@sourceregistry/sveltekit-oidc 2.0.0 → 2.0.2

package/README.md

@@ -211,6 +211,12 @@ returns. `getPublicSession(event)` is available when the hook has not already lo
 `OIDCContext` supports local expiry handling, targeted SvelteKit revalidation,
 `check_session_iframe` monitoring, and local or provider logout.
 
+When the OP iframe reports `changed`, the component first performs the Session Management 1.0
+`prompt=none` authorization check in a hidden iframe. The login handler supplies the current ID token
+as `id_token_hint`; a matching End-User refreshes the local session, while an OP error or a different
+End-User clears it. Applications using the standard `loginHandler()` and `callbackHandler()` routes do
+not need an additional endpoint.
+
 ## Session stores
 
 Without `sessionStore`, the encrypted session is stored in the cookie. For server-side sessions:

package/dist/client/OIDCContext.svelte

@@ -7,10 +7,11 @@
 
 <script lang="ts" generics="TIdentity extends OIDCUserClaims = OIDCUserClaims">
     import {beforeNavigate, invalidate, invalidateAll} from '$app/navigation';
-    import {tick} from 'svelte';
+    import {onDestroy, tick} from 'svelte';
     import type {Snippet} from 'svelte';
 
     import {setOIDCContext} from './context.js';
+    import {classifySessionMonitorEvent} from './session-monitor.js';
 
     type RedirectMode = 'login' | 'logout' | 'reload' | 'none';
 
@@ -50,7 +51,10 @@
         children?: Snippet;
     } = $props();
 
-    let iframe = $state<HTMLIFrameElement | undefined>(undefined);
+    let sessionIframe = $state<HTMLIFrameElement | undefined>(undefined);
+    let silentReauthenticationIframe = $state<HTMLIFrameElement | undefined>(undefined);
+    let silentReauthenticationUrl = $state<string | undefined>(undefined);
+    let silentReauthenticationTimeout: number | undefined;
     let status = $state<'authenticated' | 'unauthenticated' | 'expired' | 'revoked'>('unauthenticated');
     let revalidating = $state(false);
     let handledUnauthenticated = $state(false);
@@ -112,8 +116,14 @@
         }
     });
 
-    function buildLoginUrl(returnTo = `${window.location.pathname}${window.location.search}`) {
-        return `${resolvedLoginPath}?returnTo=${encodeURIComponent(returnTo)}`;
+    function buildLoginUrl(
+        returnTo = `${window.location.pathname}${window.location.search}`,
+        prompt?: 'none'
+    ) {
+        const url = new URL(resolvedLoginPath, window.location.href);
+        url.searchParams.set('returnTo', returnTo);
+        if (prompt) url.searchParams.set('prompt', prompt);
+        return `${url.pathname}${url.search}${url.hash}`;
     }
 
     async function logout(clearSessionOnly = false) {
@@ -203,6 +213,58 @@
         login();
     }
 
+    async function finishSilentReauthentication(result: 'authenticated' | 'logged_out') {
+        if (silentReauthenticationTimeout) {
+            window.clearTimeout(silentReauthenticationTimeout);
+            silentReauthenticationTimeout = undefined;
+        }
+        silentReauthenticationUrl = undefined;
+        await revalidate();
+        await tick();
+
+        if (result === 'authenticated' && session?.isAuthenticated) {
+            status = 'authenticated';
+            debug('silent_reauthentication_completed', {sub: session.sub});
+            return;
+        }
+
+        status = 'revoked';
+        debug('silent_reauthentication_logged_out');
+        await handleRedirect(redirectOnRevoked);
+    }
+
+    function startSilentReauthentication() {
+        if (silentReauthenticationUrl) return;
+
+        debug('silent_reauthentication_started');
+        silentReauthenticationUrl = buildLoginUrl(
+            `${window.location.pathname}${window.location.search}`,
+            'none'
+        );
+        silentReauthenticationTimeout = window.setTimeout(() => {
+            debug('silent_reauthentication_timed_out');
+            void logout(true).then(() => finishSilentReauthentication('logged_out'));
+        }, 30_000);
+    }
+
+    function handleSilentReauthenticationLoad() {
+        if (!silentReauthenticationUrl || !silentReauthenticationIframe?.contentWindow) return;
+
+        try {
+            const documentElement = silentReauthenticationIframe.contentWindow.document.documentElement;
+            const result = documentElement.dataset.oidcSilentReauth;
+            if (result === 'authenticated' || result === 'logged_out') {
+                void finishSilentReauthentication(result);
+            }
+        } catch {
+            // The authorization request is currently displaying the cross-origin OP document.
+        }
+    }
+
+    onDestroy(() => {
+        if (silentReauthenticationTimeout) window.clearTimeout(silentReauthenticationTimeout);
+    });
+
     $effect(() => {
         const isAuthenticated = Boolean(session?.isAuthenticated);
         // Suppress authenticated→unauthenticated transition while a revalidation is
@@ -284,27 +346,30 @@
     });
 
     $effect(() => {
-        if (!canMonitorIframe || !iframeUrl || !iframe) {
+        if (!canMonitorIframe || !iframeUrl || !sessionIframe) {
             return;
         }
 
         const targetOrigin = new URL(iframeUrl).origin;
         const poll = window.setInterval(() => {
-            if (!iframe?.contentWindow || !session?.sessionState) {
+            if (!sessionIframe?.contentWindow || !session?.sessionState) {
                 return;
             }
 
-            iframe.contentWindow.postMessage(`${config.clientId} ${session.sessionState}`, targetOrigin);
+            sessionIframe.contentWindow.postMessage(`${config.clientId} ${session.sessionState}`, targetOrigin);
         }, checkSessionIntervalMs);
 
         const onMessage = (event: MessageEvent) => {
-            if (event.origin !== targetOrigin || typeof event.data !== 'string') {
+            const result = classifySessionMonitorEvent(event, targetOrigin, sessionIframe?.contentWindow);
+            if (result === 'error') {
+                // `error` means the OP could not determine session state (for example,
+                // transient storage or network denial). It is not proof of revocation.
+                debug('iframe_session_error', {origin: event.origin});
                 return;
             }
-            if (event.data === 'changed' || event.data === 'error') {
-                debug('iframe_session_event', {result: event.data, origin: event.origin});
-                status = 'revoked';
-                void logout(true).then(() => handleRedirect(redirectOnRevoked));
+            if (result === 'changed') {
+                debug('iframe_session_event', {result, origin: event.origin});
+                startSilentReauthentication();
             }
         };
 
@@ -319,7 +384,8 @@
 
 {#if canMonitorIframe && iframeUrl}
     <iframe
-            bind:this={iframe}
+            id="oidc-session-monitor"
+            bind:this={sessionIframe}
             title="OIDC session monitor"
             src={iframeUrl}
             hidden
@@ -327,4 +393,15 @@
     ></iframe>
 {/if}
 
+{#if silentReauthenticationUrl}
+    <iframe
+            bind:this={silentReauthenticationIframe}
+            title="OIDC silent re-authentication"
+            src={silentReauthenticationUrl}
+            onload={handleSilentReauthenticationLoad}
+            hidden
+            aria-hidden="true"
+    ></iframe>
+{/if}
+
 {@render children?.()}

package/dist/client/session-monitor.d.ts

@@ -0,0 +1,3 @@
+export type OIDCSessionMonitorMessage = 'changed' | 'unchanged' | 'error' | 'ignored';
+export declare function classifySessionMonitorMessage(data: unknown): OIDCSessionMonitorMessage;
+export declare function classifySessionMonitorEvent(event: Pick<MessageEvent, 'data' | 'origin' | 'source'>, expectedOrigin: string, expectedSource: unknown): OIDCSessionMonitorMessage;

package/dist/client/session-monitor.js

@@ -0,0 +1,9 @@
+export function classifySessionMonitorMessage(data) {
+    return data === 'changed' || data === 'unchanged' || data === 'error' ? data : 'ignored';
+}
+export function classifySessionMonitorEvent(event, expectedOrigin, expectedSource) {
+    if (event.origin !== expectedOrigin || !expectedSource || event.source !== expectedSource) {
+        return 'ignored';
+    }
+    return classifySessionMonitorMessage(event.data);
+}

package/dist/server/index.js

@@ -8,6 +8,21 @@ import { absoluteUrl, base64UrlEncode, buildCookieOptions, collectGroups, create
 import { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
 export { createInMemoryBackChannelLogoutStore, createInMemorySessionStore } from './store.js';
 const OIDC_SESSION_REVALIDATION_DEPENDENCY = 'oidc:session';
+const LOGIN_PROMPTS = new Set([
+    'login',
+    'consent',
+    'none',
+    'select_account'
+]);
+function silentReauthenticationResponse(status) {
+    return new Response(`<!doctype html><html lang="en" data-oidc-silent-reauth="${status}"><head><meta charset="utf-8"><title>OIDC session check</title></head><body></body></html>`, {
+        headers: {
+            'Content-Type': 'text/html; charset=utf-8',
+            'Cache-Control': 'no-store',
+            'Content-Security-Policy': "default-src 'none'; frame-ancestors 'self'"
+        }
+    });
+}
 function buildLogger(logger) {
     const noop = () => { };
     if (logger === false)
@@ -395,11 +410,14 @@ export function createOIDC(options) {
         const state = base64UrlEncode(randomBytes(24));
         const nonce = base64UrlEncode(randomBytes(24));
         const returnTo = internalRedirectPath(event, loginOptions.returnTo ?? options.defaultLoginRedirect, '/');
+        const existingSession = loginOptions.prompt === 'none' ? await readPersistedSession(event.cookies) : null;
         cookieStore.writeState(event.cookies, {
             state,
             nonce,
             codeVerifier: pkce.verifier,
             returnTo,
+            prompt: loginOptions.prompt,
+            originalSub: existingSession?.session.sub,
             createdAt: Math.floor(Date.now() / 1000)
         });
         const redirectUri = absoluteUrl(event, redirectPath);
@@ -418,6 +436,9 @@ export function createOIDC(options) {
         if (loginOptions.prompt) {
             authorizationUrl.searchParams.set('prompt', loginOptions.prompt);
         }
+        if (loginOptions.prompt === 'none' && existingSession?.session.tokens.idToken) {
+            authorizationUrl.searchParams.set('id_token_hint', existingSession.session.tokens.idToken);
+        }
         for (const [key, value] of Object.entries(loginOptions.extraParams ?? {})) {
             authorizationUrl.searchParams.set(key, value);
         }
@@ -448,6 +469,9 @@ export function createOIDC(options) {
             });
         }
         const idTokenClaims = await validateIdToken(tokenResponse.id_token, stateCookie.nonce);
+        if (stateCookie.prompt === 'none' && stateCookie.originalSub && idTokenClaims.sub !== stateCookie.originalSub) {
+            throw error(401, { message: 'Silent re-authentication returned a different End-User' });
+        }
         const userInfo = options.fetchUserInfo === false
             ? undefined
             : await fetchUserInfo(tokenResponse.access_token).catch(() => undefined);
@@ -476,7 +500,8 @@ export function createOIDC(options) {
             event: event,
             tokenResponse
         });
-        await writePersistedSession(event.cookies, session);
+        const existingSession = stateCookie.prompt === 'none' ? await readPersistedSession(event.cookies) : null;
+        await writePersistedSession(event.cookies, session, existingSession?.id);
         return {
             session,
             returnTo: stateCookie.returnTo
@@ -566,19 +591,36 @@ export function createOIDC(options) {
     function loginHandler(defaults = {}) {
         return async (event) => {
             const returnTo = event.url.searchParams.get('returnTo') ?? defaults.returnTo;
-            return signIn(event, { ...defaults, returnTo });
+            const requestedPrompt = event.url.searchParams.get('prompt');
+            const prompt = requestedPrompt && LOGIN_PROMPTS.has(requestedPrompt)
+                ? requestedPrompt
+                : defaults.prompt;
+            return signIn(event, { ...defaults, returnTo, prompt });
         };
     }
     function callbackHandler(handlerOptions = {}) {
         return async (event) => {
+            const stateCookie = cookieStore.readState(event.cookies);
+            const callbackState = event.url.searchParams.get('state');
+            const isSilentReauthentication = Boolean(stateCookie?.prompt === 'none' && callbackState && callbackState === stateCookie.state);
             try {
                 const result = await handleCallback(event);
+                if (isSilentReauthentication) {
+                    return silentReauthenticationResponse('authenticated');
+                }
                 const response = await handlerOptions.onsuccess?.(event, result);
                 if (response)
                     return response;
                 throw redirect(302, internalRedirectPath(event, handlerOptions.redirectTo ?? result.returnTo, '/'));
             }
             catch (err) {
+                if (isSilentReauthentication) {
+                    cookieStore.clearState(event.cookies);
+                    const persisted = await readPersistedSession(event.cookies);
+                    await clearPersistedSession(event.cookies, persisted?.id);
+                    log.debug('Silent OIDC re-authentication failed — clearing local session');
+                    return silentReauthenticationResponse('logged_out');
+                }
                 const response = await handlerOptions.onfailure?.(event, err);
                 if (response) {
                     return response;

package/dist/server/types.d.ts

@@ -244,6 +244,8 @@ export type OIDCStateCookie = {
     nonce: string;
     codeVerifier: string;
     returnTo: string;
+    prompt?: OIDCLoginOptions['prompt'];
+    originalSub?: string;
     createdAt: number;
 };
 export type MinimalRequestEvent = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sourceregistry/sveltekit-oidc",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "OIDC authentication helpers for SvelteKit applications",
   "license": "Apache-2.0",
   "scripts": {