@industream/hub-auth

Framework-agnostic client for the Industream Hub auth. It loads the Hub login connector (<industream-login>, served by the menu origin), resolves access tokens through the cross-origin SharedWorker bridge, and injects Authorization: Bearer <token> on API calls — so every sibling app shares one signed-in session without re-authenticating.

Usage

import { HubService, TokenService, withBearer } from "@industream/hub-auth";

const tokens = new TokenService(
  new HubService({ hubOrigin: cfg.industreamHubOrigin }),
);
const authedFetch = withBearer(tokens); // drop-in `fetch`

// Observe login / refresh / logout transitions:
const stop = await tokens.onAuthState((s) => console.log(s.status));

// Trigger a Hub logout (ends the shared session across all app origins):
await tokens.logout();

Angular:

import { provideIndustreamHubAuth, hubBearerInterceptor } from "@industream/hub-auth/angular";

providers: [
  provideIndustreamHubAuth({ hubOrigin: environment.industreamHubOrigin }),
  provideHttpClient(withInterceptors([hubBearerInterceptor])),
];

Signals

The wrapper models the connector's public AuthClient:

• state$ — AuthState { status, accessToken?, userinfo?, reason? }, where status is unknown | initializing | login-required | authenticated | refreshing | unauthenticated | logged-out.
• getAccessToken / getToken(forceRefresh) — silent refresh; force a fresh token after a 401.
• logout(reason) — ends the Hub session; LogoutResult.upstreamIdToken finishes an upstream OIDC/Logto end-session.
• onAuthState — observe login / refresh / logout transitions.

withBearer and the Angular interceptor retry once with a forced refresh on 401/403.

Changelog

0.1.3

• Widen the optional @angular/* and rxjs peer ranges (>=17.3.12 / >=7.8.2) so Angular 18–20 apps (e.g. datacatalog-ui on Angular 20) install cleanly instead of hitting an ERESOLVE peer conflict.

0.1.2

• Sync the consumed AuthClient type with the current connector: add the refreshing status, logout() / userinfo() / OIDC / custom sticky-event signals, and AuthState.userinfo / reason.
• Add TokenService.logout(reason) passthrough so apps can end the shared Hub session (fixes logout → re-login from external app windows).

0.1.1

• Initial framework-agnostic core + Angular adapter.