@imtbl/auth 2.12.5 → 2.12.6-alpha.0

package/src/Auth.test.ts

@@ -268,6 +268,231 @@ describe('Auth', () => {
     });
   });
 
+  describe('refreshTokenAndUpdatePromise', () => {
+    it('emits TOKEN_REFRESHED event when signinSilent succeeds', async () => {
+      const mockOidcUser = {
+        id_token: 'new-id',
+        access_token: 'new-access',
+        refresh_token: 'new-refresh',
+        expired: false,
+        profile: { sub: 'user-123', email: 'test@example.com', nickname: 'tester' },
+      };
+
+      (decodeJwtPayload as jest.Mock).mockReturnValue({
+        username: undefined,
+        passport: undefined,
+      });
+
+      const auth = Object.create(Auth.prototype) as Auth;
+      const mockEventEmitter = { emit: jest.fn() };
+      const mockUserManager = {
+        signinSilent: jest.fn().mockResolvedValue(mockOidcUser),
+      };
+
+      (auth as any).eventEmitter = mockEventEmitter;
+      (auth as any).userManager = mockUserManager;
+      (auth as any).refreshingPromise = null;
+
+      const user = await (auth as any).refreshTokenAndUpdatePromise();
+
+      expect(user).toBeDefined();
+      expect(user.accessToken).toBe('new-access');
+      expect(mockEventEmitter.emit).toHaveBeenCalledWith(
+        AuthEvents.TOKEN_REFRESHED,
+        expect.objectContaining({
+          accessToken: 'new-access',
+          refreshToken: 'new-refresh',
+        }),
+      );
+    });
+
+    it('does not emit TOKEN_REFRESHED event when signinSilent returns null', async () => {
+      const auth = Object.create(Auth.prototype) as Auth;
+      const mockEventEmitter = { emit: jest.fn() };
+      const mockUserManager = {
+        signinSilent: jest.fn().mockResolvedValue(null),
+      };
+
+      (auth as any).eventEmitter = mockEventEmitter;
+      (auth as any).userManager = mockUserManager;
+      (auth as any).refreshingPromise = null;
+
+      const user = await (auth as any).refreshTokenAndUpdatePromise();
+
+      expect(user).toBeNull();
+      expect(mockEventEmitter.emit).not.toHaveBeenCalled();
+    });
+
+    it('emits USER_REMOVED event for invalid_grant error', async () => {
+      const auth = Object.create(Auth.prototype) as Auth;
+      const mockEventEmitter = { emit: jest.fn() };
+      const mockUserManager = {
+        signinSilent: jest.fn().mockRejectedValue(
+          Object.assign(new Error('invalid_grant'), {
+            error: 'invalid_grant',
+            error_description: 'Unknown or invalid refresh token',
+          }),
+        ),
+        removeUser: jest.fn().mockResolvedValue(undefined),
+      };
+
+      // Make the error an instance of ErrorResponse
+      const { ErrorResponse } = jest.requireActual('oidc-client-ts');
+      const errorResponse = new ErrorResponse({
+        error: 'invalid_grant',
+        error_description: 'Unknown or invalid refresh token',
+      });
+      mockUserManager.signinSilent.mockRejectedValue(errorResponse);
+
+      (auth as any).eventEmitter = mockEventEmitter;
+      (auth as any).userManager = mockUserManager;
+      (auth as any).refreshingPromise = null;
+
+      await expect((auth as any).refreshTokenAndUpdatePromise()).rejects.toThrow();
+
+      expect(mockEventEmitter.emit).toHaveBeenCalledWith(
+        AuthEvents.USER_REMOVED,
+        expect.objectContaining({
+          reason: 'refresh_failed',
+        }),
+      );
+      expect(mockUserManager.removeUser).toHaveBeenCalled();
+    });
+
+    it('emits USER_REMOVED event for login_required error', async () => {
+      const auth = Object.create(Auth.prototype) as Auth;
+      const mockEventEmitter = { emit: jest.fn() };
+      const mockUserManager = {
+        signinSilent: jest.fn(),
+        removeUser: jest.fn().mockResolvedValue(undefined),
+      };
+
+      const { ErrorResponse } = jest.requireActual('oidc-client-ts');
+      const errorResponse = new ErrorResponse({
+        error: 'login_required',
+        error_description: 'User must re-authenticate',
+      });
+      mockUserManager.signinSilent.mockRejectedValue(errorResponse);
+
+      (auth as any).eventEmitter = mockEventEmitter;
+      (auth as any).userManager = mockUserManager;
+      (auth as any).refreshingPromise = null;
+
+      await expect((auth as any).refreshTokenAndUpdatePromise()).rejects.toThrow();
+
+      expect(mockEventEmitter.emit).toHaveBeenCalledWith(
+        AuthEvents.USER_REMOVED,
+        expect.objectContaining({
+          reason: 'refresh_failed',
+        }),
+      );
+      expect(mockUserManager.removeUser).toHaveBeenCalled();
+    });
+
+    it('emits USER_REMOVED event for network errors', async () => {
+      const auth = Object.create(Auth.prototype) as Auth;
+      const mockEventEmitter = { emit: jest.fn() };
+      const mockUserManager = {
+        signinSilent: jest.fn().mockRejectedValue(new Error('Network error: Failed to fetch')),
+        removeUser: jest.fn().mockResolvedValue(undefined),
+      };
+
+      (auth as any).eventEmitter = mockEventEmitter;
+      (auth as any).userManager = mockUserManager;
+      (auth as any).refreshingPromise = null;
+
+      await expect((auth as any).refreshTokenAndUpdatePromise()).rejects.toThrow();
+
+      expect(mockEventEmitter.emit).toHaveBeenCalledWith(
+        AuthEvents.USER_REMOVED,
+        expect.objectContaining({
+          reason: 'refresh_failed',
+        }),
+      );
+      expect(mockUserManager.removeUser).toHaveBeenCalled();
+    });
+
+    it('emits USER_REMOVED event for server_error OAuth error', async () => {
+      const auth = Object.create(Auth.prototype) as Auth;
+      const mockEventEmitter = { emit: jest.fn() };
+      const mockUserManager = {
+        signinSilent: jest.fn(),
+        removeUser: jest.fn().mockResolvedValue(undefined),
+      };
+
+      const { ErrorResponse } = jest.requireActual('oidc-client-ts');
+      const errorResponse = new ErrorResponse({
+        error: 'server_error',
+        error_description: 'Internal server error',
+      });
+      mockUserManager.signinSilent.mockRejectedValue(errorResponse);
+
+      (auth as any).eventEmitter = mockEventEmitter;
+      (auth as any).userManager = mockUserManager;
+      (auth as any).refreshingPromise = null;
+
+      await expect((auth as any).refreshTokenAndUpdatePromise()).rejects.toThrow();
+
+      expect(mockEventEmitter.emit).toHaveBeenCalledWith(
+        AuthEvents.USER_REMOVED,
+        expect.objectContaining({
+          reason: 'refresh_failed',
+        }),
+      );
+      expect(mockUserManager.removeUser).toHaveBeenCalled();
+    });
+
+    it('emits USER_REMOVED event for unknown errors (safer default)', async () => {
+      const auth = Object.create(Auth.prototype) as Auth;
+      const mockEventEmitter = { emit: jest.fn() };
+      const mockUserManager = {
+        signinSilent: jest.fn().mockRejectedValue(new Error('Some unknown error')),
+        removeUser: jest.fn().mockResolvedValue(undefined),
+      };
+
+      (auth as any).eventEmitter = mockEventEmitter;
+      (auth as any).userManager = mockUserManager;
+      (auth as any).refreshingPromise = null;
+
+      await expect((auth as any).refreshTokenAndUpdatePromise()).rejects.toThrow();
+
+      // Unknown errors should remove user (safer default)
+      expect(mockEventEmitter.emit).toHaveBeenCalledWith(
+        AuthEvents.USER_REMOVED,
+        expect.objectContaining({
+          reason: 'refresh_failed',
+        }),
+      );
+      expect(mockUserManager.removeUser).toHaveBeenCalled();
+    });
+
+    it('does not emit USER_REMOVED event for ErrorTimeout', async () => {
+      const auth = Object.create(Auth.prototype) as Auth;
+      const mockEventEmitter = { emit: jest.fn() };
+      const mockUserManager = {
+        signinSilent: jest.fn(),
+        removeUser: jest.fn().mockResolvedValue(undefined),
+      };
+
+      // Mock ErrorTimeout
+      const { ErrorTimeout } = jest.requireActual('oidc-client-ts');
+      const timeoutError = new ErrorTimeout('Silent sign-in timed out');
+      mockUserManager.signinSilent.mockRejectedValue(timeoutError);
+
+      (auth as any).eventEmitter = mockEventEmitter;
+      (auth as any).userManager = mockUserManager;
+      (auth as any).refreshingPromise = null;
+
+      await expect((auth as any).refreshTokenAndUpdatePromise()).rejects.toThrow();
+
+      expect(mockEventEmitter.emit).not.toHaveBeenCalledWith(
+        AuthEvents.USER_REMOVED,
+        expect.anything(),
+      );
+      expect(mockUserManager.removeUser).not.toHaveBeenCalled();
+    });
+  });
+
   describe('loginWithPopup', () => {
     let mockUserManager: any;
     let originalCryptoRandomUUID: any;

package/src/Auth.ts

@@ -30,6 +30,7 @@ import {
   IdTokenPayload,
   isUserZkEvm,
   EvmChain,
+  ChainAddress,
 } from './types';
 import EmbeddedLoginPrompt from './login/embeddedLoginPrompt';
 import TypedEventEmitter from './utils/typedEventEmitter';
@@ -75,6 +76,11 @@ const extractTokenErrorMessage = (
   return `Token request failed with status ${status}`;
 };
 
+const toChainAddress = (ethAddress: string, userAdminAddress: string): ChainAddress => ({
+  ethAddress: ethAddress as `0x${string}`,
+  userAdminAddress: userAdminAddress as `0x${string}`,
+});
+
 const logoutEndpoint = '/v2/logout';
 const crossSdkBridgeLogoutEndpoint = '/im-logged-out';
 const authorizeEndpoint = '/authorize';
@@ -573,20 +579,14 @@ export class Auth {
     };
 
     if (passport?.zkevm_eth_address && passport?.zkevm_user_admin_address) {
-      user.zkEvm = {
-        ethAddress: passport.zkevm_eth_address,
-        userAdminAddress: passport.zkevm_user_admin_address,
-      };
+      user.zkEvm = toChainAddress(passport.zkevm_eth_address, passport.zkevm_user_admin_address);
     }
 
     const chains = Object.values(EvmChain).filter((chain) => chain !== EvmChain.ZKEVM);
     for (const chain of chains) {
       const chainMetadata = passport?.[chain as Exclude<EvmChain, EvmChain.ZKEVM>];
       if (chainMetadata?.eth_address && chainMetadata?.user_admin_address) {
-        user[chain] = {
-          ethAddress: chainMetadata.eth_address,
-          userAdminAddress: chainMetadata.user_admin_address,
-        };
+        user[chain] = toChainAddress(chainMetadata.eth_address, chainMetadata.user_admin_address);
       }
     }
 
@@ -779,15 +779,21 @@ export class Auth {
         try {
           const newOidcUser = await this.userManager.signinSilent();
           if (newOidcUser) {
-            resolve(Auth.mapOidcUserToDomainModel(newOidcUser));
+            const user = Auth.mapOidcUserToDomainModel(newOidcUser);
+            // Emit TOKEN_REFRESHED event so consumers (e.g., auth-next-client) can sync
+            // the new tokens to their session. This is critical for refresh token
+            // rotation - without this, the server-side session may have stale tokens.
+            this.eventEmitter.emit(AuthEvents.TOKEN_REFRESHED, user);
+            resolve(user);
             return;
           }
           resolve(null);
         } catch (err) {
           let passportErrorType = PassportErrorType.AUTHENTICATION_ERROR;
           let errorMessage = 'Failed to refresh token';
+          // Default to REMOVING user - safer to log out on unknown errors
+          // Only keep user logged in for explicitly known transient errors
           let removeUser = true;
-
           if (err instanceof ErrorTimeout) {
             passportErrorType = PassportErrorType.SILENT_LOGIN_ERROR;
             errorMessage = `${errorMessage}: ${err.message}`;
@@ -802,6 +808,13 @@ export class Auth {
           }
 
           if (removeUser) {
+            // Emit USER_REMOVED event BEFORE removing user so consumers can react
+            // (e.g., auth-next-client can clear the NextAuth session)
+            this.eventEmitter.emit(AuthEvents.USER_REMOVED, {
+              reason: 'refresh_failed',
+              error: errorMessage,
+            });
+
             try {
               await this.userManager.removeUser();
             } catch (removeUserError) {

package/src/index.ts

@@ -19,9 +19,11 @@ export type {
   PassportMetadata,
   PassportChainMetadata,
   ChainAddress,
+  ZkEvmInfo,
   IdTokenPayload,
   PKCEData,
   AuthEventMap,
+  UserRemovedReason,
 } from './types';
 export {
   isUserZkEvm,
@@ -40,3 +42,17 @@ export {
 } from './errors';
 
 export { decodeJwtPayload } from './utils/jwt';
+
+// ============================================================================
+// Standalone Login Functions (stateless, for use with NextAuth or similar)
+// ============================================================================
+
+export {
+  loginWithPopup,
+  loginWithEmbedded,
+  loginWithRedirect,
+  handleLoginCallback,
+  type LoginConfig,
+  type TokenResponse,
+  type StandaloneLoginOptions,
+} from './login/standalone';