import('svelte').SvelteComponent<ReturnType<__sveltets_Render<TClaims>['props']>, ReturnType<__sveltets_Render<TClaims>['events']>, ReturnType<__sveltets_Render<TClaims>['slots']>> & {
+        $$bindings?: ReturnType<__sveltets_Render<TClaims>['bindings']>;
+    } & ReturnType<__sveltets_Render<TClaims>['exports']>;
+    <TClaims extends OIDCUserClaims = OIDCUserClaims>(internal: unknown, props: ReturnType<__sveltets_Render<TClaims>['props']> & {}): ReturnType<__sveltets_Render<TClaims>['exports']>;
+    z_$$bindings?: ReturnType<__sveltets_Render<any>['bindings']>;
+}
+declare const OIDCContext: $$IsomorphicComponent;
+type OIDCContext<TClaims extends OIDCUserClaims = OIDCUserClaims> = InstanceType<typeof OIDCContext<TClaims>>;
 export default OIDCContext;

package/dist/client/context.d.ts

@@ -1,16 +1,16 @@
-import type { OIDCDiscoveryDocument, OIDCPublicSession } from '../server/index.js';
-export type OIDCClientContextValue = {
+import type { OIDCDiscoveryDocument, OIDCPublicSession, OIDCUserClaims } from '../server/index.js';
+export type OIDCClientContextValue<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
     isAuthenticated: boolean;
-    session: OIDCPublicSession | null;
-    user: OIDCPublicSession['user'];
-    claims: OIDCPublicSession['claims'];
-    groups: OIDCPublicSession['groups'];
+    session: OIDCPublicSession<TClaims> | null;
+    user: OIDCPublicSession<TClaims>['user'];
+    claims: OIDCPublicSession<TClaims>['claims'];
+    groups: OIDCPublicSession<TClaims>['groups'];
     metadata?: Pick<OIDCDiscoveryDocument, 'issuer' | 'check_session_iframe' | 'end_session_endpoint' | 'backchannel_logout_supported' | 'backchannel_logout_session_supported'>;
     status: 'authenticated' | 'unauthenticated' | 'expired' | 'revoked';
     login: (returnTo?: string) => void;
     logout: (clearSessionOnly?: boolean) => Promise<void>;
     revalidate: () => Promise<void>;
 };
-export declare function setOIDCContext(value: OIDCClientContextValue): OIDCClientContextValue;
-export declare function getOIDCContext(): OIDCClientContextValue;
-export declare function useOIDC(): OIDCClientContextValue;
+export declare function setOIDCContext<TClaims extends OIDCUserClaims = OIDCUserClaims>(value: OIDCClientContextValue<TClaims>): OIDCClientContextValue<TClaims>;
+export declare function getOIDCContext<TClaims extends OIDCUserClaims = OIDCUserClaims>(): OIDCClientContextValue<TClaims>;
+export declare function useOIDC<TClaims extends OIDCUserClaims = OIDCUserClaims>(): OIDCClientContextValue<TClaims>;

package/dist/server/cookies.d.ts

@@ -1,2 +1,2 @@
-import type { CookieOptions, OIDCCookies } from './types.js';
-export declare function createOIDCCookieStore(cookieSecret: string, sessionCookieName: string, stateCookieName: string, cookieOptions: CookieOptions): OIDCCookies;
+import type { CookieOptions, OIDCCookies, OIDCSession, OIDCUserClaims } from './types.js';
+export declare function createOIDCCookieStore<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>>(cookieSecret: string, sessionCookieName: string, stateCookieName: string, cookieOptions: CookieOptions): OIDCCookies<TClaims, TSession>;

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
-import type { OIDCOptions, OIDCInstance } from './types.js';
+import type { OIDCOptions, OIDCInstance, OIDCSession, OIDCUserClaims } from './types.js';
 export type * from './types.js';
 export { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
-export declare function createOIDC(options: OIDCOptions): OIDCInstance;
+export declare function createOIDC<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>>(options: OIDCOptions<TClaims, TSession>): OIDCInstance<TClaims, TSession>;
 export declare const OpenIDConnect: typeof createOIDC;

package/dist/server/index.js

@@ -199,7 +199,9 @@ export function createOIDC(options) {
             algorithms: metadata.id_token_signing_alg_values_supported,
             clockSkew: clockSkewSeconds
         });
-        const transformedClaims = options.transformClaims ? await options.transformClaims(claims) : claims;
+        const transformedClaims = options.transformClaims
+            ? await options.transformClaims(claims)
+            : claims;
         if (transformedClaims.nonce !== nonce) {
             throw error(401, { message: 'Invalid id_token nonce' });
         }
@@ -258,7 +260,9 @@ export function createOIDC(options) {
                 ? await validateIdToken(tokenResponse.id_token, session.nonce)
                 : session.claims;
             const rawUser = options.fetchUserInfo !== false ? await fetchUserInfo(tokenResponse.access_token) : session.user;
-            const user = options.transformUser ? await options.transformUser(rawUser, { claims }) : rawUser;
+            const user = options.transformUser
+                ? await options.transformUser(rawUser, { claims })
+                : rawUser;
             const nextSession = {
                 ...session,
                 sub: claims?.sub ?? session.sub,
@@ -347,7 +351,9 @@ export function createOIDC(options) {
         const rawUser = options.fetchUserInfo === false
             ? undefined
             : await fetchUserInfo(tokenResponse.access_token).catch(() => undefined);
-        const user = options.transformUser ? await options.transformUser(rawUser, { claims }) : rawUser;
+        const user = options.transformUser
+            ? await options.transformUser(rawUser, { claims })
+            : rawUser;
         const metadata = await getMetadata();
         const now = Math.floor(Date.now() / 1000);
         const session = {

package/dist/server/session.d.ts

@@ -1,3 +1,3 @@
-import type { OIDCSession, OIDCSessionTokens, OIDCTokenResponse } from './types.js';
+import type { OIDCSession, OIDCSessionTokens, OIDCTokenResponse, OIDCUserClaims } from './types.js';
 export declare function normalizeTokens(tokenResponse: OIDCTokenResponse, defaultScope: string[], existing?: OIDCSessionTokens, now?: number): OIDCSessionTokens;
-export declare function shouldRefresh(session: OIDCSession, refreshToleranceSeconds: number, now?: number): boolean;
+export declare function shouldRefresh<TClaims extends OIDCUserClaims = OIDCUserClaims>(session: OIDCSession<TClaims>, refreshToleranceSeconds: number, now?: number): boolean;

package/dist/server/store.d.ts

@@ -1,3 +1,3 @@
-import type { OIDCBackChannelLogoutStore, OIDCSessionStore } from './types.js';
-export declare function createInMemoryBackChannelLogoutStore(): OIDCBackChannelLogoutStore;
-export declare function createInMemorySessionStore(): OIDCSessionStore;
+import type { OIDCBackChannelLogoutStore, OIDCSession, OIDCSessionStore, OIDCUserClaims } from './types.js';
+export declare function createInMemoryBackChannelLogoutStore<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>>(): OIDCBackChannelLogoutStore<TClaims, TSession>;
+export declare function createInMemorySessionStore<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>>(): OIDCSessionStore<TClaims, TSession>;

package/dist/server/types.d.ts

@@ -56,7 +56,7 @@ export type OIDCUserClaims = Record<string, unknown> & {
     nbf?: number;
     nonce?: string;
 };
-export type OIDCSession = {
+export type OIDCSession<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
     issuer: string;
     clientId: string;
     nonce?: string;
@@ -64,16 +64,16 @@ export type OIDCSession = {
     sid?: string;
     sessionState?: string;
     groups: string[];
-    user?: OIDCUserClaims;
-    claims?: OIDCUserClaims;
+    user?: TClaims;
+    claims?: TClaims;
     tokens: OIDCSessionTokens;
     createdAt: number;
     refreshedAt: number;
 };
-export type OIDCPublicSession = {
+export type OIDCPublicSession<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
     isAuthenticated: boolean;
-    user?: OIDCUserClaims;
-    claims?: OIDCUserClaims;
+    user?: TClaims;
+    claims?: TClaims;
     groups: string[];
     scope: string[];
     expiresAt?: number;
@@ -114,13 +114,13 @@ export type OIDCBackChannelLogoutRecord = {
     jti: string;
     iat: number;
 };
-export type OIDCBackChannelLogoutStore = {
+export type OIDCBackChannelLogoutStore<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>> = {
     revoke(record: OIDCBackChannelLogoutRecord): MaybePromise<void>;
-    isRevoked(session: OIDCSession): MaybePromise<boolean>;
+    isRevoked(session: TSession): MaybePromise<boolean>;
 };
-export type OIDCSessionStore = {
-    get(sessionId: string): MaybePromise<OIDCSession | null>;
-    set(sessionId: string, session: OIDCSession): MaybePromise<void>;
+export type OIDCSessionStore<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>> = {
+    get(sessionId: string): MaybePromise<TSession | null>;
+    set(sessionId: string, session: TSession): MaybePromise<void>;
     delete(sessionId: string): MaybePromise<void>;
 };
 export type OIDCSessionManagementConfig = {
@@ -133,7 +133,7 @@ export type OIDCSessionManagementConfig = {
     backChannelLogoutSupported: boolean;
     backChannelLogoutSessionSupported: boolean;
 };
-export type OIDCOptions = {
+export type OIDCOptions<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>> = {
     issuer?: string;
     discoveryUrl?: string;
     clientId: string;
@@ -155,19 +155,19 @@ export type OIDCOptions = {
     refreshToleranceSeconds?: number;
     defaultLoginRedirect?: string;
     defaultLogoutRedirect?: string;
-    sessionStore?: OIDCSessionStore;
-    backChannelLogoutStore?: OIDCBackChannelLogoutStore;
-    transformClaims?: (claims: OIDCUserClaims) => MaybePromise<OIDCUserClaims>;
+    sessionStore?: OIDCSessionStore<TClaims, TSession>;
+    backChannelLogoutStore?: OIDCBackChannelLogoutStore<TClaims, TSession>;
+    transformClaims?: (claims: OIDCUserClaims) => MaybePromise<TClaims>;
     transformUser?: (user: OIDCUserClaims | undefined, context: {
-        claims?: OIDCUserClaims;
-    }) => MaybePromise<OIDCUserClaims | undefined>;
-    transformSession?: (session: OIDCSession, context: {
+        claims?: TClaims;
+    }) => MaybePromise<TClaims | undefined>;
+    transformSession?: (session: OIDCSession<TClaims>, context: {
         event?: RequestEvent;
         tokenResponse?: OIDCTokenResponse;
-        claims?: OIDCUserClaims;
-        user?: OIDCUserClaims;
+        claims?: TClaims;
+        user?: TClaims;
         isRefresh: boolean;
-    }) => MaybePromise<OIDCSession>;
+    }) => MaybePromise<TSession>;
     endpoints?: Partial<OIDCDiscoveryDocument>;
 };
 export type OIDCLoginOptions = {
@@ -181,16 +181,16 @@ export type OIDCLogoutOptions = {
     state?: string;
     clearSessionOnly?: boolean;
 };
-export type OIDCCallbackResult = {
-    session: OIDCSession;
+export type OIDCCallbackResult<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>> = {
+    session: TSession;
     returnTo: string;
 };
-export type OIDCHandleLocals = {
+export type OIDCHandleLocals<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>> = {
     isAuthenticated: boolean;
-    session: OIDCSession | null;
-    user?: OIDCUserClaims;
-    claims?: OIDCUserClaims;
-    requireAuth: () => Promise<OIDCSession>;
+    session: TSession | null;
+    user?: TClaims;
+    claims?: TClaims;
+    requireAuth: () => Promise<TSession>;
     clearSession: () => Promise<void>;
 };
 export type OIDCStateCookie = {
@@ -200,8 +200,8 @@ export type OIDCStateCookie = {
     returnTo: string;
     createdAt: number;
 };
-export type OIDCCallbackHandlerOptions = {
-    onsuccess?: (event: RequestEvent, result: OIDCCallbackResult) => MaybePromise<Response | void>;
+export type OIDCCallbackHandlerOptions<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>> = {
+    onsuccess?: (event: RequestEvent, result: OIDCCallbackResult<TClaims, TSession>) => MaybePromise<Response | void>;
     onfailure?: (event: RequestEvent, err: unknown) => MaybePromise<Response | void>;
     redirectTo?: string;
 };
@@ -214,9 +214,9 @@ export type OIDCClientAssertionOptions = {
     clientId: string;
     clientSecret?: string;
 };
-export type OIDCCookies = {
-    readSession(cookies: Cookies): OIDCSession | null;
-    writeSession(cookies: Cookies, session: OIDCSession): void;
+export type OIDCCookies<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>> = {
+    readSession(cookies: Cookies): TSession | null;
+    writeSession(cookies: Cookies, session: TSession): void;
     clearSession(cookies: Cookies): void;
     readSessionReference(cookies: Cookies): {
         id: string;
@@ -229,28 +229,30 @@ export type OIDCCookies = {
     writeState(cookies: Cookies, state: OIDCStateCookie): void;
     clearState(cookies: Cookies): void;
 };
-export type OIDCPersistedSession = {
+export type OIDCPersistedSession<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>> = {
     id?: string;
-    session: OIDCSession;
+    session: TSession;
 };
-export type OIDCInstance = {
+export type OIDCInstance<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>> = {
     handle: Handle;
     getMetadata: () => Promise<OIDCDiscoveryDocument>;
-    getSession: (event: RequestEvent) => Promise<OIDCSession | null>;
-    getPublicSession: (event: RequestEvent) => Promise<OIDCPublicSession | null>;
+    getSession: (event: RequestEvent) => Promise<TSession | null>;
+    getPublicSession: (event: RequestEvent) => Promise<OIDCPublicSession<TClaims> | null>;
     getSessionManagementConfig: () => Promise<OIDCSessionManagementConfig>;
     login: (event: RequestEvent, loginOptions?: OIDCLoginOptions) => Promise<never>;
     logout: (event: RequestEvent, logoutOptions?: OIDCLogoutOptions) => Promise<never>;
-    handleCallback: (event: RequestEvent) => Promise<OIDCCallbackResult>;
+    handleCallback: (event: RequestEvent) => Promise<OIDCCallbackResult<TClaims, TSession>>;
     handleBackChannelLogout: (event: RequestEvent) => Promise<Response>;
     loginHandler: (defaults?: OIDCLoginOptions) => RequestHandler;
-    callbackHandler: (handlerOptions?: OIDCCallbackHandlerOptions) => RequestHandler;
+    callbackHandler: (handlerOptions?: OIDCCallbackHandlerOptions<TClaims, TSession>) => RequestHandler;
     logoutHandler: (defaults?: OIDCLogoutOptions) => RequestHandler;
     backChannelLogoutHandler: () => RequestHandler;
     createActions: (actionOptions?: OIDCActionOptions) => Readonly<{
         login: Action;
         logout: Action;
     }>;
-    requireAuth: (event: RequestEvent, returnTo?: string) => Promise<OIDCSession>;
+    requireAuth: (event: RequestEvent, returnTo?: string) => Promise<TSession>;
     clearSession: (cookies: Cookies) => Promise<void>;
 };
+export type OIDCInferClaims<T> = T extends OIDCInstance<infer TClaims> ? TClaims : OIDCUserClaims;
+export type OIDCInferSession<T> = T extends OIDCInstance<infer _TClaims, infer TSession> ? TSession : OIDCSession<OIDCUserClaims>;

package/dist/server/utils.d.ts

@@ -8,7 +8,7 @@ export declare function createPKCEPair(length?: number): {
 export declare function normalizeIssuer(issuer: string): string;
 export declare function normalizeScope(scope?: string[]): string[];
 export declare function normalizeStringArray(value: unknown): string[];
-export declare function collectGroups(...sources: Array<OIDCUserClaims | undefined>): string[];
+export declare function collectGroups<TClaims extends OIDCUserClaims = OIDCUserClaims>(...sources: Array<TClaims | undefined>): string[];
 export declare function createSignedValue(value: string, secret: string): string;
 export declare function verifySignedValue(value: string, secret: string): string | null;
 export declare function serializeSignedCookie(payload: unknown, secret: string): string;
@@ -16,4 +16,4 @@ export declare function parseSignedCookie<T>(value: string | undefined, secret:
 export declare function buildCookieOptions(options?: Partial<CookieOptions>): CookieOptions;
 export declare function parseProviderError(event: RequestEvent): null;
 export declare function absoluteUrl(event: RequestEvent, pathOrUrl: string): string;
-export declare function toPublicSession(session: OIDCSession | null): OIDCPublicSession | null;
+export declare function toPublicSession<TClaims extends OIDCUserClaims = OIDCUserClaims>(session: OIDCSession<TClaims> | null): OIDCPublicSession<TClaims> | null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sourceregistry/sveltekit-oidc",
-  "version": "1.1.1",
+  "version": "1.3.0",
   "description": "OIDC authentication helpers for SvelteKit applications.",
   "license": "Apache-2.0",
   "scripts": {
@@ -57,22 +57,22 @@
     "svelte": "^5.0.0"
   },
   "devDependencies": {
-    "@sveltejs/adapter-auto": "^7.0.0",
-    "@sveltejs/kit": "^2.50.2",
-    "@sveltejs/package": "^2.5.7",
-    "@sveltejs/vite-plugin-svelte": "^6.2.4",
-    "@types/node": "^25.5.2",
+    "@sveltejs/adapter-auto": "^7.0.1",
+    "@sveltejs/kit": "^2.63.1",
+    "@sveltejs/package": "^2.5.8",
+    "@sveltejs/vite-plugin-svelte": "^7.1.2",
+    "@types/node": "^25.9.2",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/git": "^10.0.1",
-    "publint": "^0.3.17",
-    "svelte": "^5.54.0",
-    "svelte-check": "^4.4.2",
-    "typescript": "^5.9.3",
-    "vite": "^7.3.1",
-    "@vitest/coverage-v8": "^4.1.2",
-    "vitest": "^4.1.2",
-    "@sourceregistry/semantic-release-jsr": "^1.0.1",
-    "typedoc": "^0.28.18"
+    "publint": "^0.3.21",
+    "svelte": "^5.56.3",
+    "svelte-check": "^4.6.0",
+    "typescript": "^6.0.3",
+    "vite": "^8.0.16",
+    "@vitest/coverage-v8": "^4.1.8",
+    "vitest": "^4.1.8",
+    "@sourceregistry/semantic-release-jsr": "^1.1.1",
+    "typedoc": "^0.28.19"
   },
   "keywords": [
     "sveltekit",
@@ -83,7 +83,7 @@
     "oauth"
   ],
   "dependencies": {
-    "@sourceregistry/node-jwt": "^1.5.9"
+    "@sourceregistry/node-jwt": "^1.5.10"
   },
   "release": {
     "branches": [