@authu/react 1.0.64 → 1.0.66

package/README.md

@@ -128,6 +128,55 @@ function ApiComponent() {
 }
 ```
 
+## Token Storage
+
+**Tokens never touch `localStorage`, `sessionStorage` or any other persistent
+store.** The access token and the refresh token live in memory for the lifetime
+of the page: an XSS on the host application can still act as the user while the
+page is open, but it can no longer walk away with a 30-day refresh token and
+replay it from anywhere, later.
+
+The trade-off is that a reload loses the tokens. The session itself is not
+lost, though: it lives in AuthU's own cookie, and the SDK re-derives the tokens
+from it on every page load with one silent round trip.
+
+### Silent renewal (`prompt=none`)
+
+On mount, when no code is coming back in the URL, the SDK redirects to
+`/authorize?prompt=none`. AuthU answers without ever showing a page:
+
+- session cookie still valid → it redirects straight back with a fresh
+  authorization code, which the SDK exchanges for tokens. The visitor sees a
+  single redirect and stays signed in.
+- no session → it redirects back with `error=login_required`. The SDK reads
+  that as "anonymous", renders accordingly, and records the attempt in
+  `sessionStorage` so the tab never loops through AuthU again.
+
+The URL the visitor asked for is saved before the round trip and restored
+afterwards, so landing on `redirectUri` is invisible.
+
+Set `silentAuth: false` to opt out. The session then does not survive a reload
+at all: every load starts signed out until `login()` is called.
+
+### Logging out
+
+`logout()` now navigates to AuthU's `/logout` rather than only clearing memory.
+It has to: the session lives in the AuthU cookie, so a purely local logout
+would let the next silent renewal sign the visitor right back in. The browser
+returns to `redirectUri`, or to `options.returnTo` when given - which must be a
+URI registered for the tenant, or on the tenant's home origin, otherwise AuthU
+falls back to its own host.
+
+### Upgrading from 1.0.x
+
+Two behaviour changes to expect in an app that upgrades:
+
+- any token left in `localStorage` under `authu_tokens` by a previous version
+  is deleted on the first load;
+- `logout()` performs a full navigation. Code that expected it to be
+  synchronous and stay on the page must move whatever it did afterwards into
+  `options.returnTo`.
+
 ## API Reference
 
 ### AuthUProvider Props
@@ -139,6 +188,7 @@ function ApiComponent() {
 | `redirectUri` | `string` | Yes | Callback URL after login |
 | `scope` | `string` | No | OAuth2 scopes (default: `openid profile email`) |
 | `audience` | `string` | No | API audience for access tokens |
+| `silentAuth` | `boolean` | No | Silent session renewal (default: `true`, see below) |
 
 ### useAuthU Returns
 

package/dist/AuthUProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthUProvider.d.ts","sourceRoot":"","sources":["../src/AuthUProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,SAAS,EAIf,MAAM,OAAO,CAAC;AAef,OAAO,KAAK,EAEV,WAAW,EACX,iBAAiB,EAElB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,YAAY,mDAAgD,CAAC;AAO1E,UAAU,kBAAkB;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,SAAS,CAAC;CACrB;AAID,wBAAgB,aAAa,CAAC,EAAC,MAAM,EAAE,QAAQ,EAAC,EAAE,kBAAkB,2CAqcnE"}
+{"version":3,"file":"AuthUProvider.d.ts","sourceRoot":"","sources":["../src/AuthUProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,SAAS,EAKf,MAAM,OAAO,CAAC;AAef,OAAO,KAAK,EAEV,WAAW,EACX,iBAAiB,EAIlB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,YAAY,mDAAgD,CAAC;AAO1E,UAAU,kBAAkB;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,SAAS,CAAC;CACrB;AAuDD,wBAAgB,aAAa,CAAC,EAAC,MAAM,EAAE,QAAQ,EAAC,EAAE,kBAAkB,2CAwYnE"}

package/dist/AuthUProvider.js

@@ -1,23 +1,77 @@
 import { jsx as _jsx } from "react/jsx-runtime";
-import { createContext, useCallback, useEffect, useState } from 'react';
+import { createContext, useCallback, useEffect, useRef, useState } from 'react';
 import { clearCodeVerifier, clearNonce, clearState, generateCodeChallenge, generateCodeVerifier, generateNonce, generateState, getCodeVerifier, getStoredState, storeCodeVerifier, storeNonce, storeState } from './pkce.js';
 export const AuthUContext = createContext(null);
 function buildBaseUrl(domain) {
     const protocol = domain.startsWith('localhost') ? 'http' : 'https';
     return `${protocol}://${domain}`;
 }
-const TOKEN_STORAGE_KEY = 'authu_tokens';
+/**
+ * Tokens are never written to disk. Up to 1.0.x they lived in localStorage
+ * under this key, where any XSS on the host app could read them and replay a
+ * 30-day refresh token from anywhere; the key is only kept here so an app
+ * upgrading to this version wipes what the previous one left behind.
+ */
+const LEGACY_TOKEN_STORAGE_KEY = 'authu_tokens';
+/**
+ * Holding the tokens in memory means a reload loses them, so the session is
+ * re-derived from the AuthU session cookie instead: one `prompt=none` round
+ * trip through /authorize, which returns a fresh code without showing a page
+ * when the cookie is still valid, and `error=login_required` when it is not.
+ * The attempt is recorded per tab so a signed-out visitor bounces once and
+ * then renders anonymously rather than looping through AuthU forever.
+ */
+const SILENT_ATTEMPT_KEY = 'authu_silent_attempted';
+const RETURN_TO_KEY = 'authu_return_to';
+const EMPTY_STATE = {
+    isLoading: false,
+    isAuthenticated: false,
+    user: null,
+    accessToken: null,
+    refreshToken: null,
+    expiresAt: null,
+    error: null
+};
+function currentLocation() {
+    return `${window.location.pathname}${window.location.search}${window.location.hash}`;
+}
+/**
+ * Only a same-origin path is ever restored: `//evil.example` is a valid
+ * relative URL for the browser but a different origin, so a poisoned entry
+ * cannot turn the silent round trip into an open redirect.
+ */
+function readReturnTo() {
+    const stored = sessionStorage.getItem(RETURN_TO_KEY);
+    sessionStorage.removeItem(RETURN_TO_KEY);
+    if (!stored || !stored.startsWith('/') || stored.startsWith('//')) {
+        return null;
+    }
+    return stored;
+}
 export function AuthUProvider({ config, children }) {
     const [state, setState] = useState({
-        isLoading: true,
-        isAuthenticated: false,
-        user: null,
-        accessToken: null,
-        refreshToken: null,
-        expiresAt: null,
-        error: null
+        ...EMPTY_STATE,
+        isLoading: true
     });
-    const getAuthorizationUrl = useCallback(async (options) => {
+    // The tokens also live in a ref so getAccessToken() and refreshTokens() read
+    // the current pair rather than the one captured when the callback was built:
+    // two concurrent API calls racing on an expiring token would otherwise both
+    // rotate the refresh token, and the loser is now treated as a replay.
+    const tokensRef = useRef(null);
+    const refreshInFlight = useRef(null);
+    const setTokens = useCallback((tokens, user) => {
+        tokensRef.current = tokens;
+        setState(prev => ({
+            isLoading: false,
+            isAuthenticated: tokens !== null,
+            user: tokens === null ? null : user !== undefined ? user : prev.user,
+            accessToken: tokens?.accessToken ?? null,
+            refreshToken: tokens?.refreshToken ?? null,
+            expiresAt: tokens?.expiresAt ?? null,
+            error: null
+        }));
+    }, []);
+    const buildAuthorizationUrl = useCallback(async (options) => {
         const codeVerifier = generateCodeVerifier();
         const codeChallenge = await generateCodeChallenge(codeVerifier);
         const stateValue = generateState();
@@ -44,6 +98,9 @@ export function AuthUProvider({ config, children }) {
         if (options?.screenHint) {
             params.set('screen_hint', options.screenHint);
         }
+        if (options?.prompt) {
+            params.set('prompt', options.prompt);
+        }
         return `${buildBaseUrl(config.domain)}/authorize?${params.toString()}`;
     }, [config]);
     const exchangeCodeForTokensWithVerifier = useCallback(async (code, codeVerifier) => {
@@ -79,22 +136,31 @@ export function AuthUProvider({ config, children }) {
         };
     }, []);
     const login = useCallback(async (options) => {
-        const url = await getAuthorizationUrl(options);
-        console.log('[AuthU SDK] login() called, redirecting to:', url);
-        window.location.href = url;
-    }, [getAuthorizationUrl]);
-    const logout = useCallback(() => {
-        localStorage.removeItem(TOKEN_STORAGE_KEY);
-        setState({
-            isLoading: false,
-            isAuthenticated: false,
-            user: null,
-            accessToken: null,
-            refreshToken: null,
-            expiresAt: null,
-            error: null
+        sessionStorage.removeItem(SILENT_ATTEMPT_KEY);
+        if (options?.returnTo) {
+            sessionStorage.setItem(RETURN_TO_KEY, options.returnTo);
+        }
+        window.location.href = await buildAuthorizationUrl(options);
+    }, [buildAuthorizationUrl]);
+    /**
+     * A local logout is no longer enough: the session now lives in AuthU's own
+     * cookie, so clearing memory alone would let the next silent renewal sign
+     * the visitor straight back in. The browser is sent to AuthU /logout, which
+     * kills the session and bounces back to the app.
+     */
+    const logout = useCallback((options) => {
+        tokensRef.current = null;
+        sessionStorage.setItem(SILENT_ATTEMPT_KEY, '1');
+        setState(EMPTY_STATE);
+        // The destination has to survive AuthU's own check, which only accepts a
+        // URI the tenant registered or its home origin: the configured
+        // redirectUri is registered by construction, so it is the safe default.
+        const params = new URLSearchParams({
+            client_id: config.clientId,
+            redirect_uri: options?.returnTo || config.redirectUri
         });
-    }, []);
+        window.location.href = `${buildBaseUrl(config.domain)}/logout?${params.toString()}`;
+    }, [config.domain, config.clientId, config.redirectUri]);
     const fetchUserInfo = useCallback(async (accessToken) => {
         try {
             const response = await fetch(`${buildBaseUrl(config.domain)}/oauth/userinfo`, {
@@ -116,206 +182,151 @@ export function AuthUProvider({ config, children }) {
         }
     }, [config.domain]);
     const refreshTokens = useCallback(async () => {
-        if (!state.refreshToken)
+        const refreshToken = tokensRef.current?.refreshToken;
+        if (!refreshToken)
             return false;
-        try {
-            const response = await fetch(`${buildBaseUrl(config.domain)}/oauth/token`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    grant_type: 'refresh_token',
-                    refresh_token: state.refreshToken,
-                    client_id: config.clientId
-                })
-            });
-            if (!response.ok) {
-                logout();
+        if (refreshInFlight.current)
+            return refreshInFlight.current;
+        const run = async () => {
+            try {
+                const response = await fetch(`${buildBaseUrl(config.domain)}/oauth/token`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({
+                        grant_type: 'refresh_token',
+                        refresh_token: refreshToken,
+                        client_id: config.clientId
+                    })
+                });
+                if (!response.ok) {
+                    tokensRef.current = null;
+                    setState(EMPTY_STATE);
+                    return false;
+                }
+                const tokens = await response.json();
+                setTokens({
+                    accessToken: tokens.access_token,
+                    refreshToken: tokens.refresh_token ?? null,
+                    expiresAt: Date.now() + tokens.expires_in * 1000
+                }, tokens.id_token ? parseIdToken(tokens.id_token) : undefined);
+                return true;
+            }
+            catch {
+                tokensRef.current = null;
+                setState(EMPTY_STATE);
                 return false;
             }
-            const tokens = await response.json();
-            const expiresAt = Date.now() + tokens.expires_in * 1000;
-            const user = tokens.id_token ? parseIdToken(tokens.id_token) : state.user;
-            localStorage.setItem(TOKEN_STORAGE_KEY, JSON.stringify({
-                accessToken: tokens.access_token,
-                refreshToken: tokens.refresh_token,
-                expiresAt
-            }));
-            setState(prev => ({
-                ...prev,
-                accessToken: tokens.access_token,
-                refreshToken: tokens.refresh_token,
-                expiresAt,
-                user: user || prev.user
-            }));
-            return true;
-        }
-        catch {
-            logout();
-            return false;
-        }
-    }, [
-        state.refreshToken,
-        state.user,
-        config.domain,
-        config.clientId,
-        logout,
-        parseIdToken
-    ]);
+        };
+        const pending = run().finally(() => {
+            refreshInFlight.current = null;
+        });
+        refreshInFlight.current = pending;
+        return pending;
+    }, [config.domain, config.clientId, parseIdToken, setTokens]);
     const getAccessToken = useCallback(async () => {
-        if (!state.accessToken)
+        const tokens = tokensRef.current;
+        if (!tokens)
             return null;
-        if (state.expiresAt && Date.now() >= state.expiresAt - 60000) {
+        if (Date.now() >= tokens.expiresAt - 60000) {
             const refreshed = await refreshTokens();
             if (!refreshed)
                 return null;
         }
-        return state.accessToken;
-    }, [state.accessToken, state.expiresAt, refreshTokens]);
+        return tokensRef.current?.accessToken ?? null;
+    }, [refreshTokens]);
+    const configRef = useRef(config);
+    configRef.current = config;
+    const bootstrapped = useRef(false);
     useEffect(() => {
-        const handleCallback = async () => {
-            console.log('[AuthU SDK] handleCallback starting, URL:', window.location.href);
+        if (bootstrapped.current)
+            return;
+        bootstrapped.current = true;
+        // Silent renewal lands on redirectUri, which for most apps is a bare
+        // /callback route: the URL is rewritten back to the page the visitor
+        // actually asked for. replaceState alone would leave a client-side router
+        // still rendering /callback, so a popstate is dispatched to make it
+        // re-read the location.
+        const restoreUrl = () => {
+            const returnTo = readReturnTo();
+            window.history.replaceState({}, document.title, returnTo || window.location.pathname);
+            if (returnTo) {
+                window.dispatchEvent(new PopStateEvent('popstate'));
+            }
+        };
+        const bootstrap = async () => {
+            localStorage.removeItem(LEGACY_TOKEN_STORAGE_KEY);
             const params = new URLSearchParams(window.location.search);
             const code = params.get('code');
             const returnedState = params.get('state');
             const error = params.get('error');
-            console.log('[AuthU SDK] handleCallback params - code:', !!code, 'state:', returnedState, 'error:', error);
             if (error) {
-                setState(prev => ({
-                    ...prev,
-                    isLoading: false,
-                    error: new Error(params.get('error_description') || error)
-                }));
+                const description = params.get('error_description') ||
+                    params.get('errorDescription') ||
+                    error;
+                restoreUrl();
+                // A refused silent renewal is the expected answer for a visitor who is
+                // simply not signed in: it is an anonymous render, not an error.
+                if (error === 'login_required' || error === 'interaction_required') {
+                    sessionStorage.setItem(SILENT_ATTEMPT_KEY, '1');
+                    setState(EMPTY_STATE);
+                    return;
+                }
+                setState({ ...EMPTY_STATE, error: new Error(description) });
                 return;
             }
             if (code) {
                 const storedState = getStoredState();
                 if (returnedState !== storedState) {
-                    setState(prev => ({
-                        ...prev,
-                        isLoading: false,
+                    setState({
+                        ...EMPTY_STATE,
                         error: new Error('Invalid state parameter')
-                    }));
+                    });
                     return;
                 }
-                // Get and immediately clear code verifier to prevent duplicate exchanges
-                // (React StrictMode double-mount protection)
+                // Read and clear the verifier in one go: React StrictMode mounts this
+                // effect twice, and the second pass must not replay the same code.
                 const codeVerifier = getCodeVerifier();
-                if (!codeVerifier) {
-                    console.log('[AuthU SDK] No code verifier found, skipping duplicate callback');
+                if (!codeVerifier)
                     return;
-                }
                 clearCodeVerifier();
                 clearState();
                 clearNonce();
-                // Clear URL immediately to prevent issues on refresh
-                window.history.replaceState({}, document.title, window.location.pathname);
+                restoreUrl();
                 try {
                     const tokens = await exchangeCodeForTokensWithVerifier(code, codeVerifier);
-                    const user = parseIdToken(tokens.id_token);
-                    const expiresAt = Date.now() + tokens.expires_in * 1000;
-                    localStorage.setItem(TOKEN_STORAGE_KEY, JSON.stringify({
-                        accessToken: tokens.access_token,
-                        refreshToken: tokens.refresh_token,
-                        expiresAt
-                    }));
-                    setState({
-                        isLoading: false,
-                        isAuthenticated: true,
-                        user,
+                    sessionStorage.removeItem(SILENT_ATTEMPT_KEY);
+                    setTokens({
                         accessToken: tokens.access_token,
-                        refreshToken: tokens.refresh_token,
-                        expiresAt,
-                        error: null
-                    });
+                        refreshToken: tokens.refresh_token ?? null,
+                        expiresAt: Date.now() + tokens.expires_in * 1000
+                    }, tokens.id_token
+                        ? parseIdToken(tokens.id_token)
+                        : await fetchUserInfo(tokens.access_token));
                 }
                 catch (err) {
-                    setState(prev => ({
-                        ...prev,
-                        isLoading: false,
+                    setState({
+                        ...EMPTY_STATE,
                         error: err instanceof Error ? err : new Error('Authentication failed')
-                    }));
+                    });
                 }
                 return;
             }
-            const stored = localStorage.getItem(TOKEN_STORAGE_KEY);
-            console.log('[AuthU SDK] Checking localStorage for tokens:', !!stored);
-            if (stored) {
-                try {
-                    const tokens = JSON.parse(stored);
-                    console.log('[AuthU SDK] Found tokens, expiresAt:', tokens.expiresAt, 'now:', Date.now(), 'valid:', tokens.expiresAt > Date.now());
-                    if (tokens.expiresAt > Date.now()) {
-                        const user = await fetchUserInfo(tokens.accessToken);
-                        console.log('[AuthU SDK] Tokens valid, user:', user);
-                        setState({
-                            isLoading: false,
-                            isAuthenticated: true,
-                            user,
-                            accessToken: tokens.accessToken,
-                            refreshToken: tokens.refreshToken,
-                            expiresAt: tokens.expiresAt,
-                            error: null
-                        });
-                        return;
-                    }
-                    if (tokens.refreshToken) {
-                        console.log('[AuthU SDK] Access token expired, attempting refresh...');
-                        try {
-                            const response = await fetch(`${buildBaseUrl(config.domain)}/oauth/token`, {
-                                method: 'POST',
-                                headers: { 'Content-Type': 'application/json' },
-                                body: JSON.stringify({
-                                    grant_type: 'refresh_token',
-                                    refresh_token: tokens.refreshToken,
-                                    client_id: config.clientId
-                                })
-                            });
-                            if (response.ok) {
-                                const newTokens = await response.json();
-                                const expiresAt = Date.now() + newTokens.expires_in * 1000;
-                                const user = newTokens.id_token
-                                    ? parseIdToken(newTokens.id_token)
-                                    : await fetchUserInfo(newTokens.access_token);
-                                localStorage.setItem(TOKEN_STORAGE_KEY, JSON.stringify({
-                                    accessToken: newTokens.access_token,
-                                    refreshToken: newTokens.refresh_token,
-                                    expiresAt
-                                }));
-                                console.log('[AuthU SDK] Token refresh successful, user:', user);
-                                setState({
-                                    isLoading: false,
-                                    isAuthenticated: true,
-                                    user,
-                                    accessToken: newTokens.access_token,
-                                    refreshToken: newTokens.refresh_token,
-                                    expiresAt,
-                                    error: null
-                                });
-                                return;
-                            }
-                            console.log('[AuthU SDK] Token refresh failed, clearing tokens');
-                            localStorage.removeItem(TOKEN_STORAGE_KEY);
-                        }
-                        catch {
-                            console.log('[AuthU SDK] Token refresh error, clearing tokens');
-                            localStorage.removeItem(TOKEN_STORAGE_KEY);
-                        }
-                    }
-                }
-                catch {
-                    console.log('[AuthU SDK] Error parsing stored tokens, removing');
-                    localStorage.removeItem(TOKEN_STORAGE_KEY);
-                }
+            if (configRef.current.silentAuth === false ||
+                sessionStorage.getItem(SILENT_ATTEMPT_KEY)) {
+                setState(EMPTY_STATE);
+                return;
             }
-            console.log('[AuthU SDK] No valid tokens found, setting isLoading: false');
-            setState(prev => ({ ...prev, isLoading: false }));
+            sessionStorage.setItem(SILENT_ATTEMPT_KEY, '1');
+            sessionStorage.setItem(RETURN_TO_KEY, currentLocation());
+            window.location.replace(await buildAuthorizationUrl({ prompt: 'none' }));
         };
-        handleCallback();
+        bootstrap();
     }, [
+        buildAuthorizationUrl,
         exchangeCodeForTokensWithVerifier,
         fetchUserInfo,
-        config.clientId,
-        config.domain,
-        parseIdToken
+        parseIdToken,
+        setTokens
     ]);
     const checkEmailExists = useCallback(async (email) => {
         try {

package/dist/pkce.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../src/pkce.ts"],"names":[],"mappings":"AA2BA,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG7E;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAMD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAE/C;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,UAAU,IAAI,IAAI,CAEjC;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,UAAU,IAAI,IAAI,CAEjC"}
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../src/pkce.ts"],"names":[],"mappings":"AA2BA,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG7E;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAcD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAExD;AAED,wBAAgB,eAAe,IAAI,MAAM,GAAG,IAAI,CAE/C;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,UAAU,IAAI,IAAI,CAEjC;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,cAAc,IAAI,MAAM,GAAG,IAAI,CAE9C;AAED,wBAAgB,UAAU,IAAI,IAAI,CAEjC"}

package/dist/pkce.js

@@ -34,6 +34,14 @@ export function generateState() {
 export function generateNonce() {
     return generateRandomString(32);
 }
+/**
+ * The verifier, the state and the nonce have to outlive a full navigation to
+ * AuthU and back. They stay in localStorage rather than sessionStorage on
+ * purpose: 1.0.10 moved them there after sessionStorage lost them across the
+ * cross-domain round trip. They are single-use, consumed within seconds, and
+ * cleared as soon as the callback is handled - unlike the tokens, which never
+ * touch any storage at all.
+ */
 const STORAGE_KEY_VERIFIER = 'authu_code_verifier';
 const STORAGE_KEY_STATE = 'authu_state';
 const STORAGE_KEY_NONCE = 'authu_nonce';

package/dist/types.d.ts

@@ -4,6 +4,13 @@ export interface AuthUConfig {
     redirectUri: string;
     scope?: string;
     audience?: string;
+    /**
+     * Silent session renewal through `/authorize?prompt=none`, on by default.
+     * Tokens are held in memory only, so this round trip is what carries a
+     * session across a page reload. Turning it off means every reload starts
+     * signed out.
+     */
+    silentAuth?: boolean;
 }
 export interface AuthUUser {
     sub: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,aAAa,KAAK,IAAI,CAAC;IAC1C,cAAc,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,aAAa,KAAK,IAAI,CAAC;IAC1C,cAAc,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,IAAI,EAAE,SAAS,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authu/react",
-  "version": "1.0.64",
+  "version": "1.0.66",
   "description": "React SDK for AuthU - Centralized Multi-Tenant Authentication Service",
   "type": "module",
   "main": "./dist/index.js",