@spidy092/auth-client 3.2.0 → 3.2.2

package/dist/index.js

@@ -243,7 +243,14 @@ var config = {
   // Required for local dev with mkcert/self-signed certs where httpOnly cookies
   // may not work reliably across origins
   // ⚠️ In true production, set to false and rely on httpOnly cookies
-  persistRefreshToken: false
+  persistRefreshToken: false,
+  // ========== CROSS-TAB LOGOUT BROADCAST ==========
+  // Name of the BroadcastChannel the SDK posts a {type:'LOGOUT', reason}
+  // message on when logout() runs, so sibling tabs of the same app react
+  // immediately instead of waiting for a storage event or a validation poll.
+  // All company browser clients share one channel so the receiver wiring is
+  // identical everywhere. Apps may override per deployment.
+  logoutChannelName: "auth_platform_sso_channel"
 };
 var RUNTIME_POLICY_DEFAULTS = {
   tokenRefreshBuffer: 60,
@@ -412,6 +419,19 @@ async function emitAuthDiagnostic(event, outcome, reasonCode, details = {}) {
 
 // core.js
 var callbackProcessed = false;
+var LOGOUT_REQUEST_TIMEOUT_MS = 8e3;
+function broadcastLogoutToTabs(clientKey, reason = "user_logout") {
+  try {
+    if (typeof BroadcastChannel === "undefined") return;
+    const { logoutChannelName } = getConfig();
+    if (!logoutChannelName) return;
+    const channel = new BroadcastChannel(logoutChannelName);
+    channel.postMessage({ type: "LOGOUT", reason, clientKey });
+    channel.close();
+  } catch (err) {
+    console.warn("\u26A0\uFE0F Cross-tab logout broadcast failed (non-fatal):", (err == null ? void 0 : err.message) || err);
+  }
+}
 function login(clientKeyArg, redirectUriArg, options = {}) {
   resetCallbackState();
   const {
@@ -482,7 +502,9 @@ async function logout(options = {}) {
   clearRefreshToken();
   sessionStorage.removeItem("originalApp");
   sessionStorage.removeItem("returnUrl");
+  broadcastLogoutToTabs(clientKey);
   try {
+    const logoutSignal = typeof AbortSignal !== "undefined" && typeof AbortSignal.timeout === "function" ? AbortSignal.timeout(LOGOUT_REQUEST_TIMEOUT_MS) : void 0;
     const response = await fetch(`${authBaseUrl}/logout/${clientKey}`, {
       method: "POST",
       credentials: "include",
@@ -491,7 +513,8 @@ async function logout(options = {}) {
         "Authorization": token ? `Bearer ${token}` : "",
         "Content-Type": "application/json"
       },
-      body: JSON.stringify({ refreshToken: refreshToken2, idToken: idToken2, scope })
+      body: JSON.stringify({ refreshToken: refreshToken2, idToken: idToken2, scope }),
+      ...logoutSignal ? { signal: logoutSignal } : {}
     });
     if (!response.ok) {
       throw new Error(`Logout failed: ${response.status}`);
@@ -516,6 +539,13 @@ async function logout(options = {}) {
       clientKey
     });
   }
+  if (scope === "sso" && authBaseUrl && clientKey) {
+    const frontChannelLogoutUrl = new URL(
+      `${authBaseUrl.replace(/\/+$/, "")}/logout/${encodeURIComponent(clientKey)}`
+    );
+    window.location.replace(frontChannelLogoutUrl.toString());
+    return;
+  }
   const fallbackUrl = isRouterMode() ? new URL("/login", window.location.origin) : new URL("/login", accountUiUrl);
   fallbackUrl.searchParams.set("logged_out", "true");
   fallbackUrl.searchParams.set("client", clientKey);