docpouch-client 1.0.3 → 1.0.5

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 import { Socket } from "socket.io-client";
 /**
  * Client for interacting with docPouch API.
+ * Supports JWT and OIDC authentication with comprehensive logout capabilities.
+ * Provides event emitter functionality for logout events.
  */
 export default class docPouchClient {
     /**
@@ -49,6 +51,10 @@ export default class docPouchClient {
      * @type {boolean}
      */
     private connectionInProgress;
+    /**
+     * Event emitter for logout events
+     */
+    private events;
     /**
      * Creates an instance of docPouchClient.
      *
@@ -227,9 +233,40 @@ export default class docPouchClient {
     /**
      * Logs out the client, clearing all tokens and disconnecting WebSocket.
      *
+     * @param {LogoutOptions} [options] - Logout options for OIDC logout
      * @returns {Promise<void>}
      */
-    logout(): Promise<void>;
+    logout(options?: LogoutOptions): Promise<void>;
+    /**
+     * Explicitly logout from OIDC provider
+     * Redirects to /end_session endpoint
+     *
+     * @param {LogoutOptions} [options] - Logout options
+     * @returns {Promise<void>}
+     */
+    logoutOidc(options?: LogoutOptions): Promise<void>;
+    /**
+     * Logout from JWT (client-side only)
+     *
+     * @returns {Promise<void>}
+     */
+    logoutJwt(): Promise<void>;
+    /**
+     * Listen for logout events
+     */
+    onLogout(callback: () => void): void;
+    /**
+     * Listen for OIDC logout specifically
+     */
+    onOidcLogout(callback: () => void): void;
+    /**
+     * Listen for JWT logout specifically
+     */
+    onJwtLogout(callback: () => void): void;
+    /**
+     * Emit an event
+     */
+    private emit;
     /**
      * Registers a new OIDC client with the server (dynamic client registration).
      *
@@ -296,6 +333,19 @@ export default class docPouchClient {
     private generateCodeVerifier;
     private generateCodeChallenge;
     private generateState;
+    /**
+     * Check if user was just logged out (after redirect from /end_session)
+     * Checks URL for logout indicator or checks localStorage
+     *
+     * @returns {boolean} True if user was just logged out
+     */
+    wasJustLoggedOut(): boolean;
+    /**
+     * Get post_logout_redirect_uri after OIDC logout
+     *
+     * @returns {string | null} The post logout redirect URI or null if not set
+     */
+    getPostLogoutRedirectUri(): string | null;
 }
 export interface I_UserEntry extends I_UserCreation {
     _id: string;
@@ -335,6 +385,10 @@ export interface I_LoginResponse {
     userName: string;
     expiresIn?: number;
 }
+export interface LogoutOptions {
+    redirectUri?: string;
+    idTokenHint?: string;
+}
 export interface I_OidcConfig {
     issuer: string;
     clientId: string;
@@ -342,6 +396,7 @@ export interface I_OidcConfig {
     scope?: string;
     scopes?: string[];
     clientSecret?: string;
+    postLogoutRedirectUri?: string;
 }
 export interface I_OidcTokenResponse {
     accessToken: string;

package/dist/index.js

@@ -2,6 +2,8 @@ import { io } from "socket.io-client";
 import packetJson from '../package.json';
 /**
  * Client for interacting with docPouch API.
+ * Supports JWT and OIDC authentication with comprehensive logout capabilities.
+ * Provides event emitter functionality for logout events.
  */
 export default class docPouchClient {
     /**
@@ -40,6 +42,10 @@ export default class docPouchClient {
          * @type {boolean}
          */
         this.connectionInProgress = false;
+        /**
+         * Event emitter for logout events
+         */
+        this.events = {};
         this.baseUrl = host;
         const socketUrl = host.includes('://') ? host : `https://${host}`;
         const socketUrlWithPort = socketUrl.includes(':') && !socketUrl.endsWith(':')
@@ -411,11 +417,15 @@ export default class docPouchClient {
         return true;
     }
     restoreOidcSession() {
-        if (typeof window === 'undefined' || !window.localStorage)
-            return false;
         const stored = localStorage.getItem('docpouch_oidc_session');
-        if (!stored)
+        if (!stored) {
+            // If no session, check if user was just logged out
+            if (this.wasJustLoggedOut()) {
+                // User was logged out, emit oidc-logout event
+                this.emit('oidc-logout');
+            }
             return false;
+        }
         try {
             const session = JSON.parse(stored);
             if (!session.accessToken || Date.now() >= session.expiry) {
@@ -474,18 +484,134 @@ export default class docPouchClient {
     /**
      * Logs out the client, clearing all tokens and disconnecting WebSocket.
      *
+     * @param {LogoutOptions} [options] - Logout options for OIDC logout
+     * @returns {Promise<void>}
+     */
+    async logout(options) {
+        const wasOidc = this.authMethod === 'oidc';
+        // For OIDC, redirect to /end_session endpoint
+        if (wasOidc && this.oidcConfig && typeof window !== 'undefined') {
+            const redirectUri = options?.redirectUri || this.oidcConfig.redirectUri || window.location.origin;
+            let url = `${this.oidcConfig.issuer}/end_session?post_logout_redirect_uri=${encodeURIComponent(redirectUri)}`;
+            // Add id_token_hint if available
+            const idToken = options?.idTokenHint || this.oidcIdToken;
+            if (idToken) {
+                url += `&id_token_hint=${idToken}`;
+            }
+            // Clear tokens before redirect
+            this.authToken = null;
+            this.clearOidcTokens();
+            this.authMethod = 'none';
+            if (this.socket.connected)
+                this.socket.disconnect();
+            // Redirect to OIDC logout endpoint
+            window.location.href = url;
+            return;
+        }
+        // For JWT or no auth, just clear local state
+        const wasJwt = this.authMethod === 'jwt';
+        this.authToken = null;
+        this.clearOidcTokens();
+        this.authMethod = 'none';
+        if (this.socket.connected)
+            this.socket.disconnect();
+        if (typeof window !== 'undefined' && window.location &&
+            (window.location.search.includes('code=') || window.location.search.includes('state='))) {
+            window.history.replaceState({}, '', window.location.pathname);
+        }
+        // Emit appropriate logout events
+        if (wasJwt) {
+            this.emit('jwt-logout');
+            this.emit('logout');
+        }
+        else if (!wasOidc) {
+            // No auth case
+            this.emit('logout');
+        }
+    }
+    /**
+     * Explicitly logout from OIDC provider
+     * Redirects to /end_session endpoint
+     *
+     * @param {LogoutOptions} [options] - Logout options
      * @returns {Promise<void>}
      */
-    async logout() {
+    async logoutOidc(options) {
+        if (this.authMethod !== 'oidc') {
+            throw new Error('Not logged in with OIDC');
+        }
+        if (!this.oidcConfig?.issuer) {
+            throw new Error('OIDC issuer not configured');
+        }
+        const { redirectUri = this.oidcConfig.redirectUri || window.location.origin, idTokenHint } = options || {};
+        let url = `${this.oidcConfig.issuer}/end_session?post_logout_redirect_uri=${encodeURIComponent(redirectUri)}`;
+        if (idTokenHint) {
+            url += `&id_token_hint=${idTokenHint}`;
+        }
+        else if (this.oidcIdToken) {
+            url += `&id_token_hint=${this.oidcIdToken}`;
+        }
+        // Clear tokens before redirect
         this.authToken = null;
         this.clearOidcTokens();
         this.authMethod = 'none';
+        if (this.socket.connected)
+            this.socket.disconnect();
+        // Emit OIDC logout event
+        this.emit('oidc-logout');
+        this.emit('logout');
+        window.location.href = url;
+    }
+    /**
+     * Logout from JWT (client-side only)
+     *
+     * @returns {Promise<void>}
+     */
+    async logoutJwt() {
+        if (this.authMethod !== 'jwt') {
+            throw new Error('Not logged in with JWT');
+        }
+        this.authToken = null;
+        this.authMethod = 'none';
         if (this.socket.connected)
             this.socket.disconnect();
         if (typeof window !== 'undefined' && window.location &&
             (window.location.search.includes('code=') || window.location.search.includes('state='))) {
             window.history.replaceState({}, '', window.location.pathname);
         }
+        // Emit JWT logout event
+        if (this.events['jwt-logout']) {
+            this.events['jwt-logout']();
+        }
+        if (this.events['logout']) {
+            this.events['logout']();
+        }
+    }
+    /**
+     * Listen for logout events
+     */
+    onLogout(callback) {
+        this.events['logout'] = callback;
+    }
+    /**
+     * Listen for OIDC logout specifically
+     */
+    onOidcLogout(callback) {
+        this.events['oidc-logout'] = callback;
+    }
+    /**
+     * Listen for JWT logout specifically
+     */
+    onJwtLogout(callback) {
+        this.events['jwt-logout'] = callback;
+    }
+    /**
+     * Emit an event
+     */
+    emit(event) {
+        if (this.events[event]) {
+            this.events[event]();
+        }
     }
     // OIDC Dynamic Client Registration Methods
     /**
@@ -742,4 +868,33 @@ export default class docPouchClient {
         crypto.getRandomValues(array);
         return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join('');
     }
+    /**
+     * Check if user was just logged out (after redirect from /end_session)
+     * Checks URL for logout indicator or checks localStorage
+     *
+     * @returns {boolean} True if user was just logged out
+     */
+    wasJustLoggedOut() {
+        // Check URL query parameter
+        const urlParams = new URLSearchParams(window.location.search);
+        if (urlParams.get('logout') === 'true') {
+            return true;
+        }
+        // Check localStorage flag
+        const lastAuthMethod = localStorage.getItem('lastAuthMethod');
+        const currentAuthMethod = localStorage.getItem('authMethod');
+        // If last was OIDC/JWT but current is none, was logged out
+        if (lastAuthMethod && currentAuthMethod === null) {
+            return true;
+        }
+        return false;
+    }
+    /**
+     * Get post_logout_redirect_uri after OIDC logout
+     *
+     * @returns {string | null} The post logout redirect URI or null if not set
+     */
+    getPostLogoutRedirectUri() {
+        return localStorage.getItem('postLogoutRedirectUri');
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "docpouch-client",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
@@ -23,16 +23,16 @@
   "description": "Client SDK for DocPouch API - supports JWT and OIDC authentication",
   "repository": {
     "type": "git",
-    "url": "https://github.com/BFH-JTF/docpouch-client"
+    "url": "git+https://github.com/BFH-JTF/docpouch-client.git"
   },
   "devDependencies": {
     "@types/express": "^5.0.6",
     "@types/jest": "^30.0.0",
-    "@types/node": "^25.7.0",
+    "@types/node": "^25.9.1",
     "express": "^5.2.1",
     "jest": "^30.4.2",
     "socket.io": "^4.8.3",
-    "ts-jest": "^29.4.9",
+    "ts-jest": "^29.4.10",
     "typescript": "^6.0.3"
   },
   "dependencies": {

package/chat-09e440bd-c52c-44b9-bba4-01cebc84bd7b.txt

@@ -1,223 +0,0 @@
-Chat 'ChatTitle(text="I am adding authent…" with OpenCode, isCustom=true)' (09e440bd-c52c-44b9-bba4-01cebc84bd7b)
-Context:
-
-Messages: 18
-=================================================================================================================
-
-==== RestoredMessage #1 ====
-User: 
-I am adding authentication using node-oidcProvider to my app in addition to the already present localStorage solution. To give clients the possibility to register, is it enough to create a call to `this.expressApp.post` and get the necessary information from the client including some kind of secret?
-Attachments:
-Attachment Name: Console Selection
-Attachments Kind: Visible
-Attachments Source: Other / RestoredChatAttachment
-Attachments Text:
-this.expressApp.get
-Attachment Name: Console Selection
-Attachments Kind: Visible
-Attachments Source: Other / RestoredChatAttachment
-Attachments Text:
-validate
-
-
-kotlin.Unit
-
-==== RestoredMessage #2 ====
-Assistant: 
-
-
-kotlin.Unit
-
-==== RestoredMessage #3 ====
-User: 
-Yes, good idea
-Attachments:
-Attachment Name: Console Selection
-Attachments Kind: Visible
-Attachments Source: Other / RestoredChatAttachment
-Attachments Text:
-validate
-
-
-kotlin.Unit
-
-==== RestoredMessage #4 ====
-Assistant: 
-
-
-kotlin.Unit
-
-==== RestoredMessage #5 ====
-User: 
-1. I want a controlled registration. I changed initialAccessToken to `process.env.OIDC_REGISTRATION_TOKEN`.
-2. I don't even know what JWKS is, let alone have anything set up for it.
-Yes, please proceed
-Attachments:
-Attachment Name: Console Selection
-Attachments Kind: Visible
-Attachments Source: Other / RestoredChatAttachment
-Attachments Text:
-process.env.OIDC_REGISTRATION_TOKEN
-Attachment Name: Console Selection
-Attachments Kind: Visible
-Attachments Source: Other / RestoredChatAttachment
-Attachments Text:
-validate
-
-
-kotlin.Unit
-
-==== RestoredMessage #6 ====
-Assistant: 
-
-
-kotlin.Unit
-
-==== RestoredMessage #7 ====
-User: 
-Let's go with a static JWKS for starters. Yes, I would like the clients to have their choice, whether they want to use the localStorage or the OIDC approach for authentication. For both, the clients are expected to build their own login masks.
-If the registration token is not just a random string, I need help, yes. 
-Attachments:
-Attachment Name: Console Selection
-Attachments Kind: Visible
-Attachments Source: Other / RestoredChatAttachment
-Attachments Text:
-process.env.OIDC_REGISTRATION_TOKEN
-Attachment Name: Console Selection
-Attachments Kind: Visible
-Attachments Source: Other / RestoredChatAttachment
-Attachments Text:
-validate
-
-
-kotlin.Unit
-
-==== RestoredMessage #8 ====
-Assistant: 
-
-
-kotlin.Unit
-
-==== RestoredMessage #9 ====
-User: 
-I am unsure,now. If I give clients these options for auth, is it easier for them, than having to build their own login mask?
-1. The old approach using the token in localStorage.
-2. OIDC and they can use a login mask provided by docPouch.
-Attachments:
-Attachment Name: Console Selection
-Attachments Kind: Visible
-Attachments Source: Other / RestoredChatAttachment
-Attachments Text:
-process.env.OIDC_REGISTRATION_TOKEN
-Attachment Name: Console Selection
-Attachments Kind: Visible
-Attachments Source: Other / RestoredChatAttachment
-Attachments Text:
-validate
-Attachment Name: Console Selection
-Attachments Kind: Visible
-Attachments Source: Other / RestoredChatAttachment
-Attachments Text:
-JWT_SECRET=your-secure-jwt-secret-here
-Attachment Name: Console Selection
-Attachments Kind: Visible
-Attachments Source: Other / RestoredChatAttachment
-Attachments Text:
-NODE_ENV
-
-
-kotlin.Unit
-
-==== RestoredMessage #10 ====
-Assistant: 
-
-
-kotlin.Unit
-
-==== RestoredMessage #11 ====
-User: 
-I want to offer both choices and build a server-side login page.
-Attachments:
-Attachment Name: Console Selection
-Attachments Kind: Visible
-Attachments Source: Other / RestoredChatAttachment
-Attachments Text:
-process.env.OIDC_REGISTRATION_TOKEN
-Attachment Name: Console Selection
-Attachments Kind: Visible
-Attachments Source: Other / RestoredChatAttachment
-Attachments Text:
-validate
-Attachment Name: Console Selection
-Attachments Kind: Visible
-Attachments Source: Other / RestoredChatAttachment
-Attachments Text:
-JWT_SECRET=your-secure-jwt-secret-here
-Attachment Name: Console Selection
-Attachments Kind: Visible
-Attachments Source: Other / RestoredChatAttachment
-Attachments Text:
-NODE_ENV
-
-
-kotlin.Unit
-
-==== RestoredMessage #12 ====
-Assistant: 
-
-
-kotlin.Unit
-
-==== RestoredMessage #13 ====
-User: 
-Do I need to update the express routes, so that they are able to validate users using both approaches?
-Attachments:
-Attachment Name: Console Selection
-Attachments Kind: Visible
-Attachments Source: Other / RestoredChatAttachment
-Attachments Text:
-JWT_SECRET=your-secure-jwt-secret-here
-
-
-kotlin.Unit
-
-==== RestoredMessage #14 ====
-Assistant: 
-
-
-kotlin.Unit
-
-==== RestoredMessage #15 ====
-User: 
-I am importing interfaces from the docPouch client I have written. I assume I will have to update some of those, as well, when I update the docPouch client, correct?
-Attachments:
-Attachment Name: Console Selection
-Attachments Kind: Visible
-Attachments Source: Other / RestoredChatAttachment
-Attachments Text:
-JWT_SECRET=your-secure-jwt-secret-here
-
-
-kotlin.Unit
-
-==== RestoredMessage #16 ====
-Assistant: 
-
-
-kotlin.Unit
-
-==== UserMessageImpl #17 ====
-User: 
-Yes, I would like to go for Option A and the client should offer different methods for the different auth methods and thus explicitly choose. Please make a detailed plan for yourself, so when I load up my docpouch-client project and give you this instruction, you know exactly what to do.
-
-kotlin.Unit
-
-==== AgentMessage #18 ====
-Assistant: 
-
-
-Tool use list:
-
-
-kotlin.Unit
-

package/hff

@@ -1,114 +0,0 @@
-warning: in the working copy of 'README.md', LF will be replaced by CRLF the next time Git touches it
-warning: in the working copy of 'src/index.ts', LF will be replaced by CRLF the next time Git touches it
-warning: in the working copy of 'tsconfig.json', LF will be replaced by CRLF the next time Git touches it
-diff --git a/package-lock.json b/package-lock.json
-index dacae59..99c15e5 100644
---- a/package-lock.json
-+++ b/package-lock.json
-@@ -1,12 +1,12 @@
- {
-   "name": "docpouch-client",
--  "version": "1.0.0",
-+  "version": "1.0.1",
-   "lockfileVersion": 3,
-   "requires": true,
-   "packages": {
-     "": {
-       "name": "docpouch-client",
--      "version": "1.0.0",
-+      "version": "1.0.1",
-       "license": "MIT",
-       "dependencies": {
-         "socket.io-client": "^4.8.3"
-diff --git a/package.json b/package.json
-index 47412b6..61174a1 100644
---- a/package.json
-+++ b/package.json
-@@ -1,6 +1,6 @@
- {
-   "name": "docpouch-client",
--  "version": "1.0.1",
-+  "version": "1.0.3",
-   "main": "dist/index.js",
-   "types": "dist/index.d.ts",
-   "exports": {
-diff --git a/src/index.ts b/src/index.ts
-index b9368d4..545dade 100644
---- a/src/index.ts
-+++ b/src/index.ts
-@@ -358,6 +358,18 @@ export default class docPouchClient {
- 
-     // OIDC Authentication Methods
- 
-+    /**
-+     * Sets the OIDC configuration to use for the callback and token exchange.
-+     * Call this before {@link handleOidcCallback} if the client was freshly
-+     * instantiated after a page reload (the config is otherwise only set
-+     * internally by {@link loginWithOidc} before the redirect).
-+     *
-+     * @param {I_OidcConfig} config - OIDC provider configuration.
-+     */
-+    setOidcConfig(config: I_OidcConfig): void {
-+        this.oidcConfig = config;
-+    }
-+
-     /**
-      * Initiates the OIDC authentication flow by redirecting to the authorization endpoint.
-      *
-@@ -373,11 +385,20 @@ export default class docPouchClient {
-         this.oidcState = this.generateState();
-         const codeChallenge = await this.generateCodeChallenge(this.codeVerifier!);
- 
-+        if (typeof window !== 'undefined' && window.sessionStorage) {
-+            sessionStorage.setItem('docpouch_oidc_state', this.oidcState!);
-+            sessionStorage.setItem('docpouch_oidc_code_verifier', this.codeVerifier!);
-+            sessionStorage.setItem('docpouch_oidc_issuer', config.issuer);
-+            sessionStorage.setItem('docpouch_oidc_client_id', config.clientId);
-+            sessionStorage.setItem('docpouch_oidc_redirect_uri', config.redirectUri);
-+        }
-+
-+        const scope = config.scope || config.scopes?.join(' ') || 'openid profile';
-         const params = new URLSearchParams({
-             response_type: 'code',
-             client_id: config.clientId,
-             redirect_uri: config.redirectUri,
--            scope: config.scopes?.join(' ') || 'openid profile',
-+            scope,
-             state: this.oidcState!,
-             code_challenge: codeChallenge,
-             code_challenge_method: 'S256'
-@@ -399,6 +420,26 @@ export default class docPouchClient {
- 
-         if (error) throw new Error(`OAuth error: ${error}`);
-         if (!code || !state) return false;
-+
-+        if (typeof window !== 'undefined' && window.sessionStorage) {
-+            this.oidcState = sessionStorage.getItem('docpouch_oidc_state') || this.oidcState;
-+            this.codeVerifier = sessionStorage.getItem('docpouch_oidc_code_verifier') || this.codeVerifier;
-+            sessionStorage.removeItem('docpouch_oidc_state');
-+            sessionStorage.removeItem('docpouch_oidc_code_verifier');
-+
-+            if (!this.oidcConfig) {
-+                const issuer = sessionStorage.getItem('docpouch_oidc_issuer');
-+                const clientId = sessionStorage.getItem('docpouch_oidc_client_id');
-+                const redirectUri = sessionStorage.getItem('docpouch_oidc_redirect_uri');
-+                if (issuer && clientId && redirectUri) {
-+                    this.oidcConfig = { issuer, clientId, redirectUri };
-+                    sessionStorage.removeItem('docpouch_oidc_issuer');
-+                    sessionStorage.removeItem('docpouch_oidc_client_id');
-+                    sessionStorage.removeItem('docpouch_oidc_redirect_uri');
-+                }
-+            }
-+        }
-+
-         if (state !== this.oidcState) throw new Error('State mismatch');
- 
-         const discovery = await this.discoverOidc();
-@@ -861,6 +902,7 @@ export interface I_OidcConfig {
-     issuer: string;
-     clientId: string;
-     redirectUri: string;
-+    scope?: string;
-     scopes?: string[];
-     clientSecret?: string;
- }

package/jest.config.cjs

@@ -1,18 +0,0 @@
-module.exports = {
-  preset: 'ts-jest',
-  testEnvironment: 'node',
-  moduleNameMapper: {
-    '^(\\.{1,2}/.*)\\.js$': '$1',
-  },
-  transform: {
-    '^.+\\.tsx?$': ['ts-jest', {
-      useESM: true,
-    }],
-  },
-  extensionsToTreatAsEsm: ['.ts'],
-  moduleFileExtensions: ['ts', 'tsx', 'js', 'jsx', 'json', 'node'],
-  testMatch: ['**/__tests__/**/*.ts?(x)', '**/?(*.)+(spec|test).ts?(x)', 'tests/**/*.test.ts'],
-  collectCoverage: true,
-  coverageDirectory: 'coverage',
-  coverageReporters: ['text', 'lcov'],
-};