@freelight/auth-client

Shared browser auth client for FreeLight apps (FreeLight DAO + the Freelight campaign platform). A HotStaq frontend module so both apps run the same OIDC + session code instead of vendoring near-identical copies.

Auth itself is provided by FreelightAuth (OIDC provider: /auth, /token, /session/end, JWKS). This package is only the client.

Ships

• oidc-client.js → window.OIDCClient — Authorization Code + PKCE login, code exchange, RP-initiated logout (with id_token_hint aud-gate), plus:
  • OIDCClient.refreshTokens(config) — refresh_token grant; on success writes the jwtToken (+ rotated refreshToken) cookies and resolves true; resolves false when there's no refresh token; rejects on HTTP/network error.
  • OIDCClient.isTokenExpired(jwt) / decodeJwtPayload(jwt) — client-side exp read for the on-load session guard.
• session-manager.js → window.flSession — idle tracking, silent refresh before exp, the idle prompt, and the signed-out modal with a 60s countdown that auto-routes to re-auth (Close cancels to copy unsaved input).

Install (consuming app)

// package.json
"postinstall": "npx hotstaq module install @freelight/auth-client@<ver>"

Load the assets via absolute paths (shell + header), e.g.:

<script src="/hotstaq_modules/@freelight/auth-client/public/js/oidc-client.js"></script>
<script src="/hotstaq_modules/@freelight/auth-client/public/js/session-manager.js"></script>

Then window.flSession.init(config) with { authUrl, authClientId, cookiesDomain }. Per-app glue (role gate / default redirect / templates) stays in the app and calls OIDCClient + flSession.

Develop

npm test runs the node:test suite (jsdom). CI: build → test → publish (main).