@udibo/oauth2 0.14.0 → 0.14.1

package/esm/adapters/hono/bff/bff.d.ts

@@ -374,10 +374,20 @@ export interface HonoBffOptions {
      * Who owns the BFF's session record. Defaults to `"own"`.
      *
      * - `"own"` (default): the BFF creates and owns its session at
-     *   `/auth/callback` — it always mints a fresh id (`sessionStore.create`)
-     *   and ignores any inbound cookie. Use when the app has no session here
-     *   until the OAuth flow completes: standalone BFFs, or apps whose login
-     *   lives on a separate / external IDP.
+     *   `/auth/callback` — it always mints a fresh id (`sessionStore.create`).
+     *   A session the inbound cookie names is replaced: once the code exchange
+     *   and `resolveUser` succeed, the BFF destroys it (`sessionStore.destroy`)
+     *   before creating the new one, so signing in again in the same browser —
+     *   switching organization, a step-up — never leaves the earlier session
+     *   readable beside the new one. Its refresh token is not revoked: an
+     *   authorization server may extend a revocation to other tokens of the
+     *   same grant or sign-in (RFC 7009 §2.1), the new ones included.
+     *   A callback the authorization server refuses, or whose state check,
+     *   code exchange or `resolveUser` fails, leaves the existing session as
+     *   it was; a store failure while creating the replacement leaves the
+     *   browser signed out. Use when the app has no session here until the
+     *   OAuth flow completes: standalone BFFs, or apps whose login lives on a
+     *   separate / external IDP.
      * - `"shared"`: the app already created the session at its own login step,
      *   and the BFF **attaches** tokens to that existing session at
      *   `/auth/callback` (via `sessionStore.update`) instead of creating its

package/esm/adapters/hono/bff/bff.js

@@ -670,9 +670,10 @@ export class HonoBff {
                     createdAt: now,
                     updatedAt: now,
                 };
-                const existing = this.#sessionMode === "shared"
-                    ? getCookie(c, this.#cookieName)
-                    : undefined;
+                const inbound = getCookie(c, this.#cookieName);
+                const existing = this.#sessionMode === "shared" ? inbound : undefined;
+                if (inbound && !existing)
+                    await this.#store.destroy(inbound);
                 const cookieValue = existing
                     ? await this.#store.update(existing, data)
                     : await this.#store.create(data);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "repository": {
     "type": "git",