@thunderid/express 1.0.7 → 1.2.0

package/dist/ThunderIDExpressClient.d.ts

@@ -13,6 +13,7 @@ declare class ThunderIDExpressClient<T extends ExpressClientConfig = ExpressClie
      */
     getSessionCookieName(): string;
     getUserFromRequest(req: express.Request): Promise<User | undefined>;
+    updateUserCredentialsFromRequest(req: express.Request, payload: Record<string, string>): Promise<void>;
     signIn(req: express.Request, res: express.Response, next: express.NextFunction, signInConfig?: Record<string, string | boolean>): Promise<TokenResponse>;
     signOut(userId?: string): Promise<string>;
 }

package/dist/ThunderIDExpressClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDExpressClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDExpressClient.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,mBAAmB,EAEnB,OAAO,EACP,aAAa,EACb,IAAI,EAEL,MAAM,iBAAiB,CAAC;AACzB,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAAC,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAGpD,cAAM,sBAAsB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB,CAAE,SAAQ,mBAAmB,CAAC,CAAC,CAAC;IAC9G,OAAO,CAAC,cAAc,CAAkC;;IAMlC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAKhF,IAAW,aAAa,IAAI,mBAAmB,GAAG,SAAS,CAE1D;IAED;;;;OAIG;IACI,oBAAoB,IAAI,MAAM;IAOxB,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAK1D,MAAM,CAC1B,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,IAAI,EAAE,OAAO,CAAC,YAAY,EAC1B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAC9C,OAAO,CAAC,aAAa,CAAC;IAwDH,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAGhE;AAED,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"ThunderIDExpressClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDExpressClient.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,mBAAmB,EAEnB,OAAO,EACP,aAAa,EACb,IAAI,EAEL,MAAM,iBAAiB,CAAC;AACzB,OAAO,OAAO,MAAM,SAAS,CAAC;AAG9B,OAAO,EAAC,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAGpD,cAAM,sBAAsB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB,CAAE,SAAQ,mBAAmB,CAAC,CAAC,CAAC;IAC9G,OAAO,CAAC,cAAc,CAAkC;;IAMlC,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAKhF,IAAW,aAAa,IAAI,mBAAmB,GAAG,SAAS,CAE1D;IAED;;;;OAIG;IACI,oBAAoB,IAAI,MAAM;IAOxB,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAMnE,gCAAgC,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAM7F,MAAM,CAC1B,GAAG,EAAE,OAAO,CAAC,OAAO,EACpB,GAAG,EAAE,OAAO,CAAC,QAAQ,EACrB,IAAI,EAAE,OAAO,CAAC,YAAY,EAC1B,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAC9C,OAAO,CAAC,aAAa,CAAC;IAuDH,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAGhE;AAED,eAAe,sBAAsB,CAAC"}

package/dist/cjs/index.cjs

@@ -25,6 +25,8 @@ let __thunderid_node = require("@thunderid/node");
 __thunderid_node = __toESM(__thunderid_node);
 let uuid = require("uuid");
 uuid = __toESM(uuid);
+let express = require("express");
+express = __toESM(express);
 
 //#region src/constants/CookieConfig.ts
 /** Default cookie configuration values. */
@@ -73,6 +75,10 @@ var ThunderIDExpressClient = class extends __thunderid_node.ThunderIDNodeClient
 		const sessionId = req.cookies?.[this.getSessionCookieName()];
 		return this.getUser(sessionId);
 	}
+	async updateUserCredentialsFromRequest(req, payload) {
+		const sessionId = req.cookies?.[this.getSessionCookieName()];
+		return this.updateUserCredentials(payload, sessionId);
+	}
 	async signIn(req, res, next, signInConfig) {
 		if (expressUtils_default(req.originalUrl)) return Promise.reject(new __thunderid_node.ThunderIDAuthException("EXPRESS-CLIENT-SI-IV01", "Invalid login request URL", "Login request contains an error query parameter in the URL"));
 		const cookieName = this.getSessionCookieName();
@@ -90,7 +96,7 @@ var ThunderIDExpressClient = class extends __thunderid_node.ThunderIDNodeClient
 			res.redirect(url);
 			if (typeof next === "function") next();
 		};
-		const authResponse = await super.signIn(authRedirectCallback, userId, req.query["code"], req.query["session_state"], req.query["state"], signInConfig);
+		const authResponse = await super.signIn(authRedirectCallback, userId, req.query["code"], req.query["state"], signInConfig);
 		if (authResponse.accessToken || authResponse.idToken) return authResponse;
 		return {
 			accessToken: "",
@@ -352,9 +358,88 @@ const handleFlow = () => {
 };
 var flow_default = handleFlow;
 
+//#endregion
+//#region src/middleware/backchannelLogout.ts
+const BODY_LIMIT = "16kb";
+/**
+* Returns an Express route handler for OpenID Connect back-channel logout. ThunderID posts a
+* `logout_token` to it when a session this application took part in ends, and the handler ends
+* the matching local sessions, so the next request that presents one is rejected by `protect()`.
+*
+* - Answers `200` for a valid token, including one that names no session held here.
+* - Answers `400` for a request or token that is not valid, and `500` when the logout could not be
+*   recorded, which makes the server try again.
+*
+* Must be used after `thunderID()` middleware so that `req.thunderIDAuth` is set. Mount it at the
+* path registered as the application's back-channel logout URI. It needs no body parser and no
+* session cookie: the token's signature is the authentication.
+*
+* ```ts
+* app.post('/backchannel-logout', handleBackchannelLogout());
+* ```
+*/
+const handleBackchannelLogout = () => {
+	const parseForm = express.default.urlencoded({
+		extended: false,
+		limit: BODY_LIMIT
+	});
+	const handle = async (req, res) => {
+		const client = req.thunderIDAuth;
+		if (!client) {
+			__thunderid_node.logger.error("thunderID() middleware must be mounted before handleBackchannelLogout()");
+			res.status(500).end();
+			return;
+		}
+		const logoutToken = req.body?.[__thunderid_node.BackchannelLogoutConstants.TOKEN_PARAM];
+		if (typeof logoutToken !== "string" || logoutToken.length === 0) {
+			res.status(400).end();
+			return;
+		}
+		try {
+			const result = await client.handleBackchannelLogout(logoutToken);
+			try {
+				await client.expressConfig?.onBackchannelLogout?.(result);
+			} catch {
+				__thunderid_node.logger.error("The onBackchannelLogout hook failed.");
+			}
+			res.status(200).end();
+		} catch (e) {
+			if (e instanceof __thunderid_node.InvalidLogoutTokenError) {
+				__thunderid_node.logger.warn(`Rejected a back-channel logout token (${e.code}).`);
+				res.status(400).end();
+				return;
+			}
+			__thunderid_node.logger.error("Could not complete a back-channel logout.");
+			res.status(500).end();
+		}
+	};
+	return (req, res) => {
+		res.set("Cache-Control", "no-store");
+		if (req.method !== "POST") {
+			res.set("Allow", "POST").status(405).end();
+			return;
+		}
+		if (!req.is("application/x-www-form-urlencoded")) {
+			res.status(400).end();
+			return;
+		}
+		parseForm(req, res, (parseError) => {
+			if (parseError) {
+				res.status(400).end();
+				return;
+			}
+			handle(req, res).catch(() => {
+				res.status(500).end();
+			});
+		});
+	};
+};
+var backchannelLogout_default = handleBackchannelLogout;
+
 //#endregion
 exports.CookieConfig = CookieConfig_default;
 exports.ThunderIDExpressClient = ThunderIDExpressClient_default;
+exports.handleBackchannelLogout = backchannelLogout_default;
 exports.handleFlow = flow_default;
 exports.handleSignIn = handleSignIn;
 exports.handleSignOut = handleSignOut;

package/dist/edge/index.js

@@ -1,5 +1,6 @@
-import { CookieConfig, ThunderIDAuthException, ThunderIDNodeClient, ThunderIDRuntimeError, executeEmbeddedSignInFlow, logger, resolveResourceEndpoint } from "@thunderid/node";
+import { BackchannelLogoutConstants, CookieConfig, InvalidLogoutTokenError, ThunderIDAuthException, ThunderIDNodeClient, ThunderIDRuntimeError, executeEmbeddedSignInFlow, logger, resolveResourceEndpoint } from "@thunderid/node";
 import { v4 } from "uuid";
+import express from "express";
 
 export * from "@thunderid/node"
 
@@ -50,6 +51,10 @@ var ThunderIDExpressClient = class extends ThunderIDNodeClient {
 		const sessionId = req.cookies?.[this.getSessionCookieName()];
 		return this.getUser(sessionId);
 	}
+	async updateUserCredentialsFromRequest(req, payload) {
+		const sessionId = req.cookies?.[this.getSessionCookieName()];
+		return this.updateUserCredentials(payload, sessionId);
+	}
 	async signIn(req, res, next, signInConfig) {
 		if (expressUtils_default(req.originalUrl)) return Promise.reject(new ThunderIDAuthException("EXPRESS-CLIENT-SI-IV01", "Invalid login request URL", "Login request contains an error query parameter in the URL"));
 		const cookieName = this.getSessionCookieName();
@@ -67,7 +72,7 @@ var ThunderIDExpressClient = class extends ThunderIDNodeClient {
 			res.redirect(url);
 			if (typeof next === "function") next();
 		};
-		const authResponse = await super.signIn(authRedirectCallback, userId, req.query["code"], req.query["session_state"], req.query["state"], signInConfig);
+		const authResponse = await super.signIn(authRedirectCallback, userId, req.query["code"], req.query["state"], signInConfig);
 		if (authResponse.accessToken || authResponse.idToken) return authResponse;
 		return {
 			accessToken: "",
@@ -330,4 +335,82 @@ const handleFlow = () => {
 var flow_default = handleFlow;
 
 //#endregion
-export { CookieConfig_default as CookieConfig, ThunderIDExpressClient_default as ThunderIDExpressClient, flow_default as handleFlow, handleSignIn, handleSignOut, protect_default as protect, thunderID };
+//#region src/middleware/backchannelLogout.ts
+const BODY_LIMIT = "16kb";
+/**
+* Returns an Express route handler for OpenID Connect back-channel logout. ThunderID posts a
+* `logout_token` to it when a session this application took part in ends, and the handler ends
+* the matching local sessions, so the next request that presents one is rejected by `protect()`.
+*
+* - Answers `200` for a valid token, including one that names no session held here.
+* - Answers `400` for a request or token that is not valid, and `500` when the logout could not be
+*   recorded, which makes the server try again.
+*
+* Must be used after `thunderID()` middleware so that `req.thunderIDAuth` is set. Mount it at the
+* path registered as the application's back-channel logout URI. It needs no body parser and no
+* session cookie: the token's signature is the authentication.
+*
+* ```ts
+* app.post('/backchannel-logout', handleBackchannelLogout());
+* ```
+*/
+const handleBackchannelLogout = () => {
+	const parseForm = express.urlencoded({
+		extended: false,
+		limit: BODY_LIMIT
+	});
+	const handle = async (req, res) => {
+		const client = req.thunderIDAuth;
+		if (!client) {
+			logger.error("thunderID() middleware must be mounted before handleBackchannelLogout()");
+			res.status(500).end();
+			return;
+		}
+		const logoutToken = req.body?.[BackchannelLogoutConstants.TOKEN_PARAM];
+		if (typeof logoutToken !== "string" || logoutToken.length === 0) {
+			res.status(400).end();
+			return;
+		}
+		try {
+			const result = await client.handleBackchannelLogout(logoutToken);
+			try {
+				await client.expressConfig?.onBackchannelLogout?.(result);
+			} catch {
+				logger.error("The onBackchannelLogout hook failed.");
+			}
+			res.status(200).end();
+		} catch (e) {
+			if (e instanceof InvalidLogoutTokenError) {
+				logger.warn(`Rejected a back-channel logout token (${e.code}).`);
+				res.status(400).end();
+				return;
+			}
+			logger.error("Could not complete a back-channel logout.");
+			res.status(500).end();
+		}
+	};
+	return (req, res) => {
+		res.set("Cache-Control", "no-store");
+		if (req.method !== "POST") {
+			res.set("Allow", "POST").status(405).end();
+			return;
+		}
+		if (!req.is("application/x-www-form-urlencoded")) {
+			res.status(400).end();
+			return;
+		}
+		parseForm(req, res, (parseError) => {
+			if (parseError) {
+				res.status(400).end();
+				return;
+			}
+			handle(req, res).catch(() => {
+				res.status(500).end();
+			});
+		});
+	};
+};
+var backchannelLogout_default = handleBackchannelLogout;
+
+//#endregion
+export { CookieConfig_default as CookieConfig, ThunderIDExpressClient_default as ThunderIDExpressClient, backchannelLogout_default as handleBackchannelLogout, flow_default as handleFlow, handleSignIn, handleSignOut, protect_default as protect, thunderID };

package/dist/index.d.ts

@@ -2,6 +2,7 @@ export { default as ThunderIDExpressClient } from './ThunderIDExpressClient';
 export { thunderID, handleSignIn, handleSignOut } from './middleware/authentication';
 export { default as protect } from './middleware/protect';
 export { default as handleFlow } from './middleware/flow';
+export { default as handleBackchannelLogout } from './middleware/backchannelLogout';
 export type { ExpressClientConfig, ThunderIDExpressConfig, StrictExpressClientConfig } from './models/config';
 export { default as CookieConfig } from './constants/CookieConfig';
 export * from '@thunderid/node';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,0BAA0B,CAAC;AAG3E,OAAO,EAAC,SAAS,EAAE,YAAY,EAAE,aAAa,EAAC,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAC,OAAO,IAAI,OAAO,EAAC,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAC,OAAO,IAAI,UAAU,EAAC,MAAM,mBAAmB,CAAC;AAGxD,YAAY,EAAC,mBAAmB,EAAE,sBAAsB,EAAE,yBAAyB,EAAC,MAAM,iBAAiB,CAAC;AAK5G,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,0BAA0B,CAAC;AAIjE,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,0BAA0B,CAAC;AAG3E,OAAO,EAAC,SAAS,EAAE,YAAY,EAAE,aAAa,EAAC,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAC,OAAO,IAAI,OAAO,EAAC,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAC,OAAO,IAAI,UAAU,EAAC,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,gCAAgC,CAAC;AAGlF,YAAY,EAAC,mBAAmB,EAAE,sBAAsB,EAAE,yBAAyB,EAAC,MAAM,iBAAiB,CAAC;AAK5G,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,0BAA0B,CAAC;AAIjE,cAAc,iBAAiB,CAAC"}

package/dist/index.js

@@ -1,5 +1,6 @@
-import { CookieConfig, ThunderIDAuthException, ThunderIDNodeClient, ThunderIDRuntimeError, executeEmbeddedSignInFlow, logger, resolveResourceEndpoint } from "@thunderid/node";
+import { BackchannelLogoutConstants, CookieConfig, InvalidLogoutTokenError, ThunderIDAuthException, ThunderIDNodeClient, ThunderIDRuntimeError, executeEmbeddedSignInFlow, logger, resolveResourceEndpoint } from "@thunderid/node";
 import { v4 } from "uuid";
+import express from "express";
 
 export * from "@thunderid/node"
 
@@ -50,6 +51,10 @@ var ThunderIDExpressClient = class extends ThunderIDNodeClient {
 		const sessionId = req.cookies?.[this.getSessionCookieName()];
 		return this.getUser(sessionId);
 	}
+	async updateUserCredentialsFromRequest(req, payload) {
+		const sessionId = req.cookies?.[this.getSessionCookieName()];
+		return this.updateUserCredentials(payload, sessionId);
+	}
 	async signIn(req, res, next, signInConfig) {
 		if (expressUtils_default(req.originalUrl)) return Promise.reject(new ThunderIDAuthException("EXPRESS-CLIENT-SI-IV01", "Invalid login request URL", "Login request contains an error query parameter in the URL"));
 		const cookieName = this.getSessionCookieName();
@@ -67,7 +72,7 @@ var ThunderIDExpressClient = class extends ThunderIDNodeClient {
 			res.redirect(url);
 			if (typeof next === "function") next();
 		};
-		const authResponse = await super.signIn(authRedirectCallback, userId, req.query["code"], req.query["session_state"], req.query["state"], signInConfig);
+		const authResponse = await super.signIn(authRedirectCallback, userId, req.query["code"], req.query["state"], signInConfig);
 		if (authResponse.accessToken || authResponse.idToken) return authResponse;
 		return {
 			accessToken: "",
@@ -330,4 +335,82 @@ const handleFlow = () => {
 var flow_default = handleFlow;
 
 //#endregion
-export { CookieConfig_default as CookieConfig, ThunderIDExpressClient_default as ThunderIDExpressClient, flow_default as handleFlow, handleSignIn, handleSignOut, protect_default as protect, thunderID };
+//#region src/middleware/backchannelLogout.ts
+const BODY_LIMIT = "16kb";
+/**
+* Returns an Express route handler for OpenID Connect back-channel logout. ThunderID posts a
+* `logout_token` to it when a session this application took part in ends, and the handler ends
+* the matching local sessions, so the next request that presents one is rejected by `protect()`.
+*
+* - Answers `200` for a valid token, including one that names no session held here.
+* - Answers `400` for a request or token that is not valid, and `500` when the logout could not be
+*   recorded, which makes the server try again.
+*
+* Must be used after `thunderID()` middleware so that `req.thunderIDAuth` is set. Mount it at the
+* path registered as the application's back-channel logout URI. It needs no body parser and no
+* session cookie: the token's signature is the authentication.
+*
+* ```ts
+* app.post('/backchannel-logout', handleBackchannelLogout());
+* ```
+*/
+const handleBackchannelLogout = () => {
+	const parseForm = express.urlencoded({
+		extended: false,
+		limit: BODY_LIMIT
+	});
+	const handle = async (req, res) => {
+		const client = req.thunderIDAuth;
+		if (!client) {
+			logger.error("thunderID() middleware must be mounted before handleBackchannelLogout()");
+			res.status(500).end();
+			return;
+		}
+		const logoutToken = req.body?.[BackchannelLogoutConstants.TOKEN_PARAM];
+		if (typeof logoutToken !== "string" || logoutToken.length === 0) {
+			res.status(400).end();
+			return;
+		}
+		try {
+			const result = await client.handleBackchannelLogout(logoutToken);
+			try {
+				await client.expressConfig?.onBackchannelLogout?.(result);
+			} catch {
+				logger.error("The onBackchannelLogout hook failed.");
+			}
+			res.status(200).end();
+		} catch (e) {
+			if (e instanceof InvalidLogoutTokenError) {
+				logger.warn(`Rejected a back-channel logout token (${e.code}).`);
+				res.status(400).end();
+				return;
+			}
+			logger.error("Could not complete a back-channel logout.");
+			res.status(500).end();
+		}
+	};
+	return (req, res) => {
+		res.set("Cache-Control", "no-store");
+		if (req.method !== "POST") {
+			res.set("Allow", "POST").status(405).end();
+			return;
+		}
+		if (!req.is("application/x-www-form-urlencoded")) {
+			res.status(400).end();
+			return;
+		}
+		parseForm(req, res, (parseError) => {
+			if (parseError) {
+				res.status(400).end();
+				return;
+			}
+			handle(req, res).catch(() => {
+				res.status(500).end();
+			});
+		});
+	};
+};
+var backchannelLogout_default = handleBackchannelLogout;
+
+//#endregion
+export { CookieConfig_default as CookieConfig, ThunderIDExpressClient_default as ThunderIDExpressClient, backchannelLogout_default as handleBackchannelLogout, flow_default as handleFlow, handleSignIn, handleSignOut, protect_default as protect, thunderID };

package/dist/middleware/backchannelLogout.d.ts

@@ -0,0 +1,21 @@
+import express from 'express';
+/**
+ * Returns an Express route handler for OpenID Connect back-channel logout. ThunderID posts a
+ * `logout_token` to it when a session this application took part in ends, and the handler ends
+ * the matching local sessions, so the next request that presents one is rejected by `protect()`.
+ *
+ * - Answers `200` for a valid token, including one that names no session held here.
+ * - Answers `400` for a request or token that is not valid, and `500` when the logout could not be
+ *   recorded, which makes the server try again.
+ *
+ * Must be used after `thunderID()` middleware so that `req.thunderIDAuth` is set. Mount it at the
+ * path registered as the application's back-channel logout URI. It needs no body parser and no
+ * session cookie: the token's signature is the authentication.
+ *
+ * ```ts
+ * app.post('/backchannel-logout', handleBackchannelLogout());
+ * ```
+ */
+declare const handleBackchannelLogout: () => express.RequestHandler;
+export default handleBackchannelLogout;
+//# sourceMappingURL=backchannelLogout.d.ts.map

package/dist/middleware/backchannelLogout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backchannelLogout.d.ts","sourceRoot":"","sources":["../../src/middleware/backchannelLogout.ts"],"names":[],"mappings":"AASA,OAAO,OAAO,MAAM,SAAS,CAAC;AAQ9B;;;;;;;;;;;;;;;;GAgBG;AACH,QAAA,MAAM,uBAAuB,QAAO,OAAO,CAAC,cAmE3C,CAAC;AAEF,eAAe,uBAAuB,CAAC"}

package/dist/models/config.d.ts

@@ -1,4 +1,4 @@
-import { ThunderIDNodeConfig, ThunderIDRuntimeError, TokenResponse } from '@thunderid/node';
+import { BackchannelLogoutResult, ThunderIDNodeConfig, ThunderIDRuntimeError, TokenResponse } from '@thunderid/node';
 import express from 'express';
 /**
  * Express-specific configuration fields.
@@ -12,6 +12,15 @@ export interface StrictExpressClientConfig {
     onError?: (res: express.Response, exception: ThunderIDRuntimeError) => void;
     /** Called with the response when a protected route is accessed without a valid session. */
     onUnauthenticated?: (res: express.Response) => void;
+    /**
+     * Called after a back-channel logout ended this SDK's sessions, so the application can clear
+     * what it holds for them. Best effort: a failure is logged and the handler still answers 200,
+     * since the sessions are already ended and a retry would find nothing.
+     *
+     * This SDK mounts the endpoint with `handleBackchannelLogout()` and does not read the
+     * `backchannelLogout` configuration key of the SDK specification.
+     */
+    onBackchannelLogout?: (result: BackchannelLogoutResult) => void | Promise<void>;
 }
 /**
  * Full configuration type for `ThunderIDExpressClient`.

package/dist/models/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/models/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAC,MAAM,iBAAiB,CAAC;AAC1F,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,aAAa,KAAK,IAAI,CAAC;IACzE,uDAAuD;IACvD,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC;IAC5C,oEAAoE;IACpE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,qBAAqB,KAAK,IAAI,CAAC;IAC5E,2FAA2F;IAC3F,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,GAAG,yBAAyB,CAAC;AAElF;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,mBAAmB,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/models/config.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,uBAAuB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,aAAa,EAAC,MAAM,iBAAiB,CAAC;AACnH,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,aAAa,EAAE,aAAa,KAAK,IAAI,CAAC;IACzE,uDAAuD;IACvD,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC;IAC5C,oEAAoE;IACpE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,qBAAqB,KAAK,IAAI,CAAC;IAC5E,2FAA2F;IAC3F,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC;IACpD;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,GAAG,yBAAyB,CAAC;AAElF;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,mBAAmB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thunderid/express",
-  "version": "1.0.7",
+  "version": "1.2.0",
   "description": "Express.js SDK for ThunderID",
   "keywords": [
     "thunderid",
@@ -44,10 +44,10 @@
     "rimraf": "6.1.3",
     "rolldown": "1.0.0-beta.45",
     "typescript": "5.9.3",
-    "vitest": "4.1.10"
+    "vitest": "4.1.11"
   },
   "dependencies": {
-    "@thunderid/node": "^1.0.7",
+    "@thunderid/node": "^1.2.0",
     "uuid": "11.1.1"
   },
   "peerDependencies": {