@svadmin/sso 0.11.1 → 0.11.2

package/dist/auth-provider.d.ts

@@ -17,6 +17,8 @@ export interface SSOConfig {
     scopes?: string[];
     /** Where to redirect after logout */
     postLogoutRedirectUri?: string;
+    /** Optional public RP-initiated logout endpoint override. */
+    endSessionEndpoint?: string;
     /** Token storage backend. Default: 'local' (localStorage) */
     storage?: 'local' | 'session' | TokenStorage;
     /** Storage namespace. Defaults to an issuer/client-specific key. */

package/dist/auth-provider.js

@@ -210,7 +210,10 @@ export function createSSOAuthProvider(config) {
         if (oidcConfig)
             return oidcConfig;
         if (config.manualEndpoints) {
-            oidcConfig = config.manualEndpoints;
+            oidcConfig = {
+                ...config.manualEndpoints,
+                ...(config.endSessionEndpoint ? { end_session_endpoint: config.endSessionEndpoint } : {}),
+            };
             return oidcConfig;
         }
         const url = `${config.issuer.replace(/\/$/, '')}/.well-known/openid-configuration`;
@@ -234,7 +237,10 @@ export function createSSOAuthProvider(config) {
                 cause: error,
             });
         }
-        oidcConfig = readOIDCConfig(discovered);
+        const discoveredConfig = readOIDCConfig(discovered);
+        oidcConfig = config.endSessionEndpoint
+            ? { ...discoveredConfig, end_session_endpoint: config.endSessionEndpoint }
+            : discoveredConfig;
         return oidcConfig;
     }
     async function requestToken(endpoint, body, fallbackMessage) {
@@ -408,14 +414,16 @@ export function createSSOAuthProvider(config) {
             }
             try {
                 const endpoints = await discover();
-                if (typeof window !== 'undefined' && endpoints.end_session_endpoint && session?.id_token) {
-                    const params = new URLSearchParams({
-                        id_token_hint: session.id_token,
-                        ...(config.postLogoutRedirectUri
-                            ? { post_logout_redirect_uri: config.postLogoutRedirectUri }
-                            : {}),
-                    });
-                    window.location.href = `${endpoints.end_session_endpoint}?${params}`;
+                if (typeof window !== 'undefined' && endpoints.end_session_endpoint) {
+                    const logoutUrl = new URL(endpoints.end_session_endpoint, window.location.href);
+                    logoutUrl.searchParams.set('client_id', config.clientId);
+                    logoutUrl.searchParams.delete('id_token_hint');
+                    if (session?.id_token)
+                        logoutUrl.searchParams.set('id_token_hint', session.id_token);
+                    if (config.postLogoutRedirectUri) {
+                        logoutUrl.searchParams.set('post_logout_redirect_uri', config.postLogoutRedirectUri);
+                    }
+                    window.location.href = logoutUrl.href;
                     return { success: true };
                 }
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/sso",
-  "version": "0.11.1",
+  "version": "0.11.2",
   "type": "module",
   "description": "OIDC/OAuth2 SSO AuthProvider plugin for svadmin — supports Okta, Azure AD, Cognito, Keycloak, Google",
   "license": "MIT",
@@ -32,10 +32,10 @@
     "dist"
   ],
   "peerDependencies": {
-    "@svadmin/core": "^0.32.1"
+    "@svadmin/core": "^0.32.2"
   },
   "devDependencies": {
-    "typescript": "^5.7.0"
+    "typescript": "^6.0.3"
   },
   "scripts": {
     "build": "bun ../../scripts/build-node-package.ts"