Add SvelteKit SDK (@thunderid/sveltekit) - #31
Closed
Chamal1120 wants to merge 32 commits into
Closed
Chamal1120 wants to merge 32 commits into
Chamal1120 wants to merge 32 commits into
Conversation
BREAKING CHANGE: ThunderIDSvelteClient now extends ThunderIDNodeClient instead of ThunderIDBrowserClient. Provider accepts ssrData prop for SSR hydration. Sign-in/out are server-driven via redirect. Architecture: - ThunderIDSvelteClient: singleton, extends ThunderIDNodeClient - Server: session JWT utils, handle hook, load helper, route handlers - Provider: SSR-first, hydration from .data - Composables: delegate auth actions to server endpoints - Components: SignedIn/SignedOut/Loading control, SignIn/Out/Up buttons Session management uses jose HS256 cookies matching Nuxt/Next.js pattern.
…tation Gaps filled: - Token refresh: maybeRefreshToken() proactively refreshes expiring access tokens in hooks; getValidAccessToken() for consumer use - Org switch: createOrgSwitchHandler() POST handler for org switching - Route guard: requireServerSession() throws SvelteKit redirect(307) when unauthenticated, for use in +page.server.ts load functions - Type augmentation: app.d.ts augments App.Locals with thunderid: ThunderIDSSRData so event.locals.thunderid is typed without casts
…n test - Add brandingPreference to ThunderIDSSRData, context, provider, composables - Fetch branding in parallel during handle hook (Gap 7) - Add 20 unit tests across 3 test files (session, guard, client) - Fix cookie name assertion to match actual CookieConfig format
Covers installation, SPA quick start, 7-step SvelteKit SSR setup (hook, routes, load, provider), route guard, org switch, composables, and component reference.
The SDK exports factory functions (createThunderIDHandle, createSignInHandler, etc.) — README now references the correct names. Also adds a TypeScript setup section for App.Locals type augmentation.
Uses pnpm create sv@latest (official SvelteKit scaffolding) as the prerequisite step before the 7-step setup.
…kspace - Use npx sv create (official Svelte CLI) instead of pnpm create sv - Add apps/* to pnpm-workspace.yaml so test apps get deps resolved - Add apps/ to .gitignore so throwaway test apps don't clutter the repo
- ssrData is passed as a single prop (ssrData={data}), not spread
- Merge step 7 and layout wiring into one complete +layout.svelte example
- Show SignedIn/SignedOut/SignInButton/SignOutButton in the layout
…v fallback - Add resolveConfig() helper that merges user config with env vars (THUNDERID_BASE_URL, THUNDERID_CLIENT_ID, THUNDERID_CLIENT_SECRET, THUNDERID_SESSION_SECRET) - Update createThunderIDHandle to use resolveConfig - Update createSignInHandler, createCallbackHandler, createSignOutHandler, createOrgSwitchHandler — all accept optional config now - Export resolveConfig from @thunderid/svelte/server
…d token refresh
- Fix sign-in handler: remove broken redirectUri/scope custom params, pass
client_secret as {{clientSecret}} for IdP-based secret resolution
- Fix callback handler: add try-catch with proper error serialization
(ThunderIDAuthException does not extend Error)
- Fix orgSwitch handler: same catch pattern for non-Error exceptions
- Add tokenRequest.authMethod default of client_secret_post in config
(matches IdP expectations for server-side apps)
- Add missing await on getStorageManager().getConfigData() in
getMyOrganizations and signOut methods
- Add .catch(() => []) on getMyOrganizations call in hooks to handle
403 gracefully when user lacks org scope
- Update README with /static/private pattern, tokenRequest config,
and redirect URI setup notes
- IAMError class + ErrorCode enum with 25+ typed error codes - LoggerAdapter interface + DefaultLogger with PII sanitization - HTTPS enforcement in initialize() and resolveConfig() - PKCE flag removed (forced to true) - RFC 7009 token revocation on sign-out - signUp() redirect-based implementation - signInSilently() session-check implementation - changePassword() skeleton with NOT_IMPLEMENTED error - Callback.svelte component with loading/error/success states - reInitialize(), double-init guard, missing config validation - isLoading() tracking during initialize() - Logger replaces all bare console.* calls - All lint errors on new files fixed
…DK spec - Move apps/test-app/ to samples/apps/sveltekit-b2c/ (spec §17) - Rename package from test-app to sveltekit-b2c - Rewrite README with prerequisites, env setup, run instructions - Add packages/sveltekit/.gitignore (node_modules, .svelte-kit, dist) - Anchor root .gitignore apps/ rule to /apps/ so samples/apps/ is tracked - Add samples/** to pnpm-workspace.yaml
- Rename package directory from packages/svelte to packages/sveltekit - Rename package from @thunderid/svelte to @thunderid/sveltekit - Add Base* presentation components (12 new components) - Add EventBus, i18n translations, IdTokenValidator - Add HTTPAdapter, StorageAdapter - Enhance server routes (callback, signin, signout, refresh) - Add sanitizer tests, session tests, guard tests - Combine CSR (BrowserClient) + SSR (Node SDK) in one package
# Conflicts: # .github/workflows/release.yml # .gitignore # pnpm-lock.yaml # pnpm-workspace.yaml
|
Important Review skippedToo many files! This PR contains 107 files, which is 57 over the limit of 50. To get a review, narrow the scope: Upgrade to a paid plan to raise the limit. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (4)
📒 Files selected for processing (107)
You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…samples/<framework>/quickstart)
Chamal1120
changed the title
Member
|
Hey @Chamal1120, Thanks a lot for working on this! As per our SDK roadmap, we’re currently focused on stabilizing and enriching our existing SDK suite. Because of that, a new SDK isn’t something we want to prioritize at the moment. That said, you’re welcome to maintain this as a community SDK and publish it under your own npm scope/account. We’re currently working on a process for managing community-maintained tools and how we can list them in our documentation. In the meantime, let’s keep this in your fork and publish releases from your own npm account. Suggestion for package name: Cheers! |
🔀 Cross-SDK feature parityDoes this change need to ship in the other ThunderID SDKs too? This check stays red until one of these labels answers that:
Ports
No sibling SDKs accounted for on this thread yet. Reply to this comment and the boxes above tick themselves. Nothing needs
For an SDK this change does not reach, name it and say so on one line:
Where an SDK genuinely does not need this change, say so in a reply rather than leaving it unaccounted for. The contract is in the SDK development specification. |
12 tasks
Author
|
@brionmario Thanks for the response. I'll keep this going on my side. Also it's been a while so I might have to look into the latest source of other SDKs and get mine up to speed. |
Member
+1. Also, we’ve moved the spec for generating and updating SDKs to the Just FYI. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
@thunderid/sveltekit— a full SvelteKit SDK following the four-layer architecture spec.What's included
ThunderIDSvelteClientextending Browser SDK, Svelte 5 runes (useThunderID,useUser), components (SignInButton,SignOutButton,SignedIn,SignedOut,Loading),AppShelllayouthandle),loadhelper, route handlers (/callback,/signin,/signout),guardfor protected routes, session/cookie managementsamples/sveltekit/quickstart— standalone demo with environment setupPackage hierarchy
@thunderid/sveltekit→@thunderid/browser→@thunderid/javascriptVerification
pnpm build✓pnpm typecheck✓ (0 errors, 0 warnings)pnpm test— existing unit tests forThunderIDSvelteClient