@sourceregistry/sveltekit-oidc 1.6.14 → 1.8.0

package/README.md

@@ -155,6 +155,13 @@ export async function load(event) {
 `OIDCContext`, so the standard setup above does not re-run unrelated page loads. If you destructure
 the load event, pass both `cookies` and `depends`: `oidc.getPublicSession({cookies, depends})`.
 
+When `oidc.handle` has already loaded an enriched session for the current request, project that
+session without reading or enriching it again:
+
+```ts
+const session = oidc.toPublicSession(event.locals.oidc?.session ?? null, event.depends);
+```
+
 Periodic revalidation is disabled by default to avoid unnecessary page updates. Set
 `revalidateIntervalMs` to a positive interval only when you need polling in addition to token-expiry
 and provider session monitoring. Existing integrations that pass only `cookies` remain compatible;

package/dist/server/index.js

@@ -356,7 +356,11 @@ export function createOIDC(options) {
         }
     }
     async function getSession(event) {
-        return maybeRefreshSession(event.cookies, await readPersistedSession(event.cookies));
+        const session = await maybeRefreshSession(event.cookies, await readPersistedSession(event.cookies));
+        if (!session || !options.enrichSession) {
+            return session;
+        }
+        return options.enrichSession(session, { event: event });
     }
     async function signIn(event, loginOptions = {}) {
         const metadata = await getMetadata();
@@ -614,18 +618,20 @@ export function createOIDC(options) {
             backChannelLogoutSessionSupported: Boolean(metadata.backchannel_logout_session_supported)
         };
     }
+    function createPublicSession(session, depends) {
+        depends?.(OIDC_SESSION_REVALIDATION_DEPENDENCY);
+        const publicSession = toPublicSession(session);
+        return publicSession && depends
+            ? { ...publicSession, revalidationDependency: OIDC_SESSION_REVALIDATION_DEPENDENCY }
+            : publicSession;
+    }
     return {
         handle,
         hook,
         getMetadata,
         getSession,
-        getPublicSession: async (event) => {
-            event.depends?.(OIDC_SESSION_REVALIDATION_DEPENDENCY);
-            const session = toPublicSession(await getSession(event));
-            return session && event.depends
-                ? { ...session, revalidationDependency: OIDC_SESSION_REVALIDATION_DEPENDENCY }
-                : session;
-        },
+        getPublicSession: async (event) => createPublicSession(await getSession(event), event.depends),
+        toPublicSession: createPublicSession,
         getSessionManagementConfig,
         login: signIn,
         logout: signOut,

package/dist/server/types.d.ts

@@ -182,6 +182,18 @@ export type OIDCOptions<TClaims extends OIDCUserClaims = OIDCUserClaims, TSessio
         user?: TClaims;
         isRefresh: boolean;
     }) => MaybePromise<TSession>;
+    /**
+     * Runs on every `getSession` read (and therefore every `getPublicSession`,
+     * `hook()`-provided `requireAuth`, and the instance-level `requireAuth`) —
+     * unlike `transformSession`, which only fires on session creation and token
+     * refresh. Use this to keep data your app owns outside the token (e.g. roles
+     * or memberships stored in your own database) fresh without waiting for a
+     * refresh. Only invoked when a session is present; the result is not persisted
+     * back to the session store.
+     */
+    enrichSession?: (session: TSession, context: {
+        event?: MinimalRequestEvent;
+    }) => MaybePromise<TSession>;
     endpoints?: Partial<OIDCDiscoveryDocument>;
     logger?: OIDCLogger | false;
     /**
@@ -278,6 +290,8 @@ export type OIDCInstance<TClaims extends OIDCUserClaims = OIDCUserClaims, TSessi
         cookies: Cookies;
         depends?: (dependency: string) => void;
     }) => Promise<OIDCPublicSession<TClaims> | null>;
+    /** Projects an already-loaded session without reading, refreshing, or enriching it again. */
+    toPublicSession: (session: TSession | null, depends?: (dependency: string) => void) => OIDCPublicSession<TClaims> | null;
     getSessionManagementConfig: () => Promise<OIDCSessionManagementConfig>;
     login: (event: MinimalRequestEvent, loginOptions?: OIDCLoginOptions) => Promise<never>;
     logout: (event: MinimalRequestEvent, logoutOptions?: OIDCLogoutOptions) => Promise<never>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sourceregistry/sveltekit-oidc",
-  "version": "1.6.14",
+  "version": "1.8.0",
   "description": "OIDC authentication helpers for SvelteKit applications",
   "license": "Apache-2.0",
   "scripts": {