@auth0/auth0-spa-js 2.11.1 → 2.11.3

package/dist/auth0-spa-js.development.js

@@ -540,7 +540,7 @@
         exports.default = SuperTokensLock;
     }));
     var Lock = unwrapExports(browserTabsLock);
-    var version = "2.11.1";
+    var version = "2.11.3";
     const DEFAULT_AUTHORIZE_TIMEOUT_IN_SECONDS = 60;
     const DEFAULT_POPUP_CONFIG_OPTIONS = {
         timeoutInSeconds: DEFAULT_AUTHORIZE_TIMEOUT_IN_SECONDS
@@ -720,7 +720,9 @@
             clearTimeout(timeoutId);
             clearInterval(popupTimer);
             window.removeEventListener("message", popupEventListener, false);
-            config.popup.close();
+            if (config.closePopup !== false) {
+                config.popup.close();
+            }
             if (e.data.response.error) {
                 return reject(GenericError.fromPayload(e.data.response));
             }
@@ -1400,7 +1402,7 @@
                 if (matchedKey) {
                     wrappedEntry = await this.cache.get(matchedKey);
                 }
-                if (!matchedKey && useMrrt && cacheMode !== "cache-only") {
+                if (!wrappedEntry && useMrrt && cacheMode !== "cache-only") {
                     return this.getEntryWithRefreshToken(cacheKey, keys);
                 }
             }
@@ -1925,7 +1927,9 @@
         }
     }
     const GET_TOKEN_SILENTLY_LOCK_KEY = "auth0.lock.getTokenSilently";
+    const GET_TOKEN_FROM_IFRAME_LOCK_KEY = "auth0.lock.getTokenFromIFrame";
     const buildGetTokenSilentlyLockKey = (clientId, audience) => `${GET_TOKEN_SILENTLY_LOCK_KEY}.${clientId}.${audience}`;
+    const buildIframeLockKey = clientId => `${GET_TOKEN_FROM_IFRAME_LOCK_KEY}.${clientId}`;
     const buildOrganizationHintCookieName = clientId => `auth0.${clientId}.organization_hint`;
     const OLD_IS_AUTHENTICATED_COOKIE_NAME = "auth0.is.authenticated";
     const buildIsAuthenticatedCookieName = clientId => `auth0.${clientId}.is.authenticated`;
@@ -2660,53 +2664,60 @@
             }
         }
         async _getTokenFromIFrame(options) {
-            const params = Object.assign(Object.assign({}, options.authorizationParams), {
-                prompt: "none"
-            });
-            const orgHint = this.cookieStorage.get(this.orgHintCookieName);
-            if (orgHint && !params.organization) {
-                params.organization = orgHint;
-            }
-            const {url: url, state: stateIn, nonce: nonceIn, code_verifier: code_verifier, redirect_uri: redirect_uri, scope: scope, audience: audience} = await this._prepareAuthorizeUrl(params, {
-                response_mode: "web_message"
-            }, window.location.origin);
-            try {
-                if (window.crossOriginIsolated) {
-                    throw new GenericError("login_required", "The application is running in a Cross-Origin Isolated context, silently retrieving a token without refresh token is not possible.");
-                }
-                const authorizeTimeout = options.timeoutInSeconds || this.options.authorizeTimeoutInSeconds;
-                let eventOrigin;
+            const iframeLockKey = buildIframeLockKey(this.options.clientId);
+            if (await retryPromise((() => lock.acquireLock(iframeLockKey, 5e3)), 10)) {
                 try {
-                    eventOrigin = new URL(this.domainUrl).origin;
-                } catch (_a) {
-                    eventOrigin = this.domainUrl;
-                }
-                const codeResult = await runIframe(url, eventOrigin, authorizeTimeout);
-                if (stateIn !== codeResult.state) {
-                    throw new GenericError("state_mismatch", "Invalid state");
-                }
-                const tokenResult = await this._requestToken(Object.assign(Object.assign({}, options.authorizationParams), {
-                    code_verifier: code_verifier,
-                    code: codeResult.code,
-                    grant_type: "authorization_code",
-                    redirect_uri: redirect_uri,
-                    timeout: options.authorizationParams.timeout || this.httpTimeoutMs
-                }), {
-                    nonceIn: nonceIn,
-                    organization: params.organization
-                });
-                return Object.assign(Object.assign({}, tokenResult), {
-                    scope: scope,
-                    oauthTokenScope: tokenResult.scope,
-                    audience: audience
-                });
-            } catch (e) {
-                if (e.error === "login_required") {
-                    this.logout({
-                        openUrl: false
+                    const params = Object.assign(Object.assign({}, options.authorizationParams), {
+                        prompt: "none"
                     });
+                    const orgHint = this.cookieStorage.get(this.orgHintCookieName);
+                    if (orgHint && !params.organization) {
+                        params.organization = orgHint;
+                    }
+                    const {url: url, state: stateIn, nonce: nonceIn, code_verifier: code_verifier, redirect_uri: redirect_uri, scope: scope, audience: audience} = await this._prepareAuthorizeUrl(params, {
+                        response_mode: "web_message"
+                    }, window.location.origin);
+                    if (window.crossOriginIsolated) {
+                        throw new GenericError("login_required", "The application is running in a Cross-Origin Isolated context, silently retrieving a token without refresh token is not possible.");
+                    }
+                    const authorizeTimeout = options.timeoutInSeconds || this.options.authorizeTimeoutInSeconds;
+                    let eventOrigin;
+                    try {
+                        eventOrigin = new URL(this.domainUrl).origin;
+                    } catch (_a) {
+                        eventOrigin = this.domainUrl;
+                    }
+                    const codeResult = await runIframe(url, eventOrigin, authorizeTimeout);
+                    if (stateIn !== codeResult.state) {
+                        throw new GenericError("state_mismatch", "Invalid state");
+                    }
+                    const tokenResult = await this._requestToken(Object.assign(Object.assign({}, options.authorizationParams), {
+                        code_verifier: code_verifier,
+                        code: codeResult.code,
+                        grant_type: "authorization_code",
+                        redirect_uri: redirect_uri,
+                        timeout: options.authorizationParams.timeout || this.httpTimeoutMs
+                    }), {
+                        nonceIn: nonceIn,
+                        organization: params.organization
+                    });
+                    return Object.assign(Object.assign({}, tokenResult), {
+                        scope: scope,
+                        oauthTokenScope: tokenResult.scope,
+                        audience: audience
+                    });
+                } catch (e) {
+                    if (e.error === "login_required") {
+                        this.logout({
+                            openUrl: false
+                        });
+                    }
+                    throw e;
+                } finally {
+                    await lock.releaseLock(iframeLockKey);
                 }
-                throw e;
+            } else {
+                throw new TimeoutError;
             }
         }
         async _getTokenUsingRefreshToken(options) {
@@ -2734,7 +2745,7 @@
                 }), {
                     scopesToRequest: scopesToRequest
                 });
-                if (tokenResult.refresh_token && this.options.useMrrt && (cache === null || cache === void 0 ? void 0 : cache.refresh_token)) {
+                if (tokenResult.refresh_token && (cache === null || cache === void 0 ? void 0 : cache.refresh_token)) {
                     await this.cacheManager.updateEntry(cache.refresh_token, tokenResult.refresh_token);
                 }
                 if (this.options.useMrrt) {