@sourceregistry/sveltekit-oidc 1.6.5 → 1.6.7

package/dist/client/OIDCContext.svelte

@@ -6,7 +6,8 @@
 </script>
 
 <script lang="ts" generics="TClaims extends OIDCUserClaims = OIDCUserClaims">
-    import {goto, invalidateAll} from '$app/navigation';
+    import {invalidateAll} from '$app/navigation';
+    import {tick} from 'svelte';
     import type {Snippet} from 'svelte';
 
     import {setOIDCContext} from './context.js';
@@ -21,6 +22,7 @@
         checkSessionIntervalMs = 5000,
         monitorSession = true,
         revalidateIntervalMs = 30000,
+        renewalLeadTimeMs = 5000,
         redirectOnExpired = 'login',
         redirectOnRevoked = 'login',
         redirectIfUnauthenticated = false,
@@ -33,6 +35,7 @@
         checkSessionIntervalMs?: number;
         monitorSession?: boolean;
         revalidateIntervalMs?: number;
+        renewalLeadTimeMs?: number;
         redirectOnExpired?: RedirectMode;
         redirectOnRevoked?: RedirectMode;
         redirectIfUnauthenticated?: boolean;
@@ -101,7 +104,9 @@
     }
 
     function login(returnTo?: string) {
-        void goto(buildLoginUrl(returnTo), {invalidateAll: false});
+        // loginPath is a plain +server.ts redirect endpoint, not a routable
+        // page — use a full browser navigation, not SvelteKit's goto().
+        window.location.href = buildLoginUrl(returnTo);
     }
 
     async function revalidate() {
@@ -130,17 +135,39 @@
         status = isAuthenticated ? 'authenticated' : status === 'authenticated' ? 'unauthenticated' : status;
     });
 
+    let lastExpiresAt: number | undefined;
+    let renewalAttemptedForExpiresAt: number | undefined;
+
     $effect(() => {
         if (!session?.isAuthenticated || !session.expiresAt) {
             return;
         }
 
-        const timeoutMs = Math.max(0, session.expiresAt * 1000 - Date.now());
+        // If a prior revalidate already came back with the same (still-past)
+        // expiresAt, the server couldn't refresh the token (e.g. no refresh
+        // token available) — retrying immediately forever would spin-loop.
+        // Treat that as a hard expiry instead of rescheduling.
+        if (
+            lastExpiresAt !== undefined &&
+            session.expiresAt <= lastExpiresAt &&
+            session.expiresAt * 1000 <= Date.now()
+        ) {
+            status = 'expired';
+            void handleRedirect(redirectOnExpired);
+            return;
+        }
+        lastExpiresAt = session.expiresAt;
+
+        const expiresAt = session.expiresAt;
+        const leadTimeMs = renewalAttemptedForExpiresAt === expiresAt ? 0 : renewalLeadTimeMs;
+        const timeoutMs = Math.max(0, expiresAt * 1000 - Date.now() - leadTimeMs);
         const timer = window.setTimeout(async () => {
             // Silent revalidate first — server's maybeRefreshSession will refresh
             // the token if a valid refresh_token exists. Only redirect if the
             // session comes back unauthenticated after that.
+            renewalAttemptedForExpiresAt = expiresAt;
             await revalidate();
+            await tick();
             if (!session?.isAuthenticated) {
                 status = 'expired';
                 void handleRedirect(redirectOnExpired);

package/dist/client/OIDCContext.svelte.d.ts

@@ -9,6 +9,7 @@ declare function $$render<TClaims extends OIDCUserClaims = OIDCUserClaims>(): {
         checkSessionIntervalMs?: number;
         monitorSession?: boolean;
         revalidateIntervalMs?: number;
+        renewalLeadTimeMs?: number;
         redirectOnExpired?: "none" | "login" | "logout" | "reload";
         redirectOnRevoked?: "none" | "login" | "logout" | "reload";
         redirectIfUnauthenticated?: boolean;

package/dist/server/index.js

@@ -479,7 +479,7 @@ export function createOIDC(options) {
     };
     async function hook(event) {
         const session = await getSession(event);
-        return {
+        return event.locals.oidc = {
             oidc: {
                 isAuthenticated: Boolean(session),
                 session,
@@ -506,9 +506,8 @@ export function createOIDC(options) {
             try {
                 const result = await handleCallback(event);
                 const response = await handlerOptions.onsuccess?.(event, result);
-                if (response) {
+                if (response)
                     return response;
-                }
                 throw redirect(302, internalRedirectPath(event, handlerOptions.redirectTo ?? result.returnTo, '/'));
             }
             catch (err) {

package/dist/server/jwt.js

@@ -5,8 +5,9 @@ import { base64UrlEncode } from './utils.js';
 export async function fetchJson(url, init) {
     const response = await fetch(url, init);
     if (!response.ok) {
+        const body = await response.text().catch(() => '');
         throw error(response.status, {
-            message: `OIDC request failed for '${url}' with status ${response.status}`
+            message: `OIDC request failed for '${url}' with status ${response.status}: ${body}`
         });
     }
     return (await response.json());

package/dist/server/types.d.ts

@@ -244,12 +244,17 @@ export type OIDCInstance<TClaims extends OIDCUserClaims = OIDCUserClaims, TSessi
     handle: Handle;
     hook: (event: {
         cookies: RequestEvent['cookies'];
+        locals: App.Locals;
     }) => Promise<{
         oidc: OIDCHandleLocals<TClaims, TSession>;
     }>;
     getMetadata: () => Promise<OIDCDiscoveryDocument>;
-    getSession: (event: RequestEvent) => Promise<TSession | null>;
-    getPublicSession: (event: RequestEvent) => Promise<OIDCPublicSession<TClaims> | null>;
+    getSession: (event: {
+        cookies: RequestEvent['cookies'];
+    }) => Promise<TSession | null>;
+    getPublicSession: (event: {
+        cookies: RequestEvent['cookies'];
+    }) => Promise<OIDCPublicSession<TClaims> | null>;
     getSessionManagementConfig: () => Promise<OIDCSessionManagementConfig>;
     login: (event: RequestEvent, loginOptions?: OIDCLoginOptions) => Promise<never>;
     logout: (event: RequestEvent, logoutOptions?: OIDCLogoutOptions) => Promise<never>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sourceregistry/sveltekit-oidc",
-  "version": "1.6.5",
+  "version": "1.6.7",
   "description": "OIDC authentication helpers for SvelteKit applications",
   "license": "Apache-2.0",
   "scripts": {