@inrupt/solid-client-authn-browser 1.17.5 → 2.1.0

package/dist/ClientAuthentication.d.ts

@@ -1,3 +1,4 @@
+/// <reference types="node" />
 /**
  * @hidden
  * @packageDocumentation

package/dist/Session.d.ts

@@ -1,10 +1,7 @@
-/// <reference types="node" />
 /**
  * @hidden
  */
 import type { ILoginInputOptions, ISessionInfo, IStorage, IHasSessionEventListener, ISessionEventListener, ILogoutOptions } from "@inrupt/solid-client-authn-core";
-import type { fetch } from "@inrupt/universal-fetch";
-import EventEmitter from "events";
 import type ClientAuthentication from "./ClientAuthentication";
 export interface ISessionOptions {
     /**
@@ -33,28 +30,10 @@ export interface IHandleIncomingRedirectOptions {
      * If your app's access has not expired yet and re-activation completed
      * successfully, a `sessionRestore` event will be fired with the URL the user
      * was at before they were redirected to their Solid Identity Provider.
-     * {@see onSessionRestore}
+     * See {@link ISessionEventListener}: a callback can be registered to
+     * `session.events.on(EVENTS.SESSION_RESTORED, callback)`.
      */
     restorePreviousSession?: boolean;
-    /**
-     * Inrupt's Enterprise Solid Server can set a cookie to allow the browser to
-     * access private resources on a Pod. In order to mitigate the logout-on-refresh
-     * issue on the short term, the server also implemented a session endpoint
-     * enabling the client app to know whether the cookie is set. When a user
-     * logs in to a server that has that capability enabled, applications that set
-     * this option to `true` will be able to make use of it.
-     *
-     * If your app supports the newest session restore approach, and `restorePreviousSession`
-     * is set to true, this option is automatically set to false, but your app will
-     * not be logged out when reloaded.
-     *
-     * `useEssSession` defaults to false and will be removed in the future; to
-     * preserve sessions across page reloads, use of `restorePreviousSession` is
-     * recommended.
-     *
-     * @deprecated unreleased
-     */
-    useEssSession?: boolean;
     /**
      * The URL of the page handling the redirect, including the query
      * parameters — these contain the information to process the login.
@@ -67,7 +46,7 @@ export declare function silentlyAuthenticate(sessionId: string, clientAuthn: Cli
 /**
  * A {@link Session} object represents a user's session on an application. The session holds state, as it stores information enabling acces to private resources after login for instance.
  */
-export declare class Session extends EventEmitter implements IHasSessionEventListener {
+export declare class Session implements IHasSessionEventListener {
     /**
      * Information regarding the current session.
      */
@@ -160,50 +139,8 @@ export declare class Session extends EventEmitter implements IHasSessionEventLis
      * Completes the login process by processing the information provided by the
      * Solid identity provider through redirect.
      *
-     * @param options See {@see IHandleIncomingRedirectOptions}.
+     * @param options See {@link IHandleIncomingRedirectOptions}.
      */
     handleIncomingRedirect: (inputOptions?: string | IHandleIncomingRedirectOptions) => Promise<ISessionInfo | undefined>;
-    /**
-     * Register a callback function to be called when a user completes login.
-     *
-     * The callback is called when {@link handleIncomingRedirect} completes successfully.
-     *
-     * @param callback The function called when a user completes login.
-     * @deprecated Prefer session.events.on(EVENTS.LOGIN, callback)
-     */
-    onLogin(callback: () => unknown): void;
-    /**
-     * Register a callback function to be called when a user logs out:
-     *
-     * @param callback The function called when a user completes logout.
-     * @deprecated Prefer session.events.on(EVENTS.LOGOUT, callback)
-     */
-    onLogout(callback: () => unknown): void;
-    /**
-     * Register a callback function to be called when a user logs out:
-     *
-     * @param callback The function called when an error occurs.
-     * @since 1.11.0
-     * @deprecated Prefer session.events.on(EVENTS.ERROR, callback)
-     */
-    onError(callback: (error: string | null, errorDescription?: string | null) => unknown): void;
-    /**
-     * Register a callback function to be called when a session is restored.
-     *
-     * Note: the callback will be called with the saved value of the 'current URL'
-     * at the time the session was restored.
-     *
-     * @param callback The function called when a user's already logged-in session is restored, e.g., after a silent authentication is completed after a page refresh.
-     * @deprecated Prefer session.events.on(EVENTS.SESSION_RESTORED, callback)
-     */
-    onSessionRestore(callback: (currentUrl: string) => unknown): void;
-    /**
-     * Register a callback that runs when the session expires and can no longer
-     * make authenticated requests, but following a user logout.
-     * @param callback The function that runs on session expiration.
-     * @since 1.11.0
-     * @deprecated Prefer session.events.on(EVENTS.SESSION_EXPIRED, callback)
-     */
-    onSessionExpiration(callback: () => unknown): void;
     private setSessionInfo;
 }

package/dist/defaultSession.d.ts

@@ -44,34 +44,6 @@ export declare const logout: Session["logout"];
  * @since 1.3.0
  */
 export declare const handleIncomingRedirect: Session["handleIncomingRedirect"];
-/**
- * Register a callback function to be called when a user completes login.
- *
- * The callback is called when {@link handleIncomingRedirect} completes successfully.
- * @since 1.3.0
- *
- * @param callback The function called when a user completes login.
- * @deprecated Prefer events.on(EVENTS.LOGIN, callback)
-
- */
-export declare const onLogin: Session["onLogin"];
-/**
- * Register a callback function to be called when a user logs out:
- *
- * @param callback The function called when a user completes logout.
- * @since 1.3.0
- * @deprecated Prefer events.on(EVENTS.LOGOUT, callback)
- *
- */
-export declare const onLogout: Session["onLogout"];
-/**
- * Register a callback function to be called when a session is restored:
- *
- * @param callback The function called when a session is restored.
- * @since 1.3.0
- * @deprecated Prefer events.on(EVENTS.SESSION_RESTORED, callback)
- */
-export declare const onSessionRestore: Session["onSessionRestore"];
 /**
  * {@link SessionEventEmitter} instance to subscribe to events by the default session.
  *

package/dist/dependencies.d.ts

@@ -8,9 +8,8 @@
 import type { IStorage } from "@inrupt/solid-client-authn-core";
 import ClientAuthentication from "./ClientAuthentication";
 /**
- *
  * @param dependencies
- * @deprecated This function will be removed from the external API in an upcoming release.
+ * @hidden
  */
 export declare function getClientAuthenticationWithDependencies(dependencies: {
     secureStorage?: IStorage;

package/dist/index.d.ts

@@ -1,4 +1,3 @@
-export { Session, ISessionOptions } from "./Session";
-export { getClientAuthenticationWithDependencies } from "./dependencies";
+export { Session, ISessionOptions, IHandleIncomingRedirectOptions, } from "./Session";
 export * from "./defaultSession";
-export { ILoginInputOptions, ISessionInfo, IStorage, NotImplementedError, ConfigurationError, InMemoryStorage, EVENTS, } from "@inrupt/solid-client-authn-core";
+export { ILoginInputOptions, ISessionInfo, IStorage, NotImplementedError, ConfigurationError, InMemoryStorage, IHasSessionEventListener, ISessionEventListener, IEndSessionOptions, ILogoutOptions, EVENTS, } from "@inrupt/solid-client-authn-core";

package/dist/index.js

@@ -4,7 +4,6 @@ var solidClientAuthnCore = require('@inrupt/solid-client-authn-core');
 var uuid = require('uuid');
 var EventEmitter = require('events');
 var oidcClientExt = require('@inrupt/oidc-client-ext');
-var universalFetch = require('@inrupt/universal-fetch');
 
 //
 // Copyright Inrupt Inc.
@@ -265,8 +264,7 @@ class AuthorizationCodeWithPkceOidcHandler extends solidClientAuthnCore.Authoriz
             authority: oidcLoginOptions.issuer.toString(),
             client_id: oidcLoginOptions.client.clientId,
             client_secret: oidcLoginOptions.client.clientSecret,
-            redirect_uri: oidcLoginOptions.redirectUrl.toString(),
-            post_logout_redirect_uri: oidcLoginOptions.redirectUrl.toString(),
+            redirect_uri: oidcLoginOptions.redirectUrl,
             response_type: "code",
             scope: solidClientAuthnCore.DEFAULT_SCOPES,
             filterProtocolClaims: true,
@@ -445,7 +443,7 @@ class IssuerConfigFetcher {
         // Make sure to append a slash at issuer URL, so that the .well-known URL
         // includes the full issuer path. See https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig.
         issuer.endsWith("/") ? issuer : `${issuer}/`).href;
-        const issuerConfigRequestBody = await universalFetch.fetch.call(globalThis, openIdConfigUrl);
+        const issuerConfigRequestBody = await fetch(openIdConfigUrl);
         // Check the validity of the fetched config
         try {
             issuerConfig = processConfig(await issuerConfigRequestBody.json());
@@ -627,14 +625,6 @@ class FallbackRedirectHandler {
 // OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 // SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 //
-/**
- * @hidden
- * @packageDocumentation
- */
-// FIXME: The following doesn't work in the browser, it results in all the fetches
-// being unauthenticated. This should be looked into when migrating to universal-fetch.
-// import { fetch } from "cross-fetch";
-const globalFetch = (...args) => universalFetch.fetch.call(globalThis, ...args);
 /**
  * @hidden
  */
@@ -682,25 +672,18 @@ class AuthCodeRedirectHandler {
             throw new Error(`The redirect URL for session ${storedSessionId} is missing from storage.`);
         }
         const client = await this.clientRegistrar.getClient({ sessionId: storedSessionId }, issuerConfig);
-        let tokens;
         const tokenCreatedAt = Date.now();
-        if (isDpop) {
-            tokens = await oidcClientExt.getDpopToken(issuerConfig, client, {
-                grantType: "authorization_code",
-                // We rely on our 'canHandle' function checking that the OAuth 'code'
-                // parameter is present in our query string.
-                code: url.searchParams.get("code"),
-                codeVerifier,
-                redirectUrl: storedRedirectIri,
-            });
-            // Delete oidc-client-specific session information from storage. This is
-            // done automatically when retrieving a bearer token, but since the DPoP
-            // binding uses our custom code, this needs to be done manually.
-            window.localStorage.removeItem(`oidc.${oauthState}`);
-        }
-        else {
-            tokens = await oidcClientExt.getBearerToken(url.toString());
-        }
+        const tokens = await oidcClientExt.getTokens(issuerConfig, client, {
+            grantType: "authorization_code",
+            // We rely on our 'canHandle' function checking that the OAuth 'code'
+            // parameter is present in our query string.
+            code: url.searchParams.get("code"),
+            codeVerifier,
+            redirectUrl: storedRedirectIri,
+        }, isDpop);
+        // Delete oidc-client-specific session information from storage. oidc-client
+        // is no longer used for the token exchange, so it doesn't perform this automatically.
+        window.localStorage.removeItem(`oidc.${oauthState}`);
         let refreshOptions;
         if (tokens.refreshToken !== undefined) {
             refreshOptions = {
@@ -709,7 +692,7 @@ class AuthCodeRedirectHandler {
                 tokenRefresher: this.tokerRefresher,
             };
         }
-        const authFetch = await solidClientAuthnCore.buildAuthenticatedFetch(globalFetch, tokens.accessToken, {
+        const authFetch = await solidClientAuthnCore.buildAuthenticatedFetch(tokens.accessToken, {
             dpopKey: tokens.dpopKey,
             refreshOptions,
             eventEmitter,
@@ -870,25 +853,27 @@ class ClientRegistrar {
     }
     async getClient(options, issuerConfig) {
         // If client secret and/or client id are stored in storage, use those.
-        const [storedClientId, storedClientSecret,
-        // storedClientName,
-        ] = await Promise.all([
+        const [storedClientId, storedClientSecret, storedClientName, storedClientType,] = await Promise.all([
             this.storageUtility.getForUser(options.sessionId, "clientId", {
                 secure: false,
             }),
             this.storageUtility.getForUser(options.sessionId, "clientSecret", {
                 secure: false,
             }),
-            // this.storageUtility.getForUser(options.sessionId, "clientName", {
-            //   // FIXME: figure out how to persist secure storage at reload
-            //   secure: false,
-            // }),
+            this.storageUtility.getForUser(options.sessionId, "clientName", {
+                secure: false,
+            }),
+            this.storageUtility.getForUser(options.sessionId, "clientType", {
+                secure: false,
+            }),
         ]);
-        if (storedClientId) {
+        if (storedClientId && solidClientAuthnCore.isKnownClientType(storedClientType)) {
             return {
                 clientId: storedClientId,
                 clientSecret: storedClientSecret,
-                clientType: "dynamic",
+                clientName: storedClientName,
+                // Note: static clients are not applicable in a browser context.
+                clientType: storedClientType,
             };
         }
         try {
@@ -896,6 +881,7 @@ class ClientRegistrar {
             // Save info
             const infoToSave = {
                 clientId: registeredClient.clientId,
+                clientType: "dynamic",
             };
             if (registeredClient.clientSecret) {
                 infoToSave.clientSecret = registeredClient.clientSecret;
@@ -1043,9 +1029,8 @@ class TokenRefresher {
 // SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 //
 /**
- *
  * @param dependencies
- * @deprecated This function will be removed from the external API in an upcoming release.
+ * @hidden
  */
 function getClientAuthenticationWithDependencies(dependencies) {
     const inMemoryStorage = new solidClientAuthnCore.InMemoryStorage();
@@ -1140,7 +1125,7 @@ function isLoggedIn(sessionInfo) {
 /**
  * A {@link Session} object represents a user's session on an application. The session holds state, as it stores information enabling acces to private resources after login for instance.
  */
-class Session extends EventEmitter {
+class Session {
     /**
      * Session object constructor. Typically called as follows:
      *
@@ -1157,7 +1142,6 @@ class Session extends EventEmitter {
      *
      */
     constructor(sessionOptions = {}, sessionId = undefined) {
-        super();
         this.tokenRequestInProgress = false;
         /**
          * Triggers the login process. Note that this method will redirect the user away from your app.
@@ -1248,7 +1232,7 @@ class Session extends EventEmitter {
          * Completes the login process by processing the information provided by the
          * Solid identity provider through redirect.
          *
-         * @param options See {@see IHandleIncomingRedirectOptions}.
+         * @param options See {@link IHandleIncomingRedirectOptions}.
          */
         this.handleIncomingRedirect = async (inputOptions = {}) => {
             var _a;
@@ -1301,11 +1285,7 @@ class Session extends EventEmitter {
             this.tokenRequestInProgress = false;
             return sessionInfo;
         };
-        // Until Session no longer implements EventEmitter, this.events is just a proxy
-        // to this (with some interface filtering). When we make the breaking change,
-        // this.events will be a regular EventEmitter (implementing ISessionEventEmitter):
-        // this.events = new EventEmitter();
-        this.events = new Proxy(this, solidClientAuthnCore.buildProxyHandler(Session.prototype, "events only implements ISessionEventListener"));
+        this.events = new EventEmitter();
         if (sessionOptions.clientAuthentication) {
             this.clientAuthentication = sessionOptions.clientAuthentication;
         }
@@ -1339,58 +1319,6 @@ class Session extends EventEmitter {
         this.events.on(solidClientAuthnCore.EVENTS.SESSION_EXPIRED, () => this.internalLogout(false));
         this.events.on(solidClientAuthnCore.EVENTS.ERROR, () => this.internalLogout(false));
     }
-    /**
-     * Register a callback function to be called when a user completes login.
-     *
-     * The callback is called when {@link handleIncomingRedirect} completes successfully.
-     *
-     * @param callback The function called when a user completes login.
-     * @deprecated Prefer session.events.on(EVENTS.LOGIN, callback)
-     */
-    onLogin(callback) {
-        this.events.on(solidClientAuthnCore.EVENTS.LOGIN, callback);
-    }
-    /**
-     * Register a callback function to be called when a user logs out:
-     *
-     * @param callback The function called when a user completes logout.
-     * @deprecated Prefer session.events.on(EVENTS.LOGOUT, callback)
-     */
-    onLogout(callback) {
-        this.events.on(solidClientAuthnCore.EVENTS.LOGOUT, callback);
-    }
-    /**
-     * Register a callback function to be called when a user logs out:
-     *
-     * @param callback The function called when an error occurs.
-     * @since 1.11.0
-     * @deprecated Prefer session.events.on(EVENTS.ERROR, callback)
-     */
-    onError(callback) {
-        this.events.on(solidClientAuthnCore.EVENTS.ERROR, callback);
-    }
-    /**
-     * Register a callback function to be called when a session is restored.
-     *
-     * Note: the callback will be called with the saved value of the 'current URL'
-     * at the time the session was restored.
-     *
-     * @param callback The function called when a user's already logged-in session is restored, e.g., after a silent authentication is completed after a page refresh.
-     * @deprecated Prefer session.events.on(EVENTS.SESSION_RESTORED, callback)
-     */
-    onSessionRestore(callback) {
-        this.events.on(solidClientAuthnCore.EVENTS.SESSION_RESTORED, callback);
-    }
-    /**
-     * Register a callback that runs when the session expires and can no longer
-     * make authenticated requests, but following a user logout.
-     * @param callback The function that runs on session expiration.
-     * @since 1.11.0
-     * @deprecated Prefer session.events.on(EVENTS.SESSION_EXPIRED, callback)
-     */
-    onSessionExpiration(callback) {
-        this.events.on(solidClientAuthnCore.EVENTS.SESSION_EXPIRED, callback);
-    }
     setSessionInfo(sessionInfo) {
         this.info.isLoggedIn = sessionInfo.isLoggedIn;
         this.info.webId = sessionInfo.webId;
@@ -1448,7 +1376,7 @@ function getDefaultSession() {
  * @since 1.3.0
  */
 /* eslint-disable-next-line no-shadow */
-const fetch = (...args) => {
+const fetch$1 = (...args) => {
     const session = getDefaultSession();
     return session.fetch(...args);
 };
@@ -1486,43 +1414,6 @@ const handleIncomingRedirect = (...args) => {
     const session = getDefaultSession();
     return session.handleIncomingRedirect(...args);
 };
-/**
- * Register a callback function to be called when a user completes login.
- *
- * The callback is called when {@link handleIncomingRedirect} completes successfully.
- * @since 1.3.0
- *
- * @param callback The function called when a user completes login.
- * @deprecated Prefer events.on(EVENTS.LOGIN, callback)
-
- */
-const onLogin = (...args) => {
-    const session = getDefaultSession();
-    return session.onLogin(...args);
-};
-/**
- * Register a callback function to be called when a user logs out:
- *
- * @param callback The function called when a user completes logout.
- * @since 1.3.0
- * @deprecated Prefer events.on(EVENTS.LOGOUT, callback)
- *
- */
-const onLogout = (...args) => {
-    const session = getDefaultSession();
-    return session.onLogout(...args);
-};
-/**
- * Register a callback function to be called when a session is restored:
- *
- * @param callback The function called when a session is restored.
- * @since 1.3.0
- * @deprecated Prefer events.on(EVENTS.SESSION_RESTORED, callback)
- */
-const onSessionRestore = (...args) => {
-    const session = getDefaultSession();
-    return session.onSessionRestore(...args);
-};
 /**
  * {@link SessionEventEmitter} instance to subscribe to events by the default session.
  *
@@ -1533,30 +1424,26 @@ const events = () => {
 };
 
 Object.defineProperty(exports, 'ConfigurationError', {
-  enumerable: true,
-  get: function () { return solidClientAuthnCore.ConfigurationError; }
+    enumerable: true,
+    get: function () { return solidClientAuthnCore.ConfigurationError; }
 });
 Object.defineProperty(exports, 'EVENTS', {
-  enumerable: true,
-  get: function () { return solidClientAuthnCore.EVENTS; }
+    enumerable: true,
+    get: function () { return solidClientAuthnCore.EVENTS; }
 });
 Object.defineProperty(exports, 'InMemoryStorage', {
-  enumerable: true,
-  get: function () { return solidClientAuthnCore.InMemoryStorage; }
+    enumerable: true,
+    get: function () { return solidClientAuthnCore.InMemoryStorage; }
 });
 Object.defineProperty(exports, 'NotImplementedError', {
-  enumerable: true,
-  get: function () { return solidClientAuthnCore.NotImplementedError; }
+    enumerable: true,
+    get: function () { return solidClientAuthnCore.NotImplementedError; }
 });
 exports.Session = Session;
 exports.events = events;
-exports.fetch = fetch;
-exports.getClientAuthenticationWithDependencies = getClientAuthenticationWithDependencies;
+exports.fetch = fetch$1;
 exports.getDefaultSession = getDefaultSession;
 exports.handleIncomingRedirect = handleIncomingRedirect;
 exports.login = login;
 exports.logout = logout;
-exports.onLogin = onLogin;
-exports.onLogout = onLogout;
-exports.onSessionRestore = onSessionRestore;
 //# sourceMappingURL=index.js.map