@asgardeo/auth-spa 0.2.19 → 0.2.22

package/src/clients/main-thread-client.ts

@@ -19,18 +19,23 @@
 import {
     AUTHORIZATION_CODE,
     AsgardeoAuthClient,
+    AsgardeoAuthException,
     AuthClientConfig,
+    AuthenticationUtils,
     BasicUserInfo,
     CustomGrantConfig,
     DecodedIDTokenPayload,
+    FetchResponse,
     GetAuthURLConfig,
     OIDCEndpoints,
     ResponseMode,
     SESSION_STATE,
+    STATE,
     Store,
     TokenResponse
 } from "@asgardeo/auth-js";
 import {
+    ACCESS_TOKEN_INVALID,
     CHECK_SESSION_SIGNED_IN,
     CHECK_SESSION_SIGNED_OUT,
     CUSTOM_GRANT_CONFIG,
@@ -41,7 +46,6 @@ import {
     SILENT_SIGN_IN_STATE,
     Storage
 } from "../constants";
-import { AsgardeoSPAException } from "../exception";
 import { SPAHelper, SessionManagementHelper } from "../helpers";
 import { HttpClient, HttpClientInstance } from "../http-client";
 import {
@@ -56,6 +60,7 @@ import {
 import { SPACustomGrantConfig } from "../models/request-custom-grant";
 import { LocalStore, MemoryStore, SessionStore } from "../stores";
 import { SPAUtils } from "../utils";
+import { SPACryptoUtils } from "../utils/crypto-utils";
 
 const initiateStore = (store: Storage | undefined): Store => {
     switch (store) {
@@ -74,12 +79,13 @@ export const MainThreadClient = async (
     config: AuthClientConfig<MainThreadClientConfig>
 ): Promise<MainThreadClientInterface> => {
     const _store: Store = initiateStore(config.storage);
-    const _authenticationClient = new AsgardeoAuthClient<MainThreadClientConfig>(_store);
+    const _cryptoUtils: SPACryptoUtils = new SPACryptoUtils();
+    const _authenticationClient = new AsgardeoAuthClient<MainThreadClientConfig>(_store, _cryptoUtils);
     await _authenticationClient.initialize(config);
 
     const _spaHelper = new SPAHelper<MainThreadClientConfig>(_authenticationClient);
     const _dataLayer = _authenticationClient.getDataLayer();
-    const _sessionManagementHelper = SessionManagementHelper(
+    const _sessionManagementHelper = await SessionManagementHelper(
         async () => {
             return _authenticationClient.signOut();
         },
@@ -99,7 +105,7 @@ export const MainThreadClient = async (
         if (requestConfig.attachToken) {
             request.headers = {
                 ...request.headers,
-                Authorization: `Bearer ${await _authenticationClient.getAccessToken()}`
+                Authorization: `Bearer ${ await _authenticationClient.getAccessToken() }`
             };
         }
     };
@@ -126,9 +132,10 @@ export const MainThreadClient = async (
     const httpRequest = async (requestConfig: HttpRequestConfig): Promise<HttpResponse> => {
         let matches = false;
         const config = await _dataLayer.getConfigData();
+        const serverOrigin = (config as any).baseUrl || (config as any).serverOrigin;
 
-        for (const baseUrl of [...((await config?.resourceServerURLs) ?? []), config?.serverOrigin]) {
-            if (requestConfig?.url?.startsWith(baseUrl)) {
+        for (const baseUrl of [ ...((await config?.resourceServerURLs) ?? []), serverOrigin ]) {
+            if (baseUrl && requestConfig?.url?.startsWith(baseUrl)) {
                 matches = true;
 
                 break;
@@ -150,22 +157,19 @@ export const MainThreadClient = async (
                         } catch (refreshError: any) {
                             if (_isHttpHandlerEnabled) {
                                 if (typeof _httpErrorCallback === "function") {
-                                    await _httpErrorCallback(error);
+                                    await _httpErrorCallback({ ...error, code: ACCESS_TOKEN_INVALID });
                                 }
                                 if (typeof _httpFinishCallback === "function") {
                                     _httpFinishCallback();
                                 }
                             }
 
-                            return Promise.reject(
-                                new AsgardeoSPAException(
-                                    "MAIN_THREAD_CLIENT-HR-ES01",
-                                    "main-thread-client",
-                                    "httpRequest",
-                                    "",
-                                    "",
-                                    refreshError
-                                )
+                            throw new AsgardeoAuthException(
+                                "SPA-MAIN_THREAD_CLIENT-HR-SE01",
+                                refreshError?.name ?? "Refresh token request failed.",
+                                refreshError?.message ??
+                                "An error occurred while trying to refresh the " +
+                                "access token following a 401 response from the server."
                             );
                         }
 
@@ -201,16 +205,12 @@ export const MainThreadClient = async (
                     return Promise.reject(error);
                 });
         } else {
-            return Promise.reject(
-                new AsgardeoSPAException(
-                    "MAIN_THREAD_CLIENT-HR-IV02",
-                    "main-thread-client",
-                    "httpRequest",
-                    "Request to the provided endpoint is prohibited.",
-                    "Requests can only be sent to resource servers specified by the `resourceServerURLs`" +
-                        " attribute while initializing the SDK. The specified endpoint in this request " +
-                        "cannot be found among the `resourceServerURLs`"
-                )
+            throw new AsgardeoAuthException(
+                "SPA-MAIN_THREAD_CLIENT-HR-IV02",
+                "Request to the provided endpoint is prohibited.",
+                "Requests can only be sent to resource servers specified by the `resourceServerURLs`" +
+                " attribute while initializing the SDK. The specified endpoint in this request " +
+                "cannot be found among the `resourceServerURLs`"
             );
         }
     };
@@ -219,11 +219,16 @@ export const MainThreadClient = async (
         let matches = true;
         const config = await _dataLayer.getConfigData();
 
+        const serverOrigin = (config as any).baseUrl || (config as any).serverOrigin;
+
         for (const requestConfig of requestConfigs) {
             let urlMatches = false;
 
-            for (const baseUrl of [...((await config)?.resourceServerURLs ?? []), config?.serverOrigin]) {
-                if (requestConfig.url?.startsWith(baseUrl)) {
+            for (const baseUrl of [
+                ...((await config)?.resourceServerURLs ?? []),
+                serverOrigin
+            ]) {
+                if (baseUrl && requestConfig.url?.startsWith(baseUrl)) {
                     urlMatches = true;
 
                     break;
@@ -253,33 +258,31 @@ export const MainThreadClient = async (
                     })
                     .catch(async (error: HttpError) => {
                         if (error?.response?.status === 401 || !error?.response) {
-                            let refreshTokenResponse;
+                            let refreshTokenResponse: TokenResponse;
                             try {
                                 refreshTokenResponse = await _authenticationClient.refreshAccessToken();
                             } catch (refreshError: any) {
                                 if (_isHttpHandlerEnabled) {
                                     if (typeof _httpErrorCallback === "function") {
-                                        await _httpErrorCallback(error);
+                                        await _httpErrorCallback({ ...error, code: ACCESS_TOKEN_INVALID });
                                     }
                                     if (typeof _httpFinishCallback === "function") {
                                         _httpFinishCallback();
                                     }
                                 }
 
-                                return Promise.reject(
-                                    new AsgardeoSPAException(
-                                        "MAIN_THREAD_CLIENT-HRA-ES01",
-                                        "main-thread-client",
-                                        "httpRequestAll",
-                                        "",
-                                        "",
-                                        refreshError
-                                    )
+                                throw new AsgardeoAuthException(
+                                    "SPA-MAIN_THREAD_CLIENT-HRA-SE01",
+                                    refreshError?.name ?? "Refresh token request failed.",
+                                    refreshError?.message ??
+                                    "An error occurred while trying to refresh the " +
+                                    "access token following a 401 response from the server."
                                 );
                             }
 
                             if (refreshTokenResponse) {
-                                return _httpClient.all &&
+                                return (
+                                    _httpClient.all &&
                                     _httpClient
                                         .all(requests)
                                         .then((response) => {
@@ -296,7 +299,8 @@ export const MainThreadClient = async (
                                             }
 
                                             return Promise.reject(error);
-                                        });
+                                        })
+                                );
                             }
                         }
 
@@ -313,16 +317,12 @@ export const MainThreadClient = async (
                     })
             );
         } else {
-            return Promise.reject(
-                new AsgardeoSPAException(
-                    "MAIN_THREAD_CLIENT-HRA-IV02",
-                    "main-thread-client",
-                    "httpRequest",
-                    "Request to the provided endpoint is prohibited.",
-                    "Requests can only be sent to resource servers specified by the `resourceServerURLs`" +
-                        " attribute while initializing the SDK. The specified endpoint in this request " +
-                        "cannot be found among the `resourceServerURLs`"
-                )
+            throw new AsgardeoAuthException(
+                "SPA-MAIN_THREAD_CLIENT-HRA-IV02",
+                "Request to the provided endpoint is prohibited.",
+                "Requests can only be sent to resource servers specified by the `resourceServerURLs`" +
+                " attribute while initializing the SDK. The specified endpoint in this request " +
+                "cannot be found among the `resourceServerURLs`"
             );
         }
     };
@@ -356,15 +356,15 @@ export const MainThreadClient = async (
             config.checkSessionInterval ?? 3,
             config.sessionRefreshInterval ?? 300,
             config.signInRedirectURL,
-            oidcEndpoints.authorizationEndpoint ?? "",
-            config.enablePKCE
+            async (params?: GetAuthURLConfig): Promise<string> => _authenticationClient.getAuthorizationURL(params)
         );
     };
 
     const signIn = async (
         signInConfig?: GetAuthURLConfig,
         authorizationCode?: string,
-        sessionState?: string
+        sessionState?: string,
+        state?: string
     ): Promise<BasicUserInfo> => {
         const config = await _dataLayer.getConfigData();
 
@@ -401,18 +401,22 @@ export const MainThreadClient = async (
 
         let resolvedAuthorizationCode: string;
         let resolvedSessionState: string;
+        let resolvedState: string;
 
         if (config?.responseMode === ResponseMode.formPost && authorizationCode) {
             resolvedAuthorizationCode = authorizationCode;
             resolvedSessionState = sessionState ?? "";
+            resolvedState = state ?? "";
         } else {
             resolvedAuthorizationCode = new URL(window.location.href).searchParams.get(AUTHORIZATION_CODE) ?? "";
             resolvedSessionState = new URL(window.location.href).searchParams.get(SESSION_STATE) ?? "";
+            resolvedState = new URL(window.location.href).searchParams.get(STATE) ?? "";
+
             SPAUtils.removeAuthorizationCode();
         }
 
-        if (resolvedAuthorizationCode) {
-            return requestAccessToken(resolvedAuthorizationCode, resolvedSessionState);
+        if (resolvedAuthorizationCode && resolvedState) {
+            return requestAccessToken(resolvedAuthorizationCode, resolvedSessionState, resolvedState);
         }
 
         const error = new URL(window.location.href).searchParams.get(ERROR);
@@ -425,20 +429,14 @@ export const MainThreadClient = async (
 
             history.pushState(null, document.title, url.toString());
 
-            return Promise.reject(
-                new AsgardeoSPAException(
-                    "MAIN_THREAD_CLIENT-SI-BE",
-                    "main-thread-client",
-                    "signIn",
-                    error,
-                    errorDescription ?? ""
-                )
-            );
+            throw new AsgardeoAuthException("SPA-MAIN_THREAD_CLIENT-SI-SE01", error, errorDescription ?? "");
         }
 
         return _authenticationClient.getAuthorizationURL(signInConfig).then(async (url: string) => {
             if (config.storage === Storage.BrowserMemory && config.enablePKCE) {
-                SPAUtils.setPKCE((await _authenticationClient.getPKCECode()) as string);
+                const pkceKey: string = AuthenticationUtils.extractPKCEKeyFromStateParam(resolvedState);
+
+                SPAUtils.setPKCE(pkceKey, (await _authenticationClient.getPKCECode(resolvedState)) as string);
             }
 
             location.href = url;
@@ -458,7 +456,7 @@ export const MainThreadClient = async (
     };
 
     const signOut = async (): Promise<boolean> => {
-        if (await _authenticationClient.isAuthenticated() && !_getSignOutURLFromSessionStorage) {
+        if ((await _authenticationClient.isAuthenticated()) && !_getSignOutURLFromSessionStorage) {
             location.href = await _authenticationClient.signOut();
         } else {
             location.href = SPAUtils.getSignOutURL();
@@ -474,31 +472,33 @@ export const MainThreadClient = async (
         return true;
     };
 
-    const requestCustomGrant = async (config: SPACustomGrantConfig): Promise<BasicUserInfo | HttpResponse> => {
+    const requestCustomGrant = async (config: SPACustomGrantConfig): Promise<BasicUserInfo | FetchResponse> => {
         let useDefaultEndpoint = true;
         let matches = false;
-        const clientConfig = await _dataLayer.getConfigData();
+
+        const serverOrigin = (config as any).baseUrl || (config as any).serverOrigin;
 
         // If the config does not contains a token endpoint, default token endpoint will be used.
         if (config?.tokenEndpoint) {
             useDefaultEndpoint = false;
+
             for (const baseUrl of [
                 ...((await _dataLayer.getConfigData())?.resourceServerURLs ?? []),
-                clientConfig?.serverOrigin
+                serverOrigin
             ]) {
-                if (config.tokenEndpoint?.startsWith(baseUrl)) {
+                if (baseUrl && config.tokenEndpoint?.startsWith(baseUrl)) {
                     matches = true;
                     break;
                 }
             }
         }
-        if(config.shouldReplayAfterRefresh) {
+        if (config.shouldReplayAfterRefresh) {
             _dataLayer.setTemporaryDataParameter(CUSTOM_GRANT_CONFIG, JSON.stringify(config));
         }
         if (useDefaultEndpoint || matches) {
             return _authenticationClient
                 .requestCustomGrant(config)
-                .then(async (response: HttpResponse | TokenResponse) => {
+                .then(async (response: FetchResponse | TokenResponse) => {
                     if (config.preventSignOutURLUpdate) {
                         _getSignOutURLFromSessionStorage = true;
                     }
@@ -508,7 +508,7 @@ export const MainThreadClient = async (
 
                         return _authenticationClient.getBasicUserInfo();
                     } else {
-                        return response as HttpResponse;
+                        return response as FetchResponse;
                     }
                 })
                 .catch((error) => {
@@ -516,14 +516,12 @@ export const MainThreadClient = async (
                 });
         } else {
             return Promise.reject(
-                new AsgardeoSPAException(
-                    "MAIN_THREAD_CLIENT-RCG-IV01",
-                    "main-thread-client",
-                    "requestCustomGrant",
+                new AsgardeoAuthException(
+                    "SPA-MAIN_THREAD_CLIENT-RCG-IV01",
                     "Request to the provided endpoint is prohibited.",
                     "Requests can only be sent to resource servers specified by the `resourceServerURLs`" +
-                        " attribute while initializing the SDK. The specified token endpoint in this request " +
-                        "cannot be found among the `resourceServerURLs`"
+                    " attribute while initializing the SDK. The specified token endpoint in this request " +
+                    "cannot be found among the `resourceServerURLs`"
                 )
             );
         }
@@ -558,18 +556,22 @@ export const MainThreadClient = async (
 
     const requestAccessToken = async (
         resolvedAuthorizationCode: string,
-        resolvedSessionState: string
+        resolvedSessionState: string,
+        resolvedState: string
     ): Promise<BasicUserInfo> => {
         const config = await _dataLayer.getConfigData();
 
         if (config.storage === Storage.BrowserMemory && config.enablePKCE) {
-            const pkce = SPAUtils.getPKCE();
+            const pkce = SPAUtils.getPKCE(AuthenticationUtils.extractPKCEKeyFromStateParam(resolvedState));
 
-            await _authenticationClient.setPKCECode(pkce);
+            await _authenticationClient.setPKCECode(
+                AuthenticationUtils.extractPKCEKeyFromStateParam(resolvedState),
+                pkce
+            );
         }
 
         return _authenticationClient
-            .requestAccessToken(resolvedAuthorizationCode, resolvedSessionState)
+            .requestAccessToken(resolvedAuthorizationCode, resolvedSessionState, resolvedState)
             .then(async () => {
                 // Disable this temporarily
                 /* if (config.storage === Storage.BrowserMemory) {
@@ -634,7 +636,12 @@ export const MainThreadClient = async (
             const url: string = urlObject.toString();
 
             if (config.storage === Storage.BrowserMemory && config.enablePKCE) {
-                SPAUtils.setPKCE((await _authenticationClient.getPKCECode()) as string);
+                const state = urlObject.searchParams.get(STATE);
+
+                SPAUtils.setPKCE(
+                    AuthenticationUtils.extractPKCEKeyFromStateParam(state ?? ""),
+                    (await _authenticationClient.getPKCECode(state ?? "")) as string
+                );
             }
 
             promptNoneIFrame.src = url;
@@ -657,7 +664,7 @@ export const MainThreadClient = async (
                 }
 
                 if (data?.type == CHECK_SESSION_SIGNED_IN && data?.data?.code) {
-                    requestAccessToken(data.data.code, data?.data?.sessionState)
+                    requestAccessToken(data.data.code, data?.data?.sessionState, data?.data?.state)
                         .then((response: BasicUserInfo) => {
                             window.removeEventListener("message", listenToPromptNoneIFrame);
                             resolve(response);
@@ -723,11 +730,11 @@ export const MainThreadClient = async (
     };
 
     const getCustomGrantConfigData = async (): Promise<AuthClientConfig<CustomGrantConfig> | null> => {
-        const configString =  await _dataLayer.getTemporaryDataParameter(CUSTOM_GRANT_CONFIG);
-        if(configString) {
+        const configString = await _dataLayer.getTemporaryDataParameter(CUSTOM_GRANT_CONFIG);
+        if (configString) {
             return JSON.parse(configString as string);
         } else {
-            return null
+            return null;
         }
     };