@sourceregistry/sveltekit-oidc 1.8.0 → 2.0.0

package/dist/server/index.js

@@ -1,4 +1,4 @@
-import { error, redirect, } from '@sveltejs/kit';
+import { error, redirect } from '@sveltejs/kit';
 import { randomBytes } from 'node:crypto';
 import { decode, fromWeb, verify } from '@sourceregistry/node-jwt/promises';
 import { createOIDCCookieStore } from './cookies.js';
@@ -9,8 +9,7 @@ import { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from
 export { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
 const OIDC_SESSION_REVALIDATION_DEPENDENCY = 'oidc:session';
 function buildLogger(logger) {
-    const noop = () => {
-    };
+    const noop = () => { };
     if (logger === false)
         return { debug: noop, info: noop, warn: noop, error: noop };
     if (logger)
@@ -18,21 +17,19 @@ function buildLogger(logger) {
             debug: (...a) => logger.debug?.(...a),
             info: (...a) => logger.info?.(...a),
             warn: (...a) => logger.warn?.(...a),
-            error: (...a) => logger.error?.(...a),
+            error: (...a) => logger.error?.(...a)
         };
     const p = '[sveltekit-oidc]';
     return {
         debug: (...a) => console.debug(p, ...a),
         info: (...a) => console.info(p, ...a),
         warn: (...a) => console.warn(p, ...a),
-        error: (...a) => console.error(p, ...a),
+        error: (...a) => console.error(p, ...a)
     };
 }
 export function createOIDC(options) {
     const log = buildLogger(options.logger);
-    const sessionStore = options.sessionStore === 'memory'
-        ? createInMemorySessionStore()
-        : options.sessionStore;
+    const sessionStore = options.sessionStore === 'memory' ? createInMemorySessionStore() : options.sessionStore;
     const backChannelLogoutStore = options.backChannelLogoutStore === 'memory'
         ? createInMemoryBackChannelLogoutStore()
         : options.backChannelLogoutStore;
@@ -54,10 +51,20 @@ export function createOIDC(options) {
     const cookieStore = createOIDCCookieStore(options.cookieSecret, sessionCookieName, stateCookieName, cookieOptions);
     let metadataPromise;
     let jwksPromise;
+    function hasCurrentSessionShape(session) {
+        return Boolean(session?.identity?.sub && session.idTokenClaims?.sub);
+    }
     async function readPersistedSession(cookies) {
         if (!sessionStore) {
             const session = cookieStore.readSession(cookies);
-            return session ? { session } : null;
+            if (!session)
+                return null;
+            if (!hasCurrentSessionShape(session)) {
+                log.debug('Discarding an incompatible OIDC session');
+                cookieStore.clearSession(cookies);
+                return null;
+            }
+            return { session };
         }
         const reference = cookieStore.readSessionReference(cookies);
         if (!reference?.id) {
@@ -70,6 +77,12 @@ export function createOIDC(options) {
             cookieStore.clearSessionReference(cookies);
             return null;
         }
+        if (!hasCurrentSessionShape(session)) {
+            log.debug('Discarding an incompatible persisted OIDC session');
+            await sessionStore.delete(reference.id);
+            cookieStore.clearSessionReference(cookies);
+            return null;
+        }
         return {
             id: reference.id,
             session
@@ -108,7 +121,9 @@ export function createOIDC(options) {
                 const issuer = options.issuer ? normalizeIssuer(options.issuer) : undefined;
                 const discoveryUrl = options.discoveryUrl ?? (issuer ? `${issuer}/.well-known/openid-configuration` : undefined);
                 if (!discoveryUrl) {
-                    throw error(500, { message: 'OIDC issuer or discoveryUrl must be configured' });
+                    throw error(500, {
+                        message: 'OIDC issuer or discoveryUrl must be configured'
+                    });
                 }
                 const document = await fetchJson(discoveryUrl, undefined, fetchImpl);
                 return {
@@ -124,9 +139,14 @@ export function createOIDC(options) {
         if (!jwksPromise) {
             jwksPromise = getMetadata().then((metadata) => {
                 if (!metadata.jwks_uri) {
-                    throw error(500, { message: 'OIDC jwks_uri is required to validate id_token values' });
+                    throw error(500, {
+                        message: 'OIDC jwks_uri is required to validate id_token values'
+                    });
                 }
-                return fromWeb(metadata.jwks_uri, { overrideEndpointCheck: true, fetch: fetchImpl });
+                return fromWeb(metadata.jwks_uri, {
+                    overrideEndpointCheck: true,
+                    fetch: fetchImpl
+                });
             });
         }
         return jwksPromise;
@@ -142,7 +162,9 @@ export function createOIDC(options) {
         const jwks = await getJwks();
         const key = decoded.header.kid ? await jwks.key(decoded.header.kid) : (await jwks.list())[0];
         if (!key) {
-            throw error(401, { message: 'Unable to resolve a signing key from JWKS' });
+            throw error(401, {
+                message: 'Unable to resolve a signing key from JWKS'
+            });
         }
         try {
             const result = await verify(token, key.toKeyObject(), verifyOptions);
@@ -150,9 +172,7 @@ export function createOIDC(options) {
         }
         catch (err) {
             throw error(401, {
-                message: typeof err === 'object' && err && 'reason' in err
-                    ? String(err.reason)
-                    : 'JWT verification failed'
+                message: typeof err === 'object' && err && 'reason' in err ? String(err.reason) : 'JWT verification failed'
             });
         }
     }
@@ -167,13 +187,17 @@ export function createOIDC(options) {
                 return { headers, body };
             case 'client_secret_basic':
                 if (!options.clientSecret) {
-                    throw error(500, { message: 'clientSecret is required for client_secret_basic' });
+                    throw error(500, {
+                        message: 'clientSecret is required for client_secret_basic'
+                    });
                 }
                 headers.authorization = asAuthorizationHeader(options.clientId, options.clientSecret);
                 return { headers, body };
             case 'client_secret_post':
                 if (!options.clientSecret) {
-                    throw error(500, { message: 'clientSecret is required for client_secret_post' });
+                    throw error(500, {
+                        message: 'clientSecret is required for client_secret_post'
+                    });
                 }
                 body.set('client_id', options.clientId);
                 body.set('client_secret', options.clientSecret);
@@ -190,7 +214,9 @@ export function createOIDC(options) {
                 return { headers, body };
             case 'private_key_jwt':
                 if (!options.privateKeyJwt?.privateKey) {
-                    throw error(500, { message: 'privateKeyJwt.privateKey is required for private_key_jwt' });
+                    throw error(500, {
+                        message: 'privateKeyJwt.privateKey is required for private_key_jwt'
+                    });
                 }
                 body.set('client_id', options.clientId);
                 body.set('client_assertion', await createPrivateKeyJwtAssertion({
@@ -201,7 +227,9 @@ export function createOIDC(options) {
                 body.set('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');
                 return { headers, body };
             default:
-                throw error(500, { message: `Unsupported client authentication method '${clientAuthMethod}'` });
+                throw error(500, {
+                    message: `Unsupported client authentication method '${clientAuthMethod}'`
+                });
         }
     }
     async function exchangeCode(params) {
@@ -237,9 +265,17 @@ export function createOIDC(options) {
             clockSkew: clockSkewSeconds
         });
         validateIdTokenClaims(claims, nonce);
-        return options.transformClaims
-            ? await options.transformClaims(claims)
-            : claims;
+        return claims;
+    }
+    async function resolveIdentity(idTokenClaims, userInfo, reason) {
+        if (options.resolveIdentity) {
+            return options.resolveIdentity({ idTokenClaims, userInfo, reason });
+        }
+        return {
+            ...idTokenClaims,
+            ...userInfo,
+            groups: userInfo?.groups ?? idTokenClaims.groups
+        };
     }
     async function validateBackChannelLogoutToken(logoutToken) {
         const metadata = await getMetadata();
@@ -276,7 +312,7 @@ export function createOIDC(options) {
         }
         return backChannelLogoutStore.isRevoked(session);
     }
-    async function maybeRefreshSession(cookies, persisted) {
+    async function maybeRefreshSession(cookies, persisted, event) {
         const session = persisted?.session ?? null;
         if (!session) {
             return null;
@@ -312,42 +348,37 @@ export function createOIDC(options) {
                 refreshExpiresAt: session.tokens.refreshExpiresAt
             });
             const tokenResponse = await refreshTokens(session.tokens.refreshToken);
-            const claims = tokenResponse.id_token
+            const idTokenClaims = tokenResponse.id_token
                 ? await validateIdToken(tokenResponse.id_token, session.nonce)
-                : session.claims;
-            const rawUser = options.fetchUserInfo !== false ? await fetchUserInfo(tokenResponse.access_token) : session.user;
-            if (claims) {
-                validateUserInfoSubject(claims, rawUser);
-            }
-            const user = options.transformUser
-                ? await options.transformUser(rawUser, { claims })
-                : rawUser;
+                : session.idTokenClaims;
+            const userInfo = options.fetchUserInfo !== false ? await fetchUserInfo(tokenResponse.access_token) : session.userInfo;
+            validateUserInfoSubject(idTokenClaims, userInfo);
+            const identity = await resolveIdentity(idTokenClaims, userInfo, 'refresh');
             const nextSession = {
                 ...session,
-                sub: claims?.sub ?? session.sub,
-                sid: claims?.sid ?? session.sid,
-                groups: collectGroups(claims, user, session.user, session.claims),
-                claims,
-                user,
+                sub: idTokenClaims.sub,
+                sid: idTokenClaims.sid ?? session.sid,
+                groups: collectGroups(idTokenClaims, userInfo, identity),
+                idTokenClaims,
+                userInfo,
+                identity,
                 sessionState: tokenResponse.session_state ?? session.sessionState,
                 tokens: normalizeTokens(tokenResponse, defaultScope, session.tokens),
                 refreshedAt: Math.floor(Date.now() / 1000)
             };
-            const finalSession = options.transformSession
-                ? await options.transformSession(nextSession, {
-                    tokenResponse,
-                    claims,
-                    user,
-                    isRefresh: true
-                })
-                : nextSession;
-            await writePersistedSession(cookies, finalSession, persisted?.id);
+            await options.beforeSessionPersist?.({
+                session: nextSession,
+                reason: 'refresh',
+                event,
+                tokenResponse
+            });
+            await writePersistedSession(cookies, nextSession, persisted?.id);
             log.debug('OIDC session tokens refreshed', {
-                expiresAt: finalSession.tokens.expiresAt,
-                refreshExpiresAt: finalSession.tokens.refreshExpiresAt,
-                hasRefreshToken: Boolean(finalSession.tokens.refreshToken)
+                expiresAt: nextSession.tokens.expiresAt,
+                refreshExpiresAt: nextSession.tokens.refreshExpiresAt,
+                hasRefreshToken: Boolean(nextSession.tokens.refreshToken)
             });
-            return finalSession;
+            return nextSession;
         }
         catch (err) {
             log.error('Token refresh failed — clearing session', err);
@@ -356,11 +387,7 @@ export function createOIDC(options) {
         }
     }
     async function getSession(event) {
-        const session = await maybeRefreshSession(event.cookies, await readPersistedSession(event.cookies));
-        if (!session || !options.enrichSession) {
-            return session;
-        }
-        return options.enrichSession(session, { event: event });
+        return maybeRefreshSession(event.cookies, await readPersistedSession(event.cookies), 'url' in event && 'request' in event ? event : undefined);
     }
     async function signIn(event, loginOptions = {}) {
         const metadata = await getMetadata();
@@ -416,44 +443,42 @@ export function createOIDC(options) {
             codeVerifier: stateCookie.codeVerifier
         });
         if (!tokenResponse.id_token) {
-            throw error(401, { message: 'OIDC callback response must include an id_token' });
+            throw error(401, {
+                message: 'OIDC callback response must include an id_token'
+            });
         }
-        const claims = await validateIdToken(tokenResponse.id_token, stateCookie.nonce);
-        const rawUser = options.fetchUserInfo === false
+        const idTokenClaims = await validateIdToken(tokenResponse.id_token, stateCookie.nonce);
+        const userInfo = options.fetchUserInfo === false
             ? undefined
             : await fetchUserInfo(tokenResponse.access_token).catch(() => undefined);
-        validateUserInfoSubject(claims, rawUser);
-        const user = options.transformUser
-            ? await options.transformUser(rawUser, { claims })
-            : rawUser;
+        validateUserInfoSubject(idTokenClaims, userInfo);
+        const identity = await resolveIdentity(idTokenClaims, userInfo, 'login');
         const metadata = await getMetadata();
         const now = Math.floor(Date.now() / 1000);
         const session = {
             issuer: metadata.issuer,
             clientId: options.clientId,
             nonce: stateCookie.nonce,
-            sub: claims?.sub,
-            sid: claims?.sid,
+            sub: idTokenClaims.sub,
+            sid: idTokenClaims.sid,
             sessionState: tokenResponse.session_state ?? event.url.searchParams.get('session_state') ?? undefined,
-            groups: collectGroups(claims, user),
-            user,
-            claims,
+            groups: collectGroups(idTokenClaims, userInfo, identity),
+            idTokenClaims,
+            userInfo,
+            identity,
             tokens: normalizeTokens(tokenResponse, defaultScope),
             createdAt: now,
             refreshedAt: now
         };
-        const finalSession = options.transformSession
-            ? await options.transformSession(session, {
-                event: event,
-                tokenResponse,
-                claims,
-                user,
-                isRefresh: false
-            })
-            : session;
-        await writePersistedSession(event.cookies, finalSession);
+        await options.beforeSessionPersist?.({
+            session,
+            reason: 'login',
+            event: event,
+            tokenResponse
+        });
+        await writePersistedSession(event.cookies, session);
         return {
-            session: finalSession,
+            session,
             returnTo: stateCookie.returnTo
         };
     }
@@ -483,7 +508,9 @@ export function createOIDC(options) {
     async function handleBackChannelLogout(event) {
         const metadata = await getMetadata();
         if (!metadata.backchannel_logout_supported) {
-            throw error(400, { message: 'Provider does not advertise back-channel logout support' });
+            throw error(400, {
+                message: 'Provider does not advertise back-channel logout support'
+            });
         }
         if (!backChannelLogoutStore) {
             throw error(500, {
@@ -514,29 +541,27 @@ export function createOIDC(options) {
         throw redirect(302, `${absoluteUrl(event, loginPath)}?returnTo=${encodeURIComponent(internalRedirectPath(event, returnTo ?? `${event.url.pathname}${event.url.search}`, '/'))}`);
     }
     const handle = async ({ event, resolve }) => {
-        const { oidc } = await hook(event);
+        const oidc = await createRequestContext(event);
         event.locals.oidc = oidc;
         return resolve(event);
     };
-    async function hook(event) {
+    async function createRequestContext(event) {
         const session = await getSession(event);
-        const locals = {
-            oidc: {
-                isAuthenticated: Boolean(session),
-                session,
-                user: session?.user,
-                claims: session?.claims,
-                requireAuth: async () => {
-                    if (!session) {
-                        throw error(401, { message: 'Authentication required' });
-                    }
-                    return session;
-                },
-                clearSession: async () => clearPersistedSession(event.cookies)
-            }
+        const data = session && options.loadRequestData ? await options.loadRequestData({ session, event }) : null;
+        const context = {
+            isAuthenticated: Boolean(session),
+            session,
+            identity: session?.identity,
+            data,
+            requireAuth: async () => {
+                if (!session) {
+                    throw error(401, { message: 'Authentication required' });
+                }
+                return session;
+            },
+            clearSession: async () => clearPersistedSession(event.cookies)
         };
-        event.locals.oidc = locals.oidc;
-        return locals;
+        return context;
     }
     function loginHandler(defaults = {}) {
         return async (event) => {
@@ -573,7 +598,11 @@ export function createOIDC(options) {
                 form?.get('clearSessionOnly')?.toString() === '1' ||
                 form?.get('clearSessionOnly')?.toString() === 'true' ||
                 defaults.clearSessionOnly;
-            return signOut(event, { ...defaults, postLogoutRedirectUri, clearSessionOnly });
+            return signOut(event, {
+                ...defaults,
+                postLogoutRedirectUri,
+                clearSessionOnly
+            });
         };
     }
     function backChannelLogoutHandler() {
@@ -590,7 +619,8 @@ export function createOIDC(options) {
                 const form = await event.request.formData();
                 const postLogoutRedirectUri = (form.get('postLogoutRedirectUri')?.toString() ||
                     actionOptions.defaultPostLogoutRedirectUri ||
-                    undefined) ?? undefined;
+                    undefined) ??
+                    undefined;
                 const clearSessionOnly = form.get('clearSessionOnly')?.toString() === '1' ||
                     form.get('clearSessionOnly')?.toString() === 'true';
                 return signOut(event, { postLogoutRedirectUri, clearSessionOnly });
@@ -618,20 +648,34 @@ export function createOIDC(options) {
             backChannelLogoutSessionSupported: Boolean(metadata.backchannel_logout_session_supported)
         };
     }
-    function createPublicSession(session, depends) {
+    function projectPublicSession(context, depends) {
         depends?.(OIDC_SESSION_REVALIDATION_DEPENDENCY);
-        const publicSession = toPublicSession(session);
-        return publicSession && depends
-            ? { ...publicSession, revalidationDependency: OIDC_SESSION_REVALIDATION_DEPENDENCY }
+        if (!context?.session)
+            return null;
+        const base = toPublicSession(context.session);
+        if (!base)
+            return null;
+        const publicSession = options.createPublicSession
+            ? options.createPublicSession({
+                session: context.session,
+                data: context.data,
+                base
+            })
+            : base;
+        return depends
+            ? {
+                ...publicSession,
+                revalidationDependency: OIDC_SESSION_REVALIDATION_DEPENDENCY
+            }
             : publicSession;
     }
     return {
         handle,
-        hook,
+        createRequestContext,
         getMetadata,
         getSession,
-        getPublicSession: async (event) => createPublicSession(await getSession(event), event.depends),
-        toPublicSession: createPublicSession,
+        getPublicSession: async (event) => projectPublicSession(await createRequestContext(event), event.depends),
+        toPublicSession: projectPublicSession,
         getSessionManagementConfig,
         login: signIn,
         logout: signOut,

package/dist/server/store.d.ts

@@ -1,3 +1,3 @@
-import type { OIDCBackChannelLogoutStore, OIDCSession, OIDCSessionStore, OIDCUserClaims } from './types.js';
-export declare function createInMemoryBackChannelLogoutStore<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>>(): OIDCBackChannelLogoutStore<TClaims, TSession>;
-export declare function createInMemorySessionStore<TClaims extends OIDCUserClaims = OIDCUserClaims, TSession extends OIDCSession<TClaims> = OIDCSession<TClaims>>(): OIDCSessionStore<TClaims, TSession>;
+import type { OIDCBackChannelLogoutStore, OIDCSessionStore, OIDCUserClaims } from './types.js';
+export declare function createInMemoryBackChannelLogoutStore<TIdentity extends OIDCUserClaims = OIDCUserClaims>(): OIDCBackChannelLogoutStore<TIdentity>;
+export declare function createInMemorySessionStore<TIdentity extends OIDCUserClaims = OIDCUserClaims>(): OIDCSessionStore<TIdentity>;