@udibo/oauth2 0.8.0 → 0.9.0

package/README.md

@@ -76,6 +76,11 @@ a browser app with a backend, start with the BFF guide.
 authorization server. The framework-independent core accepts standard `Request`
 and `Response` objects; Hono adapters add routing and middleware.
 
+For app-owned login, `CaptchaProvider` and `verifyCaptcha` let your route check
+a client-issued bot-challenge token before calling `IdentityService`. The
+package does not include a challenge provider; see the
+[CAPTCHA route example](docs/guides/add-login.md#captcha-at-the-route-boundary).
+
 ## Examples
 
 From a checkout of this repository:

package/esm/server/authorization-server.d.ts

@@ -63,9 +63,19 @@ export interface EndSessionContext<Client extends ClientInterface> {
 }
 /** What an app's {@link EndSessionFn} may ask the server to do afterwards. */
 export interface EndSessionResult {
+    /**
+     * The app refused this logout (for example, the verified `id_token_hint`
+     * names a different person than the current session). Ignore the caller's
+     * redirect and all `headers`, including any `Set-Cookie`, so the response
+     * neither sends the browser to the RP nor clears the current session.
+     * Answer at `fallback` if supplied, otherwise 204. Omit or set `false` to
+     * preserve the normal logout behavior.
+     */
+    refused?: boolean;
     /**
      * Headers to merge into the response — the session-clearing `Set-Cookie`,
-     * typically. The server owns `Location`; anything else is yours.
+     * typically. The server owns `Location`; anything else is yours. Ignored
+     * when `refused` is true.
      */
     headers?: HeadersInit;
     /**

package/esm/server/authorization-server.js

@@ -580,8 +580,10 @@ export class AuthorizationServer extends ResourceServer {
                 subject: params.subject,
                 logoutHint: params.logoutHint,
             }) ?? {};
-            const headers = new Headers(result.headers);
-            const authorized = this.#postLogoutRedirect(client, params);
+            const headers = new Headers(result.refused ? undefined : result.headers);
+            const authorized = result.refused
+                ? undefined
+                : this.#postLogoutRedirect(client, params);
             const target = authorized ?? result.fallback;
             if (!target)
                 return new Response(null, { status: 204, headers });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@udibo/oauth2",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "A flexible OAuth2 toolkit: framework-agnostic authorization & resource servers, a typed client, Hono adapters (including a backend-for-frontend), and React bindings.",
   "repository": {
     "type": "git",