@wtfalch/auth 0.11.0 → 0.11.1

package/dist/auth.js

@@ -175,11 +175,21 @@ export function createAuth(input) {
     /**
      * Where a sign-out lands: the issuer's own logout, so its session ends and
      * the next sign-in asks who again, rather than straight back to
-     * `afterLogout`. What this function can see fail -- no id token to hint
-     * with, no `end_session_endpoint` published, the issuer not answering --
-     * falls back to the plain redirect a sign-out has always ended with.
-     * Losing the issuer's co-operation is never a reason to fail somebody's
-     * sign-out.
+     * `afterLogout`. What this function can see fail -- no `end_session_endpoint`
+     * published, the issuer not answering -- falls back to the plain redirect a
+     * sign-out has always ended with. Losing the issuer's co-operation is never
+     * a reason to fail somebody's sign-out.
+     *
+     * Having no id token is the one failure that does not fall back, because the
+     * plain redirect leaves the issuer's session standing and the next sign-in is
+     * silent. `end_session` cannot rescue it either: without a hint the issuer
+     * takes its v1 branch and ends v1 user-agent sessions, of which a v2 sign-in
+     * has none. Routing a hint-less `end_session` to the hosted login instead
+     * needs the instance's `loginV2.required`, which overrides every app's own
+     * `loginVersion.loginV2.baseUri` with the instance's -- and each app here
+     * hosts its own sign-in at `/auth`, so that flag is not available to us.
+     * The hosted login's `/logout` sits at the issuer's origin, where
+     * `scripts/provision.mjs` points the instance's `loginV2.baseUri`.
      *
      * `afterLogout` not being a registered `post_logout_redirect_uri` is a
      * failure this function cannot see: that request reaches the issuer, which
@@ -191,11 +201,12 @@ export function createAuth(input) {
      */
     const endIssuerSession = async (idToken, cookies) => {
         const afterLogout = new URL(options().afterLogout, options().appUrl).href;
-        const target = idToken
-            ? await oidc()
-                .endSessionUrl(idToken, afterLogout)
-                .catch(() => null)
-            : null;
+        if (!idToken) {
+            return redirect(new URL('/logout', options().issuer).href, cookies, 303);
+        }
+        const target = await oidc()
+            .endSessionUrl(idToken, afterLogout)
+            .catch(() => null);
         return redirect(target?.href ?? afterLogout, cookies, 303);
     };
     const logout = async (request) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/auth",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "Sign in against auth.wtfalch.dev: a server session for a Next.js app, and a browser client with silent single sign-on across subdomains.",
   "repository": {
     "type": "git",