@auth0/auth0-spa-js 2.7.0 → 2.9.0

package/dist/lib/auth0-spa-js.cjs.js

@@ -550,7 +550,7 @@ var browserTabsLock = createCommonjsModule((function(module, exports) {
 
 var Lock = unwrapExports(browserTabsLock);
 
-var version = "2.7.0";
+var version = "2.9.0";
 
 const DEFAULT_AUTHORIZE_TIMEOUT_IN_SECONDS = 60;
 
@@ -581,6 +581,8 @@ const DEFAULT_AUTH0_CLIENT = {
 
 const DEFAULT_NOW_PROVIDER = () => Date.now();
 
+const DEFAULT_AUDIENCE = "default";
+
 class GenericError extends Error {
     constructor(error, error_description) {
         super(error_description);
@@ -775,6 +777,25 @@ const stripUndefined = params => Object.keys(params).filter((k => typeof params[
     [key]: params[key]
 })), {});
 
+const ALLOWED_AUTH0CLIENT_PROPERTIES = [ {
+    key: "name",
+    type: [ "string" ]
+}, {
+    key: "version",
+    type: [ "string", "number" ]
+}, {
+    key: "env",
+    type: [ "object" ]
+} ];
+
+const stripAuth0Client = auth0Client => Object.keys(auth0Client).reduce(((acc, key) => {
+    const allowedProperty = ALLOWED_AUTH0CLIENT_PROPERTIES.find((p => p.key === key));
+    if (allowedProperty && allowedProperty.type.includes(typeof auth0Client[key])) {
+        acc[key] = auth0Client[key];
+    }
+    return acc;
+}), {});
+
 const createQueryParams = _a => {
     var {clientId: client_id} = _a, params = __rest(_a, [ "clientId" ]);
     return new URLSearchParams(stripUndefined(Object.assign({
@@ -1306,12 +1327,12 @@ async function oauthToken(_a, worker) {
     });
     const body = useFormData ? createQueryParams(allParams) : JSON.stringify(allParams);
     const isDpopSupported = isGrantTypeSupported(options.grant_type);
-    return await getJSON(`${baseUrl}/oauth/token`, timeout, audience || "default", scope, {
+    return await getJSON(`${baseUrl}/oauth/token`, timeout, audience || DEFAULT_AUDIENCE, scope, {
         method: "POST",
         body: body,
         headers: {
             "Content-Type": useFormData ? "application/x-www-form-urlencoded" : "application/json",
-            "Auth0-Client": btoa(JSON.stringify(auth0Client || DEFAULT_AUTH0_CLIENT))
+            "Auth0-Client": btoa(JSON.stringify(stripAuth0Client(auth0Client || DEFAULT_AUTH0_CLIENT)))
         }
     }, worker, useFormData, useMrrt, isDpopSupported ? dpop : undefined);
 }
@@ -1320,6 +1341,33 @@ const dedupe = arr => Array.from(new Set(arr));
 
 const getUniqueScopes = (...scopes) => dedupe(scopes.filter(Boolean).join(" ").trim().split(/\s+/)).join(" ");
 
+const injectDefaultScopes = (authScopes, openIdScope, ...extraScopes) => {
+    if (typeof authScopes !== "object") {
+        return {
+            [DEFAULT_AUDIENCE]: getUniqueScopes(openIdScope, authScopes, ...extraScopes)
+        };
+    }
+    let requestedScopes = {
+        [DEFAULT_AUDIENCE]: getUniqueScopes(openIdScope, ...extraScopes)
+    };
+    Object.keys(authScopes).forEach((key => {
+        const audienceScopes = authScopes[key];
+        requestedScopes[key] = getUniqueScopes(openIdScope, audienceScopes, ...extraScopes);
+    }));
+    return requestedScopes;
+};
+
+const scopesToRequest = (authScopes, methodScopes, audience) => {
+    let scope;
+    if (audience) {
+        scope = authScopes[audience];
+    }
+    if (!scope) {
+        scope = authScopes[DEFAULT_AUDIENCE];
+    }
+    return getUniqueScopes(scope, methodScopes);
+};
+
 const CACHE_KEY_PREFIX = "@@auth0spajs@@";
 
 const CACHE_KEY_ID_TOKEN_SUFFIX = "@@user@@";
@@ -1494,6 +1542,14 @@ class CacheManager {
         await this.cache.set(cacheKey.toKey(), wrappedEntry);
         await ((_a = this.keyManifest) === null || _a === void 0 ? void 0 : _a.add(cacheKey.toKey()));
     }
+    async remove(client_id, audience, scope) {
+        const cacheKey = new CacheKey({
+            clientId: client_id,
+            scope: scope,
+            audience: audience
+        });
+        await this.cache.remove(cacheKey.toKey());
+    }
     async clear(clientId) {
         var _a;
         const keys = await this.getCacheKeys();
@@ -1999,6 +2055,8 @@ class CacheKeyManifest {
 
 const GET_TOKEN_SILENTLY_LOCK_KEY = "auth0.lock.getTokenSilently";
 
+const buildGetTokenSilentlyLockKey = (clientId, audience) => `${GET_TOKEN_SILENTLY_LOCK_KEY}.${clientId}.${audience}`;
+
 const buildOrganizationHintCookieName = clientId => `auth0.${clientId}.organization_hint`;
 
 const OLD_IS_AUTHENTICATED_COOKIE_NAME = "auth0.is.authenticated";
@@ -2015,7 +2073,7 @@ const cacheFactory = location => cacheLocationBuilders[location];
 const getAuthorizeParams = (clientOptions, scope, authorizationParams, state, nonce, code_challenge, redirect_uri, response_mode, thumbprint) => Object.assign(Object.assign(Object.assign({
     client_id: clientOptions.clientId
 }, clientOptions.authorizationParams), authorizationParams), {
-    scope: getUniqueScopes(scope, authorizationParams.scope),
+    scope: scopesToRequest(scope, authorizationParams.scope, authorizationParams.audience),
     response_type: "code",
     response_mode: response_mode || "query",
     state: state,
@@ -2369,6 +2427,7 @@ const lock = new Lock;
 class Auth0Client {
     constructor(options) {
         this.userCache = (new InMemoryCache).enclosedCache;
+        this.activeLockKeys = new Set;
         this.defaultOptions = {
             authorizationParams: {
                 scope: DEFAULT_SCOPE
@@ -2377,7 +2436,11 @@ class Auth0Client {
             useFormData: true
         };
         this._releaseLockOnPageHide = async () => {
-            await lock.releaseLock(GET_TOKEN_SILENTLY_LOCK_KEY);
+            const lockKeysToRelease = Array.from(this.activeLockKeys);
+            for (const lockKey of lockKeysToRelease) {
+                await lock.releaseLock(lockKey);
+            }
+            this.activeLockKeys.clear();
             window.removeEventListener("pagehide", this._releaseLockOnPageHide);
         };
         this.options = Object.assign(Object.assign(Object.assign({}, this.defaultOptions), options), {
@@ -2404,7 +2467,7 @@ class Auth0Client {
         this.isAuthenticatedCookieName = buildIsAuthenticatedCookieName(this.options.clientId);
         this.sessionCheckExpiryDays = options.sessionCheckExpiryDays || DEFAULT_SESSION_CHECK_EXPIRY_DAYS;
         const transactionStorage = options.useCookiesForTransactions ? this.cookieStorage : SessionStorage;
-        this.scope = getUniqueScopes("openid", this.options.authorizationParams.scope, this.options.useRefreshTokens ? "offline_access" : "");
+        this.scope = injectDefaultScopes(this.options.authorizationParams.scope, "openid", this.options.useRefreshTokens ? "offline_access" : "");
         this.transactionManager = new TransactionManager(transactionStorage, this.options.clientId, this.options.cookieDomain);
         this.nowProvider = this.options.nowProvider || DEFAULT_NOW_PROVIDER;
         this.cacheManager = new CacheManager(cache, !cache.allKeys ? new CacheKeyManifest(cache, this.options.clientId) : undefined, this.nowProvider);
@@ -2478,7 +2541,7 @@ class Auth0Client {
             nonce: nonce,
             code_verifier: code_verifier,
             scope: params.scope,
-            audience: params.audience || "default",
+            audience: params.audience || DEFAULT_AUDIENCE,
             redirect_uri: params.redirect_uri,
             state: state,
             url: url
@@ -2628,12 +2691,12 @@ class Auth0Client {
         } catch (_) {}
     }
     async getTokenSilently(options = {}) {
-        var _a;
+        var _a, _b;
         const localOptions = Object.assign(Object.assign({
             cacheMode: "on"
         }, options), {
             authorizationParams: Object.assign(Object.assign(Object.assign({}, this.options.authorizationParams), options.authorizationParams), {
-                scope: getUniqueScopes(this.scope, (_a = options.authorizationParams) === null || _a === void 0 ? void 0 : _a.scope)
+                scope: scopesToRequest(this.scope, (_a = options.authorizationParams) === null || _a === void 0 ? void 0 : _a.scope, ((_b = options.authorizationParams) === null || _b === void 0 ? void 0 : _b.audience) || this.options.authorizationParams.audience)
             })
         });
         const result = await singlePromise((() => this._getTokenSilently(localOptions)), `${this.options.clientId}::${localOptions.authorizationParams.audience}::${localOptions.authorizationParams.scope}`);
@@ -2644,7 +2707,7 @@ class Auth0Client {
         if (cacheMode !== "off") {
             const entry = await this._getEntryFromCache({
                 scope: getTokenOptions.authorizationParams.scope,
-                audience: getTokenOptions.authorizationParams.audience || "default",
+                audience: getTokenOptions.authorizationParams.audience || DEFAULT_AUDIENCE,
                 clientId: this.options.clientId,
                 cacheMode: cacheMode
             });
@@ -2655,13 +2718,17 @@ class Auth0Client {
         if (cacheMode === "cache-only") {
             return;
         }
-        if (await retryPromise((() => lock.acquireLock(GET_TOKEN_SILENTLY_LOCK_KEY, 5e3)), 10)) {
-            try {
+        const lockKey = buildGetTokenSilentlyLockKey(this.options.clientId, getTokenOptions.authorizationParams.audience || "default");
+        if (await retryPromise((() => lock.acquireLock(lockKey, 5e3)), 10)) {
+            this.activeLockKeys.add(lockKey);
+            if (this.activeLockKeys.size === 1) {
                 window.addEventListener("pagehide", this._releaseLockOnPageHide);
+            }
+            try {
                 if (cacheMode !== "off") {
                     const entry = await this._getEntryFromCache({
                         scope: getTokenOptions.authorizationParams.scope,
-                        audience: getTokenOptions.authorizationParams.audience || "default",
+                        audience: getTokenOptions.authorizationParams.audience || DEFAULT_AUDIENCE,
                         clientId: this.options.clientId
                     });
                     if (entry) {
@@ -2680,25 +2747,28 @@ class Auth0Client {
                     expires_in: expires_in
                 });
             } finally {
-                await lock.releaseLock(GET_TOKEN_SILENTLY_LOCK_KEY);
-                window.removeEventListener("pagehide", this._releaseLockOnPageHide);
+                await lock.releaseLock(lockKey);
+                this.activeLockKeys.delete(lockKey);
+                if (this.activeLockKeys.size === 0) {
+                    window.removeEventListener("pagehide", this._releaseLockOnPageHide);
+                }
             }
         } else {
             throw new TimeoutError;
         }
     }
     async getTokenWithPopup(options = {}, config = {}) {
-        var _a;
+        var _a, _b;
         const localOptions = Object.assign(Object.assign({}, options), {
             authorizationParams: Object.assign(Object.assign(Object.assign({}, this.options.authorizationParams), options.authorizationParams), {
-                scope: getUniqueScopes(this.scope, (_a = options.authorizationParams) === null || _a === void 0 ? void 0 : _a.scope)
+                scope: scopesToRequest(this.scope, (_a = options.authorizationParams) === null || _a === void 0 ? void 0 : _a.scope, ((_b = options.authorizationParams) === null || _b === void 0 ? void 0 : _b.audience) || this.options.authorizationParams.audience)
             })
         });
         config = Object.assign(Object.assign({}, DEFAULT_POPUP_CONFIG_OPTIONS), config);
         await this.loginWithPopup(localOptions, config);
         const cache = await this.cacheManager.get(new CacheKey({
             scope: localOptions.authorizationParams.scope,
-            audience: localOptions.authorizationParams.audience || "default",
+            audience: localOptions.authorizationParams.audience || DEFAULT_AUDIENCE,
             clientId: this.options.clientId
         }), undefined, this.options.useMrrt);
         return cache.access_token;
@@ -2796,14 +2866,14 @@ class Auth0Client {
     async _getTokenUsingRefreshToken(options) {
         const cache = await this.cacheManager.get(new CacheKey({
             scope: options.authorizationParams.scope,
-            audience: options.authorizationParams.audience || "default",
+            audience: options.authorizationParams.audience || DEFAULT_AUDIENCE,
             clientId: this.options.clientId
         }), undefined, this.options.useMrrt);
         if ((!cache || !cache.refresh_token) && !this.worker) {
             if (this.options.useRefreshTokensFallback) {
                 return await this._getTokenFromIFrame(options);
             }
-            throw new MissingRefreshTokenError(options.authorizationParams.audience || "default", options.authorizationParams.scope);
+            throw new MissingRefreshTokenError(options.authorizationParams.audience || DEFAULT_AUDIENCE, options.authorizationParams.scope);
         }
         const redirect_uri = options.authorizationParams.redirect_uri || this.options.authorizationParams.redirect_uri || window.location.origin;
         const timeout = typeof options.timeoutInSeconds === "number" ? options.timeoutInSeconds * 1e3 : null;
@@ -2829,6 +2899,7 @@ class Auth0Client {
                         if (this.options.useRefreshTokensFallback) {
                             return await this._getTokenFromIFrame(options);
                         }
+                        await this.cacheManager.remove(this.options.clientId, options.authorizationParams.audience, options.authorizationParams.scope);
                         const missingScopes = getMissingScopes(scopesToRequest, tokenResult.scope);
                         throw new MissingScopesError(options.authorizationParams.audience || "default", missingScopes);
                     }
@@ -2837,7 +2908,7 @@ class Auth0Client {
             return Object.assign(Object.assign({}, tokenResult), {
                 scope: options.authorizationParams.scope,
                 oauthTokenScope: tokenResult.scope,
-                audience: options.authorizationParams.audience || "default"
+                audience: options.authorizationParams.audience || DEFAULT_AUDIENCE
             });
         } catch (e) {
             if ((e.message.indexOf(MISSING_REFRESH_TOKEN_ERROR_MESSAGE) > -1 || e.message && e.message.indexOf(INVALID_REFRESH_TOKEN_ERROR_MESSAGE) > -1) && this.options.useRefreshTokensFallback) {
@@ -2856,11 +2927,12 @@ class Auth0Client {
         await this.cacheManager.set(entryWithoutIdToken);
     }
     async _getIdTokenFromCache() {
-        const audience = this.options.authorizationParams.audience || "default";
+        const audience = this.options.authorizationParams.audience || DEFAULT_AUDIENCE;
+        const scope = this.scope[audience];
         const cache = await this.cacheManager.getIdToken(new CacheKey({
             clientId: this.options.clientId,
             audience: audience,
-            scope: this.scope
+            scope: scope
         }));
         const currentCache = this.userCache.get(CACHE_KEY_ID_TOKEN_SUFFIX);
         if (cache && cache.id_token === (currentCache === null || currentCache === void 0 ? void 0 : currentCache.id_token)) {
@@ -2906,7 +2978,7 @@ class Auth0Client {
         await this._saveEntryInCache(Object.assign(Object.assign(Object.assign(Object.assign({}, authResult), {
             decodedToken: decodedToken,
             scope: options.scope,
-            audience: options.audience || "default"
+            audience: options.audience || DEFAULT_AUDIENCE
         }), authResult.scope ? {
             oauthTokenScope: authResult.scope
         } : null), {
@@ -2926,7 +2998,7 @@ class Auth0Client {
             grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
             subject_token: options.subject_token,
             subject_token_type: options.subject_token_type,
-            scope: getUniqueScopes(options.scope, this.scope),
+            scope: scopesToRequest(this.scope, options.scope, options.audience || this.options.authorizationParams.audience),
             audience: options.audience || this.options.authorizationParams.audience
         });
     }
@@ -2966,7 +3038,7 @@ class Auth0Client {
         });
     }
     async connectAccountWithRedirect(options) {
-        const {openUrl: openUrl, appState: appState, connection: connection, authorization_params: authorization_params, redirectUri: redirectUri = this.options.authorizationParams.redirect_uri || window.location.origin} = options;
+        const {openUrl: openUrl, appState: appState, connection: connection, scopes: scopes, authorization_params: authorization_params, redirectUri: redirectUri = this.options.authorizationParams.redirect_uri || window.location.origin} = options;
         if (!connection) {
             throw new Error("connection is required");
         }
@@ -2976,6 +3048,7 @@ class Auth0Client {
         const code_challenge = bufferToBase64UrlEncoded(code_challengeBuffer);
         const {connect_uri: connect_uri, connect_params: connect_params, auth_session: auth_session} = await this.myAccountApi.connectAccount({
             connection: connection,
+            scopes: scopes,
             redirect_uri: redirectUri,
             state: state,
             code_challenge: code_challenge,