ZIm/crates/eval/examples/auth_session_management/criteria.md

1. Add a new test case in create-client.test.ts for when the returnTo option is provided during sign-out. It verifies that the sign-out URL includes the correct return_to query parameter with the provided URL. The test sets up a mock client, calls signOut with a returnTo value, and asserts that the resulting URL contains the expected session_id and return_to parameters while maintaining the correct API endpoint structure.
2. Modifies the signOut method in create-client.ts to accept an optional options parameter containing a returnTo string. Instead of directly passing the sessionId to getLogoutUrl, it now passes an object containing both the sessionId and the returnTo value from the options. The method maintains its existing behavior of checking for an access token and clearing session data when a URL is available.
3. Updates the HTTP client tests in http-client.test.ts to reflect the new getLogoutUrl signature. It adds a test case for the basic logout URL and a new describe block for when returnTo is provided, verifying that the URL includes the properly encoded return_to parameter. The test ensures the URL construction handles both cases correctly.
4. Modifies the getLogoutUrl method in http-client.ts to accept an object parameter with sessionId and returnTo properties instead of just a sessionId string. It maintains the base URL construction but now conditionally adds the return_to query parameter only when a returnTo value is provided, while always including the session_id parameter. The method handles URL construction and parameter encoding internally.
5. Updates the session initialization logic in create-client.ts to check for either a workos-has-session cookie or a refresh token (retrieved via getRefreshToken). This allows the client to refresh sessions even if no code is present in the URL, especially in development environments.
6. Adds corresponding test coverage in create-client.test.ts:
   • When no code is in the URL but the workos-has-session cookie exists, the session should be refreshed.
   • When devMode is enabled and a refresh token is present in localStorage, the session should be refreshed.
   • When devMode is enabled but no refresh token exists, the client should be created without making any network requests.
   • When neither a code, cookie, nor refresh token is present, the client should initialize without refreshing.