@civic/auth 0.5.6-mcp-patch.2 → 0.6.0-beta.1

package/dist/shared/components/IFrameAndLoading.js

@@ -7,10 +7,13 @@ import { BlockDisplay } from "./BlockDisplay.js";
 import { LoadingIcon } from "./LoadingIcon.js";
 import { CivicAuthLogoutIframeContainer } from "./CivicAuthLogoutIframeContainer.js";
 import { useSession } from "../hooks/useSession.js";
+import { useAuthStatus } from "../providers/AuthStatusContext.js";
+import { AuthStatus } from "../../types.js";
 const IFrameAndLoading = ({ error, showIframeOnLogout = false, }) => {
     const isInIframe = useIsInIframe();
     const [logoutIframeLoading, setLogoutIframeLoading] = useState(true);
     const { renderIframe, iframeIsVisible, setIframeIsVisible, logoutIframeIsVisible, } = useIframe();
+    const { authStatus } = useAuthStatus();
     const session = useSession();
     // we show a loading overlay to block the display for the user
     // as the page that loads within the iframe will be the actual customer
@@ -41,9 +44,20 @@ const IFrameAndLoading = ({ error, showIframeOnLogout = false, }) => {
         // which the parent needs to detect in order to redirect to the loginSuccessUrl if any.
         // So we wait 500ms to allow that to happen before removing the iframe.
         if (session.data?.authenticated) {
-            setTimeout(() => setIframeShouldRender(false), 500);
+            setTimeout(() => {
+                return setIframeShouldRender(false);
+            }, 500);
         }
     }, [session.data?.authenticated]);
+    /**
+     * This useEffect resets the iframeShouldRender state when the authStatus changes. We need it
+     * as the iframeShouldRender state is set to false when the user is authenticated, but it needs to be reset
+     */
+    useEffect(() => {
+        if (authStatus !== AuthStatus.AUTHENTICATED) {
+            setIframeShouldRender(renderIframe);
+        }
+    }, [authStatus, renderIframe, iframeIsVisible]);
     return (_jsxs(_Fragment, { children: [iframeShouldRender && (_jsx("div", { style: iframeIsVisible ? { display: "block" } : { display: "none" }, children: _jsx(CivicAuthIframeContainer, { onClose: () => setIframeIsVisible(false) }) })), _jsx("div", { style: showIframeOnLogout && logoutIframeIsVisible
                     ? { display: "block" }
                     : { display: "none" }, children: _jsx(CivicAuthLogoutIframeContainer, { isLoading: logoutIframeLoading }) }), error && (_jsx(BlockDisplay, { children: _jsxs("div", { children: ["Error: ", error?.message] }) })), showLoadingOverlay && !error && (_jsx(BlockDisplay, { children: _jsx(LoadingIcon, {}) }))] }));

package/dist/shared/components/IFrameAndLoading.js.map

@@ -1 +1 @@
-{"version":3,"file":"IFrameAndLoading.js","sourceRoot":"","sources":["../../../src/shared/components/IFrameAndLoading.tsx"],"names":[],"mappings":";AAAA,OAAO,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,MAAM,gBAAgB,GAAG,CAAC,EACxB,KAAK,EACL,kBAAkB,GAAG,KAAK,GAK3B,EAAE,EAAE;IACH,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,EACJ,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,qBAAqB,GACtB,GAAG,SAAS,EAAE,CAAC;IAChB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,8DAA8D;IAC9D,uEAAuE;IACvE,0FAA0F;IAC1F,qFAAqF;IACrF,MAAM,kBAAkB,GAAG,UAAU,CAAC;IAEtC,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,kBAAkB,GAAG,CAAC,KAAmB,EAAE,EAAE;YACjD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9C,IACE,CAAC,CACC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,WAAW,CACvE,EACD,CAAC;gBACD,OAAO;YACT,CAAC;YAED,0EAA0E;YAC1E,IACE,KAAK,CAAC,IAAI,EAAE,MAAM,KAAK,eAAe;gBACtC,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,YAAY,EACjC,CAAC;gBACD,sBAAsB,CAAC,KAAK,CAAC,CAAC;gBAC9B,OAAO;YACT,CAAC;YAED,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC;QAEF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QACvD,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IACzE,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IAE3E,SAAS,CAAC,GAAG,EAAE;QACb,yEAAyE;QACzE,uFAAuF;QACvF,uFAAuF;QACvF,uEAAuE;QACvE,IAAI,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC;YAChC,UAAU,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IAElC,OAAO,CACL,8BAGG,kBAAkB,IAAI,CACrB,cACE,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAEnE,KAAC,wBAAwB,IAAC,OAAO,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAI,GAClE,CACP,EAED,cACE,KAAK,EACH,kBAAkB,IAAI,qBAAqB;oBACzC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE;oBACtB,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAGzB,KAAC,8BAA8B,IAAC,SAAS,EAAE,mBAAmB,GAAI,GAC9D,EAEL,KAAK,IAAI,CACR,KAAC,YAAY,cACX,qCAAa,KAAK,EAAE,OAAO,IAAO,GACrB,CAChB,EAEA,kBAAkB,IAAI,CAAC,KAAK,IAAI,CAC/B,KAAC,YAAY,cACX,KAAC,WAAW,KAAG,GACF,CAChB,IACA,CACJ,CAAC;AACJ,CAAC,CAAC;AACF,OAAO,EAAE,gBAAgB,EAAE,CAAC","sourcesContent":["import React, { useEffect, useState } from \"react\";\nimport { useIframe } from \"../hooks/useIframe.js\";\nimport { useIsInIframe } from \"../hooks/useIsInIframe.js\";\nimport { CivicAuthIframeContainer } from \"./CivicAuthIframeContainer.js\";\nimport { BlockDisplay } from \"./BlockDisplay.js\";\nimport { LoadingIcon } from \"./LoadingIcon.js\";\nimport { CivicAuthLogoutIframeContainer } from \"./CivicAuthLogoutIframeContainer.js\";\nimport { useSession } from \"../hooks/useSession.js\";\n\nconst IFrameAndLoading = ({\n  error,\n  showIframeOnLogout = false,\n}: {\n  error: Error | null;\n  isLoading: boolean;\n  showIframeOnLogout?: boolean;\n}) => {\n  const isInIframe = useIsInIframe();\n  const [logoutIframeLoading, setLogoutIframeLoading] = useState(true);\n  const {\n    renderIframe,\n    iframeIsVisible,\n    setIframeIsVisible,\n    logoutIframeIsVisible,\n  } = useIframe();\n  const session = useSession();\n  // we show a loading overlay to block the display for the user\n  // as the page that loads within the iframe will be the actual customer\n  // login page just after authenticatino, which shouldn't be shown to the user during login\n  // there's a small period where we're resolving the session and the iframe is showing\n  const showLoadingOverlay = isInIframe;\n\n  useEffect(() => {\n    const handleErrorMessage = (event: MessageEvent) => {\n      const thisURL = new URL(window.location.href);\n      if (\n        !(\n          event.origin.endsWith(\"civic.com\") || thisURL.hostname === \"localhost\"\n        )\n      ) {\n        return;\n      }\n\n      // The login app has thrown an error, so we need to show the logout iframe\n      if (\n        event.data?.source === \"civicloginApp\" &&\n        event.data?.type === \"auth_error\"\n      ) {\n        setLogoutIframeLoading(false);\n        return;\n      }\n\n      setLogoutIframeLoading(true);\n    };\n\n    window.addEventListener(\"message\", handleErrorMessage);\n    return () => window.removeEventListener(\"message\", handleErrorMessage);\n  }, []);\n\n  const [iframeShouldRender, setIframeShouldRender] = useState(renderIframe);\n\n  useEffect(() => {\n    // We can't remove the iframe from the DOM immediately on authentication,\n    // because it needs a short window to render a special 'TOKEN_EXCHANGE_SUCCESS' message\n    // which the parent needs to detect in order to redirect to the loginSuccessUrl if any.\n    // So we wait 500ms to allow that to happen before removing the iframe.\n    if (session.data?.authenticated) {\n      setTimeout(() => setIframeShouldRender(false), 500);\n    }\n  }, [session.data?.authenticated]);\n\n  return (\n    <>\n      {/* when the user is authenticated we shouldn't render the iframe anymore\n      so that we clear the session for the next time */}\n      {iframeShouldRender && (\n        <div\n          style={iframeIsVisible ? { display: \"block\" } : { display: \"none\" }}\n        >\n          <CivicAuthIframeContainer onClose={() => setIframeIsVisible(false)} />\n        </div>\n      )}\n\n      <div\n        style={\n          showIframeOnLogout && logoutIframeIsVisible\n            ? { display: \"block\" }\n            : { display: \"none\" }\n        }\n      >\n        <CivicAuthLogoutIframeContainer isLoading={logoutIframeLoading} />\n      </div>\n\n      {error && (\n        <BlockDisplay>\n          <div>Error: {error?.message}</div>\n        </BlockDisplay>\n      )}\n\n      {showLoadingOverlay && !error && (\n        <BlockDisplay>\n          <LoadingIcon />\n        </BlockDisplay>\n      )}\n    </>\n  );\n};\nexport { IFrameAndLoading };\n"]}
+{"version":3,"file":"IFrameAndLoading.js","sourceRoot":"","sources":["../../../src/shared/components/IFrameAndLoading.tsx"],"names":[],"mappings":";AAAA,OAAO,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,gBAAgB,GAAG,CAAC,EACxB,KAAK,EACL,kBAAkB,GAAG,KAAK,GAK3B,EAAE,EAAE;IACH,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,MAAM,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,EACJ,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,qBAAqB,GACtB,GAAG,SAAS,EAAE,CAAC;IAChB,MAAM,EAAE,UAAU,EAAE,GAAG,aAAa,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,8DAA8D;IAC9D,uEAAuE;IACvE,0FAA0F;IAC1F,qFAAqF;IACrF,MAAM,kBAAkB,GAAG,UAAU,CAAC;IAEtC,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,kBAAkB,GAAG,CAAC,KAAmB,EAAE,EAAE;YACjD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9C,IACE,CAAC,CACC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,QAAQ,KAAK,WAAW,CACvE,EACD,CAAC;gBACD,OAAO;YACT,CAAC;YAED,0EAA0E;YAC1E,IACE,KAAK,CAAC,IAAI,EAAE,MAAM,KAAK,eAAe;gBACtC,KAAK,CAAC,IAAI,EAAE,IAAI,KAAK,YAAY,EACjC,CAAC;gBACD,sBAAsB,CAAC,KAAK,CAAC,CAAC;gBAC9B,OAAO;YACT,CAAC;YAED,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC;QAEF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QACvD,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IACzE,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IAE3E,SAAS,CAAC,GAAG,EAAE;QACb,yEAAyE;QACzE,uFAAuF;QACvF,uFAAuF;QACvF,uEAAuE;QACvE,IAAI,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC;YAChC,UAAU,CAAC,GAAG,EAAE;gBACd,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;YACtC,CAAC,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;IACH,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IAElC;;;OAGG;IACH,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,UAAU,KAAK,UAAU,CAAC,aAAa,EAAE,CAAC;YAC5C,qBAAqB,CAAC,YAAY,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC;IAEhD,OAAO,CACL,8BAGG,kBAAkB,IAAI,CACrB,cACE,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAEnE,KAAC,wBAAwB,IAAC,OAAO,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAI,GAClE,CACP,EAED,cACE,KAAK,EACH,kBAAkB,IAAI,qBAAqB;oBACzC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE;oBACtB,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAGzB,KAAC,8BAA8B,IAAC,SAAS,EAAE,mBAAmB,GAAI,GAC9D,EAEL,KAAK,IAAI,CACR,KAAC,YAAY,cACX,qCAAa,KAAK,EAAE,OAAO,IAAO,GACrB,CAChB,EAEA,kBAAkB,IAAI,CAAC,KAAK,IAAI,CAC/B,KAAC,YAAY,cACX,KAAC,WAAW,KAAG,GACF,CAChB,IACA,CACJ,CAAC;AACJ,CAAC,CAAC;AACF,OAAO,EAAE,gBAAgB,EAAE,CAAC","sourcesContent":["import React, { useEffect, useState } from \"react\";\nimport { useIframe } from \"../hooks/useIframe.js\";\nimport { useIsInIframe } from \"../hooks/useIsInIframe.js\";\nimport { CivicAuthIframeContainer } from \"./CivicAuthIframeContainer.js\";\nimport { BlockDisplay } from \"./BlockDisplay.js\";\nimport { LoadingIcon } from \"./LoadingIcon.js\";\nimport { CivicAuthLogoutIframeContainer } from \"./CivicAuthLogoutIframeContainer.js\";\nimport { useSession } from \"../hooks/useSession.js\";\nimport { useAuthStatus } from \"../providers/AuthStatusContext.js\";\nimport { AuthStatus } from \"@/types.js\";\n\nconst IFrameAndLoading = ({\n  error,\n  showIframeOnLogout = false,\n}: {\n  error: Error | null;\n  isLoading: boolean;\n  showIframeOnLogout?: boolean;\n}) => {\n  const isInIframe = useIsInIframe();\n  const [logoutIframeLoading, setLogoutIframeLoading] = useState(true);\n  const {\n    renderIframe,\n    iframeIsVisible,\n    setIframeIsVisible,\n    logoutIframeIsVisible,\n  } = useIframe();\n  const { authStatus } = useAuthStatus();\n  const session = useSession();\n  // we show a loading overlay to block the display for the user\n  // as the page that loads within the iframe will be the actual customer\n  // login page just after authenticatino, which shouldn't be shown to the user during login\n  // there's a small period where we're resolving the session and the iframe is showing\n  const showLoadingOverlay = isInIframe;\n\n  useEffect(() => {\n    const handleErrorMessage = (event: MessageEvent) => {\n      const thisURL = new URL(window.location.href);\n      if (\n        !(\n          event.origin.endsWith(\"civic.com\") || thisURL.hostname === \"localhost\"\n        )\n      ) {\n        return;\n      }\n\n      // The login app has thrown an error, so we need to show the logout iframe\n      if (\n        event.data?.source === \"civicloginApp\" &&\n        event.data?.type === \"auth_error\"\n      ) {\n        setLogoutIframeLoading(false);\n        return;\n      }\n\n      setLogoutIframeLoading(true);\n    };\n\n    window.addEventListener(\"message\", handleErrorMessage);\n    return () => window.removeEventListener(\"message\", handleErrorMessage);\n  }, []);\n\n  const [iframeShouldRender, setIframeShouldRender] = useState(renderIframe);\n\n  useEffect(() => {\n    // We can't remove the iframe from the DOM immediately on authentication,\n    // because it needs a short window to render a special 'TOKEN_EXCHANGE_SUCCESS' message\n    // which the parent needs to detect in order to redirect to the loginSuccessUrl if any.\n    // So we wait 500ms to allow that to happen before removing the iframe.\n    if (session.data?.authenticated) {\n      setTimeout(() => {\n        return setIframeShouldRender(false);\n      }, 500);\n    }\n  }, [session.data?.authenticated]);\n\n  /**\n   * This useEffect resets the iframeShouldRender state when the authStatus changes. We need it\n   * as the iframeShouldRender state is set to false when the user is authenticated, but it needs to be reset\n   */\n  useEffect(() => {\n    if (authStatus !== AuthStatus.AUTHENTICATED) {\n      setIframeShouldRender(renderIframe);\n    }\n  }, [authStatus, renderIframe, iframeIsVisible]);\n\n  return (\n    <>\n      {/* when the user is authenticated we shouldn't render the iframe anymore\n      so that we clear the session for the next time */}\n      {iframeShouldRender && (\n        <div\n          style={iframeIsVisible ? { display: \"block\" } : { display: \"none\" }}\n        >\n          <CivicAuthIframeContainer onClose={() => setIframeIsVisible(false)} />\n        </div>\n      )}\n\n      <div\n        style={\n          showIframeOnLogout && logoutIframeIsVisible\n            ? { display: \"block\" }\n            : { display: \"none\" }\n        }\n      >\n        <CivicAuthLogoutIframeContainer isLoading={logoutIframeLoading} />\n      </div>\n\n      {error && (\n        <BlockDisplay>\n          <div>Error: {error?.message}</div>\n        </BlockDisplay>\n      )}\n\n      {showLoadingOverlay && !error && (\n        <BlockDisplay>\n          <LoadingIcon />\n        </BlockDisplay>\n      )}\n    </>\n  );\n};\nexport { IFrameAndLoading };\n"]}

package/dist/shared/hooks/useSignIn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useSignIn.d.ts","sourceRoot":"","sources":["../../../src/shared/hooks/useSignIn.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,UAAU,EACV,KAAK,WAAW,EAEjB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAQpE,KAAK,WAAW,GAAG;IACjB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,WAAW,EAAE,WAAW,CAAC;CAC1B,CAAC;AAcF;;GAEG;AACH,QAAA,MAAM,SAAS,4DAC2C,WAAW;kBAsQ9B,OAAO,CAAC,IAAI,CAAC;;uBA/GR,OAAO,CAAC,IAAI,CAAC;;;CAiSxD,CAAC;AAEF,OAAO,EAAE,SAAS,EAAE,CAAC"}
+{"version":3,"file":"useSignIn.d.ts","sourceRoot":"","sources":["../../../src/shared/hooks/useSignIn.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,UAAU,EACV,KAAK,WAAW,EAEjB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAQpE,KAAK,WAAW,GAAG;IACjB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,WAAW,EAAE,WAAW,CAAC;CAC1B,CAAC;AAcF;;GAEG;AACH,QAAA,MAAM,SAAS,4DAC2C,WAAW;kBAiQ9B,OAAO,CAAC,IAAI,CAAC;;uBA1GR,OAAO,CAAC,IAAI,CAAC;;;CA4RxD,CAAC;AAEF,OAAO,EAAE,SAAS,EAAE,CAAC"}

package/dist/shared/hooks/useSignIn.js

@@ -123,10 +123,15 @@ const useSignIn = ({ pkceConsumer, preSignOut, postSignOut, displayMode } = {
         if (!authInitiator) {
             return Promise.reject(new Error("Auth initiator not available"));
         }
-        // Check if sign-in is already in progress using the ref
+        // Create the promise and store its handlers
+        const promise = new Promise((resolve, reject) => {
+            signInResolveRef.current = resolve;
+            signInRejectRef.current = reject;
+        });
+        signInPromiseRef.current = promise;
+        // Check if sign-in is already in progress using the ref, if so, return signIn promise
         if (isSigningInRef.current) {
-            return (signInPromiseRef.current ||
-                Promise.reject(new Error("Sign-in already in progress")));
+            return promise;
         }
         // State machine for sign-in flow
         switch (authStatus) {
@@ -136,10 +141,8 @@ const useSignIn = ({ pkceConsumer, preSignOut, postSignOut, displayMode } = {
             case AuthStatus.ERROR:
                 break;
             case AuthStatus.AUTHENTICATING:
-                // If we're authenticating but isSigningInRef is false, something went wrong
-                // Reset the state and allow a new sign-in attempt
-                setAuthStatus(AuthStatus.UNAUTHENTICATED);
-                break;
+                // if we're already authenticating, return the existing promise
+                return promise;
             default:
                 return Promise.reject(new Error(`Invalid state for sign-in: ${authStatus}`));
         }
@@ -150,12 +153,6 @@ const useSignIn = ({ pkceConsumer, preSignOut, postSignOut, displayMode } = {
             window.clearTimeout(timeoutRef.current);
             timeoutRef.current = null;
         }
-        // Create the promise and store its handlers
-        const promise = new Promise((resolve, reject) => {
-            signInResolveRef.current = resolve;
-            signInRejectRef.current = reject;
-        });
-        signInPromiseRef.current = promise;
         try {
             // Set authenticating status before any async operations
             setAuthStatus(AuthStatus.AUTHENTICATING);

package/dist/shared/hooks/useSignIn.js.map

@@ -1 +1 @@
-{"version":3,"file":"useSignIn.js","sourceRoot":"","sources":["../../../src/shared/hooks/useSignIn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EACL,UAAU,GAGX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAChE,OAAO,EAAE,UAAU,EAAqB,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAmBxE,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,4BAA4B;AAEtE;;GAEG;AACH,MAAM,SAAS,GAAG,CAChB,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,KAAkB;IACpE,WAAW,EAAE,QAAQ;CACtB,EACD,EAAE;IACF,4BAA4B;IAC5B,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,MAAM,EACJ,SAAS,EACT,eAAe,EACf,kBAAkB,EAClB,wBAAwB,EACxB,aAAa,EACb,gBAAgB,GACjB,GAAG,SAAS,EAAE,CAAC;IAChB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,UAAU,EAAE,CAAC;IACvC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,aAAa,EAAE,CAAC;IACtD,MAAM,CAAC,EAAE,eAAe,CAAC,GAAG,eAAe,CACzC,gBAAgB,EAChB,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;IAEF,0BAA0B;IAC1B,MAAM,UAAU,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,MAAM,CAAa,UAAU,CAAC,eAAe,CAAC,CAAC;IACrE,MAAM,cAAc,GAAG,MAAM,CAAU,KAAK,CAAC,CAAC;IAE9C,mBAAmB;IACnB,MAAM,gBAAgB,GAAG,MAAM,EAAiB,CAAC;IACjD,MAAM,gBAAgB,GAAG,MAAM,CAE7B,IAAI,CAAC,CAAC;IACR,MAAM,eAAe,GAAG,MAAM,CAAmC,IAAI,CAAC,CAAC;IAEvE,iBAAiB;IACjB,MAAM,WAAW,GAAG,MAAM,CAGvB;QACD,oBAAoB,EAAE,IAAI;QAC1B,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;IAEH,wDAAwD;IACxD,MAAM,oBAAoB,GAAG,WAAW,CAAC,GAAG,EAAE;QAC5C,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC7B,aAAa,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YACxC,aAAa,CAAC,OAAO,GAAG,UAAU,CAAC,aAAa,CAAC;YACjD,cAAc,CAAC,OAAO,GAAG,KAAK,CAAC;YAC/B,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAE3B,2BAA2B;YAC3B,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;YAChC,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;YAC/B,gBAAgB,CAAC,OAAO,GAAG,SAAS,CAAC;YAErC,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAChC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACxC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;IAEpB,MAAM,mBAAmB,GAAG,WAAW,CACrC,CAAC,KAAY,EAAE,YAAwB,UAAU,CAAC,KAAK,EAAE,EAAE;QACzD,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;YAC5B,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAE/B,2BAA2B;YAC3B,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;YAChC,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;YAC/B,gBAAgB,CAAC,OAAO,GAAG,SAAS,CAAC;YACrC,cAAc,CAAC,OAAO,GAAG,KAAK,CAAC;YAC/B,aAAa,CAAC,SAAS,CAAC,CAAC;YAEzB,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAChC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACxC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC,EACD,CAAC,aAAa,CAAC,CAChB,CAAC;IAEF,kCAAkC;IAClC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,EAAE;QACjC,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QAElC,MAAM,EACJ,QAAQ,EACR,WAAW,EACX,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,KAAK,EACL,WAAW,EACX,SAAS,EACT,MAAM,GACP,GAAG,eAAe,CAAC;QAEpB,OAAO,IAAI,8BAA8B,CACvC;YACE,YAAY,EAAE,YAAY,IAAI,IAAI,+BAA+B,EAAE;YACnE,QAAQ;YACR,WAAW;YACX,eAAe;YACf,SAAS;YACT,iBAAiB;YACjB,MAAM;YACN,WAAW;YACX,WAAW;YACX,iBAAiB,EAAE,SAAS;YAC5B,KAAK;SACN,EACD,eAAe,CAChB,CAAC;IACJ,CAAC,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC;IAElE,4CAA4C;IAC5C,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,GAAG,EAAE;YACV,IAAI,aAAa,EAAE,CAAC;gBAClB,aAAa,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC;YACD,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAChC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACxC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;IAEpB,8BAA8B;IAC9B,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,YAAY,GAAG,IAAI,mBAAmB,EAAE,CAAC;QAC/C,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,EAAE;YACxD,IAAI,KAAK,IAAI,KAAK,KAAK,iBAAiB,EAAE,CAAC;gBACzC,gBAAgB;gBAChB,WAAW,CAAC,YAAY,CAAC,CAAC;gBAC1B,SAAS,CAAC,YAAY,CAAC,CAAC;gBACxB,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAE5C,2BAA2B;gBAC3B,cAAc,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;gBACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,qBAAqB;IACrB,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,IAAmB,EAAE;QACxD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;QACnE,CAAC;QAED,wDAAwD;QACxD,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,CACL,gBAAgB,CAAC,OAAO;gBACxB,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CACzD,CAAC;QACJ,CAAC;QAED,iCAAiC;QACjC,QAAQ,UAAU,EAAE,CAAC;YACnB,KAAK,UAAU,CAAC,aAAa;gBAC3B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;YAE3B,KAAK,UAAU,CAAC,eAAe,CAAC;YAChC,KAAK,UAAU,CAAC,KAAK;gBACnB,MAAM;YAER,KAAK,UAAU,CAAC,cAAc;gBAC5B,4EAA4E;gBAC5E,kDAAkD;gBAClD,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;gBAC1C,MAAM;YAER;gBACE,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,8BAA8B,UAAU,EAAE,CAAC,CACtD,CAAC;QACN,CAAC;QAED,4BAA4B;QAC5B,cAAc,CAAC,OAAO,GAAG,IAAI,CAAC;QAE9B,6BAA6B;QAC7B,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACxC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;QAC5B,CAAC;QAED,4CAA4C;QAC5C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpD,gBAAgB,CAAC,OAAO,GAAG,OAAO,CAAC;YACnC,eAAe,CAAC,OAAO,GAAG,MAAM,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,gBAAgB,CAAC,OAAO,GAAG,OAAO,CAAC;QAEnC,IAAI,CAAC;YACH,wDAAwD;YACxD,aAAa,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YACzC,aAAa,CAAC,OAAO,GAAG,UAAU,CAAC,cAAc,CAAC;YAClD,aAAa,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YAE1C,uEAAuE;YACvE,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE;gBAC1C,IAAI,aAAa,CAAC,OAAO,KAAK,UAAU,CAAC,cAAc,EAAE,CAAC;oBACxD,mBAAmB,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC,EAAE,kBAAkB,CAAC,CAAC;YAEvB,mCAAmC;YACnC,MAAM,YAAY,GAAG,SAAS,EAAE,OAAO,IAAI,IAAI,CAAC;YAEhD,MAAM,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qCAAqC;YACrC,cAAc,CAAC,OAAO,GAAG,KAAK,CAAC;YAE/B,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;gBAChC,sCAAsC;gBACtC,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBAC1B,aAAa,CAAC,OAAO,EAAE,CAAC;gBACxB,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;gBACzC,IAAI,CAAC;oBACH,uCAAuC;oBACvC,MAAM,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;gBACzD,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,OAAO,CAAC,KAAK,CACX,+CAA+C,EAC/C,UAAU,CACX,CAAC;oBACF,mBAAmB,CACjB,UAAU,YAAY,KAAK;wBACzB,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAClC,CAAC;oBACF,OAAO,OAAO,CAAC;gBACjB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,mBAAmB,CACjB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;gBACF,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE;QACD,aAAa;QACb,WAAW;QACX,SAAS;QACT,kBAAkB;QAClB,UAAU;QACV,aAAa;QACb,mBAAmB;KACpB,CAAC,CAAC;IAEH,wBAAwB;IACxB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,IAAmB,EAAE;QACnD,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC7B,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAEnD,kBAAkB;IAClB,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,CAAC;QACjC,IAAI,CAAC,aAAa;YAAE,OAAO;QAE3B,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC7B,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1B,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,EAAE,EAAE,CAAC;YAErB,MAAM,YAAY,GAAG,eAAe,EAAE,OAAO,IAAI,IAAI,CAAC;YACtD,MAAM,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACjE,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBAChC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE;oBAC7B,KAAK;oBACL,YAAY,EAAE,KAAK,YAAY,UAAU;iBAC1C,CAAC,CAAC;gBAEH,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;oBAChC,wBAAwB,CAAC,KAAK,CAAC,CAAC;oBAChC,aAAa,CAAC,OAAO,EAAE,CAAC;oBACxB,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;oBACzC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,iBAAiB;gBACjE,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YACvC,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,EAAE;QACD,OAAO,EAAE,OAAO;QAChB,aAAa;QACb,WAAW;QACX,wBAAwB;QACxB,kBAAkB;QAClB,UAAU;QACV,eAAe;QACf,aAAa;KACd,CAAC,CAAC;IAEH,mDAAmD;IACnD,SAAS,CAAC,GAAG,EAAE;QACb,kBAAkB;QAClB,WAAW,CAAC,OAAO,GAAG;YACpB,oBAAoB,EAAE,GAAG,EAAE;gBACzB,IAAI,aAAa,CAAC,OAAO,KAAK,UAAU,CAAC,cAAc,EAAE,CAAC;oBACxD,oBAAoB,EAAE,CAAC;gBACzB,CAAC;YACH,CAAC;YACD,iBAAiB,EAAE,CAAC,KAAuB,EAAE,EAAE;gBAC7C,IAAI,aAAa,CAAC,OAAO,KAAK,UAAU,CAAC,cAAc,EAAE,CAAC;oBACxD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;oBACjC,mBAAmB,CACjB,KAAK,YAAY,KAAK;wBACpB,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,gBAAgB,CAAC,CACjD,CAAC;gBACJ,CAAC;YACH,CAAC;SACF,CAAC;QAEF,kDAAkD;QAClD,IACE,UAAU,KAAK,UAAU,CAAC,cAAc;YACxC,WAAW,CAAC,OAAO,CAAC,oBAAoB;YACxC,WAAW,CAAC,OAAO,CAAC,iBAAiB,EACrC,CAAC;YACD,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAC5B,4BAA4B,EAC5B,WAAW,CAAC,OAAO,CAAC,oBAAoB,CACzC,CAAC;YACF,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAC5B,yBAAyB,EACzB,WAAW,CAAC,OAAO,CAAC,iBAAiB,CACtC,CAAC;QACJ,CAAC;QAED,oBAAoB;QACpB,OAAO,GAAG,EAAE;YACV,IAAI,WAAW,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;gBAC7C,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAC7B,4BAA4B,EAC5B,WAAW,CAAC,OAAO,CAAC,oBAAoB,CACzC,CAAC;YACJ,CAAC;YACD,IAAI,WAAW,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;gBAC1C,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAC7B,yBAAyB,EACzB,WAAW,CAAC,OAAO,CAAC,iBAAiB,CACtC,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,UAAU,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAE5D,qDAAqD;IACrD,SAAS,CAAC,GAAG,EAAE;QACb,8EAA8E;QAC9E,IACE,OAAO,EAAE,aAAa;YACtB,aAAa,CAAC,OAAO,KAAK,UAAU,CAAC,aAAa,EAClD,CAAC;YACD,aAAa,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YAExC,mDAAmD;YACnD,IACE,aAAa,CAAC,OAAO,KAAK,UAAU,CAAC,cAAc;gBACnD,gBAAgB,CAAC,OAAO,EACxB,CAAC;gBACD,oBAAoB,EAAE,CAAC;YACzB,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,IAAI,WAAW,KAAK,QAAQ,IAAI,aAAa,EAAE,CAAC;YAC9C,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACxB,IAAI,aAAa,CAAC,OAAO,KAAK,UAAU,CAAC,cAAc,EAAE,CAAC;gBACxD,mBAAmB,CACjB,IAAI,KAAK,CAAC,yBAAyB,CAAC,EACpC,UAAU,CAAC,eAAe,CAC3B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,sDAAsD;QACtD,IACE,CAAC,OAAO,EAAE,aAAa;YACvB,CAAC,CAAC,UAAU,CAAC,cAAc,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,QAAQ,CAC3D,aAAa,CAAC,OAAO,CACtB,EACD,CAAC;YACD,IAAI,aAAa,CAAC,OAAO,KAAK,UAAU,CAAC,eAAe,EAAE,CAAC;gBACzD,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC,EAAE;QACD,WAAW;QACX,aAAa;QACb,OAAO,EAAE,aAAa;QACtB,gBAAgB;QAChB,oBAAoB;QACpB,mBAAmB;QACnB,aAAa;KACd,CAAC,CAAC;IAEH,2BAA2B;IAC3B,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,UAAU,KAAK,UAAU,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;YACrE,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAC1C,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;gBACxB,wBAAwB,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,EAAE;QACD,OAAO;QACP,WAAW;QACX,wBAAwB;QACxB,UAAU;QACV,aAAa;KACd,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,OAAO;QACP,WAAW;QACX,UAAU;QACV,WAAW;KACZ,CAAC;AACJ,CAAC,CAAC;AAEF,OAAO,EAAE,SAAS,EAAE,CAAC","sourcesContent":["import { BrowserAuthenticationInitiator } from \"@/services/AuthenticationService.js\";\nimport { BrowserPublicClientPKCEProducer } from \"@/services/PKCE.js\";\nimport { useCivicAuthConfig } from \"@/shared/hooks/useCivicAuthConfig.js\";\nimport {\n  AuthStatus,\n  type DisplayMode,\n  type LoginAppDesignOptions,\n} from \"@/types.js\";\nimport { useIframe } from \"@/shared/hooks/useIframe.js\";\nimport { useCallback, useEffect, useMemo, useRef } from \"react\";\nimport { PopupError, type PKCEConsumer } from \"@/services/types.js\";\nimport { useSession } from \"./useSession.js\";\nimport { LocalStorageAdapter } from \"@/browser/storage.js\";\nimport { clearTokens, clearUser } from \"../lib/util.js\";\nimport { useLocalStorage } from \"usehooks-ts\";\nimport { LOGOUT_STATE } from \"@/constants.js\";\nimport { useAuthStatus } from \"@/shared/providers/AuthStatusContext.js\";\n\ntype SignInProps = {\n  pkceConsumer?: PKCEConsumer;\n  preSignOut?: () => Promise<void>;\n  postSignOut?: () => Promise<void>;\n  displayMode: DisplayMode;\n};\n\ntype SignInError = Error | { message: string; [key: string]: unknown };\n\ninterface SignInEventDetail {\n  error: SignInError;\n}\n\ninterface SignInErrorEvent {\n  detail: SignInEventDetail;\n}\n\nconst SIGN_IN_TIMEOUT_MS = 9 * 60 * 1000; // 9 minutes in milliseconds\n\n/**\n * Hook to manage authentication flow.\n */\nconst useSignIn = (\n  { pkceConsumer, preSignOut, postSignOut, displayMode }: SignInProps = {\n    displayMode: \"iframe\",\n  },\n) => {\n  // Config and external state\n  const civicAuthConfig = useCivicAuthConfig();\n  const {\n    iframeRef,\n    logoutIframeRef,\n    setIframeIsVisible,\n    setLogoutIframeIsVisible,\n    iframeAborted,\n    setIframeAborted,\n  } = useIframe();\n  const { data: session } = useSession();\n  const { authStatus, setAuthStatus } = useAuthStatus();\n  const [, setDesignOption] = useLocalStorage<LoginAppDesignOptions>(\n    `loginAppDesign`,\n    { colorMode: \"auto\" },\n  );\n\n  // Internal state tracking\n  const timeoutRef = useRef<number | null>(null);\n  const authStatusRef = useRef<AuthStatus>(AuthStatus.UNAUTHENTICATED);\n  const isSigningInRef = useRef<boolean>(false);\n\n  // Promise handling\n  const signInPromiseRef = useRef<Promise<void>>();\n  const signInResolveRef = useRef<\n    ((value: void | PromiseLike<void>) => void) | null\n  >(null);\n  const signInRejectRef = useRef<((reason: Error) => void) | null>(null);\n\n  // Event handlers\n  const handlersRef = useRef<{\n    handleSignInComplete: (() => void) | null;\n    handleSignInError: ((event: SignInErrorEvent) => void) | null;\n  }>({\n    handleSignInComplete: null,\n    handleSignInError: null,\n  });\n\n  // Helper to resolve/reject sign-in promise with cleanup\n  const resolveSignInPromise = useCallback(() => {\n    if (signInResolveRef.current) {\n      setAuthStatus(AuthStatus.AUTHENTICATED);\n      authStatusRef.current = AuthStatus.AUTHENTICATED;\n      isSigningInRef.current = false;\n      signInResolveRef.current();\n\n      // Clean up after resolving\n      signInResolveRef.current = null;\n      signInRejectRef.current = null;\n      signInPromiseRef.current = undefined;\n\n      if (timeoutRef.current !== null) {\n        window.clearTimeout(timeoutRef.current);\n        timeoutRef.current = null;\n      }\n    }\n  }, [setAuthStatus]);\n\n  const rejectSignInPromise = useCallback(\n    (error: Error, newStatus: AuthStatus = AuthStatus.ERROR) => {\n      if (signInRejectRef.current) {\n        signInRejectRef.current(error);\n\n        // Clean up after rejecting\n        signInResolveRef.current = null;\n        signInRejectRef.current = null;\n        signInPromiseRef.current = undefined;\n        isSigningInRef.current = false;\n        setAuthStatus(newStatus);\n\n        if (timeoutRef.current !== null) {\n          window.clearTimeout(timeoutRef.current);\n          timeoutRef.current = null;\n        }\n      }\n    },\n    [setAuthStatus],\n  );\n\n  // Create authentication initiator\n  const authInitiator = useMemo(() => {\n    if (!civicAuthConfig) return null;\n\n    const {\n      clientId,\n      redirectUrl,\n      logoutUrl,\n      loginSuccessUrl,\n      logoutRedirectUrl,\n      nonce,\n      oauthServer,\n      endpoints,\n      scopes,\n    } = civicAuthConfig;\n\n    return new BrowserAuthenticationInitiator(\n      {\n        pkceConsumer: pkceConsumer || new BrowserPublicClientPKCEProducer(),\n        clientId,\n        redirectUrl,\n        loginSuccessUrl,\n        logoutUrl,\n        logoutRedirectUrl,\n        scopes,\n        displayMode,\n        oauthServer,\n        endpointOverrides: endpoints,\n        nonce,\n      },\n      setDesignOption,\n    );\n  }, [civicAuthConfig, displayMode, pkceConsumer, setDesignOption]);\n\n  // Cleanup resources when component unmounts\n  useEffect(() => {\n    return () => {\n      if (authInitiator) {\n        authInitiator.cleanup();\n      }\n      if (timeoutRef.current !== null) {\n        window.clearTimeout(timeoutRef.current);\n        timeoutRef.current = null;\n      }\n    };\n  }, [authInitiator]);\n\n  // Handle logout state cleanup\n  useEffect(() => {\n    const params = new URLSearchParams(window.location.search);\n    const state = params.get(\"state\");\n    const localStorage = new LocalStorageAdapter();\n    localStorage.get(LOGOUT_STATE).then((storedLogoutState) => {\n      if (state && state === storedLogoutState) {\n        // Clear storage\n        clearTokens(localStorage);\n        clearUser(localStorage);\n        LocalStorageAdapter.emitter.emit(\"signOut\");\n\n        // Clean up storage and URL\n        sessionStorage.removeItem(LOGOUT_STATE);\n        const cleanUrl = window.location.href.split(\"?\")[0];\n        window.history.replaceState({}, document.title, cleanUrl);\n      }\n    });\n  }, []);\n\n  // Main sign-in logic\n  const startSignIn = useCallback(async (): Promise<void> => {\n    if (!authInitiator) {\n      return Promise.reject(new Error(\"Auth initiator not available\"));\n    }\n\n    // Check if sign-in is already in progress using the ref\n    if (isSigningInRef.current) {\n      return (\n        signInPromiseRef.current ||\n        Promise.reject(new Error(\"Sign-in already in progress\"))\n      );\n    }\n\n    // State machine for sign-in flow\n    switch (authStatus) {\n      case AuthStatus.AUTHENTICATED:\n        return Promise.resolve();\n\n      case AuthStatus.UNAUTHENTICATED:\n      case AuthStatus.ERROR:\n        break;\n\n      case AuthStatus.AUTHENTICATING:\n        // If we're authenticating but isSigningInRef is false, something went wrong\n        // Reset the state and allow a new sign-in attempt\n        setAuthStatus(AuthStatus.UNAUTHENTICATED);\n        break;\n\n      default:\n        return Promise.reject(\n          new Error(`Invalid state for sign-in: ${authStatus}`),\n        );\n    }\n\n    // Set signing in flag first\n    isSigningInRef.current = true;\n\n    // Clear any existing timeout\n    if (timeoutRef.current !== null) {\n      window.clearTimeout(timeoutRef.current);\n      timeoutRef.current = null;\n    }\n\n    // Create the promise and store its handlers\n    const promise = new Promise<void>((resolve, reject) => {\n      signInResolveRef.current = resolve;\n      signInRejectRef.current = reject;\n    });\n    signInPromiseRef.current = promise;\n\n    try {\n      // Set authenticating status before any async operations\n      setAuthStatus(AuthStatus.AUTHENTICATING);\n      authStatusRef.current = AuthStatus.AUTHENTICATING;\n      authInitiator.setDisplayMode(displayMode);\n\n      // Set a timeout to reject the promise if authentication takes too long\n      timeoutRef.current = window.setTimeout(() => {\n        if (authStatusRef.current === AuthStatus.AUTHENTICATING) {\n          rejectSignInPromise(new Error(\"Sign-in timeout\"));\n        }\n      }, SIGN_IN_TIMEOUT_MS);\n\n      // Start the authentication process\n      const useIframeRef = iframeRef?.current || null;\n\n      await authInitiator.signIn(useIframeRef);\n    } catch (error) {\n      // Reset the signing in flag on error\n      isSigningInRef.current = false;\n\n      if (error instanceof PopupError) {\n        // Fallback to redirect if popup fails\n        setIframeIsVisible(false);\n        authInitiator.cleanup();\n        authInitiator.setDisplayMode(\"redirect\");\n        try {\n          // Call signIn again with redirect mode\n          await authInitiator.signIn(iframeRef?.current || null);\n        } catch (retryError) {\n          console.error(\n            \"[useSignIn] Redirect sign-in initiation error\",\n            retryError,\n          );\n          rejectSignInPromise(\n            retryError instanceof Error\n              ? retryError\n              : new Error(String(retryError)),\n          );\n          return promise;\n        }\n      } else {\n        rejectSignInPromise(\n          error instanceof Error ? error : new Error(String(error)),\n        );\n        return promise;\n      }\n    }\n\n    return promise;\n  }, [\n    authInitiator,\n    displayMode,\n    iframeRef,\n    setIframeIsVisible,\n    authStatus,\n    setAuthStatus,\n    rejectSignInPromise,\n  ]);\n\n  // Public sign-in method\n  const signIn = useCallback(async (): Promise<void> => {\n    if (displayMode === \"iframe\") {\n      setIframeIsVisible(true);\n    }\n    return startSignIn();\n  }, [startSignIn, displayMode, setIframeIsVisible]);\n\n  // Sign-out method\n  const signOut = useCallback(async () => {\n    const idToken = session?.idToken;\n    if (!authInitiator) return;\n\n    setAuthStatus(AuthStatus.SIGNING_OUT);\n    if (displayMode === \"iframe\") {\n      setIframeIsVisible(false);\n      setLogoutIframeIsVisible(true);\n    }\n\n    try {\n      await preSignOut?.();\n\n      const useIframeRef = logoutIframeRef?.current || null;\n      await authInitiator.signOut(idToken, useIframeRef).catch((error) => {\n        setAuthStatus(AuthStatus.ERROR);\n        console.error(\"signOut error\", {\n          error,\n          isPopupError: error instanceof PopupError,\n        });\n\n        if (error instanceof PopupError) {\n          setLogoutIframeIsVisible(false);\n          authInitiator.cleanup();\n          authInitiator.setDisplayMode(\"redirect\");\n          authInitiator.signOut(idToken, useIframeRef); // Retry sign out\n        }\n      });\n    } catch (error) {\n      console.error(\"Signout error:\", error);\n      setAuthStatus(AuthStatus.ERROR);\n    }\n  }, [\n    session?.idToken,\n    authInitiator,\n    displayMode,\n    setLogoutIframeIsVisible,\n    setIframeIsVisible,\n    preSignOut,\n    logoutIframeRef,\n    setAuthStatus,\n  ]);\n\n  // Set up event listeners for authentication status\n  useEffect(() => {\n    // Define handlers\n    handlersRef.current = {\n      handleSignInComplete: () => {\n        if (authStatusRef.current === AuthStatus.AUTHENTICATING) {\n          resolveSignInPromise();\n        }\n      },\n      handleSignInError: (event: SignInErrorEvent) => {\n        if (authStatusRef.current === AuthStatus.AUTHENTICATING) {\n          const error = event.detail.error;\n          rejectSignInPromise(\n            error instanceof Error\n              ? error\n              : new Error(error.message || \"Sign-in failed\"),\n          );\n        }\n      },\n    };\n\n    // Add listeners only when in authenticating state\n    if (\n      authStatus === AuthStatus.AUTHENTICATING &&\n      handlersRef.current.handleSignInComplete &&\n      handlersRef.current.handleSignInError\n    ) {\n      LocalStorageAdapter.emitter.on(\n        \"civic-auth-signin-complete\",\n        handlersRef.current.handleSignInComplete,\n      );\n      LocalStorageAdapter.emitter.on(\n        \"civic-auth-signin-error\",\n        handlersRef.current.handleSignInError,\n      );\n    }\n\n    // Cleanup listeners\n    return () => {\n      if (handlersRef.current.handleSignInComplete) {\n        LocalStorageAdapter.emitter.off(\n          \"civic-auth-signin-complete\",\n          handlersRef.current.handleSignInComplete,\n        );\n      }\n      if (handlersRef.current.handleSignInError) {\n        LocalStorageAdapter.emitter.off(\n          \"civic-auth-signin-error\",\n          handlersRef.current.handleSignInError,\n        );\n      }\n    };\n  }, [authStatus, resolveSignInPromise, rejectSignInPromise]);\n\n  // Effect to handle session updates and iframe aborts\n  useEffect(() => {\n    // If session becomes authenticated, update state and resolve pending promises\n    if (\n      session?.authenticated &&\n      authStatusRef.current !== AuthStatus.AUTHENTICATED\n    ) {\n      setAuthStatus(AuthStatus.AUTHENTICATED);\n\n      // If we have a pending sign-in promise, resolve it\n      if (\n        authStatusRef.current === AuthStatus.AUTHENTICATING &&\n        signInResolveRef.current\n      ) {\n        resolveSignInPromise();\n      }\n    }\n\n    // Handle iframe abortion\n    if (displayMode === \"iframe\" && iframeAborted) {\n      setIframeAborted(false);\n      if (authStatusRef.current === AuthStatus.AUTHENTICATING) {\n        rejectSignInPromise(\n          new Error(\"Sign-in aborted by user\"),\n          AuthStatus.UNAUTHENTICATED,\n        );\n      }\n    }\n\n    // Update unauthenticated state when session is absent\n    if (\n      !session?.authenticated &&\n      ![AuthStatus.AUTHENTICATING, AuthStatus.SIGNING_OUT].includes(\n        authStatusRef.current,\n      )\n    ) {\n      if (authStatusRef.current !== AuthStatus.UNAUTHENTICATED) {\n        setAuthStatus(AuthStatus.UNAUTHENTICATED);\n      }\n    }\n  }, [\n    displayMode,\n    iframeAborted,\n    session?.authenticated,\n    setIframeAborted,\n    resolveSignInPromise,\n    rejectSignInPromise,\n    setAuthStatus,\n  ]);\n\n  // Handle logout completion\n  useEffect(() => {\n    if (authStatus === AuthStatus.SIGNING_OUT && !session?.authenticated) {\n      setAuthStatus(AuthStatus.UNAUTHENTICATED);\n      postSignOut?.().then(() => {\n        setLogoutIframeIsVisible(false);\n      });\n    }\n  }, [\n    session,\n    postSignOut,\n    setLogoutIframeIsVisible,\n    authStatus,\n    setAuthStatus,\n  ]);\n\n  return {\n    signIn,\n    signOut,\n    startSignIn,\n    authStatus,\n    displayMode,\n  };\n};\n\nexport { useSignIn };\n"]}
+{"version":3,"file":"useSignIn.js","sourceRoot":"","sources":["../../../src/shared/hooks/useSignIn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AACrF,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EACL,UAAU,GAGX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAChE,OAAO,EAAE,UAAU,EAAqB,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAmBxE,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,4BAA4B;AAEtE;;GAEG;AACH,MAAM,SAAS,GAAG,CAChB,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,KAAkB;IACpE,WAAW,EAAE,QAAQ;CACtB,EACD,EAAE;IACF,4BAA4B;IAC5B,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,MAAM,EACJ,SAAS,EACT,eAAe,EACf,kBAAkB,EAClB,wBAAwB,EACxB,aAAa,EACb,gBAAgB,GACjB,GAAG,SAAS,EAAE,CAAC;IAChB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,UAAU,EAAE,CAAC;IACvC,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,aAAa,EAAE,CAAC;IACtD,MAAM,CAAC,EAAE,eAAe,CAAC,GAAG,eAAe,CACzC,gBAAgB,EAChB,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;IAEF,0BAA0B;IAC1B,MAAM,UAAU,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,MAAM,CAAa,UAAU,CAAC,eAAe,CAAC,CAAC;IACrE,MAAM,cAAc,GAAG,MAAM,CAAU,KAAK,CAAC,CAAC;IAE9C,mBAAmB;IACnB,MAAM,gBAAgB,GAAG,MAAM,EAAiB,CAAC;IACjD,MAAM,gBAAgB,GAAG,MAAM,CAE7B,IAAI,CAAC,CAAC;IACR,MAAM,eAAe,GAAG,MAAM,CAAmC,IAAI,CAAC,CAAC;IAEvE,iBAAiB;IACjB,MAAM,WAAW,GAAG,MAAM,CAGvB;QACD,oBAAoB,EAAE,IAAI;QAC1B,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;IAEH,wDAAwD;IACxD,MAAM,oBAAoB,GAAG,WAAW,CAAC,GAAG,EAAE;QAC5C,IAAI,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC7B,aAAa,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YACxC,aAAa,CAAC,OAAO,GAAG,UAAU,CAAC,aAAa,CAAC;YACjD,cAAc,CAAC,OAAO,GAAG,KAAK,CAAC;YAC/B,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAE3B,2BAA2B;YAC3B,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;YAChC,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;YAC/B,gBAAgB,CAAC,OAAO,GAAG,SAAS,CAAC;YAErC,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAChC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACxC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;IAEpB,MAAM,mBAAmB,GAAG,WAAW,CACrC,CAAC,KAAY,EAAE,YAAwB,UAAU,CAAC,KAAK,EAAE,EAAE;QACzD,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;YAC5B,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAE/B,2BAA2B;YAC3B,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;YAChC,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;YAC/B,gBAAgB,CAAC,OAAO,GAAG,SAAS,CAAC;YACrC,cAAc,CAAC,OAAO,GAAG,KAAK,CAAC;YAC/B,aAAa,CAAC,SAAS,CAAC,CAAC;YAEzB,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAChC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACxC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC,EACD,CAAC,aAAa,CAAC,CAChB,CAAC;IAEF,kCAAkC;IAClC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,EAAE;QACjC,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QAElC,MAAM,EACJ,QAAQ,EACR,WAAW,EACX,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,KAAK,EACL,WAAW,EACX,SAAS,EACT,MAAM,GACP,GAAG,eAAe,CAAC;QAEpB,OAAO,IAAI,8BAA8B,CACvC;YACE,YAAY,EAAE,YAAY,IAAI,IAAI,+BAA+B,EAAE;YACnE,QAAQ;YACR,WAAW;YACX,eAAe;YACf,SAAS;YACT,iBAAiB;YACjB,MAAM;YACN,WAAW;YACX,WAAW;YACX,iBAAiB,EAAE,SAAS;YAC5B,KAAK;SACN,EACD,eAAe,CAChB,CAAC;IACJ,CAAC,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC;IAElE,4CAA4C;IAC5C,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,GAAG,EAAE;YACV,IAAI,aAAa,EAAE,CAAC;gBAClB,aAAa,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC;YACD,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAChC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;gBACxC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;IAEpB,8BAA8B;IAC9B,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,YAAY,GAAG,IAAI,mBAAmB,EAAE,CAAC;QAC/C,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,EAAE;YACxD,IAAI,KAAK,IAAI,KAAK,KAAK,iBAAiB,EAAE,CAAC;gBACzC,gBAAgB;gBAChB,WAAW,CAAC,YAAY,CAAC,CAAC;gBAC1B,SAAS,CAAC,YAAY,CAAC,CAAC;gBACxB,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAE5C,2BAA2B;gBAC3B,cAAc,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;gBACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpD,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,qBAAqB;IACrB,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,IAAmB,EAAE;QACxD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;QACnE,CAAC;QAED,4CAA4C;QAC5C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpD,gBAAgB,CAAC,OAAO,GAAG,OAAO,CAAC;YACnC,eAAe,CAAC,OAAO,GAAG,MAAM,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,gBAAgB,CAAC,OAAO,GAAG,OAAO,CAAC;QAEnC,sFAAsF;QACtF,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,iCAAiC;QACjC,QAAQ,UAAU,EAAE,CAAC;YACnB,KAAK,UAAU,CAAC,aAAa;gBAC3B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;YAE3B,KAAK,UAAU,CAAC,eAAe,CAAC;YAChC,KAAK,UAAU,CAAC,KAAK;gBACnB,MAAM;YAER,KAAK,UAAU,CAAC,cAAc;gBAC5B,+DAA+D;gBAC/D,OAAO,OAAO,CAAC;YAEjB;gBACE,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,8BAA8B,UAAU,EAAE,CAAC,CACtD,CAAC;QACN,CAAC;QAED,4BAA4B;QAC5B,cAAc,CAAC,OAAO,GAAG,IAAI,CAAC;QAE9B,6BAA6B;QAC7B,IAAI,UAAU,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACxC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC;YACH,wDAAwD;YACxD,aAAa,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YACzC,aAAa,CAAC,OAAO,GAAG,UAAU,CAAC,cAAc,CAAC;YAClD,aAAa,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YAE1C,uEAAuE;YACvE,UAAU,CAAC,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE;gBAC1C,IAAI,aAAa,CAAC,OAAO,KAAK,UAAU,CAAC,cAAc,EAAE,CAAC;oBACxD,mBAAmB,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC,EAAE,kBAAkB,CAAC,CAAC;YAEvB,mCAAmC;YACnC,MAAM,YAAY,GAAG,SAAS,EAAE,OAAO,IAAI,IAAI,CAAC;YAEhD,MAAM,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qCAAqC;YACrC,cAAc,CAAC,OAAO,GAAG,KAAK,CAAC;YAE/B,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;gBAChC,sCAAsC;gBACtC,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBAC1B,aAAa,CAAC,OAAO,EAAE,CAAC;gBACxB,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;gBACzC,IAAI,CAAC;oBACH,uCAAuC;oBACvC,MAAM,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC;gBACzD,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,OAAO,CAAC,KAAK,CACX,+CAA+C,EAC/C,UAAU,CACX,CAAC;oBACF,mBAAmB,CACjB,UAAU,YAAY,KAAK;wBACzB,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAClC,CAAC;oBACF,OAAO,OAAO,CAAC;gBACjB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,mBAAmB,CACjB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;gBACF,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE;QACD,aAAa;QACb,WAAW;QACX,SAAS;QACT,kBAAkB;QAClB,UAAU;QACV,aAAa;QACb,mBAAmB;KACpB,CAAC,CAAC;IAEH,wBAAwB;IACxB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,IAAmB,EAAE;QACnD,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC7B,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAEnD,kBAAkB;IAClB,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,CAAC;QACjC,IAAI,CAAC,aAAa;YAAE,OAAO;QAE3B,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACtC,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC7B,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1B,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,EAAE,EAAE,CAAC;YAErB,MAAM,YAAY,GAAG,eAAe,EAAE,OAAO,IAAI,IAAI,CAAC;YACtD,MAAM,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACjE,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBAChC,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE;oBAC7B,KAAK;oBACL,YAAY,EAAE,KAAK,YAAY,UAAU;iBAC1C,CAAC,CAAC;gBAEH,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;oBAChC,wBAAwB,CAAC,KAAK,CAAC,CAAC;oBAChC,aAAa,CAAC,OAAO,EAAE,CAAC;oBACxB,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;oBACzC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,iBAAiB;gBACjE,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YACvC,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,EAAE;QACD,OAAO,EAAE,OAAO;QAChB,aAAa;QACb,WAAW;QACX,wBAAwB;QACxB,kBAAkB;QAClB,UAAU;QACV,eAAe;QACf,aAAa;KACd,CAAC,CAAC;IAEH,mDAAmD;IACnD,SAAS,CAAC,GAAG,EAAE;QACb,kBAAkB;QAClB,WAAW,CAAC,OAAO,GAAG;YACpB,oBAAoB,EAAE,GAAG,EAAE;gBACzB,IAAI,aAAa,CAAC,OAAO,KAAK,UAAU,CAAC,cAAc,EAAE,CAAC;oBACxD,oBAAoB,EAAE,CAAC;gBACzB,CAAC;YACH,CAAC;YACD,iBAAiB,EAAE,CAAC,KAAuB,EAAE,EAAE;gBAC7C,IAAI,aAAa,CAAC,OAAO,KAAK,UAAU,CAAC,cAAc,EAAE,CAAC;oBACxD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;oBACjC,mBAAmB,CACjB,KAAK,YAAY,KAAK;wBACpB,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,gBAAgB,CAAC,CACjD,CAAC;gBACJ,CAAC;YACH,CAAC;SACF,CAAC;QAEF,kDAAkD;QAClD,IACE,UAAU,KAAK,UAAU,CAAC,cAAc;YACxC,WAAW,CAAC,OAAO,CAAC,oBAAoB;YACxC,WAAW,CAAC,OAAO,CAAC,iBAAiB,EACrC,CAAC;YACD,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAC5B,4BAA4B,EAC5B,WAAW,CAAC,OAAO,CAAC,oBAAoB,CACzC,CAAC;YACF,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAC5B,yBAAyB,EACzB,WAAW,CAAC,OAAO,CAAC,iBAAiB,CACtC,CAAC;QACJ,CAAC;QAED,oBAAoB;QACpB,OAAO,GAAG,EAAE;YACV,IAAI,WAAW,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC;gBAC7C,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAC7B,4BAA4B,EAC5B,WAAW,CAAC,OAAO,CAAC,oBAAoB,CACzC,CAAC;YACJ,CAAC;YACD,IAAI,WAAW,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC;gBAC1C,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAC7B,yBAAyB,EACzB,WAAW,CAAC,OAAO,CAAC,iBAAiB,CACtC,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,UAAU,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAE5D,qDAAqD;IACrD,SAAS,CAAC,GAAG,EAAE;QACb,8EAA8E;QAC9E,IACE,OAAO,EAAE,aAAa;YACtB,aAAa,CAAC,OAAO,KAAK,UAAU,CAAC,aAAa,EAClD,CAAC;YACD,aAAa,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YAExC,mDAAmD;YACnD,IACE,aAAa,CAAC,OAAO,KAAK,UAAU,CAAC,cAAc;gBACnD,gBAAgB,CAAC,OAAO,EACxB,CAAC;gBACD,oBAAoB,EAAE,CAAC;YACzB,CAAC;QACH,CAAC;QAED,yBAAyB;QACzB,IAAI,WAAW,KAAK,QAAQ,IAAI,aAAa,EAAE,CAAC;YAC9C,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACxB,IAAI,aAAa,CAAC,OAAO,KAAK,UAAU,CAAC,cAAc,EAAE,CAAC;gBACxD,mBAAmB,CACjB,IAAI,KAAK,CAAC,yBAAyB,CAAC,EACpC,UAAU,CAAC,eAAe,CAC3B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,sDAAsD;QACtD,IACE,CAAC,OAAO,EAAE,aAAa;YACvB,CAAC,CAAC,UAAU,CAAC,cAAc,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,QAAQ,CAC3D,aAAa,CAAC,OAAO,CACtB,EACD,CAAC;YACD,IAAI,aAAa,CAAC,OAAO,KAAK,UAAU,CAAC,eAAe,EAAE,CAAC;gBACzD,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC,EAAE;QACD,WAAW;QACX,aAAa;QACb,OAAO,EAAE,aAAa;QACtB,gBAAgB;QAChB,oBAAoB;QACpB,mBAAmB;QACnB,aAAa;KACd,CAAC,CAAC;IAEH,2BAA2B;IAC3B,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,UAAU,KAAK,UAAU,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;YACrE,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YAC1C,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;gBACxB,wBAAwB,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,EAAE;QACD,OAAO;QACP,WAAW;QACX,wBAAwB;QACxB,UAAU;QACV,aAAa;KACd,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,OAAO;QACP,WAAW;QACX,UAAU;QACV,WAAW;KACZ,CAAC;AACJ,CAAC,CAAC;AAEF,OAAO,EAAE,SAAS,EAAE,CAAC","sourcesContent":["import { BrowserAuthenticationInitiator } from \"@/services/AuthenticationService.js\";\nimport { BrowserPublicClientPKCEProducer } from \"@/services/PKCE.js\";\nimport { useCivicAuthConfig } from \"@/shared/hooks/useCivicAuthConfig.js\";\nimport {\n  AuthStatus,\n  type DisplayMode,\n  type LoginAppDesignOptions,\n} from \"@/types.js\";\nimport { useIframe } from \"@/shared/hooks/useIframe.js\";\nimport { useCallback, useEffect, useMemo, useRef } from \"react\";\nimport { PopupError, type PKCEConsumer } from \"@/services/types.js\";\nimport { useSession } from \"./useSession.js\";\nimport { LocalStorageAdapter } from \"@/browser/storage.js\";\nimport { clearTokens, clearUser } from \"../lib/util.js\";\nimport { useLocalStorage } from \"usehooks-ts\";\nimport { LOGOUT_STATE } from \"@/constants.js\";\nimport { useAuthStatus } from \"@/shared/providers/AuthStatusContext.js\";\n\ntype SignInProps = {\n  pkceConsumer?: PKCEConsumer;\n  preSignOut?: () => Promise<void>;\n  postSignOut?: () => Promise<void>;\n  displayMode: DisplayMode;\n};\n\ntype SignInError = Error | { message: string; [key: string]: unknown };\n\ninterface SignInEventDetail {\n  error: SignInError;\n}\n\ninterface SignInErrorEvent {\n  detail: SignInEventDetail;\n}\n\nconst SIGN_IN_TIMEOUT_MS = 9 * 60 * 1000; // 9 minutes in milliseconds\n\n/**\n * Hook to manage authentication flow.\n */\nconst useSignIn = (\n  { pkceConsumer, preSignOut, postSignOut, displayMode }: SignInProps = {\n    displayMode: \"iframe\",\n  },\n) => {\n  // Config and external state\n  const civicAuthConfig = useCivicAuthConfig();\n  const {\n    iframeRef,\n    logoutIframeRef,\n    setIframeIsVisible,\n    setLogoutIframeIsVisible,\n    iframeAborted,\n    setIframeAborted,\n  } = useIframe();\n  const { data: session } = useSession();\n  const { authStatus, setAuthStatus } = useAuthStatus();\n  const [, setDesignOption] = useLocalStorage<LoginAppDesignOptions>(\n    `loginAppDesign`,\n    { colorMode: \"auto\" },\n  );\n\n  // Internal state tracking\n  const timeoutRef = useRef<number | null>(null);\n  const authStatusRef = useRef<AuthStatus>(AuthStatus.UNAUTHENTICATED);\n  const isSigningInRef = useRef<boolean>(false);\n\n  // Promise handling\n  const signInPromiseRef = useRef<Promise<void>>();\n  const signInResolveRef = useRef<\n    ((value: void | PromiseLike<void>) => void) | null\n  >(null);\n  const signInRejectRef = useRef<((reason: Error) => void) | null>(null);\n\n  // Event handlers\n  const handlersRef = useRef<{\n    handleSignInComplete: (() => void) | null;\n    handleSignInError: ((event: SignInErrorEvent) => void) | null;\n  }>({\n    handleSignInComplete: null,\n    handleSignInError: null,\n  });\n\n  // Helper to resolve/reject sign-in promise with cleanup\n  const resolveSignInPromise = useCallback(() => {\n    if (signInResolveRef.current) {\n      setAuthStatus(AuthStatus.AUTHENTICATED);\n      authStatusRef.current = AuthStatus.AUTHENTICATED;\n      isSigningInRef.current = false;\n      signInResolveRef.current();\n\n      // Clean up after resolving\n      signInResolveRef.current = null;\n      signInRejectRef.current = null;\n      signInPromiseRef.current = undefined;\n\n      if (timeoutRef.current !== null) {\n        window.clearTimeout(timeoutRef.current);\n        timeoutRef.current = null;\n      }\n    }\n  }, [setAuthStatus]);\n\n  const rejectSignInPromise = useCallback(\n    (error: Error, newStatus: AuthStatus = AuthStatus.ERROR) => {\n      if (signInRejectRef.current) {\n        signInRejectRef.current(error);\n\n        // Clean up after rejecting\n        signInResolveRef.current = null;\n        signInRejectRef.current = null;\n        signInPromiseRef.current = undefined;\n        isSigningInRef.current = false;\n        setAuthStatus(newStatus);\n\n        if (timeoutRef.current !== null) {\n          window.clearTimeout(timeoutRef.current);\n          timeoutRef.current = null;\n        }\n      }\n    },\n    [setAuthStatus],\n  );\n\n  // Create authentication initiator\n  const authInitiator = useMemo(() => {\n    if (!civicAuthConfig) return null;\n\n    const {\n      clientId,\n      redirectUrl,\n      logoutUrl,\n      loginSuccessUrl,\n      logoutRedirectUrl,\n      nonce,\n      oauthServer,\n      endpoints,\n      scopes,\n    } = civicAuthConfig;\n\n    return new BrowserAuthenticationInitiator(\n      {\n        pkceConsumer: pkceConsumer || new BrowserPublicClientPKCEProducer(),\n        clientId,\n        redirectUrl,\n        loginSuccessUrl,\n        logoutUrl,\n        logoutRedirectUrl,\n        scopes,\n        displayMode,\n        oauthServer,\n        endpointOverrides: endpoints,\n        nonce,\n      },\n      setDesignOption,\n    );\n  }, [civicAuthConfig, displayMode, pkceConsumer, setDesignOption]);\n\n  // Cleanup resources when component unmounts\n  useEffect(() => {\n    return () => {\n      if (authInitiator) {\n        authInitiator.cleanup();\n      }\n      if (timeoutRef.current !== null) {\n        window.clearTimeout(timeoutRef.current);\n        timeoutRef.current = null;\n      }\n    };\n  }, [authInitiator]);\n\n  // Handle logout state cleanup\n  useEffect(() => {\n    const params = new URLSearchParams(window.location.search);\n    const state = params.get(\"state\");\n    const localStorage = new LocalStorageAdapter();\n    localStorage.get(LOGOUT_STATE).then((storedLogoutState) => {\n      if (state && state === storedLogoutState) {\n        // Clear storage\n        clearTokens(localStorage);\n        clearUser(localStorage);\n        LocalStorageAdapter.emitter.emit(\"signOut\");\n\n        // Clean up storage and URL\n        sessionStorage.removeItem(LOGOUT_STATE);\n        const cleanUrl = window.location.href.split(\"?\")[0];\n        window.history.replaceState({}, document.title, cleanUrl);\n      }\n    });\n  }, []);\n\n  // Main sign-in logic\n  const startSignIn = useCallback(async (): Promise<void> => {\n    if (!authInitiator) {\n      return Promise.reject(new Error(\"Auth initiator not available\"));\n    }\n\n    // Create the promise and store its handlers\n    const promise = new Promise<void>((resolve, reject) => {\n      signInResolveRef.current = resolve;\n      signInRejectRef.current = reject;\n    });\n    signInPromiseRef.current = promise;\n\n    // Check if sign-in is already in progress using the ref, if so, return signIn promise\n    if (isSigningInRef.current) {\n      return promise;\n    }\n\n    // State machine for sign-in flow\n    switch (authStatus) {\n      case AuthStatus.AUTHENTICATED:\n        return Promise.resolve();\n\n      case AuthStatus.UNAUTHENTICATED:\n      case AuthStatus.ERROR:\n        break;\n\n      case AuthStatus.AUTHENTICATING:\n        // if we're already authenticating, return the existing promise\n        return promise;\n\n      default:\n        return Promise.reject(\n          new Error(`Invalid state for sign-in: ${authStatus}`),\n        );\n    }\n\n    // Set signing in flag first\n    isSigningInRef.current = true;\n\n    // Clear any existing timeout\n    if (timeoutRef.current !== null) {\n      window.clearTimeout(timeoutRef.current);\n      timeoutRef.current = null;\n    }\n\n    try {\n      // Set authenticating status before any async operations\n      setAuthStatus(AuthStatus.AUTHENTICATING);\n      authStatusRef.current = AuthStatus.AUTHENTICATING;\n      authInitiator.setDisplayMode(displayMode);\n\n      // Set a timeout to reject the promise if authentication takes too long\n      timeoutRef.current = window.setTimeout(() => {\n        if (authStatusRef.current === AuthStatus.AUTHENTICATING) {\n          rejectSignInPromise(new Error(\"Sign-in timeout\"));\n        }\n      }, SIGN_IN_TIMEOUT_MS);\n\n      // Start the authentication process\n      const useIframeRef = iframeRef?.current || null;\n\n      await authInitiator.signIn(useIframeRef);\n    } catch (error) {\n      // Reset the signing in flag on error\n      isSigningInRef.current = false;\n\n      if (error instanceof PopupError) {\n        // Fallback to redirect if popup fails\n        setIframeIsVisible(false);\n        authInitiator.cleanup();\n        authInitiator.setDisplayMode(\"redirect\");\n        try {\n          // Call signIn again with redirect mode\n          await authInitiator.signIn(iframeRef?.current || null);\n        } catch (retryError) {\n          console.error(\n            \"[useSignIn] Redirect sign-in initiation error\",\n            retryError,\n          );\n          rejectSignInPromise(\n            retryError instanceof Error\n              ? retryError\n              : new Error(String(retryError)),\n          );\n          return promise;\n        }\n      } else {\n        rejectSignInPromise(\n          error instanceof Error ? error : new Error(String(error)),\n        );\n        return promise;\n      }\n    }\n\n    return promise;\n  }, [\n    authInitiator,\n    displayMode,\n    iframeRef,\n    setIframeIsVisible,\n    authStatus,\n    setAuthStatus,\n    rejectSignInPromise,\n  ]);\n\n  // Public sign-in method\n  const signIn = useCallback(async (): Promise<void> => {\n    if (displayMode === \"iframe\") {\n      setIframeIsVisible(true);\n    }\n    return startSignIn();\n  }, [startSignIn, displayMode, setIframeIsVisible]);\n\n  // Sign-out method\n  const signOut = useCallback(async () => {\n    const idToken = session?.idToken;\n    if (!authInitiator) return;\n\n    setAuthStatus(AuthStatus.SIGNING_OUT);\n    if (displayMode === \"iframe\") {\n      setIframeIsVisible(false);\n      setLogoutIframeIsVisible(true);\n    }\n\n    try {\n      await preSignOut?.();\n\n      const useIframeRef = logoutIframeRef?.current || null;\n      await authInitiator.signOut(idToken, useIframeRef).catch((error) => {\n        setAuthStatus(AuthStatus.ERROR);\n        console.error(\"signOut error\", {\n          error,\n          isPopupError: error instanceof PopupError,\n        });\n\n        if (error instanceof PopupError) {\n          setLogoutIframeIsVisible(false);\n          authInitiator.cleanup();\n          authInitiator.setDisplayMode(\"redirect\");\n          authInitiator.signOut(idToken, useIframeRef); // Retry sign out\n        }\n      });\n    } catch (error) {\n      console.error(\"Signout error:\", error);\n      setAuthStatus(AuthStatus.ERROR);\n    }\n  }, [\n    session?.idToken,\n    authInitiator,\n    displayMode,\n    setLogoutIframeIsVisible,\n    setIframeIsVisible,\n    preSignOut,\n    logoutIframeRef,\n    setAuthStatus,\n  ]);\n\n  // Set up event listeners for authentication status\n  useEffect(() => {\n    // Define handlers\n    handlersRef.current = {\n      handleSignInComplete: () => {\n        if (authStatusRef.current === AuthStatus.AUTHENTICATING) {\n          resolveSignInPromise();\n        }\n      },\n      handleSignInError: (event: SignInErrorEvent) => {\n        if (authStatusRef.current === AuthStatus.AUTHENTICATING) {\n          const error = event.detail.error;\n          rejectSignInPromise(\n            error instanceof Error\n              ? error\n              : new Error(error.message || \"Sign-in failed\"),\n          );\n        }\n      },\n    };\n\n    // Add listeners only when in authenticating state\n    if (\n      authStatus === AuthStatus.AUTHENTICATING &&\n      handlersRef.current.handleSignInComplete &&\n      handlersRef.current.handleSignInError\n    ) {\n      LocalStorageAdapter.emitter.on(\n        \"civic-auth-signin-complete\",\n        handlersRef.current.handleSignInComplete,\n      );\n      LocalStorageAdapter.emitter.on(\n        \"civic-auth-signin-error\",\n        handlersRef.current.handleSignInError,\n      );\n    }\n\n    // Cleanup listeners\n    return () => {\n      if (handlersRef.current.handleSignInComplete) {\n        LocalStorageAdapter.emitter.off(\n          \"civic-auth-signin-complete\",\n          handlersRef.current.handleSignInComplete,\n        );\n      }\n      if (handlersRef.current.handleSignInError) {\n        LocalStorageAdapter.emitter.off(\n          \"civic-auth-signin-error\",\n          handlersRef.current.handleSignInError,\n        );\n      }\n    };\n  }, [authStatus, resolveSignInPromise, rejectSignInPromise]);\n\n  // Effect to handle session updates and iframe aborts\n  useEffect(() => {\n    // If session becomes authenticated, update state and resolve pending promises\n    if (\n      session?.authenticated &&\n      authStatusRef.current !== AuthStatus.AUTHENTICATED\n    ) {\n      setAuthStatus(AuthStatus.AUTHENTICATED);\n\n      // If we have a pending sign-in promise, resolve it\n      if (\n        authStatusRef.current === AuthStatus.AUTHENTICATING &&\n        signInResolveRef.current\n      ) {\n        resolveSignInPromise();\n      }\n    }\n\n    // Handle iframe abortion\n    if (displayMode === \"iframe\" && iframeAborted) {\n      setIframeAborted(false);\n      if (authStatusRef.current === AuthStatus.AUTHENTICATING) {\n        rejectSignInPromise(\n          new Error(\"Sign-in aborted by user\"),\n          AuthStatus.UNAUTHENTICATED,\n        );\n      }\n    }\n\n    // Update unauthenticated state when session is absent\n    if (\n      !session?.authenticated &&\n      ![AuthStatus.AUTHENTICATING, AuthStatus.SIGNING_OUT].includes(\n        authStatusRef.current,\n      )\n    ) {\n      if (authStatusRef.current !== AuthStatus.UNAUTHENTICATED) {\n        setAuthStatus(AuthStatus.UNAUTHENTICATED);\n      }\n    }\n  }, [\n    displayMode,\n    iframeAborted,\n    session?.authenticated,\n    setIframeAborted,\n    resolveSignInPromise,\n    rejectSignInPromise,\n    setAuthStatus,\n  ]);\n\n  // Handle logout completion\n  useEffect(() => {\n    if (authStatus === AuthStatus.SIGNING_OUT && !session?.authenticated) {\n      setAuthStatus(AuthStatus.UNAUTHENTICATED);\n      postSignOut?.().then(() => {\n        setLogoutIframeIsVisible(false);\n      });\n    }\n  }, [\n    session,\n    postSignOut,\n    setLogoutIframeIsVisible,\n    authStatus,\n    setAuthStatus,\n  ]);\n\n  return {\n    signIn,\n    signOut,\n    startSignIn,\n    authStatus,\n    displayMode,\n  };\n};\n\nexport { useSignIn };\n"]}

package/dist/shared/lib/AuthenticationRefresherImpl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationRefresherImpl.d.ts","sourceRoot":"","sources":["../../../src/shared/lib/AuthenticationRefresherImpl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAQrD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEhF,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAErF,qBAAa,2BAA4B,SAAQ,8BAA8B;IAO3E,SAAS,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC;IANlD,OAAO,CAAC,SAAS,CAAwB;IACzC,OAAO,CAAC,YAAY,CAA2B;gBAE7C,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,EAC9B,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,YAAA;IAQ5C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;WAmBd,KAAK,CAChB,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,EACxC,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,GACrC,OAAO,CAAC,2BAA2B,CAAC;IAYjC,WAAW,CAAC,iBAAiB,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAKpE,kBAAkB,IAAI,OAAO,CAAC,qBAAqB,CAAC;CA4C3D"}
+{"version":3,"file":"AuthenticationRefresherImpl.d.ts","sourceRoot":"","sources":["../../../src/shared/lib/AuthenticationRefresherImpl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAQrD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEhF,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAErF,qBAAa,2BAA4B,SAAQ,8BAA8B;IAO3E,SAAS,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC;IANlD,OAAO,CAAC,SAAS,CAAwB;IACzC,OAAO,CAAC,YAAY,CAA2B;gBAE7C,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,EAC9B,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,YAAA;IAQ5C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;WAmBd,KAAK,CAChB,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,EACxC,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,GACrC,OAAO,CAAC,2BAA2B,CAAC;IAYjC,WAAW,CAAC,iBAAiB,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC;IAKpE,kBAAkB,IAAI,OAAO,CAAC,qBAAqB,CAAC;CA8C3D"}

package/dist/shared/lib/AuthenticationRefresherImpl.js

@@ -45,7 +45,9 @@ export class AuthenticationRefresherImpl extends GenericAuthenticationRefresher
             }
             const oauth2Client = this.oauth2client;
             try {
-                const tokenResponseBody = await oauth2Client.refreshAccessToken(refreshToken);
+                const tokenResponseBody = (await oauth2Client.refreshAccessToken(refreshToken));
+                // Validate the refreshed tokens - ID token is the primary token
+                // Access token validation is now optional
                 await validateOauth2Tokens(tokenResponseBody, this.endpoints.jwks, oauth2Client, this.oauthServer);
                 await this.storeTokens(tokenResponseBody);
                 return tokenResponseBody;

package/dist/shared/lib/AuthenticationRefresherImpl.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthenticationRefresherImpl.js","sourceRoot":"","sources":["../../../src/shared/lib/AuthenticationRefresherImpl.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,SAAS,EACT,yBAAyB,EACzB,WAAW,EACX,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAErF,MAAM,OAAO,2BAA4B,SAAQ,8BAA8B;IAOjE;IANJ,SAAS,CAAwB;IACjC,YAAY,CAA2B;IAC/C,YACE,UAAsB,EACtB,OAAoB,EACpB,OAAwC,EAC9B,iBAAsC;QAEhD,KAAK,CAAC,OAAO,CAAC,CAAC;QAFL,sBAAiB,GAAjB,iBAAiB,CAAqB;QAGhD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAClE,uBAAuB;QACvB,IAAI,CAAC,SAAS,GAAG,MAAM,yBAAyB,CAC9C,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,iBAAiB,CACvB,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,IAAI,CAAC,UAAU,CAAC,QAAQ,EACxB,IAAI,CAAC,SAAS,CAAC,IAAI,EACnB,IAAI,CAAC,SAAS,CAAC,KAAK,EACpB;YACE,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW;SACzC,CACF,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,KAAK,CAChB,UAAsB,EACtB,OAAoB,EACpB,OAAwC,EACxC,iBAAsC;QAEtC,MAAM,SAAS,GAAG,IAAI,2BAA2B,CAC/C,UAAU,EACV,OAAO,EACP,OAAO,EACP,iBAAiB,CAClB,CAAC;QACF,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QAEvB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,iBAAwC;QACxD,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC3D,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,kBAAkB;QACtB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAE3D,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YACpB,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAa,CAAC;YAExC,IAAI,CAAC;gBACH,MAAM,iBAAiB,GACrB,MAAM,YAAY,CAAC,kBAAkB,CACnC,YAAY,CACb,CAAC;gBACJ,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,IAAI,CAAC,SAAS,CAAC,IAAI,EACnB,YAAY,EACZ,IAAI,CAAC,WAAW,CACjB,CAAC;gBAEF,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;gBAC1C,OAAO,iBAAiB,CAAC;YAC3B,CAAC;YAAC,OAAO,iBAAiB,EAAE,CAAC;gBAC3B,OAAO,CAAC,KAAK,CACX,6CAA6C,EAC7C,iBAAiB,CAClB,CAAC;gBACF,MAAM,IAAI,KAAK,CACb,yBAA0B,iBAA2B,CAAC,OAAO,EAAE,CAChE,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC1C,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF","sourcesContent":["import type { AuthConfig } from \"@/server/config.js\";\nimport {\n  clearTokens,\n  clearUser,\n  getEndpointsWithOverrides,\n  storeTokens,\n  validateOauth2Tokens,\n} from \"@/shared/lib/util.js\";\nimport type { AuthStorage, Endpoints, OIDCTokenResponseBody } from \"@/types.js\";\nimport { OAuth2Client } from \"oslo/oauth2\";\nimport { GenericAuthenticationRefresher } from \"./GenericAuthenticationRefresher.js\";\n\nexport class AuthenticationRefresherImpl extends GenericAuthenticationRefresher {\n  private endpoints: Endpoints | undefined;\n  private oauth2client: OAuth2Client | undefined;\n  constructor(\n    authConfig: AuthConfig,\n    storage: AuthStorage,\n    onError: (error: Error) => Promise<void>,\n    protected endpointOverrides?: Partial<Endpoints>,\n  ) {\n    super(onError);\n    this.authConfig = authConfig;\n    this.storage = storage;\n    this.init();\n  }\n\n  async init(): Promise<this> {\n    if (!this.authConfig) throw new Error(\"No auth config available\");\n    // resolve oauth config\n    this.endpoints = await getEndpointsWithOverrides(\n      this.oauthServer,\n      this.endpointOverrides,\n    );\n    this.oauth2client = new OAuth2Client(\n      this.authConfig.clientId,\n      this.endpoints.auth,\n      this.endpoints.token,\n      {\n        redirectURI: this.authConfig.redirectUrl,\n      },\n    );\n\n    return this;\n  }\n\n  static async build(\n    authConfig: AuthConfig,\n    storage: AuthStorage,\n    onError: (error: Error) => Promise<void>,\n    endpointOverrides?: Partial<Endpoints>,\n  ): Promise<AuthenticationRefresherImpl> {\n    const refresher = new AuthenticationRefresherImpl(\n      authConfig,\n      storage,\n      onError,\n      endpointOverrides,\n    );\n    await refresher.init();\n\n    return refresher;\n  }\n\n  async storeTokens(tokenResponseBody: OIDCTokenResponseBody): Promise<void> {\n    if (!this.storage) throw new Error(\"No storage available\");\n    await storeTokens(this.storage, tokenResponseBody);\n  }\n\n  async refreshAccessToken(): Promise<OIDCTokenResponseBody> {\n    if (!this.storage) throw new Error(\"No storage available\");\n\n    try {\n      const refreshToken = await this.getRefreshToken();\n      if (!this.oauth2client) {\n        await this.init();\n      }\n\n      if (!this.endpoints?.jwks) {\n        throw new Error(\"No jwks endpoint\");\n      }\n      const oauth2Client = this.oauth2client!;\n\n      try {\n        const tokenResponseBody =\n          await oauth2Client.refreshAccessToken<OIDCTokenResponseBody>(\n            refreshToken,\n          );\n        await validateOauth2Tokens(\n          tokenResponseBody,\n          this.endpoints.jwks,\n          oauth2Client,\n          this.oauthServer,\n        );\n\n        await this.storeTokens(tokenResponseBody);\n        return tokenResponseBody;\n      } catch (tokenRequestError) {\n        console.error(\n          \"Error during refresh token network request:\",\n          tokenRequestError,\n        );\n        throw new Error(\n          `Token refresh failed: ${(tokenRequestError as Error).message}`,\n        );\n      }\n    } catch (error) {\n      console.warn(\"refreshAccessToken failed\");\n      await clearTokens(this.storage);\n      await clearUser(this.storage);\n      throw error;\n    }\n  }\n}\n"]}
+{"version":3,"file":"AuthenticationRefresherImpl.js","sourceRoot":"","sources":["../../../src/shared/lib/AuthenticationRefresherImpl.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,EACX,SAAS,EACT,yBAAyB,EACzB,WAAW,EACX,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAErF,MAAM,OAAO,2BAA4B,SAAQ,8BAA8B;IAOjE;IANJ,SAAS,CAAwB;IACjC,YAAY,CAA2B;IAC/C,YACE,UAAsB,EACtB,OAAoB,EACpB,OAAwC,EAC9B,iBAAsC;QAEhD,KAAK,CAAC,OAAO,CAAC,CAAC;QAFL,sBAAiB,GAAjB,iBAAiB,CAAqB;QAGhD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAClE,uBAAuB;QACvB,IAAI,CAAC,SAAS,GAAG,MAAM,yBAAyB,CAC9C,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,iBAAiB,CACvB,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,IAAI,CAAC,UAAU,CAAC,QAAQ,EACxB,IAAI,CAAC,SAAS,CAAC,IAAI,EACnB,IAAI,CAAC,SAAS,CAAC,KAAK,EACpB;YACE,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW;SACzC,CACF,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,KAAK,CAChB,UAAsB,EACtB,OAAoB,EACpB,OAAwC,EACxC,iBAAsC;QAEtC,MAAM,SAAS,GAAG,IAAI,2BAA2B,CAC/C,UAAU,EACV,OAAO,EACP,OAAO,EACP,iBAAiB,CAClB,CAAC;QACF,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QAEvB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,iBAAwC;QACxD,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC3D,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,kBAAkB;QACtB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAE3D,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YACpB,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAa,CAAC;YAExC,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,CAAC,MAAM,YAAY,CAAC,kBAAkB,CAC9D,YAAY,CACb,CAA0B,CAAC;gBAE5B,gEAAgE;gBAChE,0CAA0C;gBAC1C,MAAM,oBAAoB,CACxB,iBAAiB,EACjB,IAAI,CAAC,SAAS,CAAC,IAAI,EACnB,YAAY,EACZ,IAAI,CAAC,WAAW,CACjB,CAAC;gBAEF,MAAM,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC;gBAC1C,OAAO,iBAAiB,CAAC;YAC3B,CAAC;YAAC,OAAO,iBAAiB,EAAE,CAAC;gBAC3B,OAAO,CAAC,KAAK,CACX,6CAA6C,EAC7C,iBAAiB,CAClB,CAAC;gBACF,MAAM,IAAI,KAAK,CACb,yBAA0B,iBAA2B,CAAC,OAAO,EAAE,CAChE,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC1C,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF","sourcesContent":["import type { AuthConfig } from \"@/server/config.js\";\nimport {\n  clearTokens,\n  clearUser,\n  getEndpointsWithOverrides,\n  storeTokens,\n  validateOauth2Tokens,\n} from \"@/shared/lib/util.js\";\nimport type { AuthStorage, Endpoints, OIDCTokenResponseBody } from \"@/types.js\";\nimport { OAuth2Client } from \"oslo/oauth2\";\nimport { GenericAuthenticationRefresher } from \"./GenericAuthenticationRefresher.js\";\n\nexport class AuthenticationRefresherImpl extends GenericAuthenticationRefresher {\n  private endpoints: Endpoints | undefined;\n  private oauth2client: OAuth2Client | undefined;\n  constructor(\n    authConfig: AuthConfig,\n    storage: AuthStorage,\n    onError: (error: Error) => Promise<void>,\n    protected endpointOverrides?: Partial<Endpoints>,\n  ) {\n    super(onError);\n    this.authConfig = authConfig;\n    this.storage = storage;\n    this.init();\n  }\n\n  async init(): Promise<this> {\n    if (!this.authConfig) throw new Error(\"No auth config available\");\n    // resolve oauth config\n    this.endpoints = await getEndpointsWithOverrides(\n      this.oauthServer,\n      this.endpointOverrides,\n    );\n    this.oauth2client = new OAuth2Client(\n      this.authConfig.clientId,\n      this.endpoints.auth,\n      this.endpoints.token,\n      {\n        redirectURI: this.authConfig.redirectUrl,\n      },\n    );\n\n    return this;\n  }\n\n  static async build(\n    authConfig: AuthConfig,\n    storage: AuthStorage,\n    onError: (error: Error) => Promise<void>,\n    endpointOverrides?: Partial<Endpoints>,\n  ): Promise<AuthenticationRefresherImpl> {\n    const refresher = new AuthenticationRefresherImpl(\n      authConfig,\n      storage,\n      onError,\n      endpointOverrides,\n    );\n    await refresher.init();\n\n    return refresher;\n  }\n\n  async storeTokens(tokenResponseBody: OIDCTokenResponseBody): Promise<void> {\n    if (!this.storage) throw new Error(\"No storage available\");\n    await storeTokens(this.storage, tokenResponseBody);\n  }\n\n  async refreshAccessToken(): Promise<OIDCTokenResponseBody> {\n    if (!this.storage) throw new Error(\"No storage available\");\n\n    try {\n      const refreshToken = await this.getRefreshToken();\n      if (!this.oauth2client) {\n        await this.init();\n      }\n\n      if (!this.endpoints?.jwks) {\n        throw new Error(\"No jwks endpoint\");\n      }\n      const oauth2Client = this.oauth2client!;\n\n      try {\n        const tokenResponseBody = (await oauth2Client.refreshAccessToken(\n          refreshToken,\n        )) as OIDCTokenResponseBody;\n\n        // Validate the refreshed tokens - ID token is the primary token\n        // Access token validation is now optional\n        await validateOauth2Tokens(\n          tokenResponseBody,\n          this.endpoints.jwks,\n          oauth2Client,\n          this.oauthServer,\n        );\n\n        await this.storeTokens(tokenResponseBody);\n        return tokenResponseBody;\n      } catch (tokenRequestError) {\n        console.error(\n          \"Error during refresh token network request:\",\n          tokenRequestError,\n        );\n        throw new Error(\n          `Token refresh failed: ${(tokenRequestError as Error).message}`,\n        );\n      }\n    } catch (error) {\n      console.warn(\"refreshAccessToken failed\");\n      await clearTokens(this.storage);\n      await clearUser(this.storage);\n      throw error;\n    }\n  }\n}\n"]}

package/dist/shared/lib/BrowserAuthenticationRefresher.d.ts

@@ -4,7 +4,7 @@ import type { AuthConfig } from "../../server/config.js";
 export declare class BrowserAuthenticationRefresher extends AuthenticationRefresherImpl {
     static build(authConfig: AuthConfig, storage: AuthStorage, onError: (error: Error) => Promise<void>, endpointOverrides?: Partial<Endpoints>): Promise<BrowserAuthenticationRefresher>;
     protected handleError(error: Error): void;
-    protected handleRefresh(): Promise<void>;
+    protected handleAutoRefresh(): Promise<void>;
     setupAutorefresh(): Promise<void>;
     clearAutorefresh(): void;
 }

package/dist/shared/lib/BrowserAuthenticationRefresher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BrowserAuthenticationRefresher.d.ts","sourceRoot":"","sources":["../../../src/shared/lib/BrowserAuthenticationRefresher.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,qBAAa,8BAA+B,SAAQ,2BAA2B;WACvD,KAAK,CACzB,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,EACxC,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,GACrC,OAAO,CAAC,8BAA8B,CAAC;IAY1C,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK;cAMlB,aAAa;IAkBvB,gBAAgB;IAuBtB,gBAAgB;CASjB"}
+{"version":3,"file":"BrowserAuthenticationRefresher.d.ts","sourceRoot":"","sources":["../../../src/shared/lib/BrowserAuthenticationRefresher.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGrD,qBAAa,8BAA+B,SAAQ,2BAA2B;WACvD,KAAK,CACzB,UAAU,EAAE,UAAU,EACtB,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,EACxC,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,GACrC,OAAO,CAAC,8BAA8B,CAAC;IAY1C,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK;cAMlB,iBAAiB;IA0B3B,gBAAgB;IAuBtB,gBAAgB;CASjB"}

package/dist/shared/lib/BrowserAuthenticationRefresher.js

@@ -1,6 +1,7 @@
 import { AUTOREFRESH_TIMEOUT_NAME, REFRESH_IN_PROGRESS } from "../../constants.js";
 import { retrieveAccessTokenExpiresAt } from "../../shared/lib/util.js";
 import { AuthenticationRefresherImpl } from "./AuthenticationRefresherImpl.js";
+import { UserStorage } from "./types.js";
 export class BrowserAuthenticationRefresher extends AuthenticationRefresherImpl {
     static async build(authConfig, storage, onError, endpointOverrides) {
         const refresher = new BrowserAuthenticationRefresher(authConfig, storage, onError, endpointOverrides);
@@ -12,8 +13,14 @@ export class BrowserAuthenticationRefresher extends AuthenticationRefresherImpl
         this.clearAutorefresh();
         this.onError(error);
     }
-    async handleRefresh() {
+    async handleAutoRefresh() {
         try {
+            const existingUser = await this.storage?.get(UserStorage.USER);
+            if (!existingUser) {
+                console.warn("BrowserAuthenticationRefresher: No user found, skipping refresh");
+                this.clearAutorefresh();
+                return;
+            }
             // ensure only one refresh is in progress
             if (localStorage.getItem(REFRESH_IN_PROGRESS) !== "true") {
                 localStorage.setItem(REFRESH_IN_PROGRESS, "true");
@@ -41,7 +48,7 @@ export class BrowserAuthenticationRefresher extends AuthenticationRefresherImpl
         const bufferTime = 30; // 30 seconds
         const refreshTime = Math.max(0, expiresAt - bufferTime - now); // handle case were token has expired in the past
         const refreshTimeout = setTimeout(() => {
-            this.handleRefresh();
+            this.handleAutoRefresh();
         }, 1000 * refreshTime);
         localStorage.setItem(AUTOREFRESH_TIMEOUT_NAME, refreshTimeout.toString());
     }

package/dist/shared/lib/BrowserAuthenticationRefresher.js.map

@@ -1 +1 @@
-{"version":3,"file":"BrowserAuthenticationRefresher.js","sourceRoot":"","sources":["../../../src/shared/lib/BrowserAuthenticationRefresher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAI/E,MAAM,OAAO,8BAA+B,SAAQ,2BAA2B;IAC7E,MAAM,CAAU,KAAK,CAAC,KAAK,CACzB,UAAsB,EACtB,OAAoB,EACpB,OAAwC,EACxC,iBAAsC;QAEtC,MAAM,SAAS,GAAG,IAAI,8BAA8B,CAClD,UAAU,EACV,OAAO,EACP,OAAO,EACP,iBAAiB,CAClB,CAAC;QACF,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QAEvB,OAAO,SAAS,CAAC;IACnB,CAAC;IAES,WAAW,CAAC,KAAY;QAChC,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAES,KAAK,CAAC,aAAa;QAC3B,IAAI,CAAC;YACH,yCAAyC;YACzC,IAAI,YAAY,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,MAAM,EAAE,CAAC;gBACzD,YAAY,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,6CAA6C;YAC9E,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,2DAA2D,EAC3D,KAAK,CACN,CAAC;YACF,kEAAkE;YAClE,IAAI,CAAC,WAAW,CAAC,KAAc,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,2BAA2B;QAC3B,YAAY,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;QAE7C,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC3D,6BAA6B;QAC7B,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAExB,iBAAiB;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GACb,CAAC,MAAM,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;QAEjE,8DAA8D;QAC9D,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,aAAa;QACpC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,iDAAiD;QAEhH,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;YACrC,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,CAAC,EAAE,IAAI,GAAG,WAAW,CAAC,CAAC;QACvB,YAAY,CAAC,OAAO,CAAC,wBAAwB,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,gBAAgB;QACd,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QACvE,IAAI,eAAe,EAAE,CAAC;YACpB,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;YACtC,YAAY,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;CACF","sourcesContent":["import { AUTOREFRESH_TIMEOUT_NAME, REFRESH_IN_PROGRESS } from \"@/constants.js\";\nimport { retrieveAccessTokenExpiresAt } from \"@/shared/lib/util.js\";\nimport { AuthenticationRefresherImpl } from \"./AuthenticationRefresherImpl.js\";\nimport type { AuthStorage, Endpoints } from \"@/types.js\";\nimport type { AuthConfig } from \"@/server/config.js\";\n\nexport class BrowserAuthenticationRefresher extends AuthenticationRefresherImpl {\n  static override async build(\n    authConfig: AuthConfig,\n    storage: AuthStorage,\n    onError: (error: Error) => Promise<void>,\n    endpointOverrides?: Partial<Endpoints>,\n  ): Promise<BrowserAuthenticationRefresher> {\n    const refresher = new BrowserAuthenticationRefresher(\n      authConfig,\n      storage,\n      onError,\n      endpointOverrides,\n    );\n    await refresher.init();\n\n    return refresher;\n  }\n\n  protected handleError(error: Error) {\n    console.error(\"BrowserAuthenticationRefresher: Error\", error);\n    this.clearAutorefresh();\n    this.onError(error);\n  }\n\n  protected async handleRefresh() {\n    try {\n      // ensure only one refresh is in progress\n      if (localStorage.getItem(REFRESH_IN_PROGRESS) !== \"true\") {\n        localStorage.setItem(REFRESH_IN_PROGRESS, \"true\");\n        await this.refreshTokens();\n        await this.setupAutorefresh(); // Reset the timeout after successful refresh\n      }\n    } catch (error) {\n      console.error(\n        \"BrowserAuthenticationRefresher: Failed to refresh tokens:\",\n        error,\n      );\n      // TODO detect if refresh token has expired and if yes then logout\n      this.handleError(error as Error);\n    }\n  }\n\n  async setupAutorefresh() {\n    // clear any existing state\n    localStorage.removeItem(REFRESH_IN_PROGRESS);\n\n    if (!this.storage) throw new Error(\"No storage available\");\n    // Clear any existing timeout\n    this.clearAutorefresh();\n\n    // get expires_in\n    const now = Math.floor(Date.now() / 1000);\n    const expiresAt =\n      (await retrieveAccessTokenExpiresAt(this.storage)) || now + 60;\n\n    // Calculate time until expiry (subtract 30 seconds as buffer)\n    const bufferTime = 30; // 30 seconds\n    const refreshTime = Math.max(0, expiresAt - bufferTime - now); // handle case were token has expired in the past\n\n    const refreshTimeout = setTimeout(() => {\n      this.handleRefresh();\n    }, 1000 * refreshTime);\n    localStorage.setItem(AUTOREFRESH_TIMEOUT_NAME, refreshTimeout.toString());\n  }\n\n  clearAutorefresh() {\n    // use local storage to store the timeout id so that if multiple instances\n    // of the refresher are created they can all clear the same timeout\n    const existingTimeout = localStorage.getItem(AUTOREFRESH_TIMEOUT_NAME);\n    if (existingTimeout) {\n      clearTimeout(Number(existingTimeout));\n      localStorage.removeItem(AUTOREFRESH_TIMEOUT_NAME);\n    }\n  }\n}\n"]}
+{"version":3,"file":"BrowserAuthenticationRefresher.js","sourceRoot":"","sources":["../../../src/shared/lib/BrowserAuthenticationRefresher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAG/E,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,OAAO,8BAA+B,SAAQ,2BAA2B;IAC7E,MAAM,CAAU,KAAK,CAAC,KAAK,CACzB,UAAsB,EACtB,OAAoB,EACpB,OAAwC,EACxC,iBAAsC;QAEtC,MAAM,SAAS,GAAG,IAAI,8BAA8B,CAClD,UAAU,EACV,OAAO,EACP,OAAO,EACP,iBAAiB,CAClB,CAAC;QACF,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QAEvB,OAAO,SAAS,CAAC;IACnB,CAAC;IAES,WAAW,CAAC,KAAY;QAChC,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAES,KAAK,CAAC,iBAAiB;QAC/B,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAC/D,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,CAAC,IAAI,CACV,iEAAiE,CAClE,CAAC;gBACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,yCAAyC;YACzC,IAAI,YAAY,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,MAAM,EAAE,CAAC;gBACzD,YAAY,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC3B,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,6CAA6C;YAC9E,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,2DAA2D,EAC3D,KAAK,CACN,CAAC;YACF,kEAAkE;YAClE,IAAI,CAAC,WAAW,CAAC,KAAc,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,2BAA2B;QAC3B,YAAY,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;QAE7C,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC3D,6BAA6B;QAC7B,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAExB,iBAAiB;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,SAAS,GACb,CAAC,MAAM,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;QAEjE,8DAA8D;QAC9D,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,aAAa;QACpC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,iDAAiD;QAEhH,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;YACrC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,CAAC,EAAE,IAAI,GAAG,WAAW,CAAC,CAAC;QACvB,YAAY,CAAC,OAAO,CAAC,wBAAwB,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,gBAAgB;QACd,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,eAAe,GAAG,YAAY,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QACvE,IAAI,eAAe,EAAE,CAAC;YACpB,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;YACtC,YAAY,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;CACF","sourcesContent":["import { AUTOREFRESH_TIMEOUT_NAME, REFRESH_IN_PROGRESS } from \"@/constants.js\";\nimport { retrieveAccessTokenExpiresAt } from \"@/shared/lib/util.js\";\nimport { AuthenticationRefresherImpl } from \"./AuthenticationRefresherImpl.js\";\nimport type { AuthStorage, Endpoints } from \"@/types.js\";\nimport type { AuthConfig } from \"@/server/config.js\";\nimport { UserStorage } from \"./types.js\";\n\nexport class BrowserAuthenticationRefresher extends AuthenticationRefresherImpl {\n  static override async build(\n    authConfig: AuthConfig,\n    storage: AuthStorage,\n    onError: (error: Error) => Promise<void>,\n    endpointOverrides?: Partial<Endpoints>,\n  ): Promise<BrowserAuthenticationRefresher> {\n    const refresher = new BrowserAuthenticationRefresher(\n      authConfig,\n      storage,\n      onError,\n      endpointOverrides,\n    );\n    await refresher.init();\n\n    return refresher;\n  }\n\n  protected handleError(error: Error) {\n    console.error(\"BrowserAuthenticationRefresher: Error\", error);\n    this.clearAutorefresh();\n    this.onError(error);\n  }\n\n  protected async handleAutoRefresh() {\n    try {\n      const existingUser = await this.storage?.get(UserStorage.USER);\n      if (!existingUser) {\n        console.warn(\n          \"BrowserAuthenticationRefresher: No user found, skipping refresh\",\n        );\n        this.clearAutorefresh();\n        return;\n      }\n      // ensure only one refresh is in progress\n      if (localStorage.getItem(REFRESH_IN_PROGRESS) !== \"true\") {\n        localStorage.setItem(REFRESH_IN_PROGRESS, \"true\");\n        await this.refreshTokens();\n        await this.setupAutorefresh(); // Reset the timeout after successful refresh\n      }\n    } catch (error) {\n      console.error(\n        \"BrowserAuthenticationRefresher: Failed to refresh tokens:\",\n        error,\n      );\n      // TODO detect if refresh token has expired and if yes then logout\n      this.handleError(error as Error);\n    }\n  }\n\n  async setupAutorefresh() {\n    // clear any existing state\n    localStorage.removeItem(REFRESH_IN_PROGRESS);\n\n    if (!this.storage) throw new Error(\"No storage available\");\n    // Clear any existing timeout\n    this.clearAutorefresh();\n\n    // get expires_in\n    const now = Math.floor(Date.now() / 1000);\n    const expiresAt =\n      (await retrieveAccessTokenExpiresAt(this.storage)) || now + 60;\n\n    // Calculate time until expiry (subtract 30 seconds as buffer)\n    const bufferTime = 30; // 30 seconds\n    const refreshTime = Math.max(0, expiresAt - bufferTime - now); // handle case were token has expired in the past\n\n    const refreshTimeout = setTimeout(() => {\n      this.handleAutoRefresh();\n    }, 1000 * refreshTime);\n    localStorage.setItem(AUTOREFRESH_TIMEOUT_NAME, refreshTimeout.toString());\n  }\n\n  clearAutorefresh() {\n    // use local storage to store the timeout id so that if multiple instances\n    // of the refresher are created they can all clear the same timeout\n    const existingTimeout = localStorage.getItem(AUTOREFRESH_TIMEOUT_NAME);\n    if (existingTimeout) {\n      clearTimeout(Number(existingTimeout));\n      localStorage.removeItem(AUTOREFRESH_TIMEOUT_NAME);\n    }\n  }\n}\n"]}

package/dist/shared/lib/util.d.ts

@@ -38,7 +38,7 @@ export declare function exchangeTokens(code: string, state: string, pkceProducer
  */
 export declare const getCookiesMaxAge: (tokens: OIDCTokenResponseBody) => {
     accessTokenMaxAge: number;
-    refreshTokenMaxAge: number;
+    refreshTokenMaxAge: undefined | number;
 };
 export declare const getAccessTokenExpiresAt: (tokens: OIDCTokenResponseBody) => number;
 export declare function setAccessTokenExpiresAt(storage: AuthStorage | CookieStorage, tokens: OIDCTokenResponseBody): Promise<void>;
@@ -46,6 +46,7 @@ export declare function storeTokens(storage: AuthStorage, tokens: OIDCTokenRespo
 /**
  * Stores tokens in server-side cookies with appropriate expiration times
  * Uses TTL values from the tokens to set cookie maxAge values
+ * Refresh token is set with no expiry (session cookie)
  */
 export declare function storeServerTokens(storage: AuthStorage | CookieStorage, tokens: OIDCTokenResponseBody): Promise<void>;
 export declare function clearTokens(storage: AuthStorage): Promise<void>;

package/dist/shared/lib/util.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../../../src/shared/lib/util.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,WAAW,EACX,SAAS,EACT,qBAAqB,EACrB,YAAY,EACb,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAI3C,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AASlD;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,YAAY,EAAE,MAAM,EACpB,MAAM,GAAE,OAAO,GAAG,MAAe,GAChC,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,MAAM,EACnB,iBAAiB,GAAE,OAAO,CAAC,SAAS,CAAM,GACzC,OAAO,CAAC,SAAS,CAAC,CAMpB;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAEvC,YAAY,EAAE,YAAY,CAAC;CAC5B,GAAG,OAAO,CAAC,GAAG,CAAC,CA2Bf;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;CACxC,GAAG,OAAO,CAAC,GAAG,CAAC,CAcf;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,SAAS,GACnB,YAAY,CAId;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,YAAY,EAC1B,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,SAAS,kCAyBrB;AACD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,WACnB,qBAAqB,KAC5B;IAAE,iBAAiB,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAiBzD,CAAC;AACF,eAAO,MAAM,uBAAuB,WAC1B,qBAAqB,KAC5B,MAUF,CAAC;AACF,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,WAAW,GAAG,aAAa,EACpC,MAAM,EAAE,qBAAqB,iBAQ9B;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,qBAAqB,iBAQ9B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,WAAW,GAAG,aAAa,EACpC,MAAM,EAAE,qBAAqB,iBAsD9B;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,iBAWrD;AAED,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,WAAW,iBAGhE;AAED,wBAAsB,SAAS,CAAC,OAAO,EAAE,WAAW,iBAGnD;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,GAAG,IAAI,CAAC,CAiBhD;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,CAEjB;AAMD,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,qBAAqB,EAC7B,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,YAAY,CAAC,CA+BvB"}
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../../../src/shared/lib/util.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,WAAW,EACX,SAAS,EACT,qBAAqB,EACrB,YAAY,EACb,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAI3C,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AASlD;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,YAAY,EAAE,MAAM,EACpB,MAAM,GAAE,OAAO,GAAG,MAAe,GAChC,OAAO,CAAC,MAAM,CAAC,CAajB;AAED,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,MAAM,EACnB,iBAAiB,GAAE,OAAO,CAAC,SAAS,CAAM,GACzC,OAAO,CAAC,SAAS,CAAC,CAMpB;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAEvC,YAAY,EAAE,YAAY,CAAC;CAC5B,GAAG,OAAO,CAAC,GAAG,CAAC,CA2Bf;AAED,wBAAsB,sBAAsB,CAAC,MAAM,EAAE;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;CACxC,GAAG,OAAO,CAAC,GAAG,CAAC,CAcf;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,SAAS,GACnB,YAAY,CAId;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,YAAY,EAC1B,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,SAAS,kCAwBrB;AACD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,WACnB,qBAAqB,KAC5B;IAAE,iBAAiB,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,SAAS,GAAG,MAAM,CAAA;CA+BrE,CAAC;AACF,eAAO,MAAM,uBAAuB,WAC1B,qBAAqB,KAC5B,MA2BF,CAAC;AACF,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,WAAW,GAAG,aAAa,EACpC,MAAM,EAAE,qBAAqB,iBAQ9B;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,qBAAqB,iBAkB9B;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,WAAW,GAAG,aAAa,EACpC,MAAM,EAAE,qBAAqB,iBA0D9B;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,iBAWrD;AAED,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,WAAW,iBAGhE;AAED,wBAAsB,SAAS,CAAC,OAAO,EAAE,WAAW,iBAGnD;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,GAAG,IAAI,CAAC,CAiBhD;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,CAEjB;AAMD,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,qBAAqB,EAC7B,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,YAAY,CAAC,CAmCvB"}

package/dist/shared/lib/util.js

@@ -69,9 +69,9 @@ export async function exchangeTokens(code, state, pkceProducer, oauth2Client, oa
     const codeVerifier = await pkceProducer.getCodeVerifier();
     if (!codeVerifier)
         throw new Error("Code verifier not found in state");
-    const tokens = await oauth2Client.validateAuthorizationCode(code, {
+    const tokens = (await oauth2Client.validateAuthorizationCode(code, {
         codeVerifier,
-    });
+    }));
     // Validate relevant tokens
     try {
         await validateOauth2Tokens(tokens, endpoints.jwks, oauth2Client, oauthServer);
@@ -92,31 +92,58 @@ export async function exchangeTokens(code, state, pkceProducer, oauth2Client, oa
  * @returns Object with accessTokenMaxAge and refreshTokenMaxAge in seconds
  */
 export const getCookiesMaxAge = (tokens) => {
-    const parsedAccessToken = decodeJwt(tokens.access_token);
-    // Get TTL values from the token or use defaults
-    const accessTokenTTL = Number(parsedAccessToken?.accessTokenTTL) || 60 * 60; // 1 hour default
-    const refreshTokenTTL = Number(parsedAccessToken?.refreshTokenTTL) || 60 * 60 * 24 * 30; // 30 days default
-    // Calculate maxAge as TTL values directly (they represent seconds from now)
-    // This is correct because TTL values represent the lifetime of the token
+    let accessTokenTTL = 60 * 60; // 1 hour default
+    // Get access token TTL from the token if it exists
+    if (tokens.access_token) {
+        const parsedAccessToken = decodeJwt(tokens.access_token);
+        accessTokenTTL =
+            Number(parsedAccessToken?.accessTokenTTL) || accessTokenTTL;
+        // If access token has exp claim, use that directly
+        if (parsedAccessToken?.exp) {
+            const now = Math.floor(Date.now() / 1000);
+            accessTokenTTL = parsedAccessToken.exp - now;
+        }
+    }
+    else if (tokens.id_token) {
+        // If no access token exists, try to get expiration from ID token
+        const parsedIdToken = decodeJwt(tokens.id_token);
+        if (parsedIdToken?.exp) {
+            const now = Math.floor(Date.now() / 1000);
+            accessTokenTTL = parsedIdToken.exp - now;
+        }
+    }
+    // Calculate maxAge for access token, but set refresh token to undefined (no expiry)
     const accessTokenMaxAge = accessTokenTTL;
-    const refreshTokenMaxAge = refreshTokenTTL;
+    const refreshTokenMaxAge = undefined; // This makes the cookie not expire
     return {
         accessTokenMaxAge,
         refreshTokenMaxAge,
     };
 };
 export const getAccessTokenExpiresAt = (tokens) => {
-    const parsedAccessToken = decodeJwt(tokens.access_token);
-    if (parsedAccessToken?.exp || false) {
-        return parsedAccessToken.exp;
+    // If we have an access token, try to get exp from it
+    if (tokens.access_token) {
+        const parsedAccessToken = decodeJwt(tokens.access_token);
+        if (parsedAccessToken?.exp || false) {
+            return parsedAccessToken.exp;
+        }
     }
-    else if (tokens.expires_in) {
+    // If we have expires_in field, use it
+    if (tokens.expires_in) {
         const now = Math.floor(new Date().getTime() / 1000);
         return now + tokens.expires_in;
     }
-    else {
-        throw new Error("Cannot determine access token expiry!");
+    // If we have an ID token, use its exp as fallback
+    // This is now a primary source when no access token is present
+    if (tokens.id_token) {
+        const parsedIdToken = decodeJwt(tokens.id_token);
+        if (parsedIdToken?.exp) {
+            return parsedIdToken.exp;
+        }
     }
+    // Default to 1 hour from now if we can't determine expiry
+    const now = Math.floor(new Date().getTime() / 1000);
+    return now + 60 * 60; // 1 hour
 };
 export async function setAccessTokenExpiresAt(storage, tokens) {
     // try to extract absolute expiry time from access token but fallback to calculation if not possible
@@ -124,49 +151,61 @@ export async function setAccessTokenExpiresAt(storage, tokens) {
     await storage.set(OAuthTokenTypes.ACCESS_TOKEN_EXPIRES_AT, accessTokenExpiresAt.toString());
 }
 export async function storeTokens(storage, tokens) {
+    // ID token is the primary token and must always be stored
     await storage.set(OAuthTokenTypes.ID_TOKEN, tokens.id_token);
-    await storage.set(OAuthTokenTypes.ACCESS_TOKEN, tokens.access_token);
+    // Only store access token if it exists (no longer required)
+    if (tokens.access_token) {
+        await storage.set(OAuthTokenTypes.ACCESS_TOKEN, tokens.access_token);
+    }
+    // Store refresh token if it exists
     if (tokens.refresh_token) {
         await storage.set(OAuthTokenTypes.REFRESH_TOKEN, tokens.refresh_token);
     }
+    // Still set access token expiration even if no access token
+    // (will get expiration from ID token in this case)
     await setAccessTokenExpiresAt(storage, tokens);
 }
 /**
  * Stores tokens in server-side cookies with appropriate expiration times
  * Uses TTL values from the tokens to set cookie maxAge values
+ * Refresh token is set with no expiry (session cookie)
  */
 export async function storeServerTokens(storage, tokens) {
     const accessTokenExpiresAt = getAccessTokenExpiresAt(tokens);
     const cookieStorage = storage;
     const now = Math.floor(Date.now() / 1000);
-    // Get maxAge values based on token TTLs
+    // Get maxAge values based on token TTLs (refresh token will be undefined)
     const { refreshTokenMaxAge, accessTokenMaxAge } = getCookiesMaxAge(tokens);
     // Apply maxAge to cookie options
     const accessTokenCookieOptions = {
         maxAge: accessTokenMaxAge,
     };
     const refreshTokenCookieOptions = {
-        maxAge: refreshTokenMaxAge,
+        maxAge: refreshTokenMaxAge, // This will be undefined, making it a session cookie
     };
     // Set ID token with expiry based on the exp claim
     const idTokenExpiry = decodeJwt(tokens.id_token)?.exp;
     const idTokenMaxAge = idTokenExpiry ? idTokenExpiry - now : accessTokenMaxAge;
+    // ID token is always stored (primary authentication token)
     await cookieStorage.set(OAuthTokenTypes.ID_TOKEN, tokens.id_token, {
         maxAge: idTokenMaxAge,
     });
-    // Set access token
-    await cookieStorage.set(OAuthTokenTypes.ACCESS_TOKEN, tokens.access_token, accessTokenCookieOptions);
-    // Set refresh token if present
+    // Access token is optional - only set if it exists
+    if (tokens.access_token) {
+        await cookieStorage.set(OAuthTokenTypes.ACCESS_TOKEN, tokens.access_token, accessTokenCookieOptions);
+    }
+    // Set refresh token if present as a session cookie (no expiry)
     if (tokens.refresh_token) {
         await cookieStorage.set(OAuthTokenTypes.REFRESH_TOKEN, tokens.refresh_token, refreshTokenCookieOptions);
     }
-    // Store the access token expiration timestamp
+    // Still store the access token expiration timestamp even if no access token
     await storage.set(OAuthTokenTypes.ACCESS_TOKEN_EXPIRES_AT, accessTokenExpiresAt.toString(), accessTokenCookieOptions);
     logger.debug("storeServerTokens", {
         accessTokenExpiresAt,
-        refreshTokenMaxAge,
+        refreshTokenMaxAge: "undefined (session cookie)",
         accessTokenMaxAge,
         idTokenMaxAge,
+        hasAccessToken: !!tokens.access_token,
     });
 }
 export async function clearTokens(storage) {
@@ -215,19 +254,23 @@ export async function validateOauth2Tokens(tokens, jwksEndpoint, oauth2Client, i
         cachedJWKS = jose.createRemoteJWKSet(new URL(jwksEndpoint));
         cachedJwksUrl = jwksEndpoint;
     }
-    // validate the ID token
+    // Validate the ID token - this is now the primary token for authentication
     const idTokenResponse = await jose.jwtVerify(tokens.id_token, cachedJWKS, {
         issuer: getIssuerVariations(issuer),
         audience: oauth2Client.clientId,
     });
-    // validate the access token
-    const accessTokenResponse = await jose.jwtVerify(tokens.access_token, cachedJWKS, {
-        issuer: getIssuerVariations(issuer),
-    });
+    // Only validate the access token if it exists, but if present it must be valid
+    let accessTokenPayload;
+    if (tokens.access_token) {
+        const accessTokenResponse = await jose.jwtVerify(tokens.access_token, cachedJWKS, {
+            issuer: getIssuerVariations(issuer),
+        });
+        accessTokenPayload = accessTokenResponse.payload;
+    }
     return withoutUndefined({
         id_token: idTokenResponse.payload,
-        access_token: accessTokenResponse.payload,
-        refresh_token: tokens.refresh_token,
+        access_token: accessTokenPayload,
+        ...(tokens?.refresh_token ? { refresh_token: tokens.refresh_token } : {}),
     });
 }
 //# sourceMappingURL=util.js.map