@svadmin/sso 0.11.0 → 0.11.1

package/dist/auth-provider.js

@@ -8,6 +8,35 @@ import { createAuthenticatedFetch as buildAuthenticatedFetch } from './authentic
 import { createSSOAuthNetworkError, createSSOAuthResponseError, isTerminalSessionError, SSOAuthError, } from './errors.js';
 import { createSessionManager, } from './session-manager.js';
 const DEFAULT_STORAGE_KEY = 'svadmin_sso';
+const REQUIRED_OIDC_ENDPOINTS = [
+    'authorization_endpoint',
+    'token_endpoint',
+    'userinfo_endpoint',
+];
+function readOIDCConfig(body) {
+    const discovery = typeof body === 'object' && body !== null && !Array.isArray(body)
+        ? body
+        : {};
+    const missingEndpoints = REQUIRED_OIDC_ENDPOINTS.filter((endpoint) => {
+        const value = discovery[endpoint];
+        return typeof value !== 'string' || value.length === 0;
+    });
+    if (missingEndpoints.length > 0) {
+        throw new SSOAuthError(`OIDC discovery returned incomplete endpoints: missing ${missingEndpoints.join(', ')}`, 502, {
+            code: 'invalid_discovery_document',
+            body,
+        });
+    }
+    return {
+        authorization_endpoint: discovery.authorization_endpoint,
+        token_endpoint: discovery.token_endpoint,
+        userinfo_endpoint: discovery.userinfo_endpoint,
+        ...(typeof discovery.end_session_endpoint === 'string'
+            && discovery.end_session_endpoint.length > 0
+            ? { end_session_endpoint: discovery.end_session_endpoint }
+            : {}),
+    };
+}
 function decodeJwtPayload(token) {
     if (!token)
         return null;
@@ -205,15 +234,7 @@ export function createSSOAuthProvider(config) {
                 cause: error,
             });
         }
-        if (typeof discovered.authorization_endpoint !== 'string'
-            || typeof discovered.token_endpoint !== 'string'
-            || typeof discovered.userinfo_endpoint !== 'string') {
-            throw new SSOAuthError('OIDC discovery returned incomplete endpoints', 502, {
-                code: 'invalid_discovery_document',
-                body: discovered,
-            });
-        }
-        oidcConfig = discovered;
+        oidcConfig = readOIDCConfig(discovered);
         return oidcConfig;
     }
     async function requestToken(endpoint, body, fallbackMessage) {
@@ -407,7 +428,16 @@ export function createSSOAuthProvider(config) {
             };
         },
         async check() {
-            const existingSession = sessions.getSession();
+            let existingSession = sessions.getSession();
+            if (!existingSession) {
+                try {
+                    await sessions.clearInvalidSession();
+                    existingSession = sessions.getSession();
+                }
+                catch (error) {
+                    return { authenticated: false, error: getErrorResult(error) };
+                }
+            }
             if (typeof window === 'undefined') {
                 const now = Math.floor(Date.now() / 1000);
                 return existingSession && (existingSession.expires_at === undefined || existingSession.expires_at > now)

package/dist/session-manager.d.ts

@@ -31,6 +31,7 @@ export interface TokenStorageLike {
 }
 export interface SessionManager {
     getSession: () => SSOSession | null;
+    clearInvalidSession: () => Promise<void>;
     getAuthGeneration: () => number;
     saveSession: (session: SSOSession, event?: AuthStateChangeEvent) => void;
     clearSession: () => void;

package/dist/session-manager.js

@@ -306,6 +306,17 @@ export function createSessionManager(options) {
             });
         }
     }
+    function clearInvalidSession() {
+        const initialSnapshot = getSessionSnapshot();
+        if (initialSnapshot.raw === null || initialSnapshot.session)
+            return Promise.resolve();
+        return runAuthMutation(async () => {
+            const currentRaw = locallySignedOut ? null : options.storage.getItem(keys.tokens);
+            if (currentRaw === null || parseSession(currentRaw))
+                return;
+            clearTokenSession();
+        });
+    }
     function resolveRefreshRace(expectedRaw) {
         const currentRaw = locallySignedOut ? null : options.storage.getItem(keys.tokens);
         if (currentRaw === expectedRaw)
@@ -432,8 +443,11 @@ export function createSessionManager(options) {
     }
     async function getAccessToken(accessOptions = {}) {
         const snapshot = getSessionSnapshot();
-        if (!snapshot.raw || !snapshot.session)
+        if (!snapshot.raw || !snapshot.session) {
+            if (snapshot.raw)
+                await clearInvalidSession();
             return null;
+        }
         const { raw: initialRaw, session } = snapshot;
         const minValiditySeconds = Math.max(0, accessOptions.minValiditySeconds ?? 0);
         const now = Math.floor(Date.now() / 1000);
@@ -532,6 +546,7 @@ export function createSessionManager(options) {
     scheduleRefresh(parseSession(lastObservedRaw));
     return {
         getSession,
+        clearInvalidSession,
         getAuthGeneration: () => authGeneration,
         saveSession,
         clearSession,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/sso",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "type": "module",
   "description": "OIDC/OAuth2 SSO AuthProvider plugin for svadmin — supports Okta, Azure AD, Cognito, Keycloak, Google",
   "license": "MIT",
@@ -32,7 +32,7 @@
     "dist"
   ],
   "peerDependencies": {
-    "@svadmin/core": "^0.32.0"
+    "@svadmin/core": "^0.32.1"
   },
   "devDependencies": {
     "typescript": "^5.7.0"