@svadmin/sso 0.11.0 → 0.11.2

package/dist/auth-provider.d.ts

@@ -17,6 +17,8 @@ export interface SSOConfig {
     scopes?: string[];
     /** Where to redirect after logout */
     postLogoutRedirectUri?: string;
+    /** Optional public RP-initiated logout endpoint override. */
+    endSessionEndpoint?: string;
     /** Token storage backend. Default: 'local' (localStorage) */
     storage?: 'local' | 'session' | TokenStorage;
     /** Storage namespace. Defaults to an issuer/client-specific key. */

package/dist/auth-provider.js

@@ -8,6 +8,35 @@ import { createAuthenticatedFetch as buildAuthenticatedFetch } from './authentic
 import { createSSOAuthNetworkError, createSSOAuthResponseError, isTerminalSessionError, SSOAuthError, } from './errors.js';
 import { createSessionManager, } from './session-manager.js';
 const DEFAULT_STORAGE_KEY = 'svadmin_sso';
+const REQUIRED_OIDC_ENDPOINTS = [
+    'authorization_endpoint',
+    'token_endpoint',
+    'userinfo_endpoint',
+];
+function readOIDCConfig(body) {
+    const discovery = typeof body === 'object' && body !== null && !Array.isArray(body)
+        ? body
+        : {};
+    const missingEndpoints = REQUIRED_OIDC_ENDPOINTS.filter((endpoint) => {
+        const value = discovery[endpoint];
+        return typeof value !== 'string' || value.length === 0;
+    });
+    if (missingEndpoints.length > 0) {
+        throw new SSOAuthError(`OIDC discovery returned incomplete endpoints: missing ${missingEndpoints.join(', ')}`, 502, {
+            code: 'invalid_discovery_document',
+            body,
+        });
+    }
+    return {
+        authorization_endpoint: discovery.authorization_endpoint,
+        token_endpoint: discovery.token_endpoint,
+        userinfo_endpoint: discovery.userinfo_endpoint,
+        ...(typeof discovery.end_session_endpoint === 'string'
+            && discovery.end_session_endpoint.length > 0
+            ? { end_session_endpoint: discovery.end_session_endpoint }
+            : {}),
+    };
+}
 function decodeJwtPayload(token) {
     if (!token)
         return null;
@@ -181,7 +210,10 @@ export function createSSOAuthProvider(config) {
         if (oidcConfig)
             return oidcConfig;
         if (config.manualEndpoints) {
-            oidcConfig = config.manualEndpoints;
+            oidcConfig = {
+                ...config.manualEndpoints,
+                ...(config.endSessionEndpoint ? { end_session_endpoint: config.endSessionEndpoint } : {}),
+            };
             return oidcConfig;
         }
         const url = `${config.issuer.replace(/\/$/, '')}/.well-known/openid-configuration`;
@@ -205,15 +237,10 @@ export function createSSOAuthProvider(config) {
                 cause: error,
             });
         }
-        if (typeof discovered.authorization_endpoint !== 'string'
-            || typeof discovered.token_endpoint !== 'string'
-            || typeof discovered.userinfo_endpoint !== 'string') {
-            throw new SSOAuthError('OIDC discovery returned incomplete endpoints', 502, {
-                code: 'invalid_discovery_document',
-                body: discovered,
-            });
-        }
-        oidcConfig = discovered;
+        const discoveredConfig = readOIDCConfig(discovered);
+        oidcConfig = config.endSessionEndpoint
+            ? { ...discoveredConfig, end_session_endpoint: config.endSessionEndpoint }
+            : discoveredConfig;
         return oidcConfig;
     }
     async function requestToken(endpoint, body, fallbackMessage) {
@@ -387,14 +414,16 @@ export function createSSOAuthProvider(config) {
             }
             try {
                 const endpoints = await discover();
-                if (typeof window !== 'undefined' && endpoints.end_session_endpoint && session?.id_token) {
-                    const params = new URLSearchParams({
-                        id_token_hint: session.id_token,
-                        ...(config.postLogoutRedirectUri
-                            ? { post_logout_redirect_uri: config.postLogoutRedirectUri }
-                            : {}),
-                    });
-                    window.location.href = `${endpoints.end_session_endpoint}?${params}`;
+                if (typeof window !== 'undefined' && endpoints.end_session_endpoint) {
+                    const logoutUrl = new URL(endpoints.end_session_endpoint, window.location.href);
+                    logoutUrl.searchParams.set('client_id', config.clientId);
+                    logoutUrl.searchParams.delete('id_token_hint');
+                    if (session?.id_token)
+                        logoutUrl.searchParams.set('id_token_hint', session.id_token);
+                    if (config.postLogoutRedirectUri) {
+                        logoutUrl.searchParams.set('post_logout_redirect_uri', config.postLogoutRedirectUri);
+                    }
+                    window.location.href = logoutUrl.href;
                     return { success: true };
                 }
             }
@@ -407,7 +436,16 @@ export function createSSOAuthProvider(config) {
             };
         },
         async check() {
-            const existingSession = sessions.getSession();
+            let existingSession = sessions.getSession();
+            if (!existingSession) {
+                try {
+                    await sessions.clearInvalidSession();
+                    existingSession = sessions.getSession();
+                }
+                catch (error) {
+                    return { authenticated: false, error: getErrorResult(error) };
+                }
+            }
             if (typeof window === 'undefined') {
                 const now = Math.floor(Date.now() / 1000);
                 return existingSession && (existingSession.expires_at === undefined || existingSession.expires_at > now)

package/dist/session-manager.d.ts

@@ -31,6 +31,7 @@ export interface TokenStorageLike {
 }
 export interface SessionManager {
     getSession: () => SSOSession | null;
+    clearInvalidSession: () => Promise<void>;
     getAuthGeneration: () => number;
     saveSession: (session: SSOSession, event?: AuthStateChangeEvent) => void;
     clearSession: () => void;

package/dist/session-manager.js

@@ -306,6 +306,17 @@ export function createSessionManager(options) {
             });
         }
     }
+    function clearInvalidSession() {
+        const initialSnapshot = getSessionSnapshot();
+        if (initialSnapshot.raw === null || initialSnapshot.session)
+            return Promise.resolve();
+        return runAuthMutation(async () => {
+            const currentRaw = locallySignedOut ? null : options.storage.getItem(keys.tokens);
+            if (currentRaw === null || parseSession(currentRaw))
+                return;
+            clearTokenSession();
+        });
+    }
     function resolveRefreshRace(expectedRaw) {
         const currentRaw = locallySignedOut ? null : options.storage.getItem(keys.tokens);
         if (currentRaw === expectedRaw)
@@ -432,8 +443,11 @@ export function createSessionManager(options) {
     }
     async function getAccessToken(accessOptions = {}) {
         const snapshot = getSessionSnapshot();
-        if (!snapshot.raw || !snapshot.session)
+        if (!snapshot.raw || !snapshot.session) {
+            if (snapshot.raw)
+                await clearInvalidSession();
             return null;
+        }
         const { raw: initialRaw, session } = snapshot;
         const minValiditySeconds = Math.max(0, accessOptions.minValiditySeconds ?? 0);
         const now = Math.floor(Date.now() / 1000);
@@ -532,6 +546,7 @@ export function createSessionManager(options) {
     scheduleRefresh(parseSession(lastObservedRaw));
     return {
         getSession,
+        clearInvalidSession,
         getAuthGeneration: () => authGeneration,
         saveSession,
         clearSession,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/sso",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "type": "module",
   "description": "OIDC/OAuth2 SSO AuthProvider plugin for svadmin — supports Okta, Azure AD, Cognito, Keycloak, Google",
   "license": "MIT",
@@ -32,10 +32,10 @@
     "dist"
   ],
   "peerDependencies": {
-    "@svadmin/core": "^0.32.0"
+    "@svadmin/core": "^0.32.2"
   },
   "devDependencies": {
-    "typescript": "^5.7.0"
+    "typescript": "^6.0.3"
   },
   "scripts": {
     "build": "bun ../../scripts/build-node-package.ts"