@startsimpli/auth 0.4.13 → 0.4.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@startsimpli/auth",
-  "version": "0.4.13",
+  "version": "0.4.14",
   "description": "Shared authentication package for StartSimpli Next.js apps",
   "main": "./src/index.ts",
   "types": "./src/index.ts",

package/src/client/auth-client.ts

@@ -53,6 +53,8 @@ export class AuthClient {
       tokenRefreshInterval: 4 * 60 * 1000, // 4 minutes
       onSessionExpired: () => {},
       onUnauthorized: () => {},
+      loginPath: '',
+      callbackParam: 'callbackUrl',
       ...config,
     };
   }

package/src/client/auth-context.tsx

@@ -110,13 +110,30 @@ export function AuthProvider({
 
   // Session expiration handler — covers both AuthClient timer and authFetch 401
   useEffect(() => {
+    // Capture the consumer's onSessionExpired before we overwrite it below.
+    const consumerCallback = config.onSessionExpired;
+    const loginPath = config.loginPath;
+    const callbackParam = config.callbackParam ?? 'callbackUrl';
+
     const handleExpired = () => {
       setState({
         session: null,
         isLoading: false,
         isAuthenticated: false,
       });
-      config.onSessionExpired?.();
+      consumerCallback?.();
+
+      // Redirect to login if configured. Done after state reset + consumer
+      // callback so any cleanup runs first. window.location avoids pulling
+      // a router dep into the shared package — works in any framework.
+      if (loginPath && typeof window !== 'undefined') {
+        const here = window.location.pathname + window.location.search;
+        const isOnLogin = window.location.pathname.startsWith(loginPath);
+        if (!isOnLogin) {
+          const callback = encodeURIComponent(here);
+          window.location.href = `${loginPath}?${callbackParam}=${callback}`;
+        }
+      }
     };
 
     config.onSessionExpired = handleExpired;

package/src/types/index.ts

@@ -111,6 +111,21 @@ export interface AuthConfig {
   tokenRefreshInterval?: number; // milliseconds, default 4 minutes
   onSessionExpired?: () => void;
   onUnauthorized?: () => void;
+  /**
+   * If set, AuthProvider redirects the browser here when the session is
+   * lost (refresh-token rejected, manual logout, etc.). The current path
+   * is appended as a query param so the login page can return the user.
+   * Same value the server-side middleware uses, e.g. `/auth/signin`.
+   * Without this set, session loss only resets React state and the user
+   * can be left on a page where every subsequent request silently 403s
+   * (raise-simpli-lxv).
+   */
+  loginPath?: string;
+  /**
+   * Query-param name appended to `loginPath` to carry the return URL.
+   * Defaults to `callbackUrl` to match the shared server middleware.
+   */
+  callbackParam?: string;
 }
 
 /**