feat(auth): export RefreshWorker asset and support same-origin worker URL override

Author: bourgeoa

README.md

@@ -113,6 +113,34 @@ import {
 } from 'solid-logic';
 ```
 
+## Worker Asset and Runtime Configuration
+
+solid-logic publishes the OIDC refresh worker as a package export so host apps can serve it from the same origin.
+
+### Worker export
+
+- Package export: `solid-logic/RefreshWorker`
+- Built file: `dist/RefreshWorker.js`
+
+Host applications should copy or serve this file so the browser can load it with a same-origin URL.
+
+### Worker URL override
+
+Before solid-logic initializes, applications can set:
+
+```js
+window.__SOLID_LOGIC_WORKER_URL__ = 'https://app.example.com/RefreshWorker.js'
+```
+
+If this override is not set, solid-logic resolves the worker URL to `./RefreshWorker.js` against `window.location.href`.
+
+### Session fallback behavior
+
+When worker session initialization fails, solid-logic falls back in this order:
+
+1. `SessionCore` with IndexedDB-backed session database
+2. `SessionCore` with in-memory session database
+
 # How to develop
 
 Check the scripts in the `package.json` for build, watch, lint and test.

package.json

@@ -11,6 +11,10 @@
       "import": "./dist/solid-logic.esm.js",
       "require": "./dist/solid-logic.js",
       "types": "./dist/index.d.ts"
+    },
+    "./RefreshWorker": {
+      "import": "./dist/RefreshWorker.js",
+      "default": "./dist/RefreshWorker.js"
     }
   },
   "sideEffects": false,
@@ -21,10 +25,11 @@
   ],
   "scripts": {
     "clean": "rm -rf dist src/versionInfo.ts",
-    "build": "npm run clean && npm run typecheck && npm run build-version && npm run build-js && npm run build-dist && npm run postbuild-js",
+    "build": "npm run clean && npm run typecheck && npm run build-version && npm run build-js && npm run build-dist && npm run copy-worker && npm run postbuild-js",
     "build-version": "./timestamp.sh > src/versionInfo.ts  && eslint 'src/versionInfo.ts' --fix",
     "build-js": "tsc",
     "build-dist": "webpack --progress",
+    "copy-worker": "node -e \"const fs=require('fs');const path=require('path');const src=path.resolve('node_modules/@uvdsl/solid-oidc-client-browser/dist/esm/web/RefreshWorker.js');const dst=path.resolve('dist/RefreshWorker.js');fs.copyFileSync(src,dst);\"",
     "postbuild-js": "rm -f dist/versionInfo.d.ts dist/versionInfo.d.ts.map",
     "lint": "eslint",
     "lint-fix": "eslint --fix",

src/authSession/authSession.ts

@@ -147,9 +147,31 @@ class IndexedDbSessionDatabase implements SessionDatabase {
   }
 }
 
+function resolveWorkerUrl (): string | URL | undefined {
+  if (typeof window === 'undefined') return undefined
+
+  const explicitWorkerUrl = (window as any).__SOLID_LOGIC_WORKER_URL__
+  if (typeof explicitWorkerUrl === 'string' && explicitWorkerUrl.trim().length > 0) {
+    return explicitWorkerUrl
+  }
+  if (explicitWorkerUrl instanceof URL) {
+    return explicitWorkerUrl
+  }
+
+  try {
+    // Default to same-origin sibling asset next to the current page URL.
+    return new URL('./RefreshWorker.js', window.location.href).toString()
+  } catch {
+    return undefined
+  }
+}
+
 function createSession (): OidcSession {
   try {
-    return new WebSession()
+    const workerUrl = resolveWorkerUrl()
+    return workerUrl
+      ? new WebSession(undefined, { workerUrl })
+      : new WebSession()
   } catch (error) {
     // In some deployments, worker URL resolution can become file:// and fail cross-origin.
     // Fall back to SessionCore so auth still works without background refresh worker.

test/packageExports.test.ts

@@ -0,0 +1,14 @@
+import { readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+describe('package exports', () => {
+    it('exports RefreshWorker.js from dist', () => {
+        const packageJsonPath = resolve(__dirname, '..', 'package.json')
+        const packageJson = JSON.parse(readFileSync(packageJsonPath, 'utf8'))
+
+        expect(packageJson.exports['./RefreshWorker']).toEqual({
+            import: './dist/RefreshWorker.js',
+            default: './dist/RefreshWorker.js',
+        })
+    })
+})