Skip to Content
AuthOverview

Auth (@sumx/ssr-auth-core + @sumx/ssr-auth-react)

Portable OIDC + HttpOnly session stack for SumX Next.js apps.

PackageRuns onResponsibility
@sumx/ssr-auth-coreServer (API routes, middleware helpers)Cookies, token refresh, OIDC URLs, /api/auth/* factories
@sumx/ssr-auth-reactClientCheckToken gate, login skeleton, cross-tab dialog

Subpath imports (ssr-auth-core)

Fine-grained imports keep server bundles smaller:

import { AUTH_SESSION_SYNC_ENDPOINT } from '@sumx/ssr-auth-core/auth-constants';
import { sanitizeReturnPath } from '@sumx/ssr-auth-core/return-path';
import { createAuthSessionHandler } from '@sumx/ssr-auth-core/next/auth-session-handler';

Main barrel: import { ... } from '@sumx/ssr-auth-core'.

Documentation map

TopicPage
Storage keys, endpoints, timeoutsConstants
Session + token cookies, signingCookies & sessions
URL cleanup, token refresh, logout URLsOIDC utilities
Post-login redirect, allowlistReturn path
Error types for session sync UISession sync errors
Pipeline identity / hard reloadOIDC pipeline identity
createAuthSessionHandler, logout, well-knownAPI route handlers
CheckToken, deps providerReact (CheckToken)

End-to-end flow

  1. User hits a protected page → CheckToken shows LoginSkeleton or OIDC redirect.
  2. OIDC callback → client POSTs tokens to POST /api/auth/session (handler from core).
  3. Server sets signed session cookie + encrypted token cookie; optional permission fetch for return-path gate.
  4. Subsequent navigations → GET /api/auth/session verifies/refreshes tokens.
  5. Logout → POST /api/auth/logout clears cookies and may redirect to IdP end-session.

See Auth quickstart for portal wiring.

cn (class names)Constants