@sourceregistry/sveltekit-oidc 1.6.10 → 1.6.11

package/dist/client/OIDCContext.svelte

@@ -46,6 +46,7 @@
     let status = $state<'authenticated' | 'unauthenticated' | 'expired' | 'revoked'>('unauthenticated');
     let revalidating = $state(false);
     let handledUnauthenticated = $state(false);
+    let sessionExpiredDuringRevalidation = false;
 
     const metadata = $derived(config.metadata);
     const resolvedLoginPath = $derived(loginPath ?? config.loginPath ?? '/auth/login');
@@ -88,23 +89,43 @@
 
     void context;
 
+    // SvelteKit navigation hooks are registered for the component lifetime.
+    // Only intercept login redirects while a background revalidation is active.
+    beforeNavigate(({to, cancel}) => {
+        if (revalidating && to?.url.pathname.startsWith(resolvedLoginPath)) {
+            cancel();
+            sessionExpiredDuringRevalidation = true;
+        }
+    });
+
     function buildLoginUrl(returnTo = `${window.location.pathname}${window.location.search}`) {
         return `${resolvedLoginPath}?returnTo=${encodeURIComponent(returnTo)}`;
     }
 
     async function logout(clearSessionOnly = false) {
-        const body = new URLSearchParams();
         if (clearSessionOnly) {
-            body.set('clearSessionOnly', '1');
+            // Session-monitor events must clear only this application's session.
+            // Keep the flag in the URL because logoutHandler also supports callers
+            // that do not send a form body.
+            const url = new URL(logoutPath, window.location.href);
+            url.searchParams.set('clearSessionOnly', '1');
+
+            await fetch(url, {
+                method: 'POST',
+                redirect: 'manual'
+            });
+            return;
         }
 
-        await fetch(logoutPath, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/x-www-form-urlencoded'
-            },
-            body
-        });
+        // Provider logout can include an interactive confirmation and redirects.
+        // A fetch would follow that flow in the background, leaving the provider
+        // session intact and allowing the app to immediately sign in again.
+        const form = document.createElement('form');
+        form.method = 'POST';
+        form.action = logoutPath;
+        form.style.display = 'none';
+        document.body.append(form);
+        form.submit();
     }
 
     function login(returnTo?: string) {
@@ -118,21 +139,13 @@
         revalidating = true;
 
         // If the server redirects to the login path during a background
-        // revalidation (e.g. session lost, HMR store reset), intercept the
-        // SvelteKit router navigation so we can handle it through
-        // handleRedirect instead of a jarring mid-page router transition.
-        let sessionExpiredDuringRevalidation = false;
-        const stopIntercept = beforeNavigate(({ to, cancel }) => {
-            if (to?.url.pathname.startsWith(resolvedLoginPath)) {
-                cancel();
-                sessionExpiredDuringRevalidation = true;
-            }
-        });
+        // revalidation (e.g. session lost, HMR store reset), the component's
+        // navigation hook records it so we can handle the redirect below.
+        sessionExpiredDuringRevalidation = false;
 
         try {
             await invalidateAll();
         } finally {
-            stopIntercept();
             revalidating = false;
         }
 

package/dist/server/index.d.ts

@@ -1,4 +1,4 @@
-import type { OIDCOptions, OIDCInstance, OIDCSession, OIDCUserClaims } from './types.js';
+import type { OIDCInstance, OIDCOptions, OIDCSession, OIDCUserClaims } from './types.js';
 export type * from './types.js';
 export { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
 export declare function createOIDC<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>>(options: OIDCOptions<TClaims, TSession>): OIDCInstance<TClaims, TSession>;

package/dist/server/index.js

@@ -5,8 +5,8 @@ import { createOIDCCookieStore } from './cookies.js';
 import { asAuthorizationHeader, createClientSecretJwtAssertion, createPrivateKeyJwtAssertion, fetchJson } from './jwt.js';
 import { isSessionExpired, normalizeTokens, shouldRefresh } from './session.js';
 import { absoluteUrl, base64UrlEncode, buildCookieOptions, collectGroups, createPKCEPair, internalRedirectPath, normalizeIssuer, normalizeScope, parseProviderError, toPublicSession, validateIdTokenClaims, validateUserInfoSubject } from './utils.js';
-export { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
 import { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
+export { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
 function buildLogger(logger) {
     const noop = () => {
     };
@@ -233,10 +233,9 @@ export function createOIDC(options) {
             clockSkew: clockSkewSeconds
         });
         validateIdTokenClaims(claims, nonce);
-        const transformedClaims = options.transformClaims
+        return options.transformClaims
             ? await options.transformClaims(claims)
             : claims;
-        return transformedClaims;
     }
     async function validateBackChannelLogoutToken(logoutToken) {
         const metadata = await getMetadata();
@@ -534,9 +533,14 @@ export function createOIDC(options) {
             if (event.request.method !== 'POST') {
                 throw error(405, { message: 'Logout requires POST' });
             }
-            const postLogoutRedirectUri = event.url.searchParams.get('postLogoutRedirectUri') ?? defaults.postLogoutRedirectUri;
+            const form = await event.request.formData().catch(() => null);
+            const postLogoutRedirectUri = event.url.searchParams.get('postLogoutRedirectUri') ??
+                form?.get('postLogoutRedirectUri')?.toString() ??
+                defaults.postLogoutRedirectUri;
             const clearSessionOnly = event.url.searchParams.get('clearSessionOnly') === '1' ||
                 event.url.searchParams.get('clearSessionOnly') === 'true' ||
+                form?.get('clearSessionOnly')?.toString() === '1' ||
+                form?.get('clearSessionOnly')?.toString() === 'true' ||
                 defaults.clearSessionOnly;
             return signOut(event, { ...defaults, postLogoutRedirectUri, clearSessionOnly });
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sourceregistry/sveltekit-oidc",
-  "version": "1.6.10",
+  "version": "1.6.11",
   "description": "OIDC authentication helpers for SvelteKit applications",
   "license": "Apache-2.0",
   "scripts": {