@svadmin/sso 0.11.5 → 0.11.7

package/dist/auth-provider.d.ts

@@ -41,6 +41,8 @@ export interface SSOConfig {
     refreshLock?: RefreshLock;
     /** Injectable fetch implementation for testing and SSR runtimes. */
     fetcher?: typeof fetch;
+    /** Trusted permission resolver. Without one, getPermissions() returns null. */
+    getPermissions?: SSOPermissionResolver;
     /**
      * Manual OAuth2 endpoints for providers that don't support OIDC discovery
      * (e.g., GitHub). When provided, OIDC auto-discovery is skipped.
@@ -57,6 +59,12 @@ export interface TokenStorage {
     setItem: (key: string, value: string) => void;
     removeItem: (key: string) => void;
 }
+export interface SSOPermissionResolverContext {
+    session: SSOSession;
+    getAccessToken: (options?: GetAccessTokenOptions) => Promise<string | null>;
+    createAuthenticatedFetch: (fetcher?: typeof fetch) => typeof fetch;
+}
+export type SSOPermissionResolver = (context: SSOPermissionResolverContext) => Promise<unknown> | unknown;
 export interface SSOAuthProvider extends AuthProvider {
     getSession: () => Promise<SSOSession | null>;
     refreshSession: () => Promise<SSOSession | null>;

package/dist/auth-provider.js

@@ -356,6 +356,9 @@ export function createSSOAuthProvider(config) {
                 : null;
         },
     };
+    function createProviderAuthenticatedFetch(fetcher) {
+        return buildAuthenticatedFetch(authorizationSource, fetcher ?? getFetcher());
+    }
     const provider = {
         async login() {
             if (typeof window === 'undefined') {
@@ -553,22 +556,20 @@ export function createSSOAuthProvider(config) {
             }
         },
         async getPermissions() {
-            const idToken = sessions.getSession()?.id_token;
-            if (!idToken)
-                return null;
-            try {
-                const payload = decodeJwtPayload(idToken);
-                return payload?.roles ?? payload?.groups ?? payload?.permissions ?? null;
-            }
-            catch {
+            const session = sessions.getSession();
+            if (!session || !config.getPermissions)
                 return null;
-            }
+            return config.getPermissions({
+                session,
+                getAccessToken: (options) => sessions.getAccessToken(options),
+                createAuthenticatedFetch: createProviderAuthenticatedFetch,
+            });
         },
         getSession: async () => sessions.getSession(),
         refreshSession: () => sessions.refreshSession(),
         getAccessToken: (options) => sessions.getAccessToken(options),
         onAuthStateChange: (callback) => sessions.onAuthStateChange(callback),
-        createAuthenticatedFetch: (fetcher) => buildAuthenticatedFetch(authorizationSource, fetcher ?? getFetcher()),
+        createAuthenticatedFetch: createProviderAuthenticatedFetch,
         destroy: () => sessions.destroy(),
         async onError(error) {
             const status = getErrorStatus(error);

package/dist/index.d.ts

@@ -7,7 +7,7 @@
  * ```
  */
 export { createSSOAuthProvider } from './auth-provider.js';
-export type { AuthStateChangeCallback, AuthStateChangeEvent, GetAccessTokenOptions, RefreshLock, SSOAuthProvider, SSOConfig, SSOSession, TokenStorage, } from './auth-provider.js';
+export type { AuthStateChangeCallback, AuthStateChangeEvent, GetAccessTokenOptions, RefreshLock, SSOPermissionResolver, SSOPermissionResolverContext, SSOAuthProvider, SSOConfig, SSOSession, TokenStorage, } from './auth-provider.js';
 export { SSOAuthError } from './errors.js';
 export { createGoogleAuth, createMicrosoftAuth, createGitHubAuth, createGitLabAuth, createKeycloakAuth, createAuth0Auth, createSupauthAuth, } from './presets.js';
 export type { PresetOptions } from './presets.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/sso",
-  "version": "0.11.5",
+  "version": "0.11.7",
   "type": "module",
   "description": "OIDC/OAuth2 SSO AuthProvider plugin for svadmin — supports Okta, Azure AD, Cognito, Keycloak, Google",
   "license": "MIT",
@@ -18,7 +18,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "https://github.com/zuohuadong/svadmin",
+    "url": "https://github.com/vibeunion/svadmin",
     "directory": "packages/sso"
   },
   "sideEffects": false,
@@ -34,7 +34,7 @@
     "dist"
   ],
   "peerDependencies": {
-    "@svadmin/core": "^0.33.0"
+    "@svadmin/core": "^0.36.1"
   },
   "devDependencies": {
     "typescript": "^7.0.2"