@sourceregistry/sveltekit-oidc 1.7.0 → 1.8.0

package/README.md

@@ -155,6 +155,13 @@ export async function load(event) {
 `OIDCContext`, so the standard setup above does not re-run unrelated page loads. If you destructure
 the load event, pass both `cookies` and `depends`: `oidc.getPublicSession({cookies, depends})`.
 
+When `oidc.handle` has already loaded an enriched session for the current request, project that
+session without reading or enriching it again:
+
+```ts
+const session = oidc.toPublicSession(event.locals.oidc?.session ?? null, event.depends);
+```
+
 Periodic revalidation is disabled by default to avoid unnecessary page updates. Set
 `revalidateIntervalMs` to a positive interval only when you need polling in addition to token-expiry
 and provider session monitoring. Existing integrations that pass only `cookies` remain compatible;

package/dist/server/index.js

@@ -618,18 +618,20 @@ export function createOIDC(options) {
             backChannelLogoutSessionSupported: Boolean(metadata.backchannel_logout_session_supported)
         };
     }
+    function createPublicSession(session, depends) {
+        depends?.(OIDC_SESSION_REVALIDATION_DEPENDENCY);
+        const publicSession = toPublicSession(session);
+        return publicSession && depends
+            ? { ...publicSession, revalidationDependency: OIDC_SESSION_REVALIDATION_DEPENDENCY }
+            : publicSession;
+    }
     return {
         handle,
         hook,
         getMetadata,
         getSession,
-        getPublicSession: async (event) => {
-            event.depends?.(OIDC_SESSION_REVALIDATION_DEPENDENCY);
-            const session = toPublicSession(await getSession(event));
-            return session && event.depends
-                ? { ...session, revalidationDependency: OIDC_SESSION_REVALIDATION_DEPENDENCY }
-                : session;
-        },
+        getPublicSession: async (event) => createPublicSession(await getSession(event), event.depends),
+        toPublicSession: createPublicSession,
         getSessionManagementConfig,
         login: signIn,
         logout: signOut,

package/dist/server/types.d.ts

@@ -290,6 +290,8 @@ export type OIDCInstance<TClaims extends OIDCUserClaims = OIDCUserClaims, TSessi
         cookies: Cookies;
         depends?: (dependency: string) => void;
     }) => Promise<OIDCPublicSession<TClaims> | null>;
+    /** Projects an already-loaded session without reading, refreshing, or enriching it again. */
+    toPublicSession: (session: TSession | null, depends?: (dependency: string) => void) => OIDCPublicSession<TClaims> | null;
     getSessionManagementConfig: () => Promise<OIDCSessionManagementConfig>;
     login: (event: MinimalRequestEvent, loginOptions?: OIDCLoginOptions) => Promise<never>;
     logout: (event: MinimalRequestEvent, logoutOptions?: OIDCLogoutOptions) => Promise<never>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sourceregistry/sveltekit-oidc",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "OIDC authentication helpers for SvelteKit applications",
   "license": "Apache-2.0",
   "scripts": {