@capgo/capacitor-social-login 8.2.25 → 8.3.1

package/ios/Sources/SocialLoginPlugin/OAuth2Provider.swift

@@ -41,16 +41,23 @@ struct OAuth2AccessToken {
 
 struct OAuth2ProviderConfig {
     let appId: String
-    let authorizationBaseUrl: String
-    let accessTokenEndpoint: String?
+    let issuerUrl: String?
+    var authorizationBaseUrl: String?
+    var accessTokenEndpoint: String?
     let redirectUrl: String
     let resourceUrl: String?
     let responseType: String
     let pkceEnabled: Bool
     let scope: String
     let additionalParameters: [String: String]?
+    let loginHint: String?
+    let prompt: String?
+    let additionalTokenParameters: [String: String]?
     let additionalResourceHeaders: [String: String]?
-    let logoutUrl: String?
+    var logoutUrl: String?
+    let postLogoutRedirectUrl: String?
+    let additionalLogoutParameters: [String: String]?
+    let iosPrefersEphemeralWebBrowserSession: Bool
     let logsEnabled: Bool
 }
 
@@ -62,42 +69,71 @@ class OAuth2Provider: NSObject {
     private var currentProviderId: String?
     private let tokenStorageKeyPrefix = "CapgoOAuth2ProviderTokens_"
 
+    private func normalizeScope(_ value: Any?) -> String {
+        if let s = value as? String { return s }
+        if let arr = value as? [String] { return arr.joined(separator: " ") }
+        if let arr = value as? [Any] {
+            return arr.compactMap { $0 as? String }.joined(separator: " ")
+        }
+        return ""
+    }
+
     func initializeProviders(configs: [String: [String: Any]]) -> [String] {
         var errors: [String] = []
 
         for (providerId, config) in configs {
-            guard let appId = config["appId"] as? String, !appId.isEmpty else {
-                errors.append("oauth2.\(providerId).appId is required")
-                continue
-            }
-            guard let authorizationBaseUrl = config["authorizationBaseUrl"] as? String, !authorizationBaseUrl.isEmpty else {
-                errors.append("oauth2.\(providerId).authorizationBaseUrl is required")
+            let appId = (config["appId"] as? String)?.trimmingCharacters(in: .whitespacesAndNewlines)
+            let clientId = (config["clientId"] as? String)?.trimmingCharacters(in: .whitespacesAndNewlines)
+            guard let resolvedAppId = (appId?.isEmpty == false ? appId : nil) ?? (clientId?.isEmpty == false ? clientId : nil) else {
+                errors.append("oauth2.\(providerId).appId (or clientId) is required")
                 continue
             }
+            let issuerUrl = (config["issuerUrl"] as? String)?.trimmingCharacters(in: .whitespacesAndNewlines)
+            let authorizationBaseUrl =
+                (config["authorizationBaseUrl"] as? String)?.trimmingCharacters(in: .whitespacesAndNewlines) ??
+                (config["authorizationEndpoint"] as? String)?.trimmingCharacters(in: .whitespacesAndNewlines)
             guard let redirectUrl = config["redirectUrl"] as? String, !redirectUrl.isEmpty else {
                 errors.append("oauth2.\(providerId).redirectUrl is required")
                 continue
             }
+            if (authorizationBaseUrl == nil || authorizationBaseUrl?.isEmpty == true) && (issuerUrl == nil || issuerUrl?.isEmpty == true) {
+                errors.append("oauth2.\(providerId).authorizationBaseUrl (or authorizationEndpoint) or issuerUrl is required")
+                continue
+            }
 
             let providerConfig = OAuth2ProviderConfig(
-                appId: appId,
-                authorizationBaseUrl: authorizationBaseUrl,
-                accessTokenEndpoint: config["accessTokenEndpoint"] as? String,
+                appId: resolvedAppId,
+                issuerUrl: issuerUrl,
+                authorizationBaseUrl: (authorizationBaseUrl?.isEmpty == false ? authorizationBaseUrl : nil),
+                accessTokenEndpoint:
+                    (config["accessTokenEndpoint"] as? String) ??
+                    (config["tokenEndpoint"] as? String),
                 redirectUrl: redirectUrl,
                 resourceUrl: config["resourceUrl"] as? String,
                 responseType: config["responseType"] as? String ?? "code",
                 pkceEnabled: config["pkceEnabled"] as? Bool ?? true,
-                scope: config["scope"] as? String ?? "",
+                scope: normalizeScope(config["scope"] ?? config["scopes"]),
                 additionalParameters: config["additionalParameters"] as? [String: String],
+                loginHint: config["loginHint"] as? String,
+                prompt: config["prompt"] as? String,
+                additionalTokenParameters: config["additionalTokenParameters"] as? [String: String],
                 additionalResourceHeaders: config["additionalResourceHeaders"] as? [String: String],
-                logoutUrl: config["logoutUrl"] as? String,
+                logoutUrl: (config["logoutUrl"] as? String) ?? (config["endSessionEndpoint"] as? String),
+                postLogoutRedirectUrl: config["postLogoutRedirectUrl"] as? String,
+                additionalLogoutParameters: config["additionalLogoutParameters"] as? [String: String],
+                iosPrefersEphemeralWebBrowserSession:
+                    (config["iosPrefersEphemeralWebBrowserSession"] as? Bool) ??
+                    (config["iosPrefersEphemeralSession"] as? Bool) ??
+                    true,
                 logsEnabled: config["logsEnabled"] as? Bool ?? false
             )
 
             providers[providerId] = providerConfig
 
             if providerConfig.logsEnabled {
-                print("[OAuth2Provider] Initialized provider '\(providerId)' with appId: \(appId), authorizationBaseUrl: \(authorizationBaseUrl)")
+                print(
+                    "[OAuth2Provider] Initialized provider '\(providerId)' with appId: \(resolvedAppId), issuerUrl: \(issuerUrl ?? "nil"), authorizationBaseUrl: \(authorizationBaseUrl ?? "nil")"
+                )
             }
         }
 
@@ -108,93 +144,169 @@ class OAuth2Provider: NSObject {
         return providers[providerId]
     }
 
-    private func tokenStorageKey(for providerId: String) -> String {
-        return "\(tokenStorageKeyPrefix)\(providerId)"
+    private func discoveryUrl(for issuerUrl: String) -> URL? {
+        let trimmed = issuerUrl.trimmingCharacters(in: .whitespacesAndNewlines).replacingOccurrences(of: "/+$", with: "", options: .regularExpression)
+        return URL(string: "\(trimmed)/.well-known/openid-configuration")
     }
 
-    func login(providerId: String, payload: [String: Any], completion: @escaping (Result<OAuth2LoginResponse, Error>) -> Void) {
-        guard let config = getProvider(providerId) else {
+    private func ensureDiscovered(providerId: String, completion: @escaping (Result<OAuth2ProviderConfig, Error>) -> Void) {
+        guard var config = getProvider(providerId) else {
             completion(.failure(NSError(domain: "OAuth2Provider", code: -1, userInfo: [NSLocalizedDescriptionKey: "OAuth2 provider '\(providerId)' not configured. Call initialize()."])))
             return
         }
-
-        let loginScope = payload["scope"] as? String ?? config.scope
-        let state = payload["state"] as? String ?? UUID().uuidString
-        let codeVerifier = payload["codeVerifier"] as? String ?? generateCodeVerifier()
-        let redirect = payload["redirectUrl"] as? String ?? config.redirectUrl
-        let additionalLoginParams = payload["additionalParameters"] as? [String: String]
-
-        currentState = state
-        currentCodeVerifier = codeVerifier
-        currentProviderId = providerId
-
-        var components = URLComponents(string: config.authorizationBaseUrl)
-        var queryItems: [URLQueryItem] = [
-            URLQueryItem(name: "response_type", value: config.responseType),
-            URLQueryItem(name: "client_id", value: config.appId),
-            URLQueryItem(name: "redirect_uri", value: redirect),
-            URLQueryItem(name: "state", value: state)
-        ]
-
-        if !loginScope.isEmpty {
-            queryItems.append(URLQueryItem(name: "scope", value: loginScope))
-        }
-
-        // Add PKCE for code flow
-        if config.responseType == "code" && config.pkceEnabled {
-            let codeChallenge = generateCodeChallenge(from: codeVerifier)
-            queryItems.append(URLQueryItem(name: "code_challenge", value: codeChallenge))
-            queryItems.append(URLQueryItem(name: "code_challenge_method", value: "S256"))
-        }
-
-        // Add additional parameters from config
-        if let additionalParams = config.additionalParameters {
-            for (key, value) in additionalParams {
-                queryItems.append(URLQueryItem(name: key, value: value))
-            }
+        guard let issuerUrl = config.issuerUrl, !issuerUrl.isEmpty else {
+            completion(.success(config))
+            return
         }
 
-        // Add additional parameters from login options
-        if let loginParams = additionalLoginParams {
-            for (key, value) in loginParams {
-                queryItems.append(URLQueryItem(name: key, value: value))
-            }
+        // Already resolved enough for auth.
+        if config.authorizationBaseUrl != nil && (config.responseType != "code" || config.accessTokenEndpoint != nil) {
+            completion(.success(config))
+            return
         }
 
-        components?.queryItems = queryItems
-
-        guard let authUrl = components?.url, let callbackScheme = URL(string: redirect)?.scheme else {
-            completion(.failure(NSError(domain: "OAuth2Provider", code: -2, userInfo: [NSLocalizedDescriptionKey: "Invalid redirect URL configuration."])))
+        guard let url = discoveryUrl(for: issuerUrl) else {
+            completion(.failure(NSError(domain: "OAuth2Provider", code: -20, userInfo: [NSLocalizedDescriptionKey: "Invalid issuerUrl for provider '\(providerId)'."])))
             return
         }
 
         if config.logsEnabled {
-            print("[OAuth2Provider] Opening authorization URL: \(authUrl.absoluteString)")
+            print("[OAuth2Provider] Discovering OIDC configuration at: \(url.absoluteString)")
         }
 
-        let session = ASWebAuthenticationSession(url: authUrl, callbackURLScheme: callbackScheme) { [weak self] callbackURL, error in
-            guard let self = self else { return }
+        URLSession.shared.dataTask(with: url) { [weak self] data, response, error in
             if let error = error {
-                if (error as NSError).code == ASWebAuthenticationSessionError.canceledLogin.rawValue {
-                    completion(.failure(NSError(domain: "OAuth2Provider", code: -3, userInfo: [NSLocalizedDescriptionKey: "User cancelled login."])))
-                } else {
-                    completion(.failure(error))
-                }
+                completion(.failure(error))
                 return
             }
-
-            guard let callbackURL = callbackURL else {
-                completion(.failure(NSError(domain: "OAuth2Provider", code: -4, userInfo: [NSLocalizedDescriptionKey: "Invalid callback URL."])))
+            guard let http = response as? HTTPURLResponse, (200...299).contains(http.statusCode), let data = data else {
+                completion(.failure(NSError(domain: "OAuth2Provider", code: -21, userInfo: [NSLocalizedDescriptionKey: "OIDC discovery failed for provider '\(providerId)'."])))
                 return
             }
+            do {
+                let json = try JSONSerialization.jsonObject(with: data) as? [String: Any]
+                let auth = json?["authorization_endpoint"] as? String
+                let token = json?["token_endpoint"] as? String
+                let endSession = json?["end_session_endpoint"] as? String
 
-            self.handleCallback(providerId: providerId, config: config, callbackURL: callbackURL, redirectUri: redirect, completion: completion)
-        }
+                if config.authorizationBaseUrl == nil, let auth = auth, !auth.isEmpty {
+                    config.authorizationBaseUrl = auth
+                }
+                if config.accessTokenEndpoint == nil, let token = token, !token.isEmpty {
+                    config.accessTokenEndpoint = token
+                }
+                if config.logoutUrl == nil, let endSession = endSession, !endSession.isEmpty {
+                    config.logoutUrl = endSession
+                }
+
+                // Persist updated config back into map
+                self?.providers[providerId] = config
+                completion(.success(config))
+            } catch {
+                completion(.failure(error))
+            }
+        }.resume()
+    }
+
+    private func tokenStorageKey(for providerId: String) -> String {
+        return "\(tokenStorageKeyPrefix)\(providerId)"
+    }
+
+    func login(providerId: String, payload: [String: Any], completion: @escaping (Result<OAuth2LoginResponse, Error>) -> Void) {
+        ensureDiscovered(providerId: providerId) { [weak self] res in
+            guard let self = self else { return }
+            switch res {
+            case .failure(let err):
+                completion(.failure(err))
+            case .success(let config):
+                guard let authorizationBaseUrl = config.authorizationBaseUrl, !authorizationBaseUrl.isEmpty else {
+                    completion(.failure(NSError(domain: "OAuth2Provider", code: -2, userInfo: [NSLocalizedDescriptionKey: "Missing authorization endpoint (discovery may have failed)."])))
+                    return
+                }
+
+                let loginScope = self.normalizeScope(payload["scope"] ?? payload["scopes"] ?? config.scope)
+                let state = payload["state"] as? String ?? UUID().uuidString
+                let codeVerifier = payload["codeVerifier"] as? String ?? self.generateCodeVerifier()
+                let redirect = payload["redirectUrl"] as? String ?? config.redirectUrl
+                let additionalLoginParams = payload["additionalParameters"] as? [String: String]
+
+                self.currentState = state
+                self.currentCodeVerifier = codeVerifier
+                self.currentProviderId = providerId
+
+                var components = URLComponents(string: authorizationBaseUrl)
+                var queryItems: [URLQueryItem] = [
+                    URLQueryItem(name: "response_type", value: config.responseType),
+                    URLQueryItem(name: "client_id", value: config.appId),
+                    URLQueryItem(name: "redirect_uri", value: redirect),
+                    URLQueryItem(name: "state", value: state)
+                ]
+
+                if !loginScope.isEmpty {
+                    queryItems.append(URLQueryItem(name: "scope", value: loginScope))
+                }
+
+                // Add PKCE for code flow
+                if config.responseType == "code" && config.pkceEnabled {
+                    let codeChallenge = self.generateCodeChallenge(from: codeVerifier)
+                    queryItems.append(URLQueryItem(name: "code_challenge", value: codeChallenge))
+                    queryItems.append(URLQueryItem(name: "code_challenge_method", value: "S256"))
+                }
+
+                // Merge additional parameters (config + per-login)
+                var merged: [String: String] = [:]
+                if let base = config.additionalParameters {
+                    for (k, v) in base { merged[k] = v }
+                }
+                if let login = additionalLoginParams {
+                    for (k, v) in login { merged[k] = v }
+                }
+                if let loginHint = payload["loginHint"] as? String ?? config.loginHint, merged["login_hint"] == nil {
+                    merged["login_hint"] = loginHint
+                }
+                if let prompt = payload["prompt"] as? String ?? config.prompt, merged["prompt"] == nil {
+                    merged["prompt"] = prompt
+                }
+                for (k, v) in merged {
+                    queryItems.append(URLQueryItem(name: k, value: v))
+                }
+
+                components?.queryItems = queryItems
+
+                guard let authUrl = components?.url, let callbackScheme = URL(string: redirect)?.scheme else {
+                    completion(.failure(NSError(domain: "OAuth2Provider", code: -2, userInfo: [NSLocalizedDescriptionKey: "Invalid redirect URL configuration."])))
+                    return
+                }
+
+                if config.logsEnabled {
+                    print("[OAuth2Provider] Opening authorization URL: \(authUrl.absoluteString)")
+                }
+
+                let session = ASWebAuthenticationSession(url: authUrl, callbackURLScheme: callbackScheme) { [weak self] callbackURL, error in
+                    guard let self = self else { return }
+                    if let error = error {
+                        if (error as NSError).code == ASWebAuthenticationSessionError.canceledLogin.rawValue {
+                            completion(.failure(NSError(domain: "OAuth2Provider", code: -3, userInfo: [NSLocalizedDescriptionKey: "User cancelled login."])))
+                        } else {
+                            completion(.failure(error))
+                        }
+                        return
+                    }
+
+                    guard let callbackURL = callbackURL else {
+                        completion(.failure(NSError(domain: "OAuth2Provider", code: -4, userInfo: [NSLocalizedDescriptionKey: "Invalid callback URL."])))
+                        return
+                    }
 
-        session.presentationContextProvider = self
-        session.prefersEphemeralWebBrowserSession = true
-        currentSession = session
-        session.start()
+                    self.handleCallback(providerId: providerId, config: config, callbackURL: callbackURL, redirectUri: redirect, completion: completion)
+                }
+
+                session.presentationContextProvider = self
+                session.prefersEphemeralWebBrowserSession = config.iosPrefersEphemeralWebBrowserSession
+                self.currentSession = session
+                session.start()
+            }
+        }
     }
 
     private func handleCallback(providerId: String, config: OAuth2ProviderConfig, callbackURL: URL, redirectUri: String, completion: @escaping (Result<OAuth2LoginResponse, Error>) -> Void) {
@@ -251,7 +363,7 @@ class OAuth2Provider: NSObject {
                 refresh_token: nil,
                 id_token: params["id_token"]
             )
-            handleTokenSuccess(providerId: providerId, config: config, tokenResponse: tokenResponse, completion: completion)
+            handleTokenSuccess(providerId: providerId, config: config, tokenResponse: tokenResponse, fallbackRefreshToken: nil, completion: completion)
             return
         }
 
@@ -260,14 +372,38 @@ class OAuth2Provider: NSObject {
 
     func logout(providerId: String, completion: @escaping (Result<Void, Error>) -> Void) {
         UserDefaults.standard.removeObject(forKey: tokenStorageKey(for: providerId))
-
-        if let config = getProvider(providerId), let logoutUrl = config.logoutUrl, let url = URL(string: logoutUrl) {
-            DispatchQueue.main.async {
-                UIApplication.shared.open(url)
+        ensureDiscovered(providerId: providerId) { [weak self] res in
+            guard let self = self else {
+                completion(.success(()))
+                return
             }
+            if case .success(let config) = res, let logoutUrl = config.logoutUrl, let base = URL(string: logoutUrl) {
+                var url = base
+                if var components = URLComponents(url: base, resolvingAgainstBaseURL: false) {
+                    var items = components.queryItems ?? []
+                    if let idToken = self.loadTokens(for: providerId)?.idToken, !idToken.isEmpty {
+                        items.append(URLQueryItem(name: "id_token_hint", value: idToken))
+                    }
+                    if let post = config.postLogoutRedirectUrl, !post.isEmpty {
+                        items.append(URLQueryItem(name: "post_logout_redirect_uri", value: post))
+                    }
+                    if let extra = config.additionalLogoutParameters {
+                        for (k, v) in extra {
+                            items.append(URLQueryItem(name: k, value: v))
+                        }
+                    }
+                    components.queryItems = items
+                    if let composed = components.url {
+                        url = composed
+                    }
+                }
+                DispatchQueue.main.async {
+                    UIApplication.shared.open(url)
+                }
+            }
+            completion(.success(()))
         }
 
-        completion(.success(()))
     }
 
     func isLoggedIn(providerId: String, completion: @escaping (Result<Bool, Error>) -> Void) {
@@ -292,17 +428,25 @@ class OAuth2Provider: NSObject {
     }
 
     func refresh(providerId: String, completion: @escaping (Result<OAuth2LoginResponse, Error>) -> Void) {
-        guard let config = getProvider(providerId) else {
-            completion(.failure(NSError(domain: "OAuth2Provider", code: -1, userInfo: [NSLocalizedDescriptionKey: "OAuth2 provider '\(providerId)' not configured."])))
-            return
-        }
+        refreshToken(providerId: providerId, refreshToken: nil, additionalParameters: nil, completion: completion)
+    }
 
-        guard let tokens = loadTokens(for: providerId), let refreshToken = tokens.refreshToken else {
-            completion(.failure(NSError(domain: "OAuth2Provider", code: -10, userInfo: [NSLocalizedDescriptionKey: "No refresh token available. Include offline_access scope."])))
-            return
+    func refreshToken(providerId: String, refreshToken: String?, additionalParameters: [String: String]?, completion: @escaping (Result<OAuth2LoginResponse, Error>) -> Void) {
+        ensureDiscovered(providerId: providerId) { [weak self] res in
+            guard let self = self else { return }
+            switch res {
+            case .failure(let err):
+                completion(.failure(err))
+            case .success(let config):
+                let stored = self.loadTokens(for: providerId)
+                let effectiveRefreshToken = refreshToken ?? stored?.refreshToken
+                guard let rt = effectiveRefreshToken, !rt.isEmpty else {
+                    completion(.failure(NSError(domain: "OAuth2Provider", code: -10, userInfo: [NSLocalizedDescriptionKey: "No refresh token available. Include offline_access scope."])))
+                    return
+                }
+                self.refreshTokens(providerId: providerId, config: config, refreshToken: rt, additionalParameters: additionalParameters, completion: completion)
+            }
         }
-
-        refreshTokens(providerId: providerId, config: config, refreshToken: refreshToken, completion: completion)
     }
 
     private func exchangeCode(providerId: String, config: OAuth2ProviderConfig, code: String, redirectUri: String, codeVerifier: String, completion: @escaping (Result<OAuth2LoginResponse, Error>) -> Void) {
@@ -322,6 +466,10 @@ class OAuth2Provider: NSObject {
             body["code_verifier"] = codeVerifier
         }
 
+        if let extra = config.additionalTokenParameters {
+            for (k, v) in extra { body[k] = v }
+        }
+
         if config.logsEnabled {
             print("[OAuth2Provider] Exchanging code at: \(accessTokenEndpoint)")
         }
@@ -329,29 +477,36 @@ class OAuth2Provider: NSObject {
         performTokenRequest(endpoint: accessTokenEndpoint, body: body) { [weak self] result in
             switch result {
             case .success(let tokenResponse):
-                self?.handleTokenSuccess(providerId: providerId, config: config, tokenResponse: tokenResponse, completion: completion)
+                self?.handleTokenSuccess(providerId: providerId, config: config, tokenResponse: tokenResponse, fallbackRefreshToken: nil, completion: completion)
             case .failure(let error):
                 completion(.failure(error))
             }
         }
     }
 
-    private func refreshTokens(providerId: String, config: OAuth2ProviderConfig, refreshToken: String, completion: @escaping (Result<OAuth2LoginResponse, Error>) -> Void) {
+    private func refreshTokens(providerId: String, config: OAuth2ProviderConfig, refreshToken: String, additionalParameters: [String: String]? = nil, completion: @escaping (Result<OAuth2LoginResponse, Error>) -> Void) {
         guard let accessTokenEndpoint = config.accessTokenEndpoint else {
             completion(.failure(NSError(domain: "OAuth2Provider", code: -12, userInfo: [NSLocalizedDescriptionKey: "Missing accessTokenEndpoint for token refresh."])))
             return
         }
 
-        let body: [String: String] = [
+        var body: [String: String] = [
             "grant_type": "refresh_token",
             "refresh_token": refreshToken,
             "client_id": config.appId
         ]
 
+        if let extra = config.additionalTokenParameters {
+            for (k, v) in extra { body[k] = v }
+        }
+        if let extra = additionalParameters {
+            for (k, v) in extra { body[k] = v }
+        }
+
         performTokenRequest(endpoint: accessTokenEndpoint, body: body) { [weak self] result in
             switch result {
             case .success(let tokenResponse):
-                self?.handleTokenSuccess(providerId: providerId, config: config, tokenResponse: tokenResponse, completion: completion)
+                self?.handleTokenSuccess(providerId: providerId, config: config, tokenResponse: tokenResponse, fallbackRefreshToken: refreshToken, completion: completion)
             case .failure(let error):
                 completion(.failure(error))
             }
@@ -394,9 +549,10 @@ class OAuth2Provider: NSObject {
         .resume()
     }
 
-    private func handleTokenSuccess(providerId: String, config: OAuth2ProviderConfig, tokenResponse: OAuth2TokenResponse, completion: @escaping (Result<OAuth2LoginResponse, Error>) -> Void) {
+    private func handleTokenSuccess(providerId: String, config: OAuth2ProviderConfig, tokenResponse: OAuth2TokenResponse, fallbackRefreshToken: String?, completion: @escaping (Result<OAuth2LoginResponse, Error>) -> Void) {
         let expiresAt = tokenResponse.expires_in.map { Date().addingTimeInterval(TimeInterval($0)) } ?? Date().addingTimeInterval(3600)
         let scopeArray = tokenResponse.scope?.split(separator: " ").map { String($0) } ?? []
+        let effectiveRefreshToken = tokenResponse.refresh_token ?? fallbackRefreshToken
 
         // Fetch resource data if configured
         if let resourceUrl = config.resourceUrl {
@@ -417,6 +573,7 @@ class OAuth2Provider: NSObject {
                 self.completeLogin(
                     providerId: providerId,
                     tokenResponse: tokenResponse,
+                    effectiveRefreshToken: effectiveRefreshToken,
                     expiresAt: expiresAt,
                     scopeArray: scopeArray,
                     resourceData: resourceData,
@@ -427,6 +584,7 @@ class OAuth2Provider: NSObject {
             completeLogin(
                 providerId: providerId,
                 tokenResponse: tokenResponse,
+                effectiveRefreshToken: effectiveRefreshToken,
                 expiresAt: expiresAt,
                 scopeArray: scopeArray,
                 resourceData: nil,
@@ -438,6 +596,7 @@ class OAuth2Provider: NSObject {
     private func completeLogin(
         providerId: String,
         tokenResponse: OAuth2TokenResponse,
+        effectiveRefreshToken: String?,
         expiresAt: Date,
         scopeArray: [String],
         resourceData: [String: Any]?,
@@ -445,7 +604,7 @@ class OAuth2Provider: NSObject {
     ) {
         let stored = OAuth2StoredTokens(
             accessToken: tokenResponse.access_token,
-            refreshToken: tokenResponse.refresh_token,
+            refreshToken: effectiveRefreshToken,
             idToken: tokenResponse.id_token,
             expiresAt: expiresAt,
             scope: scopeArray,
@@ -459,10 +618,10 @@ class OAuth2Provider: NSObject {
                 token: tokenResponse.access_token,
                 tokenType: tokenResponse.token_type,
                 expires: ISO8601DateFormatter().string(from: expiresAt),
-                refreshToken: tokenResponse.refresh_token
+                refreshToken: effectiveRefreshToken
             ),
             idToken: tokenResponse.id_token,
-            refreshToken: tokenResponse.refresh_token,
+            refreshToken: effectiveRefreshToken,
             resourceData: resourceData,
             scope: scopeArray,
             tokenType: tokenResponse.token_type,
@@ -535,6 +694,25 @@ class OAuth2Provider: NSObject {
         }
     }
 
+    func getAccessTokenExpirationDate(providerId: String) -> Date? {
+        return loadTokens(for: providerId)?.expiresAt
+    }
+
+    func isAccessTokenAvailable(providerId: String) -> Bool {
+        guard let token = loadTokens(for: providerId)?.accessToken else { return false }
+        return !token.isEmpty
+    }
+
+    func isAccessTokenExpired(providerId: String) -> Bool {
+        guard let expiresAt = loadTokens(for: providerId)?.expiresAt else { return true }
+        return expiresAt <= Date()
+    }
+
+    func isRefreshTokenAvailable(providerId: String) -> Bool {
+        guard let rt = loadTokens(for: providerId)?.refreshToken else { return false }
+        return !rt.isEmpty
+    }
+
     private func generateCodeVerifier() -> String {
         var data = Data(count: 64)
         _ = data.withUnsafeMutableBytes { SecRandomCopyBytes(kSecRandomDefault, 64, $0.baseAddress!) }