@civic/auth 0.8.2 → 0.9.0-beta.1

package/dist/vanillajs/auth/SessionManager.js

@@ -1,17 +1,23 @@
 import { AuthEvent } from "../types/index.js";
 import { createLogger } from "../utils/logger.js";
 import { TokenRefresher } from "./TokenRefresher.js";
-import { retrieveTokens, clearTokens } from "../../shared/lib/util.js";
+import { retrieveTokens, clearTokens, getBackendEndpoints, } from "../../shared/lib/util.js";
 import { getUser } from "../../shared/lib/session.js";
 import { GenericUserSession } from "../../shared/lib/UserSession.js";
+import { AUTOREFRESH_TIMEOUT_NAME, REFRESH_IN_PROGRESS, } from "../../constants.js";
 export class SessionManager {
     storage;
     events;
     tokenRefresher;
     logger = createLogger("session");
-    constructor(storageAdapter, events) {
+    config;
+    // Simple cache for backend session check to avoid excessive API calls
+    backendSessionCache = null;
+    CACHE_DURATION = 30 * 1000; // 30 seconds
+    constructor(storageAdapter, events, config) {
         this.storage = storageAdapter;
         this.events = events;
+        this.config = config;
         this.logger.info("SessionManager initialized with shared lib token storage");
     }
     /**
@@ -22,10 +28,12 @@ export class SessionManager {
             // Initialize token refresher
             this.tokenRefresher = new TokenRefresher(this.storage, this.events, authConfig);
             await this.tokenRefresher.initialize(authConfig);
-            // Set current authentication state
+            // Check current authentication state (this now includes token validation and refresh attempts)
             const isAuthenticated = await this.isAuthenticated();
+            // Set authentication state on the token refresher
+            // This will enable auto-refresh if the user is authenticated (including after successful refresh)
             this.tokenRefresher.setAuthenticationState(isAuthenticated);
-            this.logger.info("SessionManager initialized with token refresh capability");
+            this.logger.info("SessionManager initialized with token refresh capability", { isAuthenticated });
         }
         catch (error) {
             this.logger.error("Failed to initialize SessionManager with auth config:", error);
@@ -33,48 +41,271 @@ export class SessionManager {
         }
     }
     /**
-     * Build current session from shared lib storage
+     * Build current session from shared lib storage or backend API
+     * For backend flows with httpOnly cookies, creates limited session when tokens aren't accessible
      */
     async getCurrentSession() {
         try {
             const tokens = await retrieveTokens(this.storage);
             const user = await this.getCurrentUser();
-            if (!tokens?.id_token || !user) {
-                this.logger.warn("No id_token or user available, cannot create session");
-                return null;
+            // If we have tokens and user (normal flow), create full session
+            if (tokens?.id_token && user) {
+                return {
+                    user,
+                    accessToken: tokens.access_token,
+                    idToken: tokens.id_token,
+                    refreshToken: tokens.refresh_token ?? undefined,
+                    expiresAt: tokens.oidc_session_expires_at ?? undefined,
+                };
             }
-            return {
-                user,
-                accessToken: tokens.access_token,
-                idToken: tokens.id_token,
-                refreshToken: tokens.refresh_token ?? undefined,
-                expiresAt: tokens.oidc_session_expires_at ?? undefined,
-            };
+            // If we have user but no accessible tokens (backend flow with httpOnly cookies),
+            // create a limited session with just user info
+            if (user && this.isBrowserCookieStorage()) {
+                this.logger.debug("Creating limited session for backend flow (tokens in httpOnly cookies)");
+                return {
+                    user,
+                    accessToken: undefined, // Not accessible in httpOnly cookies
+                    idToken: undefined, // Not accessible in httpOnly cookies
+                    refreshToken: undefined, // Not accessible in httpOnly cookies
+                    expiresAt: undefined, // Not accessible in httpOnly cookies
+                };
+            }
+            this.logger.debug("No session available - no tokens or user found");
+            return null;
         }
         catch (error) {
-            this.logger.error("Failed to load session from shared storage:", error);
+            this.logger.error("Failed to load session:", error);
             return null;
         }
     }
     /**
      * Check if user is authenticated using shared lib utilities
+     * For backend flows with httpOnly cookies, falls back to API check
+     *
+     * This method now validates tokens on load and attempts refresh if:
+     * - Tokens exist but are expired/invalid
+     * - A refresh token is available
      */
     async isAuthenticated() {
-        const tokens = await retrieveTokens(this.storage);
-        return !!tokens?.id_token;
+        try {
+            // First, try the standard token-based check
+            const tokens = await retrieveTokens(this.storage);
+            // Normalize empty strings to null for consistent checking
+            const hasIdToken = tokens?.id_token && tokens.id_token.trim() !== "";
+            const hasRefreshToken = tokens?.refresh_token && tokens.refresh_token.trim() !== "";
+            // If no tokens found and we're using BrowserCookieStorage,
+            // try checking backend session (for httpOnly cookies)
+            if (!hasIdToken && this.isBrowserCookieStorage()) {
+                this.logger.debug("No tokens accessible, checking backend session...", await this.checkBackendSession());
+                return await this.checkBackendSession();
+            }
+            // If we have an ID token, validate it
+            if (hasIdToken) {
+                const isTokenValid = await this.validateToken(tokens.id_token);
+                if (isTokenValid) {
+                    this.logger.debug("ID token is valid, user is authenticated");
+                    return true;
+                }
+                // Token is invalid/expired - attempt refresh if refresh token exists
+                if (hasRefreshToken && this.tokenRefresher) {
+                    this.logger.info("ID token expired/invalid, attempting refresh with refresh token");
+                    try {
+                        // Attempt token refresh
+                        await this.tokenRefresher.refreshTokens();
+                        this.logger.info("Token refresh successful during authentication check");
+                        // Check if we now have valid tokens after refresh
+                        const refreshedTokens = await retrieveTokens(this.storage);
+                        const hasRefreshedIdToken = refreshedTokens?.id_token &&
+                            refreshedTokens.id_token.trim() !== "";
+                        if (hasRefreshedIdToken) {
+                            const isRefreshedTokenValid = await this.validateToken(refreshedTokens.id_token);
+                            if (isRefreshedTokenValid) {
+                                this.logger.info("Successfully restored session via refresh token");
+                                return true;
+                            }
+                        }
+                    }
+                    catch (error) {
+                        this.logger.warn("Token refresh failed during authentication check:", error);
+                        // Clear invalid tokens and refresh token since refresh failed
+                        await clearTokens(this.storage);
+                    }
+                }
+                else {
+                    this.logger.warn("ID token invalid and no refresh token available, clearing tokens");
+                    await clearTokens(this.storage);
+                }
+            }
+            else if (hasRefreshToken && this.tokenRefresher) {
+                // No ID token but we have a refresh token - attempt to restore session
+                this.logger.info("No ID token found but refresh token exists, attempting session restore");
+                try {
+                    // Attempt token refresh
+                    await this.tokenRefresher.refreshTokens();
+                    this.logger.info("Token refresh successful during session restore");
+                    // Check if we now have valid tokens after refresh
+                    const refreshedTokens = await retrieveTokens(this.storage);
+                    const hasRefreshedIdToken = refreshedTokens?.id_token && refreshedTokens.id_token.trim() !== "";
+                    if (hasRefreshedIdToken) {
+                        const isRefreshedTokenValid = await this.validateToken(refreshedTokens.id_token);
+                        if (isRefreshedTokenValid) {
+                            this.logger.info("Successfully restored session from refresh token only");
+                            return true;
+                        }
+                    }
+                }
+                catch (error) {
+                    this.logger.warn("Session restore from refresh token failed:", error);
+                    // Clear invalid refresh token since refresh failed
+                    await clearTokens(this.storage);
+                }
+            }
+            return false;
+        }
+        catch (error) {
+            this.logger.error("Error checking authentication:", error);
+            return false;
+        }
+    }
+    /**
+     * Validate if a token is still valid (not expired)
+     * @param token JWT token to validate
+     * @returns true if token is valid, false if expired or invalid
+     */
+    async validateToken(token) {
+        try {
+            // Validate JWT format (should have 3 parts separated by dots)
+            const parts = token.split(".");
+            if (parts.length !== 3 || !parts[1]) {
+                this.logger.warn("Invalid JWT format");
+                return false;
+            }
+            // Decode the JWT to check expiration
+            const decoded = JSON.parse(atob(parts[1]));
+            const now = Math.floor(Date.now() / 1000);
+            // Check if token is expired (with 30 second buffer for clock skew)
+            if (decoded.exp && decoded.exp <= now + 30) {
+                this.logger.debug("Token is expired", {
+                    exp: decoded.exp,
+                    now: now,
+                    expired: decoded.exp <= now,
+                });
+                return false;
+            }
+            this.logger.debug("Token is valid");
+            return true;
+        }
+        catch (error) {
+            this.logger.warn("Token validation failed", error);
+            return false;
+        }
+    }
+    /**
+     * Check if we're using BrowserCookieStorage
+     */
+    isBrowserCookieStorage() {
+        return this.storage.constructor.name === "BrowserCookieStorage";
+    }
+    /**
+     * Simple backend session check via API call (with caching)
+     */
+    async checkBackendSession() {
+        try {
+            // Check if we have a valid cached result
+            if (this.backendSessionCache) {
+                const age = Date.now() - this.backendSessionCache.timestamp;
+                if (age < this.CACHE_DURATION) {
+                    this.logger.debug(`Using cached backend session result: ${this.backendSessionCache.result}`);
+                    return this.backendSessionCache.result;
+                }
+            }
+            if (!this.config.loginUrl) {
+                return false;
+            }
+            const backendUrl = new URL(this.config.loginUrl).origin;
+            const endpoints = getBackendEndpoints(this.config.backendEndpoints);
+            const response = await fetch(`${backendUrl}${endpoints.user}`, {
+                method: "GET",
+                credentials: "include", // Send httpOnly cookies
+            });
+            const result = response.ok;
+            // Cache the result
+            this.backendSessionCache = {
+                result,
+                timestamp: Date.now(),
+            };
+            this.logger.debug(`Backend session check: ${result} (cached for ${this.CACHE_DURATION / 1000}s)`);
+            return result;
+        }
+        catch (error) {
+            this.logger.debug("Backend session check failed:", error);
+            // Cache negative result for shorter time
+            this.backendSessionCache = {
+                result: false,
+                timestamp: Date.now(),
+            };
+            return false;
+        }
     }
     /**
-     * Get current user from shared lib storage
+     * Get current user from shared lib storage or backend API
+     * For backend flows with httpOnly cookies, falls back to API check
      */
     async getCurrentUser() {
         try {
-            return await getUser(this.storage);
+            // First, try to get user from accessible tokens
+            const user = await getUser(this.storage);
+            if (user) {
+                this.logger.debug("Found user from accessible tokens");
+                return user;
+            }
+            // If no user found and we're using BrowserCookieStorage,
+            // try getting user from backend API (for httpOnly cookies)
+            if (this.isBrowserCookieStorage()) {
+                this.logger.debug("No user from tokens, trying backend API...");
+                return await this.getUserFromBackendApi();
+            }
+            this.logger.debug("No user found and not using browser cookie storage");
+            return null;
         }
         catch (error) {
             this.logger.error("Failed to get user from shared storage:", error);
             return null;
         }
     }
+    /**
+     * Get user information from backend API (with caching)
+     */
+    async getUserFromBackendApi() {
+        try {
+            if (!this.config.loginUrl) {
+                this.logger.debug("No backend URL available for user fetch");
+                return null;
+            }
+            this.logger.debug("Fetching user from backend API...");
+            const backendUrl = new URL(this.config.loginUrl).origin;
+            const endpoints = getBackendEndpoints(this.config.backendEndpoints);
+            const response = await fetch(`${backendUrl}${endpoints.user}`, {
+                method: "GET",
+                credentials: "include", // Send httpOnly cookies
+                headers: { "Content-Type": "application/json" },
+            });
+            if (response.ok) {
+                const data = await response.json();
+                const user = data.user;
+                this.logger.debug("Successfully fetched user from backend API");
+                return user;
+            }
+            else {
+                this.logger.debug(`Backend user fetch failed: ${response.status}`);
+                return null;
+            }
+        }
+        catch (error) {
+            this.logger.debug("Backend user fetch failed:", error);
+            return null;
+        }
+    }
     /**
      * Clear all authentication data using shared lib utilities
      * @param preserveLogoutState - If true, preserves logout state for cleanup after redirect
@@ -92,6 +323,8 @@ export class SessionManager {
             // Clear user session using shared utilities
             const userSession = new GenericUserSession(this.storage);
             await userSession.clear();
+            // Clear backend session cache
+            this.backendSessionCache = null;
             // Stop token refresher when session is cleared
             this.tokenRefresher?.setAuthenticationState(false);
             this.events.emit(AuthEvent.USER_SESSION_CHANGED, null);
@@ -107,8 +340,6 @@ export class SessionManager {
      * This is needed during logout to preserve the logout state for cleanup after redirect
      */
     async clearTokensExceptLogoutState() {
-        // Import constants
-        const { REFRESH_IN_PROGRESS, AUTOREFRESH_TIMEOUT_NAME } = await import("../../constants.js");
         // Clear all token-related keys except LOGOUT_STATE
         // These are the OAuth token types from the constants
         const keysToDelete = [

package/dist/vanillajs/auth/SessionManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"SessionManager.js","sourceRoot":"","sources":["../../../src/vanillajs/auth/SessionManager.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE,MAAM,OAAO,cAAc;IACjB,OAAO,CAAc;IACrB,MAAM,CAAuB;IAC7B,cAAc,CAAkB;IAChC,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAEzC,YAAY,cAA2B,EAAE,MAA4B;QACnE,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,wBAAwB,CAAC,UAAsB;QACnD,IAAI,CAAC;YACH,6BAA6B;YAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CACtC,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,MAAM,EACX,UAAU,CACX,CAAC;YACF,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAEjD,mCAAmC;YACnC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YACrD,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC;YAE5D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,0DAA0D,CAC3D,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,uDAAuD,EACvD,KAAK,CACN,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAEzC,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,sDAAsD,CACvD,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,IAAI;gBACJ,WAAW,EAAE,MAAM,CAAC,YAAY;gBAChC,OAAO,EAAE,MAAM,CAAC,QAAQ;gBACxB,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;gBAC/C,SAAS,EAAE,MAAM,CAAC,uBAAuB,IAAI,SAAS;aACvD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe;QACnB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,OAAO,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,sBAA+B,KAAK;QACrD,IAAI,CAAC;YACH,IAAI,mBAAmB,EAAE,CAAC;gBACxB,6EAA6E;gBAC7E,MAAM,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,6CAA6C;gBAC7C,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;YAED,4CAA4C;YAC5C,MAAM,WAAW,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzD,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC;YAE1B,+CAA+C;YAC/C,IAAI,CAAC,cAAc,EAAE,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAEnD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;YACrD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,4BAA4B;QACxC,mBAAmB;QACnB,MAAM,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CACpE,oBAAoB,CACrB,CAAC;QAEF,mDAAmD;QACnD,qDAAqD;QACrD,MAAM,YAAY,GAAG;YACnB,UAAU;YACV,cAAc;YACd,eAAe;YACf,yBAAyB;YACzB,mBAAmB;YACnB,wBAAwB;YACxB,gFAAgF;SACjF,CAAC;QAEF,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACnD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,sBAAsB;QAKpB,OAAO,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC/C,CAAC;CACF","sourcesContent":["import type { AuthStorage } from \"../../types.js\";\nimport type { AuthenticationEvents } from \"./AuthenticationEvents.js\";\nimport type { User, Session } from \"../types/index.js\"; // Assuming Session might be used internally\nimport { AuthEvent } from \"../types/index.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport { TokenRefresher } from \"./TokenRefresher.js\";\nimport type { AuthConfig } from \"../../server/config.js\";\nimport { retrieveTokens, clearTokens } from \"../../shared/lib/util.js\";\nimport { getUser } from \"../../shared/lib/session.js\";\nimport { GenericUserSession } from \"../../shared/lib/UserSession.js\";\n\nexport class SessionManager {\n  private storage: AuthStorage;\n  private events: AuthenticationEvents;\n  private tokenRefresher?: TokenRefresher;\n  private logger = createLogger(\"session\");\n\n  constructor(storageAdapter: AuthStorage, events: AuthenticationEvents) {\n    this.storage = storageAdapter;\n    this.events = events;\n    this.logger.info(\n      \"SessionManager initialized with shared lib token storage\",\n    );\n  }\n\n  /**\n   * Initialize the session manager with auth configuration to enable token refresh\n   */\n  async initializeWithAuthConfig(authConfig: AuthConfig): Promise<void> {\n    try {\n      // Initialize token refresher\n      this.tokenRefresher = new TokenRefresher(\n        this.storage,\n        this.events,\n        authConfig,\n      );\n      await this.tokenRefresher.initialize(authConfig);\n\n      // Set current authentication state\n      const isAuthenticated = await this.isAuthenticated();\n      this.tokenRefresher.setAuthenticationState(isAuthenticated);\n\n      this.logger.info(\n        \"SessionManager initialized with token refresh capability\",\n      );\n    } catch (error) {\n      this.logger.error(\n        \"Failed to initialize SessionManager with auth config:\",\n        error,\n      );\n      this.events.emit(AuthEvent.TOKEN_REFRESH_ERROR, error);\n    }\n  }\n\n  /**\n   * Build current session from shared lib storage\n   */\n  async getCurrentSession(): Promise<Session | null> {\n    try {\n      const tokens = await retrieveTokens(this.storage);\n      const user = await this.getCurrentUser();\n\n      if (!tokens?.id_token || !user) {\n        this.logger.warn(\n          \"No id_token or user available, cannot create session\",\n        );\n        return null;\n      }\n\n      return {\n        user,\n        accessToken: tokens.access_token,\n        idToken: tokens.id_token,\n        refreshToken: tokens.refresh_token ?? undefined,\n        expiresAt: tokens.oidc_session_expires_at ?? undefined,\n      };\n    } catch (error) {\n      this.logger.error(\"Failed to load session from shared storage:\", error);\n      return null;\n    }\n  }\n\n  /**\n   * Check if user is authenticated using shared lib utilities\n   */\n  async isAuthenticated(): Promise<boolean> {\n    const tokens = await retrieveTokens(this.storage);\n    return !!tokens?.id_token;\n  }\n\n  /**\n   * Get current user from shared lib storage\n   */\n  async getCurrentUser(): Promise<User | null> {\n    try {\n      return await getUser(this.storage);\n    } catch (error) {\n      this.logger.error(\"Failed to get user from shared storage:\", error);\n      return null;\n    }\n  }\n\n  /**\n   * Clear all authentication data using shared lib utilities\n   * @param preserveLogoutState - If true, preserves logout state for cleanup after redirect\n   */\n  async clearSession(preserveLogoutState: boolean = false): Promise<void> {\n    try {\n      if (preserveLogoutState) {\n        // During logout, we need to preserve logout state for cleanup after redirect\n        await this.clearTokensExceptLogoutState();\n      } else {\n        // Normal session clearing - clear everything\n        await clearTokens(this.storage);\n      }\n\n      // Clear user session using shared utilities\n      const userSession = new GenericUserSession(this.storage);\n      await userSession.clear();\n\n      // Stop token refresher when session is cleared\n      this.tokenRefresher?.setAuthenticationState(false);\n\n      this.events.emit(AuthEvent.USER_SESSION_CHANGED, null);\n      this.logger.info(\"Session cleared using shared lib utilities\");\n    } catch (error) {\n      this.logger.error(\"Failed to clear session:\", error);\n      throw error;\n    }\n  }\n\n  /**\n   * Clear tokens from storage except logout state\n   * This is needed during logout to preserve the logout state for cleanup after redirect\n   */\n  private async clearTokensExceptLogoutState(): Promise<void> {\n    // Import constants\n    const { REFRESH_IN_PROGRESS, AUTOREFRESH_TIMEOUT_NAME } = await import(\n      \"../../constants.js\"\n    );\n\n    // Clear all token-related keys except LOGOUT_STATE\n    // These are the OAuth token types from the constants\n    const keysToDelete = [\n      \"id_token\",\n      \"access_token\",\n      \"refresh_token\",\n      \"oidc_session_expires_at\",\n      REFRESH_IN_PROGRESS,\n      AUTOREFRESH_TIMEOUT_NAME,\n      // Note: NOT clearing LOGOUT_STATE here - it's needed for cleanup after redirect\n    ];\n\n    const clearPromises = keysToDelete.map(async (key) => {\n      await this.storage.delete(key);\n    });\n\n    await Promise.all(clearPromises);\n  }\n\n  /**\n   * Manually trigger token refresh\n   */\n  async refreshTokens(): Promise<void> {\n    if (!this.tokenRefresher) {\n      throw new Error(\n        \"Token refresher not initialized. Call initializeWithAuthConfig first.\",\n      );\n    }\n\n    return this.tokenRefresher.refreshTokens();\n  }\n\n  /**\n   * Get token refresher state for debugging\n   */\n  getTokenRefresherState(): {\n    isInitialized: boolean;\n    isAuthenticated: boolean;\n    isAutoRefreshActive: boolean;\n  } | null {\n    return this.tokenRefresher?.getState() || null;\n  }\n\n  /**\n   * Clean up resources when session manager is destroyed\n   */\n  async destroy(): Promise<void> {\n    await this.tokenRefresher?.destroy();\n    this.tokenRefresher = undefined;\n    this.logger.info(\"SessionManager destroyed\");\n  }\n}\n"]}
+{"version":3,"file":"SessionManager.js","sourceRoot":"","sources":["../../../src/vanillajs/auth/SessionManager.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EACL,cAAc,EACd,WAAW,EACX,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EACL,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,OAAO,cAAc;IACjB,OAAO,CAAc;IACrB,MAAM,CAAuB;IAC7B,cAAc,CAAkB;IAChC,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,CAAa;IAE3B,sEAAsE;IAC9D,mBAAmB,GAGhB,IAAI,CAAC;IACC,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;IAE1D,YACE,cAA2B,EAC3B,MAA4B,EAC5B,MAAkB;QAElB,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,wBAAwB,CAAC,UAAsB;QACnD,IAAI,CAAC;YACH,6BAA6B;YAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CACtC,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,MAAM,EACX,UAAU,CACX,CAAC;YACF,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAEjD,+FAA+F;YAC/F,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAErD,kDAAkD;YAClD,kGAAkG;YAClG,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC;YAE5D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,0DAA0D,EAC1D,EAAE,eAAe,EAAE,CACpB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,uDAAuD,EACvD,KAAK,CACN,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAEzC,gEAAgE;YAChE,IAAI,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;gBAC7B,OAAO;oBACL,IAAI;oBACJ,WAAW,EAAE,MAAM,CAAC,YAAY;oBAChC,OAAO,EAAE,MAAM,CAAC,QAAQ;oBACxB,YAAY,EAAE,MAAM,CAAC,aAAa,IAAI,SAAS;oBAC/C,SAAS,EAAE,MAAM,CAAC,uBAAuB,IAAI,SAAS;iBACvD,CAAC;YACJ,CAAC;YAED,iFAAiF;YACjF,+CAA+C;YAC/C,IAAI,IAAI,IAAI,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,wEAAwE,CACzE,CAAC;gBACF,OAAO;oBACL,IAAI;oBACJ,WAAW,EAAE,SAAS,EAAE,qCAAqC;oBAC7D,OAAO,EAAE,SAAS,EAAE,qCAAqC;oBACzD,YAAY,EAAE,SAAS,EAAE,qCAAqC;oBAC9D,SAAS,EAAE,SAAS,EAAE,qCAAqC;iBAC5D,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC;YACH,4CAA4C;YAC5C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAElD,0DAA0D;YAC1D,MAAM,UAAU,GAAG,MAAM,EAAE,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YACrE,MAAM,eAAe,GACnB,MAAM,EAAE,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;YAE9D,2DAA2D;YAC3D,sDAAsD;YACtD,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;gBACjD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,mDAAmD,EACnD,MAAM,IAAI,CAAC,mBAAmB,EAAE,CACjC,CAAC;gBACF,OAAO,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC1C,CAAC;YAED,sCAAsC;YACtC,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAS,CAAC,CAAC;gBAEhE,IAAI,YAAY,EAAE,CAAC;oBACjB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;oBAC9D,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,qEAAqE;gBACrE,IAAI,eAAe,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;oBAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,iEAAiE,CAClE,CAAC;oBAEF,IAAI,CAAC;wBACH,wBAAwB;wBACxB,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;wBAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,sDAAsD,CACvD,CAAC;wBAEF,kDAAkD;wBAClD,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;wBAC3D,MAAM,mBAAmB,GACvB,eAAe,EAAE,QAAQ;4BACzB,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;wBACzC,IAAI,mBAAmB,EAAE,CAAC;4BACxB,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,aAAa,CACpD,eAAe,CAAC,QAAS,CAC1B,CAAC;4BACF,IAAI,qBAAqB,EAAE,CAAC;gCAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,iDAAiD,CAClD,CAAC;gCACF,OAAO,IAAI,CAAC;4BACd,CAAC;wBACH,CAAC;oBACH,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mDAAmD,EACnD,KAAK,CACN,CAAC;wBACF,8DAA8D;wBAC9D,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAClC,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,kEAAkE,CACnE,CAAC;oBACF,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;iBAAM,IAAI,eAAe,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBAClD,uEAAuE;gBACvE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wEAAwE,CACzE,CAAC;gBAEF,IAAI,CAAC;oBACH,wBAAwB;oBACxB,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;oBAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;oBAEpE,kDAAkD;oBAClD,MAAM,eAAe,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBAC3D,MAAM,mBAAmB,GACvB,eAAe,EAAE,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;oBACtE,IAAI,mBAAmB,EAAE,CAAC;wBACxB,MAAM,qBAAqB,GAAG,MAAM,IAAI,CAAC,aAAa,CACpD,eAAe,CAAC,QAAS,CAC1B,CAAC;wBACF,IAAI,qBAAqB,EAAE,CAAC;4BAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,uDAAuD,CACxD,CAAC;4BACF,OAAO,IAAI,CAAC;wBACd,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4CAA4C,EAAE,KAAK,CAAC,CAAC;oBACtE,mDAAmD;oBACnD,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,aAAa,CAAC,KAAa;QACvC,IAAI,CAAC;YACH,8DAA8D;YAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBACvC,OAAO,KAAK,CAAC;YACf,CAAC;YAED,qCAAqC;YACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAE1C,mEAAmE;YACnE,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC;gBAC3C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE;oBACpC,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,GAAG,EAAE,GAAG;oBACR,OAAO,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG;iBAC5B,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACf,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACK,sBAAsB;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,KAAK,sBAAsB,CAAC;IAClE,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,mBAAmB;QAC/B,IAAI,CAAC;YACH,yCAAyC;YACzC,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC;gBAC5D,IAAI,GAAG,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;oBAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,wCAAwC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,CAC1E,CAAC;oBACF,OAAO,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;gBACzC,CAAC;YACH,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC1B,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;YACxD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE;gBAC7D,MAAM,EAAE,KAAK;gBACb,WAAW,EAAE,SAAS,EAAE,wBAAwB;aACjD,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,QAAQ,CAAC,EAAE,CAAC;YAE3B,mBAAmB;YACnB,IAAI,CAAC,mBAAmB,GAAG;gBACzB,MAAM;gBACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,0BAA0B,MAAM,gBAAgB,IAAI,CAAC,cAAc,GAAG,IAAI,IAAI,CAC/E,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;YAE1D,yCAAyC;YACzC,IAAI,CAAC,mBAAmB,GAAG;gBACzB,MAAM,EAAE,KAAK;gBACb,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC;YAEF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC;YACH,gDAAgD;YAChD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,IAAI,EAAE,CAAC;gBACT,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBACvD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,yDAAyD;YACzD,2DAA2D;YAC3D,IAAI,IAAI,CAAC,sBAAsB,EAAE,EAAE,CAAC;gBAClC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAChE,OAAO,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC5C,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,qBAAqB;QACjC,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBAC7D,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAEvD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;YACxD,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE;gBAC7D,MAAM,EAAE,KAAK;gBACb,WAAW,EAAE,SAAS,EAAE,wBAAwB;gBAChD,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;YAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAChE,OAAO,IAAI,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBACnE,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,sBAA+B,KAAK;QACrD,IAAI,CAAC;YACH,IAAI,mBAAmB,EAAE,CAAC;gBACxB,6EAA6E;gBAC7E,MAAM,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,6CAA6C;gBAC7C,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;YAED,4CAA4C;YAC5C,MAAM,WAAW,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzD,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC;YAE1B,8BAA8B;YAC9B,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAEhC,+CAA+C;YAC/C,IAAI,CAAC,cAAc,EAAE,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAEnD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;YACrD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,4BAA4B;QACxC,mDAAmD;QACnD,qDAAqD;QACrD,MAAM,YAAY,GAAG;YACnB,UAAU;YACV,cAAc;YACd,eAAe;YACf,yBAAyB;YACzB,mBAAmB;YACnB,wBAAwB;YACxB,gFAAgF;SACjF,CAAC;QAEF,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACnD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,sBAAsB;QAKpB,OAAO,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC/C,CAAC;CACF","sourcesContent":["import type { AuthStorage } from \"../../types.js\";\nimport type { AuthenticationEvents } from \"./AuthenticationEvents.js\";\nimport type { User, Session } from \"../types/index.js\"; // Assuming Session might be used internally\nimport { AuthEvent } from \"../types/index.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport { TokenRefresher } from \"./TokenRefresher.js\";\nimport type { AuthConfig } from \"../../server/config.js\";\nimport {\n  retrieveTokens,\n  clearTokens,\n  getBackendEndpoints,\n} from \"../../shared/lib/util.js\";\nimport { getUser } from \"../../shared/lib/session.js\";\nimport { GenericUserSession } from \"../../shared/lib/UserSession.js\";\nimport {\n  AUTOREFRESH_TIMEOUT_NAME,\n  REFRESH_IN_PROGRESS,\n} from \"../../constants.js\";\n\nexport class SessionManager {\n  private storage: AuthStorage;\n  private events: AuthenticationEvents;\n  private tokenRefresher?: TokenRefresher;\n  private logger = createLogger(\"session\");\n  private config: AuthConfig;\n\n  // Simple cache for backend session check to avoid excessive API calls\n  private backendSessionCache: {\n    result: boolean;\n    timestamp: number;\n  } | null = null;\n  private readonly CACHE_DURATION = 30 * 1000; // 30 seconds\n\n  constructor(\n    storageAdapter: AuthStorage,\n    events: AuthenticationEvents,\n    config: AuthConfig,\n  ) {\n    this.storage = storageAdapter;\n    this.events = events;\n    this.config = config;\n    this.logger.info(\n      \"SessionManager initialized with shared lib token storage\",\n    );\n  }\n\n  /**\n   * Initialize the session manager with auth configuration to enable token refresh\n   */\n  async initializeWithAuthConfig(authConfig: AuthConfig): Promise<void> {\n    try {\n      // Initialize token refresher\n      this.tokenRefresher = new TokenRefresher(\n        this.storage,\n        this.events,\n        authConfig,\n      );\n      await this.tokenRefresher.initialize(authConfig);\n\n      // Check current authentication state (this now includes token validation and refresh attempts)\n      const isAuthenticated = await this.isAuthenticated();\n\n      // Set authentication state on the token refresher\n      // This will enable auto-refresh if the user is authenticated (including after successful refresh)\n      this.tokenRefresher.setAuthenticationState(isAuthenticated);\n\n      this.logger.info(\n        \"SessionManager initialized with token refresh capability\",\n        { isAuthenticated },\n      );\n    } catch (error) {\n      this.logger.error(\n        \"Failed to initialize SessionManager with auth config:\",\n        error,\n      );\n      this.events.emit(AuthEvent.TOKEN_REFRESH_ERROR, error);\n    }\n  }\n\n  /**\n   * Build current session from shared lib storage or backend API\n   * For backend flows with httpOnly cookies, creates limited session when tokens aren't accessible\n   */\n  async getCurrentSession(): Promise<Session | null> {\n    try {\n      const tokens = await retrieveTokens(this.storage);\n      const user = await this.getCurrentUser();\n\n      // If we have tokens and user (normal flow), create full session\n      if (tokens?.id_token && user) {\n        return {\n          user,\n          accessToken: tokens.access_token,\n          idToken: tokens.id_token,\n          refreshToken: tokens.refresh_token ?? undefined,\n          expiresAt: tokens.oidc_session_expires_at ?? undefined,\n        };\n      }\n\n      // If we have user but no accessible tokens (backend flow with httpOnly cookies),\n      // create a limited session with just user info\n      if (user && this.isBrowserCookieStorage()) {\n        this.logger.debug(\n          \"Creating limited session for backend flow (tokens in httpOnly cookies)\",\n        );\n        return {\n          user,\n          accessToken: undefined, // Not accessible in httpOnly cookies\n          idToken: undefined, // Not accessible in httpOnly cookies\n          refreshToken: undefined, // Not accessible in httpOnly cookies\n          expiresAt: undefined, // Not accessible in httpOnly cookies\n        };\n      }\n\n      this.logger.debug(\"No session available - no tokens or user found\");\n      return null;\n    } catch (error) {\n      this.logger.error(\"Failed to load session:\", error);\n      return null;\n    }\n  }\n\n  /**\n   * Check if user is authenticated using shared lib utilities\n   * For backend flows with httpOnly cookies, falls back to API check\n   *\n   * This method now validates tokens on load and attempts refresh if:\n   * - Tokens exist but are expired/invalid\n   * - A refresh token is available\n   */\n  async isAuthenticated(): Promise<boolean> {\n    try {\n      // First, try the standard token-based check\n      const tokens = await retrieveTokens(this.storage);\n\n      // Normalize empty strings to null for consistent checking\n      const hasIdToken = tokens?.id_token && tokens.id_token.trim() !== \"\";\n      const hasRefreshToken =\n        tokens?.refresh_token && tokens.refresh_token.trim() !== \"\";\n\n      // If no tokens found and we're using BrowserCookieStorage,\n      // try checking backend session (for httpOnly cookies)\n      if (!hasIdToken && this.isBrowserCookieStorage()) {\n        this.logger.debug(\n          \"No tokens accessible, checking backend session...\",\n          await this.checkBackendSession(),\n        );\n        return await this.checkBackendSession();\n      }\n\n      // If we have an ID token, validate it\n      if (hasIdToken) {\n        const isTokenValid = await this.validateToken(tokens.id_token!);\n\n        if (isTokenValid) {\n          this.logger.debug(\"ID token is valid, user is authenticated\");\n          return true;\n        }\n\n        // Token is invalid/expired - attempt refresh if refresh token exists\n        if (hasRefreshToken && this.tokenRefresher) {\n          this.logger.info(\n            \"ID token expired/invalid, attempting refresh with refresh token\",\n          );\n\n          try {\n            // Attempt token refresh\n            await this.tokenRefresher.refreshTokens();\n            this.logger.info(\n              \"Token refresh successful during authentication check\",\n            );\n\n            // Check if we now have valid tokens after refresh\n            const refreshedTokens = await retrieveTokens(this.storage);\n            const hasRefreshedIdToken =\n              refreshedTokens?.id_token &&\n              refreshedTokens.id_token.trim() !== \"\";\n            if (hasRefreshedIdToken) {\n              const isRefreshedTokenValid = await this.validateToken(\n                refreshedTokens.id_token!,\n              );\n              if (isRefreshedTokenValid) {\n                this.logger.info(\n                  \"Successfully restored session via refresh token\",\n                );\n                return true;\n              }\n            }\n          } catch (error) {\n            this.logger.warn(\n              \"Token refresh failed during authentication check:\",\n              error,\n            );\n            // Clear invalid tokens and refresh token since refresh failed\n            await clearTokens(this.storage);\n          }\n        } else {\n          this.logger.warn(\n            \"ID token invalid and no refresh token available, clearing tokens\",\n          );\n          await clearTokens(this.storage);\n        }\n      } else if (hasRefreshToken && this.tokenRefresher) {\n        // No ID token but we have a refresh token - attempt to restore session\n        this.logger.info(\n          \"No ID token found but refresh token exists, attempting session restore\",\n        );\n\n        try {\n          // Attempt token refresh\n          await this.tokenRefresher.refreshTokens();\n          this.logger.info(\"Token refresh successful during session restore\");\n\n          // Check if we now have valid tokens after refresh\n          const refreshedTokens = await retrieveTokens(this.storage);\n          const hasRefreshedIdToken =\n            refreshedTokens?.id_token && refreshedTokens.id_token.trim() !== \"\";\n          if (hasRefreshedIdToken) {\n            const isRefreshedTokenValid = await this.validateToken(\n              refreshedTokens.id_token!,\n            );\n            if (isRefreshedTokenValid) {\n              this.logger.info(\n                \"Successfully restored session from refresh token only\",\n              );\n              return true;\n            }\n          }\n        } catch (error) {\n          this.logger.warn(\"Session restore from refresh token failed:\", error);\n          // Clear invalid refresh token since refresh failed\n          await clearTokens(this.storage);\n        }\n      }\n\n      return false;\n    } catch (error) {\n      this.logger.error(\"Error checking authentication:\", error);\n      return false;\n    }\n  }\n\n  /**\n   * Validate if a token is still valid (not expired)\n   * @param token JWT token to validate\n   * @returns true if token is valid, false if expired or invalid\n   */\n  private async validateToken(token: string): Promise<boolean> {\n    try {\n      // Validate JWT format (should have 3 parts separated by dots)\n      const parts = token.split(\".\");\n      if (parts.length !== 3 || !parts[1]) {\n        this.logger.warn(\"Invalid JWT format\");\n        return false;\n      }\n\n      // Decode the JWT to check expiration\n      const decoded = JSON.parse(atob(parts[1]));\n      const now = Math.floor(Date.now() / 1000);\n\n      // Check if token is expired (with 30 second buffer for clock skew)\n      if (decoded.exp && decoded.exp <= now + 30) {\n        this.logger.debug(\"Token is expired\", {\n          exp: decoded.exp,\n          now: now,\n          expired: decoded.exp <= now,\n        });\n        return false;\n      }\n\n      this.logger.debug(\"Token is valid\");\n      return true;\n    } catch (error) {\n      this.logger.warn(\"Token validation failed\", error);\n      return false;\n    }\n  }\n\n  /**\n   * Check if we're using BrowserCookieStorage\n   */\n  private isBrowserCookieStorage(): boolean {\n    return this.storage.constructor.name === \"BrowserCookieStorage\";\n  }\n\n  /**\n   * Simple backend session check via API call (with caching)\n   */\n  private async checkBackendSession(): Promise<boolean> {\n    try {\n      // Check if we have a valid cached result\n      if (this.backendSessionCache) {\n        const age = Date.now() - this.backendSessionCache.timestamp;\n        if (age < this.CACHE_DURATION) {\n          this.logger.debug(\n            `Using cached backend session result: ${this.backendSessionCache.result}`,\n          );\n          return this.backendSessionCache.result;\n        }\n      }\n\n      if (!this.config.loginUrl) {\n        return false;\n      }\n\n      const backendUrl = new URL(this.config.loginUrl).origin;\n      const endpoints = getBackendEndpoints(this.config.backendEndpoints);\n      const response = await fetch(`${backendUrl}${endpoints.user}`, {\n        method: \"GET\",\n        credentials: \"include\", // Send httpOnly cookies\n      });\n\n      const result = response.ok;\n\n      // Cache the result\n      this.backendSessionCache = {\n        result,\n        timestamp: Date.now(),\n      };\n\n      this.logger.debug(\n        `Backend session check: ${result} (cached for ${this.CACHE_DURATION / 1000}s)`,\n      );\n      return result;\n    } catch (error) {\n      this.logger.debug(\"Backend session check failed:\", error);\n\n      // Cache negative result for shorter time\n      this.backendSessionCache = {\n        result: false,\n        timestamp: Date.now(),\n      };\n\n      return false;\n    }\n  }\n\n  /**\n   * Get current user from shared lib storage or backend API\n   * For backend flows with httpOnly cookies, falls back to API check\n   */\n  async getCurrentUser(): Promise<User | null> {\n    try {\n      // First, try to get user from accessible tokens\n      const user = await getUser(this.storage);\n      if (user) {\n        this.logger.debug(\"Found user from accessible tokens\");\n        return user;\n      }\n\n      // If no user found and we're using BrowserCookieStorage,\n      // try getting user from backend API (for httpOnly cookies)\n      if (this.isBrowserCookieStorage()) {\n        this.logger.debug(\"No user from tokens, trying backend API...\");\n        return await this.getUserFromBackendApi();\n      }\n\n      this.logger.debug(\"No user found and not using browser cookie storage\");\n      return null;\n    } catch (error) {\n      this.logger.error(\"Failed to get user from shared storage:\", error);\n      return null;\n    }\n  }\n\n  /**\n   * Get user information from backend API (with caching)\n   */\n  private async getUserFromBackendApi(): Promise<User | null> {\n    try {\n      if (!this.config.loginUrl) {\n        this.logger.debug(\"No backend URL available for user fetch\");\n        return null;\n      }\n\n      this.logger.debug(\"Fetching user from backend API...\");\n\n      const backendUrl = new URL(this.config.loginUrl).origin;\n      const endpoints = getBackendEndpoints(this.config.backendEndpoints);\n      const response = await fetch(`${backendUrl}${endpoints.user}`, {\n        method: \"GET\",\n        credentials: \"include\", // Send httpOnly cookies\n        headers: { \"Content-Type\": \"application/json\" },\n      });\n\n      if (response.ok) {\n        const data = await response.json();\n        const user = data.user;\n        this.logger.debug(\"Successfully fetched user from backend API\");\n        return user;\n      } else {\n        this.logger.debug(`Backend user fetch failed: ${response.status}`);\n        return null;\n      }\n    } catch (error) {\n      this.logger.debug(\"Backend user fetch failed:\", error);\n      return null;\n    }\n  }\n\n  /**\n   * Clear all authentication data using shared lib utilities\n   * @param preserveLogoutState - If true, preserves logout state for cleanup after redirect\n   */\n  async clearSession(preserveLogoutState: boolean = false): Promise<void> {\n    try {\n      if (preserveLogoutState) {\n        // During logout, we need to preserve logout state for cleanup after redirect\n        await this.clearTokensExceptLogoutState();\n      } else {\n        // Normal session clearing - clear everything\n        await clearTokens(this.storage);\n      }\n\n      // Clear user session using shared utilities\n      const userSession = new GenericUserSession(this.storage);\n      await userSession.clear();\n\n      // Clear backend session cache\n      this.backendSessionCache = null;\n\n      // Stop token refresher when session is cleared\n      this.tokenRefresher?.setAuthenticationState(false);\n\n      this.events.emit(AuthEvent.USER_SESSION_CHANGED, null);\n      this.logger.info(\"Session cleared using shared lib utilities\");\n    } catch (error) {\n      this.logger.error(\"Failed to clear session:\", error);\n      throw error;\n    }\n  }\n\n  /**\n   * Clear tokens from storage except logout state\n   * This is needed during logout to preserve the logout state for cleanup after redirect\n   */\n  private async clearTokensExceptLogoutState(): Promise<void> {\n    // Clear all token-related keys except LOGOUT_STATE\n    // These are the OAuth token types from the constants\n    const keysToDelete = [\n      \"id_token\",\n      \"access_token\",\n      \"refresh_token\",\n      \"oidc_session_expires_at\",\n      REFRESH_IN_PROGRESS,\n      AUTOREFRESH_TIMEOUT_NAME,\n      // Note: NOT clearing LOGOUT_STATE here - it's needed for cleanup after redirect\n    ];\n\n    const clearPromises = keysToDelete.map(async (key) => {\n      await this.storage.delete(key);\n    });\n\n    await Promise.all(clearPromises);\n  }\n\n  /**\n   * Manually trigger token refresh\n   */\n  async refreshTokens(): Promise<void> {\n    if (!this.tokenRefresher) {\n      throw new Error(\n        \"Token refresher not initialized. Call initializeWithAuthConfig first.\",\n      );\n    }\n\n    return this.tokenRefresher.refreshTokens();\n  }\n\n  /**\n   * Get token refresher state for debugging\n   */\n  getTokenRefresherState(): {\n    isInitialized: boolean;\n    isAuthenticated: boolean;\n    isAutoRefreshActive: boolean;\n  } | null {\n    return this.tokenRefresher?.getState() || null;\n  }\n\n  /**\n   * Clean up resources when session manager is destroyed\n   */\n  async destroy(): Promise<void> {\n    await this.tokenRefresher?.destroy();\n    this.tokenRefresher = undefined;\n    this.logger.info(\"SessionManager destroyed\");\n  }\n}\n"]}

package/dist/vanillajs/auth/TokenRefresher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TokenRefresher.d.ts","sourceRoot":"","sources":["../../../src/vanillajs/auth/TokenRefresher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAMtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAIzD;;;GAGG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,SAAS,CAAC,CAAiC;IACnD,OAAO,CAAC,OAAO,CAAc;IAC7B,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,MAAM,CAAiC;gBAG7C,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,oBAAoB,EAC5B,UAAU,CAAC,EAAE,UAAU;IASzB;;OAEG;IACG,UAAU,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAoDvD;;OAEG;IACH,sBAAsB,CAAC,eAAe,EAAE,OAAO,GAAG,IAAI;IAgBtD;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAuBpC;;OAEG;YACW,gBAAgB;IAwB9B;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAW9B;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAM9B;;OAEG;IACH,QAAQ,IAAI;QACV,aAAa,EAAE,OAAO,CAAC;QACvB,eAAe,EAAE,OAAO,CAAC;QACzB,mBAAmB,EAAE,OAAO,CAAC;KAC9B;CAOF"}
+{"version":3,"file":"TokenRefresher.d.ts","sourceRoot":"","sources":["../../../src/vanillajs/auth/TokenRefresher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAOtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAIzD;;;GAGG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,SAAS,CAAC,CAEiB;IACnC,OAAO,CAAC,OAAO,CAAc;IAC7B,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,WAAW,CAAkB;IACrC,OAAO,CAAC,MAAM,CAAiC;gBAG7C,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,oBAAoB,EAC5B,UAAU,CAAC,EAAE,UAAU;IASzB;;OAEG;IACG,UAAU,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAsEvD;;OAEG;IACH,sBAAsB,CAAC,eAAe,EAAE,OAAO,GAAG,IAAI;IAgBtD;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAuBpC;;OAEG;YACW,gBAAgB;IAwB9B;;OAEG;IACH,OAAO,CAAC,eAAe;IAOvB;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAW9B;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAM9B;;OAEG;IACH,QAAQ,IAAI;QACV,aAAa,EAAE,OAAO,CAAC;QACvB,eAAe,EAAE,OAAO,CAAC;QACzB,mBAAmB,EAAE,OAAO,CAAC;KAC9B;CAOF"}

package/dist/vanillajs/auth/TokenRefresher.js

@@ -1,5 +1,6 @@
 import { AuthEvent } from "../types/index.js";
 import { BrowserAuthenticationRefresher, } from "../../shared/lib/BrowserAuthenticationRefresher.js";
+import { BackendAuthenticationRefresher } from "./BackendAuthenticationRefresher.js";
 import { createLogger } from "../utils/logger.js";
 import { retrieveOidcSessionExpiredAt } from "../../shared/lib/util.js";
 /**
@@ -39,24 +40,36 @@ export class TokenRefresher {
                 // This mirrors the React implementation behavior
                 this.events.emit(AuthEvent.SIGN_OUT_STARTED, null);
             };
-            // Create callbacks for refresh events
-            const refreshEventCallbacks = {
-                onRefreshStarted: () => {
-                    this.logger.info("Auto token refresh started");
-                    this.events.emit(AuthEvent.TOKEN_REFRESH_STARTED, null);
-                },
-                onRefreshComplete: () => {
-                    this.logger.info("Auto token refresh completed");
-                    this.events.emit(AuthEvent.TOKEN_REFRESH_COMPLETE, null);
-                },
-                onRefreshError: (error) => {
-                    this.logger.error("Auto token refresh failed:", error);
-                    this.events.emit(AuthEvent.TOKEN_REFRESH_ERROR, error);
-                },
-            };
-            this.refresher = await BrowserAuthenticationRefresher.build(authConfig, this.storage, onError, undefined, // endpointOverrides
-            refreshEventCallbacks);
-            this.logger.info("TokenRefresher initialized");
+            // Determine if this is a backend flow or SPA flow
+            if (authConfig.loginUrl) {
+                // Backend authentication flow - use BackendAuthenticationRefresher
+                this.logger.info("Initializing backend authentication refresher", {
+                    loginUrl: authConfig.loginUrl,
+                });
+                this.refresher = await BackendAuthenticationRefresher.build(authConfig, authConfig.loginUrl, onError, this.events);
+            }
+            else {
+                // SPA authentication flow - use BrowserAuthenticationRefresher
+                this.logger.info("Initializing browser authentication refresher");
+                // Create callbacks for refresh events
+                const refreshEventCallbacks = {
+                    onRefreshStarted: () => {
+                        this.logger.info("Auto token refresh started");
+                        this.events.emit(AuthEvent.TOKEN_REFRESH_STARTED, null);
+                    },
+                    onRefreshComplete: () => {
+                        this.logger.info("Auto token refresh completed");
+                        this.events.emit(AuthEvent.TOKEN_REFRESH_COMPLETE, null);
+                    },
+                    onRefreshError: (error) => {
+                        this.logger.error("Auto token refresh failed:", error);
+                        this.events.emit(AuthEvent.TOKEN_REFRESH_ERROR, error);
+                    },
+                };
+                this.refresher = await BrowserAuthenticationRefresher.build(authConfig, this.storage, onError, undefined, // endpointOverrides
+                refreshEventCallbacks);
+            }
+            this.logger.info("TokenRefresher initialized successfully");
         }
         catch (error) {
             this.logger.error("Failed to initialize TokenRefresher:", error);

package/dist/vanillajs/auth/TokenRefresher.js.map

@@ -1 +1 @@
-{"version":3,"file":"TokenRefresher.js","sourceRoot":"","sources":["../../../src/vanillajs/auth/TokenRefresher.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EACL,8BAA8B,GAE/B,MAAM,oDAAoD,CAAC;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAExE;;;GAGG;AACH,MAAM,OAAO,cAAc;IACjB,SAAS,CAAkC;IAC3C,OAAO,CAAc;IACrB,MAAM,CAAuB;IAC7B,UAAU,CAAc;IACxB,eAAe,GAAY,KAAK,CAAC;IACjC,WAAW,GAAY,KAAK,CAAC;IAC7B,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;IAE/C,YACE,OAAoB,EACpB,MAA4B,EAC5B,UAAuB;QAEvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAE7B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,UAAsB;QACrC,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAE7B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAE7B,IAAI,CAAC;YACH,+BAA+B;YAC/B,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAErB,MAAM,OAAO,GAAG,KAAK,EAAE,KAAY,EAAE,EAAE;gBACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;gBACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;gBAEvD,8BAA8B;gBAC9B,IAAI,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC;gBAEnC,uDAAuD;gBACvD,iDAAiD;gBACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YACrD,CAAC,CAAC;YAEF,sCAAsC;YACtC,MAAM,qBAAqB,GAA0B;gBACnD,gBAAgB,EAAE,GAAG,EAAE;oBACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;oBAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;gBAC1D,CAAC;gBACD,iBAAiB,EAAE,GAAG,EAAE;oBACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;oBACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;gBAC3D,CAAC;gBACD,cAAc,EAAE,CAAC,KAAY,EAAE,EAAE;oBAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;oBACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;gBACzD,CAAC;aACF,CAAC;YAEF,IAAI,CAAC,SAAS,GAAG,MAAM,8BAA8B,CAAC,KAAK,CACzD,UAAU,EACV,IAAI,CAAC,OAAO,EACZ,OAAO,EACP,SAAS,EAAE,oBAAoB;YAC/B,qBAAqB,CACtB,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,eAAwB;QAC7C,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAE7B,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QAEvC,IAAI,eAAe,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,sFAAsF;YACtF,kCAAkC;YAClC,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACtC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,6DAA6D,IAAI,CAAC,WAAW,mBAAmB,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YAExD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAElD,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;YAErC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;YACvD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB;QAC5B,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;YAErD,IAAI,CAAC;gBACH,6FAA6F;gBAC7F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;gBAC1C,MAAM,SAAS,GACb,CAAC,MAAM,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;gBACjE,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,oBAAoB;gBAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,GAAG,CAAC,CAAC;gBAE9D,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qCAAqC,eAAe,CAAC,WAAW,EAAE,QAAQ,WAAW,WAAW,CACjG,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;OAEG;IACK,eAAe;QACrB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;YACrD,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAE/C,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;YAClC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,QAAQ;QAKN,OAAO;YACL,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS;YAC/B,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,mBAAmB,EAAE,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS;SAC9D,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { AuthStorage } from \"../../types.js\";\nimport type { AuthenticationEvents } from \"./AuthenticationEvents.js\";\nimport { AuthEvent } from \"../types/index.js\";\nimport {\n  BrowserAuthenticationRefresher,\n  type RefreshEventCallbacks,\n} from \"../../shared/lib/BrowserAuthenticationRefresher.js\";\nimport type { AuthConfig } from \"../../server/config.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport { retrieveOidcSessionExpiredAt } from \"../../shared/lib/util.js\";\n\n/**\n * TokenRefresher handles automatic token refresh for vanilla.js implementation\n * Inspired by the React useRefresh hook and BrowserAuthenticationRefresher\n */\nexport class TokenRefresher {\n  private refresher?: BrowserAuthenticationRefresher;\n  private storage: AuthStorage;\n  private events: AuthenticationEvents;\n  private authConfig?: AuthConfig;\n  private isAuthenticated: boolean = false;\n  private isDestroyed: boolean = false;\n  private logger = createLogger(\"token-refresh\");\n\n  constructor(\n    storage: AuthStorage,\n    events: AuthenticationEvents,\n    authConfig?: AuthConfig,\n  ) {\n    this.storage = storage;\n    this.events = events;\n    this.authConfig = authConfig;\n\n    this.logger.info(\"TokenRefresher initialized\");\n  }\n\n  /**\n   * Initialize the token refresher with auth configuration\n   */\n  async initialize(authConfig: AuthConfig): Promise<void> {\n    if (this.isDestroyed) return;\n\n    this.authConfig = authConfig;\n\n    try {\n      // Clear any existing refresher\n      await this.cleanup();\n\n      const onError = async (error: Error) => {\n        this.logger.error(\"Token refresh error:\", error);\n        this.events.emit(AuthEvent.TOKEN_REFRESH_ERROR, error);\n\n        // Clear auto-refresh on error\n        this.refresher?.clearAutorefresh();\n\n        // Optionally sign out the user on refresh token errors\n        // This mirrors the React implementation behavior\n        this.events.emit(AuthEvent.SIGN_OUT_STARTED, null);\n      };\n\n      // Create callbacks for refresh events\n      const refreshEventCallbacks: RefreshEventCallbacks = {\n        onRefreshStarted: () => {\n          this.logger.info(\"Auto token refresh started\");\n          this.events.emit(AuthEvent.TOKEN_REFRESH_STARTED, null);\n        },\n        onRefreshComplete: () => {\n          this.logger.info(\"Auto token refresh completed\");\n          this.events.emit(AuthEvent.TOKEN_REFRESH_COMPLETE, null);\n        },\n        onRefreshError: (error: Error) => {\n          this.logger.error(\"Auto token refresh failed:\", error);\n          this.events.emit(AuthEvent.TOKEN_REFRESH_ERROR, error);\n        },\n      };\n\n      this.refresher = await BrowserAuthenticationRefresher.build(\n        authConfig,\n        this.storage,\n        onError,\n        undefined, // endpointOverrides\n        refreshEventCallbacks,\n      );\n\n      this.logger.info(\"TokenRefresher initialized\");\n    } catch (error) {\n      this.logger.error(\"Failed to initialize TokenRefresher:\", error);\n      this.events.emit(AuthEvent.TOKEN_REFRESH_ERROR, error);\n    }\n  }\n\n  /**\n   * Set authentication state and manage auto-refresh accordingly\n   */\n  setAuthenticationState(isAuthenticated: boolean): void {\n    if (this.isDestroyed) return;\n\n    this.isAuthenticated = isAuthenticated;\n\n    if (isAuthenticated && this.refresher) {\n      // Fire and forget the async call - we don't want to make setAuthenticationState async\n      // as it would break the interface\n      this.startAutoRefresh().catch((error) => {\n        this.logger.error(\"Error starting auto refresh:\", error);\n      });\n    } else {\n      this.stopAutoRefresh();\n    }\n  }\n\n  /**\n   * Manually refresh tokens\n   */\n  async refreshTokens(): Promise<void> {\n    if (this.isDestroyed || !this.refresher) {\n      const errorMsg = `TokenRefresher not initialized or destroyed. isDestroyed: ${this.isDestroyed}, hasRefresher: ${!!this.refresher}`;\n      this.logger.error(errorMsg);\n      throw new Error(errorMsg);\n    }\n\n    try {\n      this.events.emit(AuthEvent.TOKEN_REFRESH_STARTED, null);\n\n      this.logger.info(\"Starting manual token refresh\");\n\n      await this.refresher.refreshTokens();\n\n      this.events.emit(AuthEvent.TOKEN_REFRESH_COMPLETE, null);\n      this.logger.info(\"Manual token refresh completed\");\n    } catch (error) {\n      this.logger.error(\"Manual token refresh failed:\", error);\n      this.events.emit(AuthEvent.TOKEN_REFRESH_ERROR, error);\n      throw error;\n    }\n  }\n\n  /**\n   * Start automatic token refresh\n   */\n  private async startAutoRefresh(): Promise<void> {\n    if (this.refresher && this.isAuthenticated) {\n      this.logger.info(\"Starting automatic token refresh\");\n\n      try {\n        // Calculate when the next refresh will happen (same logic as BrowserAuthenticationRefresher)\n        const now = Math.floor(Date.now() / 1000);\n        const expiresAt =\n          (await retrieveOidcSessionExpiredAt(this.storage)) || now + 60;\n        const bufferTime = 30; // 30 seconds buffer\n        const refreshTime = Math.max(0, expiresAt - bufferTime - now);\n\n        const nextRefreshDate = new Date((now + refreshTime) * 1000);\n        this.logger.info(\n          `Next token refresh scheduled for: ${nextRefreshDate.toISOString()} (in ${refreshTime} seconds)`,\n        );\n      } catch (error) {\n        this.logger.warn(\"Could not calculate next refresh time:\", error);\n      }\n\n      this.refresher.setupAutorefresh();\n    }\n  }\n\n  /**\n   * Stop automatic token refresh\n   */\n  private stopAutoRefresh(): void {\n    if (this.refresher) {\n      this.logger.info(\"Stopping automatic token refresh\");\n      this.refresher.clearAutorefresh();\n    }\n  }\n\n  /**\n   * Clean up resources\n   */\n  async cleanup(): Promise<void> {\n    this.logger.info(\"Cleaning up TokenRefresher\");\n\n    if (this.refresher) {\n      this.refresher.clearAutorefresh();\n      this.refresher = undefined;\n    }\n\n    this.isAuthenticated = false;\n  }\n\n  /**\n   * Destroy the token refresher permanently\n   */\n  async destroy(): Promise<void> {\n    this.isDestroyed = true;\n    await this.cleanup();\n    this.logger.info(\"TokenRefresher destroyed\");\n  }\n\n  /**\n   * Get current refresh state\n   */\n  getState(): {\n    isInitialized: boolean;\n    isAuthenticated: boolean;\n    isAutoRefreshActive: boolean;\n  } {\n    return {\n      isInitialized: !!this.refresher,\n      isAuthenticated: this.isAuthenticated,\n      isAutoRefreshActive: this.isAuthenticated && !!this.refresher,\n    };\n  }\n}\n"]}
+{"version":3,"file":"TokenRefresher.js","sourceRoot":"","sources":["../../../src/vanillajs/auth/TokenRefresher.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EACL,8BAA8B,GAE/B,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAErF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAExE;;;GAGG;AACH,MAAM,OAAO,cAAc;IACjB,SAAS,CAEkB;IAC3B,OAAO,CAAc;IACrB,MAAM,CAAuB;IAC7B,UAAU,CAAc;IACxB,eAAe,GAAY,KAAK,CAAC;IACjC,WAAW,GAAY,KAAK,CAAC;IAC7B,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;IAE/C,YACE,OAAoB,EACpB,MAA4B,EAC5B,UAAuB;QAEvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAE7B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IACjD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,UAAsB;QACrC,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAE7B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAE7B,IAAI,CAAC;YACH,+BAA+B;YAC/B,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAErB,MAAM,OAAO,GAAG,KAAK,EAAE,KAAY,EAAE,EAAE;gBACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;gBACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;gBAEvD,8BAA8B;gBAC9B,IAAI,CAAC,SAAS,EAAE,gBAAgB,EAAE,CAAC;gBAEnC,uDAAuD;gBACvD,iDAAiD;gBACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YACrD,CAAC,CAAC;YAEF,kDAAkD;YAClD,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACxB,mEAAmE;gBACnE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE;oBAChE,QAAQ,EAAE,UAAU,CAAC,QAAQ;iBAC9B,CAAC,CAAC;gBAEH,IAAI,CAAC,SAAS,GAAG,MAAM,8BAA8B,CAAC,KAAK,CACzD,UAAU,EACV,UAAU,CAAC,QAAQ,EACnB,OAAO,EACP,IAAI,CAAC,MAAM,CACZ,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,+DAA+D;gBAC/D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;gBAElE,sCAAsC;gBACtC,MAAM,qBAAqB,GAA0B;oBACnD,gBAAgB,EAAE,GAAG,EAAE;wBACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;wBAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;oBAC1D,CAAC;oBACD,iBAAiB,EAAE,GAAG,EAAE;wBACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;wBACjD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;oBAC3D,CAAC;oBACD,cAAc,EAAE,CAAC,KAAY,EAAE,EAAE;wBAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;wBACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;oBACzD,CAAC;iBACF,CAAC;gBAEF,IAAI,CAAC,SAAS,GAAG,MAAM,8BAA8B,CAAC,KAAK,CACzD,UAAU,EACV,IAAI,CAAC,OAAO,EACZ,OAAO,EACP,SAAS,EAAE,oBAAoB;gBAC/B,qBAAqB,CACtB,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,eAAwB;QAC7C,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAE7B,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QAEvC,IAAI,eAAe,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,sFAAsF;YACtF,kCAAkC;YAClC,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACtC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,6DAA6D,IAAI,CAAC,WAAW,mBAAmB,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;YAExD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAElD,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;YAErC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;YACvD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB;QAC5B,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;YAErD,IAAI,CAAC;gBACH,6FAA6F;gBAC7F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;gBAC1C,MAAM,SAAS,GACb,CAAC,MAAM,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;gBACjE,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,oBAAoB;gBAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,GAAG,CAAC,CAAC;gBAE9D,MAAM,eAAe,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,qCAAqC,eAAe,CAAC,WAAW,EAAE,QAAQ,WAAW,WAAW,CACjG,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;OAEG;IACK,eAAe;QACrB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;YACrD,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAE/C,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,CAAC;YAClC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7B,CAAC;QAED,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,QAAQ;QAKN,OAAO;YACL,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS;YAC/B,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,mBAAmB,EAAE,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS;SAC9D,CAAC;IACJ,CAAC;CACF","sourcesContent":["import type { AuthStorage } from \"../../types.js\";\nimport type { AuthenticationEvents } from \"./AuthenticationEvents.js\";\nimport { AuthEvent } from \"../types/index.js\";\nimport {\n  BrowserAuthenticationRefresher,\n  type RefreshEventCallbacks,\n} from \"../../shared/lib/BrowserAuthenticationRefresher.js\";\nimport { BackendAuthenticationRefresher } from \"./BackendAuthenticationRefresher.js\";\nimport type { AuthConfig } from \"../../server/config.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport { retrieveOidcSessionExpiredAt } from \"../../shared/lib/util.js\";\n\n/**\n * TokenRefresher handles automatic token refresh for vanilla.js implementation\n * Inspired by the React useRefresh hook and BrowserAuthenticationRefresher\n */\nexport class TokenRefresher {\n  private refresher?:\n    | BrowserAuthenticationRefresher\n    | BackendAuthenticationRefresher;\n  private storage: AuthStorage;\n  private events: AuthenticationEvents;\n  private authConfig?: AuthConfig;\n  private isAuthenticated: boolean = false;\n  private isDestroyed: boolean = false;\n  private logger = createLogger(\"token-refresh\");\n\n  constructor(\n    storage: AuthStorage,\n    events: AuthenticationEvents,\n    authConfig?: AuthConfig,\n  ) {\n    this.storage = storage;\n    this.events = events;\n    this.authConfig = authConfig;\n\n    this.logger.info(\"TokenRefresher initialized\");\n  }\n\n  /**\n   * Initialize the token refresher with auth configuration\n   */\n  async initialize(authConfig: AuthConfig): Promise<void> {\n    if (this.isDestroyed) return;\n\n    this.authConfig = authConfig;\n\n    try {\n      // Clear any existing refresher\n      await this.cleanup();\n\n      const onError = async (error: Error) => {\n        this.logger.error(\"Token refresh error:\", error);\n        this.events.emit(AuthEvent.TOKEN_REFRESH_ERROR, error);\n\n        // Clear auto-refresh on error\n        this.refresher?.clearAutorefresh();\n\n        // Optionally sign out the user on refresh token errors\n        // This mirrors the React implementation behavior\n        this.events.emit(AuthEvent.SIGN_OUT_STARTED, null);\n      };\n\n      // Determine if this is a backend flow or SPA flow\n      if (authConfig.loginUrl) {\n        // Backend authentication flow - use BackendAuthenticationRefresher\n        this.logger.info(\"Initializing backend authentication refresher\", {\n          loginUrl: authConfig.loginUrl,\n        });\n\n        this.refresher = await BackendAuthenticationRefresher.build(\n          authConfig,\n          authConfig.loginUrl,\n          onError,\n          this.events, // Pass events for consistency with BrowserAuthenticationRefresher\n        );\n      } else {\n        // SPA authentication flow - use BrowserAuthenticationRefresher\n        this.logger.info(\"Initializing browser authentication refresher\");\n\n        // Create callbacks for refresh events\n        const refreshEventCallbacks: RefreshEventCallbacks = {\n          onRefreshStarted: () => {\n            this.logger.info(\"Auto token refresh started\");\n            this.events.emit(AuthEvent.TOKEN_REFRESH_STARTED, null);\n          },\n          onRefreshComplete: () => {\n            this.logger.info(\"Auto token refresh completed\");\n            this.events.emit(AuthEvent.TOKEN_REFRESH_COMPLETE, null);\n          },\n          onRefreshError: (error: Error) => {\n            this.logger.error(\"Auto token refresh failed:\", error);\n            this.events.emit(AuthEvent.TOKEN_REFRESH_ERROR, error);\n          },\n        };\n\n        this.refresher = await BrowserAuthenticationRefresher.build(\n          authConfig,\n          this.storage,\n          onError,\n          undefined, // endpointOverrides\n          refreshEventCallbacks,\n        );\n      }\n\n      this.logger.info(\"TokenRefresher initialized successfully\");\n    } catch (error) {\n      this.logger.error(\"Failed to initialize TokenRefresher:\", error);\n      this.events.emit(AuthEvent.TOKEN_REFRESH_ERROR, error);\n    }\n  }\n\n  /**\n   * Set authentication state and manage auto-refresh accordingly\n   */\n  setAuthenticationState(isAuthenticated: boolean): void {\n    if (this.isDestroyed) return;\n\n    this.isAuthenticated = isAuthenticated;\n\n    if (isAuthenticated && this.refresher) {\n      // Fire and forget the async call - we don't want to make setAuthenticationState async\n      // as it would break the interface\n      this.startAutoRefresh().catch((error) => {\n        this.logger.error(\"Error starting auto refresh:\", error);\n      });\n    } else {\n      this.stopAutoRefresh();\n    }\n  }\n\n  /**\n   * Manually refresh tokens\n   */\n  async refreshTokens(): Promise<void> {\n    if (this.isDestroyed || !this.refresher) {\n      const errorMsg = `TokenRefresher not initialized or destroyed. isDestroyed: ${this.isDestroyed}, hasRefresher: ${!!this.refresher}`;\n      this.logger.error(errorMsg);\n      throw new Error(errorMsg);\n    }\n\n    try {\n      this.events.emit(AuthEvent.TOKEN_REFRESH_STARTED, null);\n\n      this.logger.info(\"Starting manual token refresh\");\n\n      await this.refresher.refreshTokens();\n\n      this.events.emit(AuthEvent.TOKEN_REFRESH_COMPLETE, null);\n      this.logger.info(\"Manual token refresh completed\");\n    } catch (error) {\n      this.logger.error(\"Manual token refresh failed:\", error);\n      this.events.emit(AuthEvent.TOKEN_REFRESH_ERROR, error);\n      throw error;\n    }\n  }\n\n  /**\n   * Start automatic token refresh\n   */\n  private async startAutoRefresh(): Promise<void> {\n    if (this.refresher && this.isAuthenticated) {\n      this.logger.info(\"Starting automatic token refresh\");\n\n      try {\n        // Calculate when the next refresh will happen (same logic as BrowserAuthenticationRefresher)\n        const now = Math.floor(Date.now() / 1000);\n        const expiresAt =\n          (await retrieveOidcSessionExpiredAt(this.storage)) || now + 60;\n        const bufferTime = 30; // 30 seconds buffer\n        const refreshTime = Math.max(0, expiresAt - bufferTime - now);\n\n        const nextRefreshDate = new Date((now + refreshTime) * 1000);\n        this.logger.info(\n          `Next token refresh scheduled for: ${nextRefreshDate.toISOString()} (in ${refreshTime} seconds)`,\n        );\n      } catch (error) {\n        this.logger.warn(\"Could not calculate next refresh time:\", error);\n      }\n\n      this.refresher.setupAutorefresh();\n    }\n  }\n\n  /**\n   * Stop automatic token refresh\n   */\n  private stopAutoRefresh(): void {\n    if (this.refresher) {\n      this.logger.info(\"Stopping automatic token refresh\");\n      this.refresher.clearAutorefresh();\n    }\n  }\n\n  /**\n   * Clean up resources\n   */\n  async cleanup(): Promise<void> {\n    this.logger.info(\"Cleaning up TokenRefresher\");\n\n    if (this.refresher) {\n      this.refresher.clearAutorefresh();\n      this.refresher = undefined;\n    }\n\n    this.isAuthenticated = false;\n  }\n\n  /**\n   * Destroy the token refresher permanently\n   */\n  async destroy(): Promise<void> {\n    this.isDestroyed = true;\n    await this.cleanup();\n    this.logger.info(\"TokenRefresher destroyed\");\n  }\n\n  /**\n   * Get current refresh state\n   */\n  getState(): {\n    isInitialized: boolean;\n    isAuthenticated: boolean;\n    isAutoRefreshActive: boolean;\n  } {\n    return {\n      isInitialized: !!this.refresher,\n      isAuthenticated: this.isAuthenticated,\n      isAutoRefreshActive: this.isAuthenticated && !!this.refresher,\n    };\n  }\n}\n"]}

package/dist/vanillajs/auth/config/ConfigProcessor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigProcessor.d.ts","sourceRoot":"","sources":["../../../../src/vanillajs/auth/config/ConfigProcessor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,qBAAqB,EACrB,wBAAwB,EAEzB,MAAM,uBAAuB,CAAC;AAO/B;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,qBAAqB,GAC5B,wBAAwB,CAgD1B"}
+{"version":3,"file":"ConfigProcessor.d.ts","sourceRoot":"","sources":["../../../../src/vanillajs/auth/config/ConfigProcessor.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,qBAAqB,EACrB,wBAAwB,EAEzB,MAAM,uBAAuB,CAAC;AAO/B;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,qBAAqB,GAC5B,wBAAwB,CA2D1B"}

package/dist/vanillajs/auth/config/ConfigProcessor.js

@@ -1,4 +1,5 @@
 import { LocalStorageAdapter } from "../../../browser/storage.js";
+import { BrowserCookieStorage } from "../../../shared/lib/BrowserCookieStorage.js";
 import { DEFAULT_SCOPES, DEFAULT_AUTH_SERVER } from "../../../constants.js";
 import { CivicAuthError, CivicAuthErrorCode, CIVIC_AUTH_CONSTANTS, } from "../types/AuthTypes.js";
 /**
@@ -23,6 +24,12 @@ export function processConfigWithDefaults(config) {
         `${window.location.origin}${window.location.pathname}`;
     // Process logoutRedirectUrl - default to redirectUrl if not provided (same behavior as reactjs implementation)
     const logoutRedirectUrl = config.logoutRedirectUrl || redirectUrl;
+    // Auto-select storage adapter based on loginUrl
+    // If loginUrl is provided (backend integration), automatically use BrowserCookieStorage
+    // Otherwise, use provided storageAdapter or default to LocalStorageAdapter
+    const storageAdapter = config.loginUrl
+        ? new BrowserCookieStorage()
+        : config.storageAdapter || new LocalStorageAdapter();
     return {
         ...config,
         redirectUrl,
@@ -40,20 +47,20 @@ export function processConfigWithDefaults(config) {
         iframeId: config.iframeId || CIVIC_AUTH_CONSTANTS.DEFAULT_IFRAME_ID,
         prompt: "consent",
         logging: loggingConfig,
-        storageAdapter: config.storageAdapter || new LocalStorageAdapter(),
+        storageAdapter,
+        loginUrl: config.loginUrl, // Include loginUrl in processed config
+        backendEndpoints: config.backendEndpoints, // Include backend endpoints in processed config
+        preloadIframe: config.preloadIframe !== false, // Default to true unless explicitly set to false
+        autoRedirect: config.autoRedirect !== false, // Default to true unless explicitly set to false
     };
 }
 /**
  * Validates required configuration properties
  */
 function validateRequiredConfig(config) {
-    // Always required configurations
-    const requiredConfigs = [{ key: "clientId", value: config.clientId }];
-    // Validate always-required fields
-    for (const { key, value } of requiredConfigs) {
-        if (!value) {
-            throw new CivicAuthError(`CivicAuth: ${key} is required.`, CivicAuthErrorCode.CONFIG_REQUIRED);
-        }
+    // Dynamic validation: clientId is only required if loginUrl is not provided
+    if (!config.loginUrl && !config.clientId) {
+        throw new CivicAuthError("CivicAuth: clientId is required when loginUrl is not provided.", CivicAuthErrorCode.CONFIG_REQUIRED);
     }
     // Conditional validation for targetContainerElement
     // Handle both the new "embedded" displayMode and the legacy iframe + iframeDisplayMode approach