@thunderid/node 1.1.0 → 1.2.1

package/dist/ThunderIDNodeClient.d.ts

@@ -1,13 +1,50 @@
-import { ExtendedAuthorizeRequestUrlParams, IdToken, OIDCEndpoints, Storage, ThunderIDJavaScriptClient, TokenExchangeRequestConfig, TokenResponse, User } from '@thunderid/javascript';
+import { BackchannelLogoutResult, ExtendedAuthorizeRequestUrlParams, IdToken, OIDCEndpoints, Storage, ThunderIDJavaScriptClient, TokenExchangeRequestConfig, TokenResponse, User } from '@thunderid/javascript';
 import { ThunderIDNodeConfig } from './models/config';
 declare class ThunderIDNodeClient<T extends ThunderIDNodeConfig = ThunderIDNodeConfig> extends ThunderIDJavaScriptClient<T> {
     private _nodeInstanceId;
+    private _handledLogoutTokens;
     constructor(instanceId?: number);
     initialize(config: T, storage?: Storage): Promise<boolean>;
     getInstanceId(): number;
     signIn(...args: any[]): Promise<TokenResponse>;
     getSignInUrl(requestConfig?: ExtendedAuthorizeRequestUrlParams, userId?: string): Promise<string>;
     signOut(...args: any[]): Promise<string>;
+    /**
+     * Handles an OpenID Connect back-channel logout: validates the logout token the server posted,
+     * then ends every local session it names. A token with a `sid` ends the sessions that joined
+     * that server session. A token with only a `sub` ends that subject's sessions that began before
+     * the token was issued, so a user who has already signed in again stays signed in.
+     *
+     * Ending a session here is local. The server has already revoked the tokens, so nothing is sent
+     * to it. A valid token that names no session held here succeeds with `sessionsEnded: 0`, which
+     * keeps a retried notification harmless.
+     *
+     * @param logoutToken - The raw `logout_token` form parameter.
+     * @returns The `sid` and `sub` the token named, when it was issued, and how many sessions were ended.
+     * @throws {InvalidLogoutTokenError} When the token is not valid or was already handled.
+     */
+    handleBackchannelLogout(logoutToken: string): Promise<BackchannelLogoutResult>;
+    /**
+     * Removes a session's index entries. Called wherever the stored session is removed, so the index
+     * does not keep growing: nothing else removes an entry once its session is gone. Sign-out does
+     * not remove the stored session, so it keeps the entry: the back-channel logout that follows
+     * finds the session through it.
+     */
+    private forgetSession;
+    clearSession(sessionId?: string): void;
+    protected clearSessionAsync(sessionId?: string): Promise<void>;
+    /**
+     * Records a new session against the `sid` and `sub` of its ID token, so a back-channel logout
+     * can find it. Sign-in does not depend on it, so a failure here is logged and not raised.
+     */
+    private indexSession;
+    private readSessionBinding;
+    /**
+     * Refuses a logout token whose `jti` was already handled. Kept in this process only, so it is
+     * a best effort across instances; a replay still cannot end a session that began after it.
+     */
+    private assertNotReplayed;
+    private rememberHandled;
     isSignedIn(userId?: string): Promise<boolean>;
     getIdToken(userId?: string): Promise<string>;
     refreshAccessToken(userId?: string): Promise<TokenResponse | User>;

package/dist/ThunderIDNodeClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDNodeClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDNodeClient.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,iCAAiC,EACjC,OAAO,EACP,aAAa,EAGb,OAAO,EAEP,yBAAyB,EACzB,0BAA0B,EAC1B,aAAa,EAEb,IAAI,EACL,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAC,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAKpD,cAAM,mBAAmB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB,CAAE,SAAQ,yBAAyB,CAAC,CAAC,CAAC;IACjH,OAAO,CAAC,eAAe,CAAK;gBAET,UAAU,SAAI;IAKX,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAMhE,aAAa,IAAI,MAAM;IAIjB,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAsE9C,YAAY,CAChC,aAAa,CAAC,EAAE,iCAAiC,EACjD,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC;IAcI,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAexC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAqB7C,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa5C,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAIlE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC;IAI/D,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAItE,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIhD,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAI7D,aAAa,CACjC,MAAM,EAAE,0BAA0B,EAClC,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,GAAG,QAAQ,GAAG,IAAI,CAAC;IAI3C;;;OAGG;IACU,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAapG;AAED,eAAe,mBAAmB,CAAC"}
+{"version":3,"file":"ThunderIDNodeClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDNodeClient.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,uBAAuB,EACvB,iCAAiC,EACjC,OAAO,EAIP,aAAa,EAGb,OAAO,EAEP,yBAAyB,EACzB,0BAA0B,EAC1B,aAAa,EAEb,IAAI,EACL,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAC,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAMpD,cAAM,mBAAmB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB,CAAE,SAAQ,yBAAyB,CAAC,CAAC,CAAC;IACjH,OAAO,CAAC,eAAe,CAAK;IAG5B,OAAO,CAAC,oBAAoB,CAAkD;gBAE3D,UAAU,SAAI;IAKX,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAMhE,aAAa,IAAI,MAAM;IAIjB,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAsE9C,YAAY,CAChC,aAAa,CAAC,EAAE,iCAAiC,EACjD,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC;IAcI,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAe9D;;;;;;;;;;;;;OAaG;IACU,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAsD3F;;;;;OAKG;YACW,aAAa;IAYX,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;cAI7B,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7E;;;OAGG;YACW,YAAY;YAYZ,kBAAkB;IAgBhC;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAezB,OAAO,CAAC,eAAe;IAID,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsB7C,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa5C,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAIlE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC;IAO/D,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAItE,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIhD,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAI7D,aAAa,CACjC,MAAM,EAAE,0BAA0B,EAClC,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,GAAG,QAAQ,GAAG,IAAI,CAAC;IAI3C;;;OAGG;IACU,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAapG;AAED,eAAe,mBAAmB,CAAC"}

package/dist/cjs/index.cjs

@@ -88,6 +88,82 @@ var NodeCryptoUtils = class {
 };
 var NodeCryptoUtils_default = NodeCryptoUtils;
 
+//#endregion
+//#region src/utils/SessionIndex.ts
+const SID_INDEX = "backchannel_logout_sid";
+const SUB_INDEX = "backchannel_logout_sub";
+/**
+* Finds local sessions by the server session identifier (`sid`) or the subject (`sub`) of their ID
+* token. The storage adapter cannot list sessions, so a back-channel logout needs this to find the
+* ones a logout token names. It lives in the same store as the sessions themselves.
+*/
+var SessionIndex = class {
+	storageManager;
+	constructor(storageManager) {
+		this.storageManager = storageManager;
+	}
+	/**
+	* Records a session that just began.
+	*/
+	async add(sessionId, binding, startedAt) {
+		if (binding.sid) {
+			const live = await this.dropEndedSessions(await this.read(SID_INDEX, binding.sid));
+			await this.write(SID_INDEX, binding.sid, {
+				...live,
+				[sessionId]: startedAt
+			});
+		}
+		if (binding.sub) {
+			const live = await this.dropEndedSessions(await this.read(SUB_INDEX, binding.sub));
+			await this.write(SUB_INDEX, binding.sub, {
+				...live,
+				[sessionId]: startedAt
+			});
+		}
+	}
+	findBySid(sid) {
+		return this.read(SID_INDEX, sid);
+	}
+	findBySub(sub) {
+		return this.read(SUB_INDEX, sub);
+	}
+	/**
+	* Forgets a session that has ended.
+	*/
+	async remove(sessionId, binding) {
+		if (binding.sid) await this.removeEntry(SID_INDEX, binding.sid, sessionId);
+		if (binding.sub) await this.removeEntry(SUB_INDEX, binding.sub, sessionId);
+	}
+	async read(index, key) {
+		try {
+			return await this.storageManager.getCustomData(index, key) ?? {};
+		} catch {
+			return {};
+		}
+	}
+	async write(index, key, sessions) {
+		await this.storageManager.removeCustomData(index, key);
+		if (Object.keys(sessions).length > 0) await this.storageManager.setCustomData(index, sessions, key);
+	}
+	async removeEntry(index, key, sessionId) {
+		const sessions = await this.read(index, key);
+		if (!(sessionId in sessions)) return;
+		delete sessions[sessionId];
+		await this.write(index, key, sessions);
+	}
+	async dropEndedSessions(sessions) {
+		const checked = await Promise.all(Object.entries(sessions).map(async ([sessionId, startedAt]) => {
+			try {
+				return (await this.storageManager.getSessionData(sessionId))?.access_token ? [sessionId, startedAt] : void 0;
+			} catch {
+				return;
+			}
+		}));
+		return Object.fromEntries(checked.filter((entry) => entry !== void 0));
+	}
+};
+var SessionIndex_default = SessionIndex;
+
 //#endregion
 //#region src/utils/SessionUtils.ts
 const UUID_VERSION = 4;
@@ -130,6 +206,7 @@ var SessionUtils_default = SessionUtils;
 //#region src/ThunderIDNodeClient.ts
 var ThunderIDNodeClient = class extends __thunderid_javascript.ThunderIDJavaScriptClient {
 	_nodeInstanceId = 0;
+	_handledLogoutTokens = /* @__PURE__ */ new Map();
 	constructor(instanceId = 0) {
 		super(void 0, new NodeCryptoUtils_default());
 		this._nodeInstanceId = instanceId;
@@ -146,7 +223,7 @@ var ThunderIDNodeClient = class extends __thunderid_javascript.ThunderIDJavaScri
 		return this._nodeInstanceId;
 	}
 	async signIn(...args) {
-		const [authURLCallback, userId, authorizationCode, sessionState, state, signInConfig] = args;
+		const [authURLCallback, userId, authorizationCode, state, signInConfig] = args;
 		if (!userId) return Promise.reject(new __thunderid_javascript.ThunderIDAuthException("NODE-AUTH_CLIENT-SI-NF01", "No user ID was provided.", "Unable to sign in the user as no user ID was provided."));
 		if (await this.isSignedIn(userId)) {
 			const sessionData$1 = await this.getStorageManager().getSessionData(userId);
@@ -173,8 +250,9 @@ var ThunderIDNodeClient = class extends __thunderid_javascript.ThunderIDJavaScri
 				tokenType: ""
 			});
 		}
-		await this.requestAccessToken(authorizationCode, sessionState ?? "", state, userId);
+		await this.requestAccessToken(authorizationCode, state, userId);
 		const sessionData = await this.getStorageManager().getSessionData(userId);
+		await this.indexSession(userId, sessionData);
 		return Promise.resolve({
 			accessToken: sessionData.access_token,
 			createdAt: sessionData.created_at,
@@ -196,6 +274,114 @@ var ThunderIDNodeClient = class extends __thunderid_javascript.ThunderIDJavaScri
 		if (!signOutUrl) return Promise.reject(new __thunderid_javascript.ThunderIDAuthException("NODE-AUTH_CLIENT-SO-NF01", "Signing out the user failed.", "Could not obtain the sign-out URL from the server."));
 		return signOutUrl;
 	}
+	/**
+	* Handles an OpenID Connect back-channel logout: validates the logout token the server posted,
+	* then ends every local session it names. A token with a `sid` ends the sessions that joined
+	* that server session. A token with only a `sub` ends that subject's sessions that began before
+	* the token was issued, so a user who has already signed in again stays signed in.
+	*
+	* Ending a session here is local. The server has already revoked the tokens, so nothing is sent
+	* to it. A valid token that names no session held here succeeds with `sessionsEnded: 0`, which
+	* keeps a retried notification harmless.
+	*
+	* @param logoutToken - The raw `logout_token` form parameter.
+	* @returns The `sid` and `sub` the token named, when it was issued, and how many sessions were ended.
+	* @throws {InvalidLogoutTokenError} When the token is not valid or was already handled.
+	*/
+	async handleBackchannelLogout(logoutToken) {
+		const claims = await this.validateLogoutToken(logoutToken);
+		this.assertNotReplayed(claims);
+		const index = new SessionIndex_default(this.getStorageManager());
+		let sessions;
+		if (claims.sid) sessions = await index.findBySid(claims.sid);
+		else {
+			const tolerance = (await this.getStorageManager().getConfigData())?.tokenValidation?.idToken?.clockTolerance ?? __thunderid_javascript.BackchannelLogoutConstants.DEFAULT_CLOCK_TOLERANCE_SECONDS;
+			const issuedBefore = (claims.iat + 1 + tolerance) * 1e3;
+			sessions = Object.fromEntries(Object.entries(await index.findBySub(claims.sub)).filter(([, startedAt]) => startedAt < issuedBefore));
+		}
+		let sessionsEnded = 0;
+		await Object.keys(sessions).reduce(async (previous, sessionId) => {
+			await previous;
+			const stored = await this.readSessionBinding(sessionId);
+			if (stored.sid && claims.sid && stored.sid !== claims.sid || stored.sub && claims.sub && stored.sub !== claims.sub) {
+				await index.remove(sessionId, {
+					sid: claims.sid,
+					sub: claims.sub
+				});
+				return;
+			}
+			await this.clearSessionAsync(sessionId);
+			await index.remove(sessionId, {
+				sid: claims.sid,
+				sub: claims.sub,
+				...stored
+			});
+			sessionsEnded += 1;
+		}, Promise.resolve());
+		this.rememberHandled(claims);
+		return {
+			issuedAt: claims.iat,
+			sessionsEnded,
+			sid: claims.sid,
+			sub: claims.sub
+		};
+	}
+	/**
+	* Removes a session's index entries. Called wherever the stored session is removed, so the index
+	* does not keep growing: nothing else removes an entry once its session is gone. Sign-out does
+	* not remove the stored session, so it keeps the entry: the back-channel logout that follows
+	* finds the session through it.
+	*/
+	async forgetSession(sessionId, sessionData) {
+		try {
+			const binding = await this.readSessionBinding(sessionId ?? "", sessionData);
+			if (binding.sid || binding.sub) await new SessionIndex_default(this.getStorageManager()).remove(sessionId ?? "", binding);
+		} catch {
+			__thunderid_javascript.logger.warn("Could not remove the session from the back-channel logout index.");
+		}
+	}
+	clearSession(sessionId) {
+		this.clearSessionAsync(sessionId);
+	}
+	async clearSessionAsync(sessionId) {
+		await this.forgetSession(sessionId);
+		await super.clearSessionAsync(sessionId);
+	}
+	/**
+	* Records a new session against the `sid` and `sub` of its ID token, so a back-channel logout
+	* can find it. Sign-in does not depend on it, so a failure here is logged and not raised.
+	*/
+	async indexSession(sessionId, sessionData) {
+		try {
+			const binding = await this.readSessionBinding(sessionId, sessionData);
+			if (binding.sid || binding.sub) await new SessionIndex_default(this.getStorageManager()).add(sessionId, binding, Date.now());
+		} catch {
+			__thunderid_javascript.logger.warn("Could not index the session for back-channel logout.");
+		}
+	}
+	async readSessionBinding(sessionId, sessionData) {
+		const idToken = (sessionData ?? await this.getStorageManager().getSessionData(sessionId))?.id_token;
+		if (!idToken) return {};
+		const { sid, sub } = await this.decodeJwtToken(idToken);
+		return {
+			...typeof sid === "string" && sid ? { sid } : {},
+			...typeof sub === "string" && sub ? { sub } : {}
+		};
+	}
+	/**
+	* Refuses a logout token whose `jti` was already handled. Kept in this process only, so it is
+	* a best effort across instances; a replay still cannot end a session that began after it.
+	*/
+	assertNotReplayed(claims) {
+		const now = Date.now();
+		this._handledLogoutTokens.forEach((expiresAt, jti) => {
+			if (expiresAt <= now) this._handledLogoutTokens.delete(jti);
+		});
+		if (this._handledLogoutTokens.has(claims.jti)) throw new __thunderid_javascript.InvalidLogoutTokenError("NODE-AUTH_CLIENT-HBL-IV01", "The logout token was already handled.");
+	}
+	rememberHandled(claims) {
+		this._handledLogoutTokens.set(claims.jti, claims.exp * 1e3);
+	}
 	async isSignedIn(userId) {
 		try {
 			if (!await super.isSignedIn(userId)) return false;
@@ -203,6 +389,7 @@ var ThunderIDNodeClient = class extends __thunderid_javascript.ThunderIDJavaScri
 			const sessionData = await sm.getSessionData(userId);
 			if (await SessionUtils_default.validateSession(sessionData)) return true;
 			if (await this.refreshAccessToken(userId)) return true;
+			await this.forgetSession(userId, sessionData);
 			await sm.removeSessionData(userId);
 			return false;
 		} catch {
@@ -217,6 +404,7 @@ var ThunderIDNodeClient = class extends __thunderid_javascript.ThunderIDJavaScri
 		return super.refreshAccessToken(userId);
 	}
 	async revokeAccessToken(userId) {
+		await this.forgetSession(userId);
 		return super.revokeAccessToken(userId);
 	}
 	async getDecodedIdToken(userId, idToken) {
@@ -356,6 +544,100 @@ var CookieChunking = class CookieChunking {
 };
 var CookieChunking_default = CookieChunking;
 
+//#endregion
+//#region src/utils/LoggedOutSessions.ts
+/**
+* Keeps logout records in the memory of this process, dropping expired ones as new ones arrive.
+*/
+var InMemoryLogoutRecordStore = class {
+	records = /* @__PURE__ */ new Map();
+	get(key) {
+		const record = this.records.get(key);
+		if (record && record.expiresAt <= Date.now()) {
+			this.records.delete(key);
+			return Promise.resolve(void 0);
+		}
+		return Promise.resolve(record?.value);
+	}
+	set(key, value, ttlSeconds) {
+		const now = Date.now();
+		this.records.forEach((record, recordKey) => {
+			if (record.expiresAt <= now) this.records.delete(recordKey);
+		});
+		this.records.set(key, {
+			expiresAt: now + ttlSeconds * 1e3,
+			value
+		});
+		return Promise.resolve();
+	}
+};
+/**
+* The sessions that back-channel logout has ended, for an SDK whose session lives in a cookie the
+* server cannot delete. The logout handler records each ended session here, and every later read
+* of a session cookie asks whether it matches one.
+*
+* A record by `sid` ends exactly that server session. A record by `sub`, written only when the
+* logout token carried no `sid`, ends that subject's sessions that began before the token was
+* issued, so signing in again afterwards works.
+*/
+var LoggedOutSessions = class LoggedOutSessions {
+	store;
+	constructor(store = new InMemoryLogoutRecordStore()) {
+		this.store = store;
+	}
+	/**
+	* Records a logout.
+	*
+	* @param logout - The `sid`, `sub` and `iat` of the validated logout token, and the clock
+	* tolerance its validation used. A logout by `sub` ends the sessions that began up to that
+	* long after `iat`: the clocks may differ by that much, and ending a session that began just
+	* after the logout is the safer mistake.
+	* @param ttlSeconds - The longest a matching session cookie could still be presented.
+	*/
+	async record(logout, ttlSeconds) {
+		const expiresAt = Date.now() + ttlSeconds * 1e3;
+		if (logout.sid) {
+			await this.store.set(LoggedOutSessions.sidKey(logout.sid), JSON.stringify({ expiresAt }), ttlSeconds);
+			return;
+		}
+		if (logout.sub) {
+			const existing = await this.read(LoggedOutSessions.subKey(logout.sub));
+			const endedAt = Math.max(logout.issuedAt + (logout.clockTolerance ?? __thunderid_javascript.BackchannelLogoutConstants.DEFAULT_CLOCK_TOLERANCE_SECONDS), existing?.endedAt ?? 0);
+			await this.store.set(LoggedOutSessions.subKey(logout.sub), JSON.stringify({
+				endedAt,
+				expiresAt
+			}), ttlSeconds);
+		}
+	}
+	/**
+	* Reports whether the presented session was ended by a recorded logout.
+	*/
+	async isLoggedOut(session) {
+		if (session.sid && await this.read(LoggedOutSessions.sidKey(session.sid))) return true;
+		if (!session.sub) return false;
+		const bySubject = await this.read(LoggedOutSessions.subKey(session.sub));
+		if (bySubject?.endedAt === void 0) return false;
+		return session.startedAt === void 0 || session.startedAt <= bySubject.endedAt;
+	}
+	async read(key) {
+		const value = await this.store.get(key);
+		if (!value) return;
+		try {
+			const record = JSON.parse(value);
+			return record.expiresAt > Date.now() ? record : void 0;
+		} catch {
+			return;
+		}
+	}
+	static sidKey(sid) {
+		return `thunderid:logout:sid:${encodeURIComponent(sid)}`;
+	}
+	static subKey(sub) {
+		return `thunderid:logout:sub:${encodeURIComponent(sub)}`;
+	}
+};
+var LoggedOutSessions_default = LoggedOutSessions;
+
 //#endregion
 //#region src/utils/generateSessionId.ts
 const generateSessionId = () => (/* @__PURE__ */ new Date()).getTime().toString(36) + Math.random().toString(36).substring(2);
@@ -382,8 +664,11 @@ if (!globalThis.fetch) {
 //#endregion
 exports.CookieChunking = CookieChunking_default;
 exports.CookieConfig = CookieConfig_default;
+exports.InMemoryLogoutRecordStore = InMemoryLogoutRecordStore;
+exports.LoggedOutSessions = LoggedOutSessions_default;
 exports.MemoryCacheStore = MemoryCacheStore_default;
 exports.NodeCryptoUtils = NodeCryptoUtils_default;
+exports.SessionIndex = SessionIndex_default;
 exports.SessionUtils = SessionUtils_default;
 exports.ThunderIDNodeClient = ThunderIDNodeClient_default;
 exports.generateSessionId = generateSessionId_default;

package/dist/index.d.ts

@@ -9,6 +9,10 @@ export { default as MemoryCacheStore } from './stores/MemoryCacheStore';
 export { default as CookieChunking } from './utils/CookieChunking';
 export { default as NodeCryptoUtils } from './utils/NodeCryptoUtils';
 export { default as SessionUtils } from './utils/SessionUtils';
+export { default as SessionIndex } from './utils/SessionIndex';
+export { default as LoggedOutSessions, InMemoryLogoutRecordStore } from './utils/LoggedOutSessions';
+export type { LogoutRecordStore, PresentedSession } from './utils/LoggedOutSessions';
+export type { IndexedSessions, SessionBinding } from './utils/SessionIndex';
 export { default as generateSessionId } from './utils/generateSessionId';
 export { default as getSessionCookieOptions } from './utils/getSessionCookieOptions';
 export * from '@thunderid/javascript';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA;;GAEG;AAGH,OAAO,EAAC,OAAO,IAAI,mBAAmB,EAAC,MAAM,uBAAuB,CAAC;AAGrE,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,0BAA0B,CAAC;AAGjE,YAAY,EAAC,mBAAmB,EAAE,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAC9E,YAAY,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,0BAA0B,CAAC;AAGzE,OAAO,EAAC,OAAO,IAAI,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AAGtE,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAC,OAAO,IAAI,iBAAiB,EAAC,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AAGnF,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA;;GAEG;AAGH,OAAO,EAAC,OAAO,IAAI,mBAAmB,EAAC,MAAM,uBAAuB,CAAC;AAGrE,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,0BAA0B,CAAC;AAGjE,YAAY,EAAC,mBAAmB,EAAE,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAC9E,YAAY,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,0BAA0B,CAAC;AAGzE,OAAO,EAAC,OAAO,IAAI,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AAGtE,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAC,OAAO,IAAI,iBAAiB,EAAE,yBAAyB,EAAC,MAAM,2BAA2B,CAAC;AAClG,YAAY,EAAC,iBAAiB,EAAE,gBAAgB,EAAC,MAAM,2BAA2B,CAAC;AACnF,YAAY,EAAC,eAAe,EAAE,cAAc,EAAC,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAC,OAAO,IAAI,iBAAiB,EAAC,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AAGnF,cAAc,uBAAuB,CAAC"}

package/dist/index.js

@@ -1,5 +1,5 @@
 import fetch, { Headers, Request, Response } from "cross-fetch";
-import { ThunderIDAuthException, ThunderIDJavaScriptClient, getVendorPrefix, resolveResourceEndpoint, updateMeCredentials } from "@thunderid/javascript";
+import { BackchannelLogoutConstants, InvalidLogoutTokenError, ThunderIDAuthException, ThunderIDJavaScriptClient, getVendorPrefix, logger, resolveResourceEndpoint, updateMeCredentials } from "@thunderid/javascript";
 import cache from "memory-cache";
 import base64url from "base64url";
 import sha256 from "fast-sha256";
@@ -59,6 +59,82 @@ var NodeCryptoUtils = class {
 };
 var NodeCryptoUtils_default = NodeCryptoUtils;
 
+//#endregion
+//#region src/utils/SessionIndex.ts
+const SID_INDEX = "backchannel_logout_sid";
+const SUB_INDEX = "backchannel_logout_sub";
+/**
+* Finds local sessions by the server session identifier (`sid`) or the subject (`sub`) of their ID
+* token. The storage adapter cannot list sessions, so a back-channel logout needs this to find the
+* ones a logout token names. It lives in the same store as the sessions themselves.
+*/
+var SessionIndex = class {
+	storageManager;
+	constructor(storageManager) {
+		this.storageManager = storageManager;
+	}
+	/**
+	* Records a session that just began.
+	*/
+	async add(sessionId, binding, startedAt) {
+		if (binding.sid) {
+			const live = await this.dropEndedSessions(await this.read(SID_INDEX, binding.sid));
+			await this.write(SID_INDEX, binding.sid, {
+				...live,
+				[sessionId]: startedAt
+			});
+		}
+		if (binding.sub) {
+			const live = await this.dropEndedSessions(await this.read(SUB_INDEX, binding.sub));
+			await this.write(SUB_INDEX, binding.sub, {
+				...live,
+				[sessionId]: startedAt
+			});
+		}
+	}
+	findBySid(sid) {
+		return this.read(SID_INDEX, sid);
+	}
+	findBySub(sub) {
+		return this.read(SUB_INDEX, sub);
+	}
+	/**
+	* Forgets a session that has ended.
+	*/
+	async remove(sessionId, binding) {
+		if (binding.sid) await this.removeEntry(SID_INDEX, binding.sid, sessionId);
+		if (binding.sub) await this.removeEntry(SUB_INDEX, binding.sub, sessionId);
+	}
+	async read(index, key) {
+		try {
+			return await this.storageManager.getCustomData(index, key) ?? {};
+		} catch {
+			return {};
+		}
+	}
+	async write(index, key, sessions) {
+		await this.storageManager.removeCustomData(index, key);
+		if (Object.keys(sessions).length > 0) await this.storageManager.setCustomData(index, sessions, key);
+	}
+	async removeEntry(index, key, sessionId) {
+		const sessions = await this.read(index, key);
+		if (!(sessionId in sessions)) return;
+		delete sessions[sessionId];
+		await this.write(index, key, sessions);
+	}
+	async dropEndedSessions(sessions) {
+		const checked = await Promise.all(Object.entries(sessions).map(async ([sessionId, startedAt]) => {
+			try {
+				return (await this.storageManager.getSessionData(sessionId))?.access_token ? [sessionId, startedAt] : void 0;
+			} catch {
+				return;
+			}
+		}));
+		return Object.fromEntries(checked.filter((entry) => entry !== void 0));
+	}
+};
+var SessionIndex_default = SessionIndex;
+
 //#endregion
 //#region src/utils/SessionUtils.ts
 const UUID_VERSION = 4;
@@ -101,6 +177,7 @@ var SessionUtils_default = SessionUtils;
 //#region src/ThunderIDNodeClient.ts
 var ThunderIDNodeClient = class extends ThunderIDJavaScriptClient {
 	_nodeInstanceId = 0;
+	_handledLogoutTokens = /* @__PURE__ */ new Map();
 	constructor(instanceId = 0) {
 		super(void 0, new NodeCryptoUtils_default());
 		this._nodeInstanceId = instanceId;
@@ -117,7 +194,7 @@ var ThunderIDNodeClient = class extends ThunderIDJavaScriptClient {
 		return this._nodeInstanceId;
 	}
 	async signIn(...args) {
-		const [authURLCallback, userId, authorizationCode, sessionState, state, signInConfig] = args;
+		const [authURLCallback, userId, authorizationCode, state, signInConfig] = args;
 		if (!userId) return Promise.reject(new ThunderIDAuthException("NODE-AUTH_CLIENT-SI-NF01", "No user ID was provided.", "Unable to sign in the user as no user ID was provided."));
 		if (await this.isSignedIn(userId)) {
 			const sessionData$1 = await this.getStorageManager().getSessionData(userId);
@@ -144,8 +221,9 @@ var ThunderIDNodeClient = class extends ThunderIDJavaScriptClient {
 				tokenType: ""
 			});
 		}
-		await this.requestAccessToken(authorizationCode, sessionState ?? "", state, userId);
+		await this.requestAccessToken(authorizationCode, state, userId);
 		const sessionData = await this.getStorageManager().getSessionData(userId);
+		await this.indexSession(userId, sessionData);
 		return Promise.resolve({
 			accessToken: sessionData.access_token,
 			createdAt: sessionData.created_at,
@@ -167,6 +245,114 @@ var ThunderIDNodeClient = class extends ThunderIDJavaScriptClient {
 		if (!signOutUrl) return Promise.reject(new ThunderIDAuthException("NODE-AUTH_CLIENT-SO-NF01", "Signing out the user failed.", "Could not obtain the sign-out URL from the server."));
 		return signOutUrl;
 	}
+	/**
+	* Handles an OpenID Connect back-channel logout: validates the logout token the server posted,
+	* then ends every local session it names. A token with a `sid` ends the sessions that joined
+	* that server session. A token with only a `sub` ends that subject's sessions that began before
+	* the token was issued, so a user who has already signed in again stays signed in.
+	*
+	* Ending a session here is local. The server has already revoked the tokens, so nothing is sent
+	* to it. A valid token that names no session held here succeeds with `sessionsEnded: 0`, which
+	* keeps a retried notification harmless.
+	*
+	* @param logoutToken - The raw `logout_token` form parameter.
+	* @returns The `sid` and `sub` the token named, when it was issued, and how many sessions were ended.
+	* @throws {InvalidLogoutTokenError} When the token is not valid or was already handled.
+	*/
+	async handleBackchannelLogout(logoutToken) {
+		const claims = await this.validateLogoutToken(logoutToken);
+		this.assertNotReplayed(claims);
+		const index = new SessionIndex_default(this.getStorageManager());
+		let sessions;
+		if (claims.sid) sessions = await index.findBySid(claims.sid);
+		else {
+			const tolerance = (await this.getStorageManager().getConfigData())?.tokenValidation?.idToken?.clockTolerance ?? BackchannelLogoutConstants.DEFAULT_CLOCK_TOLERANCE_SECONDS;
+			const issuedBefore = (claims.iat + 1 + tolerance) * 1e3;
+			sessions = Object.fromEntries(Object.entries(await index.findBySub(claims.sub)).filter(([, startedAt]) => startedAt < issuedBefore));
+		}
+		let sessionsEnded = 0;
+		await Object.keys(sessions).reduce(async (previous, sessionId) => {
+			await previous;
+			const stored = await this.readSessionBinding(sessionId);
+			if (stored.sid && claims.sid && stored.sid !== claims.sid || stored.sub && claims.sub && stored.sub !== claims.sub) {
+				await index.remove(sessionId, {
+					sid: claims.sid,
+					sub: claims.sub
+				});
+				return;
+			}
+			await this.clearSessionAsync(sessionId);
+			await index.remove(sessionId, {
+				sid: claims.sid,
+				sub: claims.sub,
+				...stored
+			});
+			sessionsEnded += 1;
+		}, Promise.resolve());
+		this.rememberHandled(claims);
+		return {
+			issuedAt: claims.iat,
+			sessionsEnded,
+			sid: claims.sid,
+			sub: claims.sub
+		};
+	}
+	/**
+	* Removes a session's index entries. Called wherever the stored session is removed, so the index
+	* does not keep growing: nothing else removes an entry once its session is gone. Sign-out does
+	* not remove the stored session, so it keeps the entry: the back-channel logout that follows
+	* finds the session through it.
+	*/
+	async forgetSession(sessionId, sessionData) {
+		try {
+			const binding = await this.readSessionBinding(sessionId ?? "", sessionData);
+			if (binding.sid || binding.sub) await new SessionIndex_default(this.getStorageManager()).remove(sessionId ?? "", binding);
+		} catch {
+			logger.warn("Could not remove the session from the back-channel logout index.");
+		}
+	}
+	clearSession(sessionId) {
+		this.clearSessionAsync(sessionId);
+	}
+	async clearSessionAsync(sessionId) {
+		await this.forgetSession(sessionId);
+		await super.clearSessionAsync(sessionId);
+	}
+	/**
+	* Records a new session against the `sid` and `sub` of its ID token, so a back-channel logout
+	* can find it. Sign-in does not depend on it, so a failure here is logged and not raised.
+	*/
+	async indexSession(sessionId, sessionData) {
+		try {
+			const binding = await this.readSessionBinding(sessionId, sessionData);
+			if (binding.sid || binding.sub) await new SessionIndex_default(this.getStorageManager()).add(sessionId, binding, Date.now());
+		} catch {
+			logger.warn("Could not index the session for back-channel logout.");
+		}
+	}
+	async readSessionBinding(sessionId, sessionData) {
+		const idToken = (sessionData ?? await this.getStorageManager().getSessionData(sessionId))?.id_token;
+		if (!idToken) return {};
+		const { sid, sub } = await this.decodeJwtToken(idToken);
+		return {
+			...typeof sid === "string" && sid ? { sid } : {},
+			...typeof sub === "string" && sub ? { sub } : {}
+		};
+	}
+	/**
+	* Refuses a logout token whose `jti` was already handled. Kept in this process only, so it is
+	* a best effort across instances; a replay still cannot end a session that began after it.
+	*/
+	assertNotReplayed(claims) {
+		const now = Date.now();
+		this._handledLogoutTokens.forEach((expiresAt, jti) => {
+			if (expiresAt <= now) this._handledLogoutTokens.delete(jti);
+		});
+		if (this._handledLogoutTokens.has(claims.jti)) throw new InvalidLogoutTokenError("NODE-AUTH_CLIENT-HBL-IV01", "The logout token was already handled.");
+	}
+	rememberHandled(claims) {
+		this._handledLogoutTokens.set(claims.jti, claims.exp * 1e3);
+	}
 	async isSignedIn(userId) {
 		try {
 			if (!await super.isSignedIn(userId)) return false;
@@ -174,6 +360,7 @@ var ThunderIDNodeClient = class extends ThunderIDJavaScriptClient {
 			const sessionData = await sm.getSessionData(userId);
 			if (await SessionUtils_default.validateSession(sessionData)) return true;
 			if (await this.refreshAccessToken(userId)) return true;
+			await this.forgetSession(userId, sessionData);
 			await sm.removeSessionData(userId);
 			return false;
 		} catch {
@@ -188,6 +375,7 @@ var ThunderIDNodeClient = class extends ThunderIDJavaScriptClient {
 		return super.refreshAccessToken(userId);
 	}
 	async revokeAccessToken(userId) {
+		await this.forgetSession(userId);
 		return super.revokeAccessToken(userId);
 	}
 	async getDecodedIdToken(userId, idToken) {
@@ -327,6 +515,100 @@ var CookieChunking = class CookieChunking {
 };
 var CookieChunking_default = CookieChunking;
 
+//#endregion
+//#region src/utils/LoggedOutSessions.ts
+/**
+* Keeps logout records in the memory of this process, dropping expired ones as new ones arrive.
+*/
+var InMemoryLogoutRecordStore = class {
+	records = /* @__PURE__ */ new Map();
+	get(key) {
+		const record = this.records.get(key);
+		if (record && record.expiresAt <= Date.now()) {
+			this.records.delete(key);
+			return Promise.resolve(void 0);
+		}
+		return Promise.resolve(record?.value);
+	}
+	set(key, value, ttlSeconds) {
+		const now = Date.now();
+		this.records.forEach((record, recordKey) => {
+			if (record.expiresAt <= now) this.records.delete(recordKey);
+		});
+		this.records.set(key, {
+			expiresAt: now + ttlSeconds * 1e3,
+			value
+		});
+		return Promise.resolve();
+	}
+};
+/**
+* The sessions that back-channel logout has ended, for an SDK whose session lives in a cookie the
+* server cannot delete. The logout handler records each ended session here, and every later read
+* of a session cookie asks whether it matches one.
+*
+* A record by `sid` ends exactly that server session. A record by `sub`, written only when the
+* logout token carried no `sid`, ends that subject's sessions that began before the token was
+* issued, so signing in again afterwards works.
+*/
+var LoggedOutSessions = class LoggedOutSessions {
+	store;
+	constructor(store = new InMemoryLogoutRecordStore()) {
+		this.store = store;
+	}
+	/**
+	* Records a logout.
+	*
+	* @param logout - The `sid`, `sub` and `iat` of the validated logout token, and the clock
+	* tolerance its validation used. A logout by `sub` ends the sessions that began up to that
+	* long after `iat`: the clocks may differ by that much, and ending a session that began just
+	* after the logout is the safer mistake.
+	* @param ttlSeconds - The longest a matching session cookie could still be presented.
+	*/
+	async record(logout, ttlSeconds) {
+		const expiresAt = Date.now() + ttlSeconds * 1e3;
+		if (logout.sid) {
+			await this.store.set(LoggedOutSessions.sidKey(logout.sid), JSON.stringify({ expiresAt }), ttlSeconds);
+			return;
+		}
+		if (logout.sub) {
+			const existing = await this.read(LoggedOutSessions.subKey(logout.sub));
+			const endedAt = Math.max(logout.issuedAt + (logout.clockTolerance ?? BackchannelLogoutConstants.DEFAULT_CLOCK_TOLERANCE_SECONDS), existing?.endedAt ?? 0);
+			await this.store.set(LoggedOutSessions.subKey(logout.sub), JSON.stringify({
+				endedAt,
+				expiresAt
+			}), ttlSeconds);
+		}
+	}
+	/**
+	* Reports whether the presented session was ended by a recorded logout.
+	*/
+	async isLoggedOut(session) {
+		if (session.sid && await this.read(LoggedOutSessions.sidKey(session.sid))) return true;
+		if (!session.sub) return false;
+		const bySubject = await this.read(LoggedOutSessions.subKey(session.sub));
+		if (bySubject?.endedAt === void 0) return false;
+		return session.startedAt === void 0 || session.startedAt <= bySubject.endedAt;
+	}
+	async read(key) {
+		const value = await this.store.get(key);
+		if (!value) return;
+		try {
+			const record = JSON.parse(value);
+			return record.expiresAt > Date.now() ? record : void 0;
+		} catch {
+			return;
+		}
+	}
+	static sidKey(sid) {
+		return `thunderid:logout:sid:${encodeURIComponent(sid)}`;
+	}
+	static subKey(sub) {
+		return `thunderid:logout:sub:${encodeURIComponent(sub)}`;
+	}
+};
+var LoggedOutSessions_default = LoggedOutSessions;
+
 //#endregion
 //#region src/utils/generateSessionId.ts
 const generateSessionId = () => (/* @__PURE__ */ new Date()).getTime().toString(36) + Math.random().toString(36).substring(2);
@@ -351,4 +633,4 @@ if (!globalThis.fetch) {
 }
 
 //#endregion
-export { CookieChunking_default as CookieChunking, CookieConfig_default as CookieConfig, MemoryCacheStore_default as MemoryCacheStore, NodeCryptoUtils_default as NodeCryptoUtils, SessionUtils_default as SessionUtils, ThunderIDNodeClient_default as ThunderIDNodeClient, generateSessionId_default as generateSessionId, getSessionCookieOptions_default as getSessionCookieOptions };
+export { CookieChunking_default as CookieChunking, CookieConfig_default as CookieConfig, InMemoryLogoutRecordStore, LoggedOutSessions_default as LoggedOutSessions, MemoryCacheStore_default as MemoryCacheStore, NodeCryptoUtils_default as NodeCryptoUtils, SessionIndex_default as SessionIndex, SessionUtils_default as SessionUtils, ThunderIDNodeClient_default as ThunderIDNodeClient, generateSessionId_default as generateSessionId, getSessionCookieOptions_default as getSessionCookieOptions };

package/dist/utils/LoggedOutSessions.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Where an SDK that keeps its session in a cookie records the sessions a back-channel logout
+ * ended. Two operations, so a shared store such as Redis fits directly (`SET key value EX ttl`
+ * and `GET key`). The default keeps records in the memory of one process.
+ */
+export interface LogoutRecordStore {
+    get(key: string): Promise<string | null | undefined>;
+    /**
+     * @param ttlSeconds - How long the record is needed. A store may drop it after that.
+     */
+    set(key: string, value: string, ttlSeconds: number): Promise<void>;
+}
+/**
+ * The session a request presents, as far as a logout record can match it.
+ */
+export interface PresentedSession {
+    /** The server session the local session joined, from the `sid` of its ID token. */
+    sid?: string;
+    /** When the local session began, in seconds since the epoch. */
+    startedAt?: number;
+    sub?: string;
+}
+/**
+ * Keeps logout records in the memory of this process, dropping expired ones as new ones arrive.
+ */
+export declare class InMemoryLogoutRecordStore implements LogoutRecordStore {
+    private records;
+    get(key: string): Promise<string | undefined>;
+    set(key: string, value: string, ttlSeconds: number): Promise<void>;
+}
+/**
+ * The sessions that back-channel logout has ended, for an SDK whose session lives in a cookie the
+ * server cannot delete. The logout handler records each ended session here, and every later read
+ * of a session cookie asks whether it matches one.
+ *
+ * A record by `sid` ends exactly that server session. A record by `sub`, written only when the
+ * logout token carried no `sid`, ends that subject's sessions that began before the token was
+ * issued, so signing in again afterwards works.
+ */
+declare class LoggedOutSessions {
+    private store;
+    constructor(store?: LogoutRecordStore);
+    /**
+     * Records a logout.
+     *
+     * @param logout - The `sid`, `sub` and `iat` of the validated logout token, and the clock
+     * tolerance its validation used. A logout by `sub` ends the sessions that began up to that
+     * long after `iat`: the clocks may differ by that much, and ending a session that began just
+     * after the logout is the safer mistake.
+     * @param ttlSeconds - The longest a matching session cookie could still be presented.
+     */
+    record(logout: {
+        clockTolerance?: number;
+        issuedAt: number;
+        sid?: string;
+        sub?: string;
+    }, ttlSeconds: number): Promise<void>;
+    /**
+     * Reports whether the presented session was ended by a recorded logout.
+     */
+    isLoggedOut(session: PresentedSession): Promise<boolean>;
+    private read;
+    private static sidKey;
+    private static subKey;
+}
+export default LoggedOutSessions;
+//# sourceMappingURL=LoggedOutSessions.d.ts.map

package/dist/utils/LoggedOutSessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoggedOutSessions.d.ts","sourceRoot":"","sources":["../../src/utils/LoggedOutSessions.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACrD;;OAEG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpE;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mFAAmF;IACnF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AASD;;GAEG;AACH,qBAAa,yBAA0B,YAAW,iBAAiB;IACjE,OAAO,CAAC,OAAO,CAGX;IAEG,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAY7C,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAY1E;AAED;;;;;;;;GAQG;AACH,cAAM,iBAAiB;IACrB,OAAO,CAAC,KAAK,CAAoB;gBAEd,KAAK,GAAE,iBAAmD;IAI7E;;;;;;;;OAQG;IACU,MAAM,CACjB,MAAM,EAAE;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAC,EAC/E,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;IAoBhB;;OAEG;IACU,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;YAkBvD,IAAI;IAiBlB,OAAO,CAAC,MAAM,CAAC,MAAM;IAIrB,OAAO,CAAC,MAAM,CAAC,MAAM;CAGtB;AAED,eAAe,iBAAiB,CAAC"}

package/dist/utils/SessionIndex.d.ts

@@ -0,0 +1,37 @@
+import { StorageManager } from '@thunderid/javascript';
+/**
+ * Local session identifiers mapped to the time each session began, in milliseconds.
+ */
+export type IndexedSessions = Record<string, number>;
+/**
+ * What ties a local session to the server: the server session it joined and its subject.
+ */
+export interface SessionBinding {
+    sid?: string;
+    sub?: string;
+}
+/**
+ * Finds local sessions by the server session identifier (`sid`) or the subject (`sub`) of their ID
+ * token. The storage adapter cannot list sessions, so a back-channel logout needs this to find the
+ * ones a logout token names. It lives in the same store as the sessions themselves.
+ */
+declare class SessionIndex<T = unknown> {
+    private storageManager;
+    constructor(storageManager: StorageManager<T>);
+    /**
+     * Records a session that just began.
+     */
+    add(sessionId: string, binding: SessionBinding, startedAt: number): Promise<void>;
+    findBySid(sid: string): Promise<IndexedSessions>;
+    findBySub(sub: string): Promise<IndexedSessions>;
+    /**
+     * Forgets a session that has ended.
+     */
+    remove(sessionId: string, binding: SessionBinding): Promise<void>;
+    private read;
+    private write;
+    private removeEntry;
+    private dropEndedSessions;
+}
+export default SessionIndex;
+//# sourceMappingURL=SessionIndex.d.ts.map

package/dist/utils/SessionIndex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionIndex.d.ts","sourceRoot":"","sources":["../../src/utils/SessionIndex.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAKrD;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAErD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,cAAM,YAAY,CAAC,CAAC,GAAG,OAAO;IAC5B,OAAO,CAAC,cAAc,CAAoB;gBAEvB,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;IAIpD;;OAEG;IACU,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcvF,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAIhD,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAIvD;;OAEG;IACU,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;YAShE,IAAI;YASJ,KAAK;YASL,WAAW;YAWX,iBAAiB;CAehC;AAED,eAAe,YAAY,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thunderid/node",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "description": "Node.js runtime SDK for ThunderID",
   "keywords": [
     "thunderid",
@@ -41,10 +41,10 @@
     "rimraf": "6.1.3",
     "rolldown": "1.0.0-beta.45",
     "typescript": "5.9.3",
-    "vitest": "4.1.10"
+    "vitest": "4.1.11"
   },
   "dependencies": {
-    "@thunderid/javascript": "^1.1.0",
+    "@thunderid/javascript": "^1.3.1",
     "base64url": "3.0.1",
     "cross-fetch": "4.1.0",
     "fast-sha256": "1.3.0",