@sodefa/auth

Shared SDK for SODEFA Auth consumers.

Install

npm install @sodefa/auth

Core Helpers

import {
  buildRefreshUrl,
  resolveAuthMode,
  verifyAccessToken,
} from "@sodefa/auth";

The root export contains shared constants, cookie names, redirect URL builders, host mode detection, cookie parsing, and JWT verification via the SODEFA Auth JWKS endpoint. The verified SodefaAuthUser includes the optional avatarUrl claim. It is refreshed together with the other user claims whenever Auth issues a new 15-minute access token.

Next.js Helpers

import {
  createSodefaAuthMiddleware,
  createSodefaCallbackRoute,
  getUser,
} from "@sodefa/auth/next";

@sodefa/auth/next provides middleware and callback helpers for internal Next.js tools:

• same-site SODEFA domains refresh through auth.sodefa.de
• off-domain previews use the Bounce authorization code flow
• Server Components and Route Handlers can read the verified SODEFA user

Required consumer env vars:

SODEFA_AUTH_BASE_URL=https://auth.sodefa.de
SODEFA_AUTH_CLIENT_ID=<client-id>
SODEFA_AUTH_CLIENT_SECRET=<client-secret>

Logout Integration

Expose logout from a consuming tool as a local POST action. Do not render a plain <a>/Link to a state-changing local logout route; router prefetches or crawlers can hit GET links before the user clicks.

If the local logout clears tool cookies and then sends the browser to central SODEFA logout, redirect with 303 See Other:

import { NextRequest, NextResponse } from "next/server";

export async function POST(request: NextRequest) {
  const response = NextResponse.redirect(
    "https://auth.sodefa.de/logout?redirect=https%3A%2F%2Ftool.sodefa.de%2Fsignin",
    303,
  );
  // Clear local tool cookies on response.
  return response;
}

GET https://auth.sodefa.de/logout?redirect=... is the browser logout endpoint. POST https://auth.sodefa.de/api/logout is the API/session revocation endpoint. A method-preserving redirect (307/308, or a framework default after POST) will forward the original POST to /logout and can produce 405 Method Not Allowed.

The /logout redirect target is validated by the central auth app, not by the client registration's redirect_uri patterns. It must be a relative auth path, the auth origin itself, an HTTPS *.sodefa.de URL, or a SODEFA-owned Vercel preview host matching *-sodefa.vercel.app. Other registered off-domain clients can still clear their local cookies and log out centrally, but the browser will land on the auth root unless they choose an allowed fallback URL.

Publishing

Build before publishing:

bun run build
npm publish --access public

npm publish also runs the package prepack script, so dist/* is rebuilt before the tarball is created.

Use provenance for the later GitHub Actions release path, not for the first local publish. npm provenance requires a supported cloud CI/CD runner.

This package is intentionally marked UNLICENSED and is only meant for SODEFA internal projects.