@svadmin/sso 0.11.18 → 0.11.20

package/dist/presets.d.ts

@@ -68,13 +68,15 @@ export declare function createKeycloakAuth(baseUrl: string, realm: string, clien
 export declare function createAuth0Auth(domain: string, clientId: string, opts?: PresetOptions): import("./auth-provider.js").SSOAuthProvider;
 export type { PresetOptions };
 /**
- * Supauth OIDC Sign-In (GoTrue-compatible identity provider).
+ * Supauth hosted OIDC Sign-In.
  *
- * Compatible with SupaCloud, SupaOAuth, and any GoTrue-based auth backend.
- * Uses standard OIDC Authorization Code Flow with PKCE.
+ * Targets the SupAuth contract hosted by SupaCloud or SupaOAuth: OIDC endpoints
+ * live below `/auth/v1`, while browser sign-out lives at the public root
+ * `/logout`. Other GoTrue deployments should provide explicit endpoints or use
+ * `createSSOAuthProvider()` directly.
  *
- * @param issuer - Supauth issuer URL (e.g., 'https://auth.example.com')
  * @param clientId - OAuth2 Client ID
+ * @param opts - SSO options. `opts.issuer` accepts a Supauth public root or `/auth/v1` issuer URL.
  */
 export declare function createSupauthAuth(clientId: string, opts?: PresetOptions & {
     issuer?: string;

package/dist/presets.js

@@ -144,22 +144,43 @@ export function createAuth0Auth(domain, clientId, opts) {
     });
 }
 // ─── Supauth / GoTrue ────────────────────────────────────────
+function normalizeSupauthIssuer(configuredIssuer) {
+    const normalizedIssuer = configuredIssuer.replace(/\/+$/, '');
+    if (!normalizedIssuer || normalizedIssuer.endsWith('/auth/v1')) {
+        return {
+            issuer: normalizedIssuer,
+            publicRoot: normalizedIssuer.slice(0, -'/auth/v1'.length),
+        };
+    }
+    return { issuer: `${normalizedIssuer}/auth/v1`, publicRoot: normalizedIssuer };
+}
 /**
- * Supauth OIDC Sign-In (GoTrue-compatible identity provider).
+ * Supauth hosted OIDC Sign-In.
  *
- * Compatible with SupaCloud, SupaOAuth, and any GoTrue-based auth backend.
- * Uses standard OIDC Authorization Code Flow with PKCE.
+ * Targets the SupAuth contract hosted by SupaCloud or SupaOAuth: OIDC endpoints
+ * live below `/auth/v1`, while browser sign-out lives at the public root
+ * `/logout`. Other GoTrue deployments should provide explicit endpoints or use
+ * `createSSOAuthProvider()` directly.
  *
- * @param issuer - Supauth issuer URL (e.g., 'https://auth.example.com')
  * @param clientId - OAuth2 Client ID
+ * @param opts - SSO options. `opts.issuer` accepts a Supauth public root or `/auth/v1` issuer URL.
  */
 export function createSupauthAuth(clientId, opts) {
-    const issuer = opts?.issuer ?? '';
+    const manualLogoutEndpoint = opts?.manualEndpoints?.end_session_endpoint;
+    const { issuer: configuredIssuer = '', endSessionEndpoint: configuredLogoutEndpoint, storageKey: configuredStorageKey, ...providerOptions } = opts ?? {};
+    const { issuer, publicRoot } = normalizeSupauthIssuer(configuredIssuer);
+    const storageKey = configuredStorageKey
+        ?? `svadmin_sso:${encodeURIComponent(configuredIssuer)}:${encodeURIComponent(clientId)}`;
+    const endSessionEndpoint = configuredLogoutEndpoint
+        ?? manualLogoutEndpoint
+        ?? (publicRoot ? `${publicRoot}/logout` : undefined);
     return createSSOAuthProvider({
         issuer,
         clientId,
         scopes: ['openid', 'profile', 'email'],
         redirectUri: resolveRedirectUri(opts),
-        ...opts,
+        storageKey,
+        ...(endSessionEndpoint === undefined ? {} : { endSessionEndpoint }),
+        ...providerOptions,
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/sso",
-  "version": "0.11.18",
+  "version": "0.11.20",
   "type": "module",
   "description": "OIDC/OAuth2 SSO AuthProvider plugin for svadmin — supports Okta, Azure AD, Cognito, Keycloak, Google",
   "license": "MIT",
@@ -34,7 +34,7 @@
     "dist"
   ],
   "peerDependencies": {
-    "@svadmin/core": "^0.49.0"
+    "@svadmin/core": "^0.49.1"
   },
   "devDependencies": {
     "typescript": "^7.0.2"