@sourceregistry/sveltekit-oidc 1.2.0 → 1.3.1

package/README.md

@@ -129,6 +129,7 @@ export async function load(event) {
 	session={data.session}
 	config={data.sessionManagement}
 	logoutPath="/auth/logout"
+	monitorSession={false}
 	redirectIfUnauthenticated={false}
 >
 	<Account />
@@ -160,6 +161,10 @@ export async function load(event) {
 - periodic `invalidateAll()` revalidation so revoked server sessions are detected
 - a client context for nested auth-aware components through `useOIDC()` / `getOIDCContext()`
 
+Set `monitorSession={false}` when you want to keep the client context but leave remote session
+revocation checks to your server-side guard or another mechanism. This disables
+`check_session_iframe` polling without changing the provider metadata exposed through the context.
+
 ## Typed Custom Claims
 
 `createOIDC` infers a `TClaims` type from whatever `transformClaims` / `transformUser` / `transformSession` return, and threads it through the session, `event.locals.oidc`, `OIDCPublicSession`, and the client context — no casts needed.
@@ -230,6 +235,57 @@ Now `event.locals.oidc?.claims?.roles` is `string[]` and `?.tenant` is `string |
 
 If `transformClaims` (and friends) are omitted, `TClaims` defaults to `OIDCUserClaims` — existing setups keep working unchanged.
 
+## Typed Custom Session
+
+Backend apps commonly stash application-specific data on the session itself (e.g. `tenantId`, `permissions`) — not just inside `claims`/`user`. A second generic, `TSession`, is inferred from `transformSession`'s return type and threads through the session store, cookies, `event.locals.oidc`, and `handleCallback`'s result — again with no casts:
+
+```ts
+// src/lib/server/auth.ts
+import { createOIDC, type OIDCSession } from 'sveltekit-oidc/server';
+
+type AppSession = OIDCSession<AppClaims> & {
+	tenantId: string;
+	permissions: string[];
+};
+
+export const oidc = createOIDC({
+	issuer: 'https://your-idp.example.com',
+	clientId: process.env.OIDC_CLIENT_ID!,
+	cookieSecret: process.env.OIDC_COOKIE_SECRET!,
+	transformClaims: (claims) => ({ ...claims, tenant: claims.tenant as string | undefined }),
+	transformSession: (session): AppSession => ({
+		...session,
+		tenantId: session.claims?.tenant ?? 'default',
+		permissions: session.user?.roles ?? []
+	})
+});
+```
+
+Extract the inferred type with `OIDCInferSession` and apply it alongside `OIDCInferClaims`:
+
+```ts
+// src/app.d.ts
+import type { OIDCHandleLocals, OIDCInferClaims, OIDCInferSession } from 'sveltekit-oidc/server';
+import { oidc } from '$lib/server/auth';
+
+export type AppClaims = OIDCInferClaims<typeof oidc>;
+export type AppSession = OIDCInferSession<typeof oidc>;
+
+declare global {
+	namespace App {
+		interface Locals {
+			oidc?: OIDCHandleLocals<AppClaims, AppSession>;
+		}
+	}
+}
+
+export {};
+```
+
+Now `event.locals.oidc?.session?.tenantId` is `string` and `?.permissions` is `string[]` everywhere — and `oidc.requireAuth(event)` / `handleCallback`'s `onsuccess` resolve to `AppSession` directly.
+
+If `transformSession` is omitted, `TSession` defaults to `OIDCSession<TClaims>` — existing setups keep working unchanged.
+
 ## Example App
 
 This repository now includes a runnable example under [src/routes](C:/Users/alexa/WebstormProjects/github.com/SourceRegistry/sveltekit-oidc/src/routes) and [src/hooks.server.ts](C:/Users/alexa/WebstormProjects/github.com/SourceRegistry/sveltekit-oidc/src/hooks.server.ts).
@@ -251,6 +307,6 @@ Set these environment variables to enable it:
 - The library validates `id_token` and `logout_token` values through `@sourceregistry/node-jwt` and provider JWKS metadata.
 - `groups` are normalized onto the session from `groups` and `roles` claims when present.
 - Use `transformClaims`, `transformUser`, and `transformSession` to project provider-specific claims into your own session shape.
-- `check_session_iframe` monitoring only runs when the provider advertises that endpoint and the session includes `session_state`.
+- `check_session_iframe` monitoring only runs when `monitorSession` is enabled, the provider advertises that endpoint, and the session includes `session_state`.
 - Refresh token handling is automatic when a valid refresh token is present.
 - `event.locals.oidc` is attached by the hook and typed via `OIDCHandleLocals<TClaims>`; see [Typed Custom Claims](#typed-custom-claims) for wiring your own claim shapes through `app.d.ts`.

package/dist/client/OIDCContext.svelte

@@ -1,212 +1,216 @@
+<script lang="ts" module>
+    import type {
+        OIDCPublicSession,
+        OIDCSessionManagementConfig, OIDCUserClaims
+    } from '../server/index.js';
+</script>
+
 <script lang="ts" generics="TClaims extends OIDCUserClaims = OIDCUserClaims">
-	import { goto, invalidateAll } from '$app/navigation';
-	import type { Snippet } from 'svelte';
-
-	import { setOIDCContext } from './context.js';
-	import type {
-		OIDCPublicSession,
-		OIDCSessionManagementConfig,
-		OIDCUserClaims
-	} from '../server/index.js';
-
-	type RedirectMode = 'login' | 'logout' | 'reload' | 'none';
-
-	let {
-		session = null,
-		config,
-		loginPath,
-		logoutPath = '/auth/logout',
-		checkSessionIntervalMs = 5000,
-		revalidateIntervalMs = 30000,
-		redirectOnExpired = 'login',
-		redirectOnRevoked = 'login',
-		redirectIfUnauthenticated = false,
-		children
-	}: {
-		session?: OIDCPublicSession<TClaims> | null;
-		config: OIDCSessionManagementConfig;
-		loginPath?: string;
-		logoutPath?: string;
-		checkSessionIntervalMs?: number;
-		revalidateIntervalMs?: number;
-		redirectOnExpired?: RedirectMode;
-		redirectOnRevoked?: RedirectMode;
-		redirectIfUnauthenticated?: boolean;
-		children?: Snippet;
-	} = $props();
-
-	let iframe = $state<HTMLIFrameElement | undefined>(undefined);
-	let status = $state<'authenticated' | 'unauthenticated' | 'expired' | 'revoked'>('unauthenticated');
-	let handledUnauthenticated = $state(false);
-
-	const metadata = $derived(config.metadata);
-	const resolvedLoginPath = $derived(loginPath ?? config.loginPath ?? '/auth/login');
-	const iframeUrl = $derived(
-		config.metadata.check_session_iframe ?? config.checkSessionIframe ?? undefined
-	);
-	const canMonitorIframe = $derived(
-		Boolean(session?.isAuthenticated && session?.sessionState && iframeUrl)
-	);
-
-	const context = setOIDCContext<TClaims>({
-		get isAuthenticated() {
-			return Boolean(session?.isAuthenticated);
-		},
-		get session() {
-			return session;
-		},
-		get user() {
-			return session?.user;
-		},
-		get claims() {
-			return session?.claims;
-		},
-		get groups() {
-			return session?.groups ?? [];
-		},
-		get metadata() {
-			return metadata;
-		},
-		get status() {
-			return status;
-		},
-		login: (returnTo?: string) => login(returnTo),
-		logout,
-		revalidate
-	});
-
-	void context;
-
-	function buildLoginUrl(returnTo = `${window.location.pathname}${window.location.search}`) {
-		return `${resolvedLoginPath}?returnTo=${encodeURIComponent(returnTo)}`;
-	}
-
-	async function logout(clearSessionOnly = false) {
-		const body = new URLSearchParams();
-		if (clearSessionOnly) {
-			body.set('clearSessionOnly', '1');
-		}
-
-		await fetch(logoutPath, {
-			method: 'POST',
-			headers: {
-				'content-type': 'application/x-www-form-urlencoded'
-			},
-			body
-		});
-	}
-
-	function login(returnTo?: string) {
-		void goto(buildLoginUrl(returnTo), { invalidateAll: false });
-	}
-
-	async function revalidate() {
-		await invalidateAll();
-	}
-
-	async function handleRedirect(mode: RedirectMode) {
-		if (mode === 'none') {
-			return;
-		}
-		if (mode === 'reload') {
-			window.location.reload();
-			return;
-		}
-		if (mode === 'logout') {
-			await logout(true);
-			window.location.reload();
-			return;
-		}
-
-		login();
-	}
-
-	$effect(() => {
-		const isAuthenticated = Boolean(session?.isAuthenticated);
-		status = isAuthenticated ? 'authenticated' : status === 'authenticated' ? 'unauthenticated' : status;
-	});
-
-	$effect(() => {
-		if (!session?.isAuthenticated || !session.expiresAt) {
-			return;
-		}
-
-		const timeoutMs = Math.max(0, session.expiresAt * 1000 - Date.now());
-		const timer = window.setTimeout(() => {
-			status = 'expired';
-			void handleRedirect(redirectOnExpired);
-		}, timeoutMs);
-
-		return () => window.clearTimeout(timer);
-	});
-
-	$effect(() => {
-		if (!session?.isAuthenticated || !revalidateIntervalMs) {
-			return;
-		}
-
-		const timer = window.setInterval(() => {
-			void revalidate();
-		}, revalidateIntervalMs);
-
-		return () => window.clearInterval(timer);
-	});
-
-	$effect(() => {
-		if (session?.isAuthenticated) {
-			handledUnauthenticated = false;
-			return;
-		}
-		if (!redirectIfUnauthenticated || handledUnauthenticated) {
-			return;
-		}
-
-		handledUnauthenticated = true;
-		status = status === 'expired' || status === 'revoked' ? status : 'unauthenticated';
-		void handleRedirect(status === 'revoked' ? redirectOnRevoked : redirectOnExpired);
-	});
-
-	$effect(() => {
-		if (!canMonitorIframe || !iframeUrl || !iframe) {
-			return;
-		}
-
-		const targetOrigin = new URL(iframeUrl).origin;
-		const poll = window.setInterval(() => {
-			if (!iframe?.contentWindow || !session?.sessionState) {
-				return;
-			}
-
-			iframe.contentWindow.postMessage(`${config.clientId} ${session.sessionState}`, targetOrigin);
-		}, checkSessionIntervalMs);
-
-		const onMessage = (event: MessageEvent) => {
-			if (event.origin !== targetOrigin || typeof event.data !== 'string') {
-				return;
-			}
-			if (event.data === 'changed' || event.data === 'error') {
-				status = 'revoked';
-				void logout(true).then(() => handleRedirect(redirectOnRevoked));
-			}
-		};
-
-		window.addEventListener('message', onMessage);
-
-		return () => {
-			window.clearInterval(poll);
-			window.removeEventListener('message', onMessage);
-		};
-	});
+    import {goto, invalidateAll} from '$app/navigation';
+    import type {Snippet} from 'svelte';
+
+    import {setOIDCContext} from './context.js';
+
+    type RedirectMode = 'login' | 'logout' | 'reload' | 'none';
+
+    let {
+        session = null,
+        config,
+        loginPath,
+        logoutPath = '/auth/logout',
+        checkSessionIntervalMs = 5000,
+        monitorSession = true,
+        revalidateIntervalMs = 30000,
+        redirectOnExpired = 'login',
+        redirectOnRevoked = 'login',
+        redirectIfUnauthenticated = false,
+        children
+    }: {
+        session?: OIDCPublicSession<TClaims> | null;
+        config: OIDCSessionManagementConfig;
+        loginPath?: string;
+        logoutPath?: string;
+        checkSessionIntervalMs?: number;
+        monitorSession?: boolean;
+        revalidateIntervalMs?: number;
+        redirectOnExpired?: RedirectMode;
+        redirectOnRevoked?: RedirectMode;
+        redirectIfUnauthenticated?: boolean;
+        children?: Snippet;
+    } = $props();
+
+    let iframe = $state<HTMLIFrameElement | undefined>(undefined);
+    let status = $state<'authenticated' | 'unauthenticated' | 'expired' | 'revoked'>('unauthenticated');
+    let handledUnauthenticated = $state(false);
+
+    const metadata = $derived(config.metadata);
+    const resolvedLoginPath = $derived(loginPath ?? config.loginPath ?? '/auth/login');
+    const iframeUrl = $derived(
+        config.metadata.check_session_iframe ?? config.checkSessionIframe ?? undefined
+    );
+    const canMonitorIframe = $derived(
+        Boolean(monitorSession && session?.isAuthenticated && session?.sessionState && iframeUrl)
+    );
+
+    const context = setOIDCContext<TClaims>({
+        get isAuthenticated() {
+            return Boolean(session?.isAuthenticated);
+        },
+        get session() {
+            return session;
+        },
+        get user() {
+            return session?.user;
+        },
+        get claims() {
+            return session?.claims;
+        },
+        get groups() {
+            return session?.groups ?? [];
+        },
+        get metadata() {
+            return metadata;
+        },
+        get status() {
+            return status;
+        },
+        login: (returnTo?: string) => login(returnTo),
+        logout,
+        revalidate
+    });
+
+    void context;
+
+    function buildLoginUrl(returnTo = `${window.location.pathname}${window.location.search}`) {
+        return `${resolvedLoginPath}?returnTo=${encodeURIComponent(returnTo)}`;
+    }
+
+    async function logout(clearSessionOnly = false) {
+        const body = new URLSearchParams();
+        if (clearSessionOnly) {
+            body.set('clearSessionOnly', '1');
+        }
+
+        await fetch(logoutPath, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/x-www-form-urlencoded'
+            },
+            body
+        });
+    }
+
+    function login(returnTo?: string) {
+        void goto(buildLoginUrl(returnTo), {invalidateAll: false});
+    }
+
+    async function revalidate() {
+        await invalidateAll();
+    }
+
+    async function handleRedirect(mode: RedirectMode) {
+        if (mode === 'none') {
+            return;
+        }
+        if (mode === 'reload') {
+            window.location.reload();
+            return;
+        }
+        if (mode === 'logout') {
+            await logout(true);
+            window.location.reload();
+            return;
+        }
+
+        login();
+    }
+
+    $effect(() => {
+        const isAuthenticated = Boolean(session?.isAuthenticated);
+        status = isAuthenticated ? 'authenticated' : status === 'authenticated' ? 'unauthenticated' : status;
+    });
+
+    $effect(() => {
+        if (!session?.isAuthenticated || !session.expiresAt) {
+            return;
+        }
+
+        const timeoutMs = Math.max(0, session.expiresAt * 1000 - Date.now());
+        const timer = window.setTimeout(() => {
+            status = 'expired';
+            void handleRedirect(redirectOnExpired);
+        }, timeoutMs);
+
+        return () => window.clearTimeout(timer);
+    });
+
+    $effect(() => {
+        if (!session?.isAuthenticated || !revalidateIntervalMs) {
+            return;
+        }
+
+        const timer = window.setInterval(() => {
+            void revalidate();
+        }, revalidateIntervalMs);
+
+        return () => window.clearInterval(timer);
+    });
+
+    $effect(() => {
+        if (session?.isAuthenticated) {
+            handledUnauthenticated = false;
+            return;
+        }
+        if (!redirectIfUnauthenticated || handledUnauthenticated) {
+            return;
+        }
+
+        handledUnauthenticated = true;
+        status = status === 'expired' || status === 'revoked' ? status : 'unauthenticated';
+        void handleRedirect(status === 'revoked' ? redirectOnRevoked : redirectOnExpired);
+    });
+
+    $effect(() => {
+        if (!canMonitorIframe || !iframeUrl || !iframe) {
+            return;
+        }
+
+        const targetOrigin = new URL(iframeUrl).origin;
+        const poll = window.setInterval(() => {
+            if (!iframe?.contentWindow || !session?.sessionState) {
+                return;
+            }
+
+            iframe.contentWindow.postMessage(`${config.clientId} ${session.sessionState}`, targetOrigin);
+        }, checkSessionIntervalMs);
+
+        const onMessage = (event: MessageEvent) => {
+            if (event.origin !== targetOrigin || typeof event.data !== 'string') {
+                return;
+            }
+            if (event.data === 'changed' || event.data === 'error') {
+                status = 'revoked';
+                void logout(true).then(() => handleRedirect(redirectOnRevoked));
+            }
+        };
+
+        window.addEventListener('message', onMessage);
+
+        return () => {
+            window.clearInterval(poll);
+            window.removeEventListener('message', onMessage);
+        };
+    });
 </script>
 
 {#if canMonitorIframe && iframeUrl}
-	<iframe
-		bind:this={iframe}
-		title="OIDC session monitor"
-		src={iframeUrl}
-		hidden
-		aria-hidden="true"
-	></iframe>
+    <iframe
+            bind:this={iframe}
+            title="OIDC session monitor"
+            src={iframeUrl}
+            hidden
+            aria-hidden="true"
+    ></iframe>
 {/if}
 
 {@render children?.()}

package/dist/client/OIDCContext.svelte.d.ts

@@ -1,5 +1,5 @@
-import type { Snippet } from 'svelte';
 import type { OIDCPublicSession, OIDCSessionManagementConfig, OIDCUserClaims } from '../server/index.js';
+import type { Snippet } from 'svelte';
 declare function $$render<TClaims extends OIDCUserClaims = OIDCUserClaims>(): {
     props: {
         session?: OIDCPublicSession<TClaims> | null;
@@ -7,6 +7,7 @@ declare function $$render<TClaims extends OIDCUserClaims = OIDCUserClaims>(): {
         loginPath?: string;
         logoutPath?: string;
         checkSessionIntervalMs?: number;
+        monitorSession?: boolean;
         revalidateIntervalMs?: number;
         redirectOnExpired?: "none" | "login" | "logout" | "reload";
         redirectOnRevoked?: "none" | "login" | "logout" | "reload";

package/dist/server/cookies.d.ts

@@ -1,2 +1,2 @@
-import type { CookieOptions, OIDCCookies, OIDCUserClaims } from './types.js';
-export declare function createOIDCCookieStore<TClaims extends OIDCUserClaims = OIDCUserClaims>(cookieSecret: string, sessionCookieName: string, stateCookieName: string, cookieOptions: CookieOptions): OIDCCookies<TClaims>;
+import type { CookieOptions, OIDCCookies, OIDCSession, OIDCUserClaims } from './types.js';
+export declare function createOIDCCookieStore<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>>(cookieSecret: string, sessionCookieName: string, stateCookieName: string, cookieOptions: CookieOptions): OIDCCookies<TClaims, TSession>;

package/dist/server/index.d.ts

@@ -1,5 +1,5 @@
-import type { OIDCOptions, OIDCInstance, OIDCUserClaims } from './types.js';
+import type { OIDCOptions, OIDCInstance, OIDCSession, OIDCUserClaims } from './types.js';
 export type * from './types.js';
 export { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
-export declare function createOIDC<TClaims extends OIDCUserClaims = OIDCUserClaims>(options: OIDCOptions<TClaims>): OIDCInstance<TClaims>;
+export declare function createOIDC<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>>(options: OIDCOptions<TClaims, TSession>): OIDCInstance<TClaims, TSession>;
 export declare const OpenIDConnect: typeof createOIDC;

package/dist/server/store.d.ts

@@ -1,3 +1,3 @@
-import type { OIDCBackChannelLogoutStore, OIDCSessionStore, OIDCUserClaims } from './types.js';
-export declare function createInMemoryBackChannelLogoutStore<TClaims extends OIDCUserClaims = OIDCUserClaims>(): OIDCBackChannelLogoutStore<TClaims>;
-export declare function createInMemorySessionStore<TClaims extends OIDCUserClaims = OIDCUserClaims>(): OIDCSessionStore<TClaims>;
+import type { OIDCBackChannelLogoutStore, OIDCSession, OIDCSessionStore, OIDCUserClaims } from './types.js';
+export declare function createInMemoryBackChannelLogoutStore<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>>(): OIDCBackChannelLogoutStore<TClaims, TSession>;
+export declare function createInMemorySessionStore<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>>(): OIDCSessionStore<TClaims, TSession>;

package/dist/server/types.d.ts

@@ -114,13 +114,13 @@ export type OIDCBackChannelLogoutRecord = {
     jti: string;
     iat: number;
 };
-export type OIDCBackChannelLogoutStore<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
+export type OIDCBackChannelLogoutStore<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>> = {
     revoke(record: OIDCBackChannelLogoutRecord): MaybePromise<void>;
-    isRevoked(session: OIDCSession<TClaims>): MaybePromise<boolean>;
+    isRevoked(session: TSession): MaybePromise<boolean>;
 };
-export type OIDCSessionStore<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
-    get(sessionId: string): MaybePromise<OIDCSession<TClaims> | null>;
-    set(sessionId: string, session: OIDCSession<TClaims>): MaybePromise<void>;
+export type OIDCSessionStore<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>> = {
+    get(sessionId: string): MaybePromise<TSession | null>;
+    set(sessionId: string, session: TSession): MaybePromise<void>;
     delete(sessionId: string): MaybePromise<void>;
 };
 export type OIDCSessionManagementConfig = {
@@ -133,7 +133,7 @@ export type OIDCSessionManagementConfig = {
     backChannelLogoutSupported: boolean;
     backChannelLogoutSessionSupported: boolean;
 };
-export type OIDCOptions<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
+export type OIDCOptions<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>> = {
     issuer?: string;
     discoveryUrl?: string;
     clientId: string;
@@ -155,8 +155,8 @@ export type OIDCOptions<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
     refreshToleranceSeconds?: number;
     defaultLoginRedirect?: string;
     defaultLogoutRedirect?: string;
-    sessionStore?: OIDCSessionStore<TClaims>;
-    backChannelLogoutStore?: OIDCBackChannelLogoutStore<TClaims>;
+    sessionStore?: OIDCSessionStore<TClaims, TSession>;
+    backChannelLogoutStore?: OIDCBackChannelLogoutStore<TClaims, TSession>;
     transformClaims?: (claims: OIDCUserClaims) => MaybePromise<TClaims>;
     transformUser?: (user: OIDCUserClaims | undefined, context: {
         claims?: TClaims;
@@ -167,7 +167,7 @@ export type OIDCOptions<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
         claims?: TClaims;
         user?: TClaims;
         isRefresh: boolean;
-    }) => MaybePromise<OIDCSession<TClaims>>;
+    }) => MaybePromise<TSession>;
     endpoints?: Partial<OIDCDiscoveryDocument>;
 };
 export type OIDCLoginOptions = {
@@ -181,16 +181,16 @@ export type OIDCLogoutOptions = {
     state?: string;
     clearSessionOnly?: boolean;
 };
-export type OIDCCallbackResult<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
-    session: OIDCSession<TClaims>;
+export type OIDCCallbackResult<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>> = {
+    session: TSession;
     returnTo: string;
 };
-export type OIDCHandleLocals<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
+export type OIDCHandleLocals<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>> = {
     isAuthenticated: boolean;
-    session: OIDCSession<TClaims> | null;
+    session: TSession | null;
     user?: TClaims;
     claims?: TClaims;
-    requireAuth: () => Promise<OIDCSession<TClaims>>;
+    requireAuth: () => Promise<TSession>;
     clearSession: () => Promise<void>;
 };
 export type OIDCStateCookie = {
@@ -200,8 +200,8 @@ export type OIDCStateCookie = {
     returnTo: string;
     createdAt: number;
 };
-export type OIDCCallbackHandlerOptions<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
-    onsuccess?: (event: RequestEvent, result: OIDCCallbackResult<TClaims>) => MaybePromise<Response | void>;
+export type OIDCCallbackHandlerOptions<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>> = {
+    onsuccess?: (event: RequestEvent, result: OIDCCallbackResult<TClaims, TSession>) => MaybePromise<Response | void>;
     onfailure?: (event: RequestEvent, err: unknown) => MaybePromise<Response | void>;
     redirectTo?: string;
 };
@@ -214,9 +214,9 @@ export type OIDCClientAssertionOptions = {
     clientId: string;
     clientSecret?: string;
 };
-export type OIDCCookies<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
-    readSession(cookies: Cookies): OIDCSession<TClaims> | null;
-    writeSession(cookies: Cookies, session: OIDCSession<TClaims>): void;
+export type OIDCCookies<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>> = {
+    readSession(cookies: Cookies): TSession | null;
+    writeSession(cookies: Cookies, session: TSession): void;
     clearSession(cookies: Cookies): void;
     readSessionReference(cookies: Cookies): {
         id: string;
@@ -229,29 +229,30 @@ export type OIDCCookies<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
     writeState(cookies: Cookies, state: OIDCStateCookie): void;
     clearState(cookies: Cookies): void;
 };
-export type OIDCPersistedSession<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
+export type OIDCPersistedSession<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>> = {
     id?: string;
-    session: OIDCSession<TClaims>;
+    session: TSession;
 };
-export type OIDCInstance<TClaims extends OIDCUserClaims = OIDCUserClaims> = {
+export type OIDCInstance<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>> = {
     handle: Handle;
     getMetadata: () => Promise<OIDCDiscoveryDocument>;
-    getSession: (event: RequestEvent) => Promise<OIDCSession<TClaims> | null>;
+    getSession: (event: RequestEvent) => Promise<TSession | null>;
     getPublicSession: (event: RequestEvent) => Promise<OIDCPublicSession<TClaims> | null>;
     getSessionManagementConfig: () => Promise<OIDCSessionManagementConfig>;
     login: (event: RequestEvent, loginOptions?: OIDCLoginOptions) => Promise<never>;
     logout: (event: RequestEvent, logoutOptions?: OIDCLogoutOptions) => Promise<never>;
-    handleCallback: (event: RequestEvent) => Promise<OIDCCallbackResult<TClaims>>;
+    handleCallback: (event: RequestEvent) => Promise<OIDCCallbackResult<TClaims, TSession>>;
     handleBackChannelLogout: (event: RequestEvent) => Promise<Response>;
     loginHandler: (defaults?: OIDCLoginOptions) => RequestHandler;
-    callbackHandler: (handlerOptions?: OIDCCallbackHandlerOptions<TClaims>) => RequestHandler;
+    callbackHandler: (handlerOptions?: OIDCCallbackHandlerOptions<TClaims, TSession>) => RequestHandler;
     logoutHandler: (defaults?: OIDCLogoutOptions) => RequestHandler;
     backChannelLogoutHandler: () => RequestHandler;
     createActions: (actionOptions?: OIDCActionOptions) => Readonly<{
         login: Action;
         logout: Action;
     }>;
-    requireAuth: (event: RequestEvent, returnTo?: string) => Promise<OIDCSession<TClaims>>;
+    requireAuth: (event: RequestEvent, returnTo?: string) => Promise<TSession>;
     clearSession: (cookies: Cookies) => Promise<void>;
 };
 export type OIDCInferClaims<T> = T extends OIDCInstance<infer TClaims> ? TClaims : OIDCUserClaims;
+export type OIDCInferSession<T> = T extends OIDCInstance<infer _TClaims, infer TSession> ? TSession : OIDCSession<OIDCUserClaims>;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sourceregistry/sveltekit-oidc",
-  "version": "1.2.0",
-  "description": "OIDC authentication helpers for SvelteKit applications.",
+  "version": "1.3.1",
+  "description": "OIDC authentication helpers for SvelteKit applications",
   "license": "Apache-2.0",
   "scripts": {
     "dev": "vite dev",