@svadmin/sso 0.11.1 → 0.11.3

package/dist/auth-provider.d.ts

@@ -17,6 +17,8 @@ export interface SSOConfig {
     scopes?: string[];
     /** Where to redirect after logout */
     postLogoutRedirectUri?: string;
+    /** Optional public RP-initiated logout endpoint override. */
+    endSessionEndpoint?: string;
     /** Token storage backend. Default: 'local' (localStorage) */
     storage?: 'local' | 'session' | TokenStorage;
     /** Storage namespace. Defaults to an issuer/client-specific key. */

package/dist/auth-provider.js

@@ -85,6 +85,9 @@ function readOptionalTokenString(response, field, fallback, fallbackMessage) {
         ? fallback
         : requireTokenString(response, field, fallbackMessage);
 }
+function authorizationScheme(tokenType) {
+    return tokenType.toLowerCase() === 'bearer' ? 'Bearer' : tokenType;
+}
 function normalizeTokenResponse(body, defaults, fallbackMessage) {
     const response = readTokenResponse(body, fallbackMessage);
     const accessToken = requireTokenString(response, 'access_token', fallbackMessage);
@@ -93,7 +96,7 @@ function normalizeTokenResponse(body, defaults, fallbackMessage) {
         id_token: typeof response.id_token === 'string' ? response.id_token : defaults.idToken,
         refresh_token: readOptionalTokenString(response, 'refresh_token', defaults.refreshToken, fallbackMessage),
         expires_at: getAccessTokenExpiry(response, accessToken),
-        token_type: readOptionalTokenString(response, 'token_type', defaults.tokenType, fallbackMessage) ?? defaults.tokenType,
+        token_type: authorizationScheme(readOptionalTokenString(response, 'token_type', defaults.tokenType, fallbackMessage) ?? defaults.tokenType),
     };
 }
 function generateRandomString(length) {
@@ -210,7 +213,10 @@ export function createSSOAuthProvider(config) {
         if (oidcConfig)
             return oidcConfig;
         if (config.manualEndpoints) {
-            oidcConfig = config.manualEndpoints;
+            oidcConfig = {
+                ...config.manualEndpoints,
+                ...(config.endSessionEndpoint ? { end_session_endpoint: config.endSessionEndpoint } : {}),
+            };
             return oidcConfig;
         }
         const url = `${config.issuer.replace(/\/$/, '')}/.well-known/openid-configuration`;
@@ -234,7 +240,10 @@ export function createSSOAuthProvider(config) {
                 cause: error,
             });
         }
-        oidcConfig = readOIDCConfig(discovered);
+        const discoveredConfig = readOIDCConfig(discovered);
+        oidcConfig = config.endSessionEndpoint
+            ? { ...discoveredConfig, end_session_endpoint: config.endSessionEndpoint }
+            : discoveredConfig;
         return oidcConfig;
     }
     async function requestToken(endpoint, body, fallbackMessage) {
@@ -343,7 +352,7 @@ export function createSSOAuthProvider(config) {
             const accessToken = await sessions.getAccessToken(options);
             const session = sessions.getSession();
             return accessToken && session?.access_token === accessToken
-                ? `${session.token_type} ${accessToken}`
+                ? `${authorizationScheme(session.token_type)} ${accessToken}`
                 : null;
         },
     };
@@ -407,15 +416,18 @@ export function createSSOAuthProvider(config) {
                 sessions.clearSession();
             }
             try {
-                const endpoints = await discover();
-                if (typeof window !== 'undefined' && endpoints.end_session_endpoint && session?.id_token) {
-                    const params = new URLSearchParams({
-                        id_token_hint: session.id_token,
-                        ...(config.postLogoutRedirectUri
-                            ? { post_logout_redirect_uri: config.postLogoutRedirectUri }
-                            : {}),
-                    });
-                    window.location.href = `${endpoints.end_session_endpoint}?${params}`;
+                const endSessionEndpoint = config.endSessionEndpoint
+                    ?? (await discover()).end_session_endpoint;
+                if (typeof window !== 'undefined' && endSessionEndpoint) {
+                    const logoutUrl = new URL(endSessionEndpoint, window.location.href);
+                    logoutUrl.searchParams.set('client_id', config.clientId);
+                    logoutUrl.searchParams.delete('id_token_hint');
+                    if (session?.id_token)
+                        logoutUrl.searchParams.set('id_token_hint', session.id_token);
+                    if (config.postLogoutRedirectUri) {
+                        logoutUrl.searchParams.set('post_logout_redirect_uri', config.postLogoutRedirectUri);
+                    }
+                    window.location.href = logoutUrl.href;
                     return { success: true };
                 }
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/sso",
-  "version": "0.11.1",
+  "version": "0.11.3",
   "type": "module",
   "description": "OIDC/OAuth2 SSO AuthProvider plugin for svadmin — supports Okta, Azure AD, Cognito, Keycloak, Google",
   "license": "MIT",
@@ -32,10 +32,10 @@
     "dist"
   ],
   "peerDependencies": {
-    "@svadmin/core": "^0.32.1"
+    "@svadmin/core": "^0.32.2"
   },
   "devDependencies": {
-    "typescript": "^5.7.0"
+    "typescript": "^6.0.3"
   },
   "scripts": {
     "build": "bun ../../scripts/build-node-package.ts"