@svadmin/sso 0.8.4 → 0.8.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@svadmin/sso",
-  "version": "0.8.4",
+  "version": "0.8.6",
   "type": "module",
   "description": "OIDC/OAuth2 SSO AuthProvider plugin for svadmin — supports Okta, Azure AD, Cognito, Keycloak, Google",
   "license": "MIT",
@@ -31,7 +31,7 @@
     "src"
   ],
   "peerDependencies": {
-    "@svadmin/core": "^0.19.4"
+    "@svadmin/core": "^0.22.1"
   },
   "devDependencies": {
     "typescript": "^5.7.0"

package/src/auth-provider.ts

@@ -16,6 +16,8 @@
  * ```ts
  * import { createSSOAuthProvider } from '@svadmin/sso';
  * import { setAuthProvider } from '@svadmin/core';
+
+
  *
  * const authProvider = createSSOAuthProvider({
  *   issuer: 'https://your-tenant.okta.com',
@@ -29,6 +31,19 @@
 
 import type { AuthProvider, Identity } from '@svadmin/core';
 
+// Safe base64url decode for JWT payloads
+function decodeJwtPayload(token: string): any {
+  if (!token) return null;
+  const parts = token.split('.');
+  if (parts.length < 2) return null;
+  const payloadStr = parts[1];
+  const padded = payloadStr + '='.repeat((4 - (payloadStr.length % 4)) % 4);
+  const binString = atob(padded.replace(/-/g, '+').replace(/_/g, '/'));
+  const bytes = Uint8Array.from(binString, (m) => m.codePointAt(0)!);
+  return JSON.parse(new TextDecoder().decode(bytes));
+}
+
+
 // ─── Types ────────────────────────────────────────────────────
 
 export interface SSOConfig {
@@ -116,11 +131,10 @@ const STORAGE_PREFIX = 'svadmin_sso_';
 
 function getStorage(config: SSOConfig): TokenStorage {
   if (config.storage && typeof config.storage === 'object') return config.storage;
-  const backend = config.storage === 'session' ? sessionStorage : localStorage;
   return {
-    getItem: (key) => backend.getItem(key),
-    setItem: (key, value) => backend.setItem(key, value),
-    removeItem: (key) => backend.removeItem(key),
+    getItem: (key) => typeof window !== 'undefined' ? (config.storage === 'session' ? sessionStorage : localStorage).getItem(key) : null,
+    setItem: (key, value) => { if (typeof window !== 'undefined') (config.storage === 'session' ? sessionStorage : localStorage).setItem(key, value); },
+    removeItem: (key) => { if (typeof window !== 'undefined') (config.storage === 'session' ? sessionStorage : localStorage).removeItem(key); },
   };
 }
 
@@ -264,6 +278,9 @@ export function createSSOAuthProvider(config: SSOConfig): AuthProvider {
 
   return {
     async login() {
+      if (typeof window === 'undefined') {
+        return { success: false, error: { message: 'SSO login requires a browser environment' } };
+      }
       const cfg = await discover();
       const { verifier, challenge } = await createPKCEChallenge();
       const state = generateRandomString(32);
@@ -293,7 +310,7 @@ export function createSSOAuthProvider(config: SSOConfig): AuthProvider {
       const tokens = getTokens();
       clearTokens();
 
-      if (cfg.end_session_endpoint && tokens?.id_token) {
+      if (typeof window !== 'undefined' && cfg.end_session_endpoint && tokens?.id_token) {
         const params = new URLSearchParams({
           id_token_hint: tokens.id_token,
           ...(config.postLogoutRedirectUri
@@ -311,6 +328,15 @@ export function createSSOAuthProvider(config: SSOConfig): AuthProvider {
     },
 
     async check() {
+      // SSR: no tokens, no callback — return unauthenticated
+      if (typeof window === 'undefined') {
+        const tokens = getTokens();
+        if (tokens && (!tokens.expires_at || tokens.expires_at > Math.floor(Date.now() / 1000))) {
+          return { authenticated: true };
+        }
+        return { authenticated: false, logout: true };
+      }
+
       // Handle callback — exchange authorization code for tokens
       const url = new URL(window.location.href);
       const code = url.searchParams.get('code');
@@ -382,7 +408,7 @@ export function createSSOAuthProvider(config: SSOConfig): AuthProvider {
       // Try to extract roles/permissions from the ID token
       if (tokens.id_token) {
         try {
-          const payload = JSON.parse(atob(tokens.id_token.split('.')[1]));
+          const payload = decodeJwtPayload(tokens.id_token);
           return payload.roles ?? payload.groups ?? payload.permissions ?? null;
         } catch {
           return null;