remix-run/remix auth@0.2.0

auth v0.2.0

on GitHub

Minor Changes

• Added createAtmosphereAuthProvider(options) to support atproto OAuth flows against Atmosphere-compatible authorization servers.

  The new provider resolves handles and DIDs with provider.prepare(handleOrDid) before redirecting, performs required pushed authorization requests with DPoP, supports both public web clients and localhost loopback development clients, and seals per-session DPoP state into the in-flight OAuth transaction using the required sessionSecret option instead of a separate persistent store.

  Create the Atmosphere provider once with shared options, call provider.prepare(handleOrDid) only before startExternalAuth(), and pass the module-scope provider directly to finishExternalAuth() and refreshExternalAuth(). Atmosphere callback results preserve the DPoP binding state and authorization server refresh details alongside the returned accessToken and refreshToken, so callers can reuse the completed token bundle directly for refresh-token exchange and follow-up DPoP-signed requests.

• Added refreshExternalAuth() to @remix-run/auth so apps can exchange stored refresh tokens for fresh OAuth and OIDC token bundles.

  The built-in OIDC providers, X, and Atmosphere now implement refresh-token exchange. Refreshed token bundles preserve the existing refresh token when the provider omits a rotated value.