Add SvelteKit SDK (@thunderid/sveltekit) - #31
Open
Chamal1120 wants to merge 32 commits into
Open
Conversation
Copy link
Copy Markdown
Sorry, something went wrong.
BREAKING CHANGE: ThunderIDSvelteClient now extends ThunderIDNodeClient instead of ThunderIDBrowserClient. Provider accepts ssrData prop for SSR hydration. Sign-in/out are server-driven via redirect. Architecture: - ThunderIDSvelteClient: singleton, extends ThunderIDNodeClient - Server: session JWT utils, handle hook, load helper, route handlers - Provider: SSR-first, hydration from .data - Composables: delegate auth actions to server endpoints - Components: SignedIn/SignedOut/Loading control, SignIn/Out/Up buttons Session management uses jose HS256 cookies matching Nuxt/Next.js pattern.
…tation Gaps filled: - Token refresh: maybeRefreshToken() proactively refreshes expiring access tokens in hooks; getValidAccessToken() for consumer use - Org switch: createOrgSwitchHandler() POST handler for org switching - Route guard: requireServerSession() throws SvelteKit redirect(307) when unauthenticated, for use in +page.server.ts load functions - Type augmentation: app.d.ts augments App.Locals with thunderid: ThunderIDSSRData so event.locals.thunderid is typed without casts
…n test - Add brandingPreference to ThunderIDSSRData, context, provider, composables - Fetch branding in parallel during handle hook (Gap 7) - Add 20 unit tests across 3 test files (session, guard, client) - Fix cookie name assertion to match actual CookieConfig format
Covers installation, SPA quick start, 7-step SvelteKit SSR setup (hook, routes, load, provider), route guard, org switch, composables, and component reference.
The SDK exports factory functions (createThunderIDHandle, createSignInHandler, etc.) — README now references the correct names. Also adds a TypeScript setup section for App.Locals type augmentation.
Uses pnpm create sv@latest (official SvelteKit scaffolding) as the prerequisite step before the 7-step setup.
…kspace - Use npx sv create (official Svelte CLI) instead of pnpm create sv - Add apps/* to pnpm-workspace.yaml so test apps get deps resolved - Add apps/ to .gitignore so throwaway test apps don't clutter the repo
- ssrData is passed as a single prop (ssrData={data}), not spread
- Merge step 7 and layout wiring into one complete +layout.svelte example
- Show SignedIn/SignedOut/SignInButton/SignOutButton in the layout
…v fallback - Add resolveConfig() helper that merges user config with env vars (THUNDERID_BASE_URL, THUNDERID_CLIENT_ID, THUNDERID_CLIENT_SECRET, THUNDERID_SESSION_SECRET) - Update createThunderIDHandle to use resolveConfig - Update createSignInHandler, createCallbackHandler, createSignOutHandler, createOrgSwitchHandler — all accept optional config now - Export resolveConfig from @thunderid/svelte/server
…d token refresh
- Fix sign-in handler: remove broken redirectUri/scope custom params, pass
client_secret as {{clientSecret}} for IdP-based secret resolution
- Fix callback handler: add try-catch with proper error serialization
(ThunderIDAuthException does not extend Error)
- Fix orgSwitch handler: same catch pattern for non-Error exceptions
- Add tokenRequest.authMethod default of client_secret_post in config
(matches IdP expectations for server-side apps)
- Add missing await on getStorageManager().getConfigData() in
getMyOrganizations and signOut methods
- Add .catch(() => []) on getMyOrganizations call in hooks to handle
403 gracefully when user lacks org scope
- Update README with /static/private pattern, tokenRequest config,
and redirect URI setup notes
- IAMError class + ErrorCode enum with 25+ typed error codes - LoggerAdapter interface + DefaultLogger with PII sanitization - HTTPS enforcement in initialize() and resolveConfig() - PKCE flag removed (forced to true) - RFC 7009 token revocation on sign-out - signUp() redirect-based implementation - signInSilently() session-check implementation - changePassword() skeleton with NOT_IMPLEMENTED error - Callback.svelte component with loading/error/success states - reInitialize(), double-init guard, missing config validation - isLoading() tracking during initialize() - Logger replaces all bare console.* calls - All lint errors on new files fixed
…DK spec - Move apps/test-app/ to samples/apps/sveltekit-b2c/ (spec §17) - Rename package from test-app to sveltekit-b2c - Rewrite README with prerequisites, env setup, run instructions - Add packages/sveltekit/.gitignore (node_modules, .svelte-kit, dist) - Anchor root .gitignore apps/ rule to /apps/ so samples/apps/ is tracked - Add samples/** to pnpm-workspace.yaml
- Rename package directory from packages/svelte to packages/sveltekit - Rename package from @thunderid/svelte to @thunderid/sveltekit - Add Base* presentation components (12 new components) - Add EventBus, i18n translations, IdTokenValidator - Add HTTPAdapter, StorageAdapter - Enhance server routes (callback, signin, signout, refresh) - Add sanitizer tests, session tests, guard tests - Combine CSR (BrowserClient) + SSR (Node SDK) in one package
# Conflicts: # .github/workflows/release.yml # .gitignore # pnpm-lock.yaml # pnpm-workspace.yaml
Copy link
Copy Markdown
|
Important Review skippedToo many files! This PR contains 107 files, which is 57 over the limit of 50. To get a review, narrow the scope: Upgrade to a paid plan to raise the limit. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: f8acde40-778a-4773-8874-dd62f00c141e 📥 CommitsReviewing files that changed from the base of the PR and between b6edf2e and e5501db. ⛔ Files ignored due to path filters (4)
You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file. Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. ❤️ ShareComment @coderabbitai help to get the list of available commands. |
Sorry, something went wrong.
…samples/<framework>/quickstart)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds @thunderid/sveltekit — a full SvelteKit SDK following the four-layer architecture spec.
What's included
Package hierarchy
@thunderid/sveltekit → @thunderid/browser → @thunderid/javascript
Verification