@sourceregistry/sveltekit-oidc 1.6.7 → 1.6.9

package/dist/client/OIDCContext.svelte

@@ -6,7 +6,7 @@
 </script>
 
 <script lang="ts" generics="TClaims extends OIDCUserClaims = OIDCUserClaims">
-    import {invalidateAll} from '$app/navigation';
+    import {invalidateAll, beforeNavigate} from '$app/navigation';
     import {tick} from 'svelte';
     import type {Snippet} from 'svelte';
 
@@ -44,6 +44,7 @@
 
     let iframe = $state<HTMLIFrameElement | undefined>(undefined);
     let status = $state<'authenticated' | 'unauthenticated' | 'expired' | 'revoked'>('unauthenticated');
+    let revalidating = $state(false);
     let handledUnauthenticated = $state(false);
 
     const metadata = $derived(config.metadata);
@@ -77,6 +78,9 @@
         get status() {
             return status;
         },
+        get revalidating() {
+            return revalidating;
+        },
         login: (returnTo?: string) => login(returnTo),
         logout,
         revalidate
@@ -110,7 +114,32 @@
     }
 
     async function revalidate() {
-        await invalidateAll();
+        if (revalidating) return;
+        revalidating = true;
+
+        // If the server redirects to the login path during a background
+        // revalidation (e.g. session lost, HMR store reset), intercept the
+        // SvelteKit router navigation so we can handle it through
+        // handleRedirect instead of a jarring mid-page router transition.
+        let sessionExpiredDuringRevalidation = false;
+        const stopIntercept = beforeNavigate(({ to, cancel }) => {
+            if (to?.url.pathname.startsWith(resolvedLoginPath)) {
+                cancel();
+                sessionExpiredDuringRevalidation = true;
+            }
+        });
+
+        try {
+            await invalidateAll();
+        } finally {
+            stopIntercept();
+            revalidating = false;
+        }
+
+        if (sessionExpiredDuringRevalidation) {
+            status = 'expired';
+            void handleRedirect(redirectOnExpired);
+        }
     }
 
     async function handleRedirect(mode: RedirectMode) {
@@ -132,6 +161,10 @@
 
     $effect(() => {
         const isAuthenticated = Boolean(session?.isAuthenticated);
+        // Suppress authenticated→unauthenticated transition while a revalidation is
+        // in-flight — the effect re-runs once revalidating flips false with the
+        // final session state, preventing a mid-refresh flicker.
+        if (revalidating && !isAuthenticated) return;
         status = isAuthenticated ? 'authenticated' : status === 'authenticated' ? 'unauthenticated' : status;
     });
 

package/dist/client/context.d.ts

@@ -10,6 +10,7 @@ export type OIDCClientContextValue<TClaims extends OIDCUserClaims = OIDCUserClai
     groups: OIDCPublicSession<TClaims>['groups'];
     metadata?: Pick<OIDCDiscoveryDocument, 'issuer' | 'check_session_iframe' | 'end_session_endpoint' | 'backchannel_logout_supported' | 'backchannel_logout_session_supported'>;
     status: 'authenticated' | 'unauthenticated' | 'expired' | 'revoked';
+    revalidating: boolean;
     login: (returnTo?: string) => void;
     logout: (clearSessionOnly?: boolean) => Promise<void>;
     revalidate: () => Promise<void>;

package/dist/server/index.js

@@ -479,7 +479,7 @@ export function createOIDC(options) {
     };
     async function hook(event) {
         const session = await getSession(event);
-        return event.locals.oidc = {
+        const locals = {
             oidc: {
                 isAuthenticated: Boolean(session),
                 session,
@@ -494,6 +494,8 @@ export function createOIDC(options) {
                 clearSession: async () => clearPersistedSession(event.cookies)
             }
         };
+        event.locals.oidc = locals.oidc;
+        return locals;
     }
     function loginHandler(defaults = {}) {
         return async (event) => {

package/dist/server/store.js

@@ -17,7 +17,10 @@ export function createInMemoryBackChannelLogoutStore() {
     };
 }
 export function createInMemorySessionStore() {
-    const sessions = new Map();
+    // Persist the Map on globalThis so Vite HMR module re-evaluations don't
+    // create a fresh store and orphan all live session cookies.
+    const g = globalThis;
+    const sessions = (g['__oidc_sessions__'] ??= new Map());
     return {
         async get(sessionId) {
             return sessions.get(sessionId) ?? null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sourceregistry/sveltekit-oidc",
-  "version": "1.6.7",
+  "version": "1.6.9",
   "description": "OIDC authentication helpers for SvelteKit applications",
   "license": "Apache-2.0",
   "scripts": {