@inrupt/solid-client-authn-browser 1.17.5 → 2.1.0

package/dist/index.mjs

@@ -1,9 +1,8 @@
-import { StorageUtility, ClientAuthentication as ClientAuthentication$1, isValidRedirectUrl, EVENTS, removeOpenIdParams, ConfigurationError, handleRegistration, AuthorizationCodeWithPkceOidcHandlerBase, DEFAULT_SCOPES, SessionInfoManagerBase, isSupportedTokenType, clear as clear$1, getUnauthenticatedSession, loadOidcContextFromStorage, buildAuthenticatedFetch, maybeBuildRpInitiatedLogout, AggregateHandler, InMemoryStorage, IWaterfallLogoutHandler, SOLID_CLIENT_AUTHN_KEY_PREFIX, buildProxyHandler } from '@inrupt/solid-client-authn-core';
+import { StorageUtility, ClientAuthentication as ClientAuthentication$1, isValidRedirectUrl, EVENTS, removeOpenIdParams, ConfigurationError, handleRegistration, AuthorizationCodeWithPkceOidcHandlerBase, DEFAULT_SCOPES, SessionInfoManagerBase, isSupportedTokenType, clear as clear$1, getUnauthenticatedSession, loadOidcContextFromStorage, buildAuthenticatedFetch, maybeBuildRpInitiatedLogout, AggregateHandler, isKnownClientType, InMemoryStorage, IWaterfallLogoutHandler, SOLID_CLIENT_AUTHN_KEY_PREFIX } from '@inrupt/solid-client-authn-core';
 export { ConfigurationError, EVENTS, InMemoryStorage, NotImplementedError } from '@inrupt/solid-client-authn-core';
 import { v4 } from 'uuid';
 import EventEmitter from 'events';
-import { normalizeCallbackUrl, OidcClient, clearOidcPersistentStorage, getDpopToken, getBearerToken, registerClient, refresh } from '@inrupt/oidc-client-ext';
-import { fetch as fetch$1 } from '@inrupt/universal-fetch';
+import { normalizeCallbackUrl, OidcClient, clearOidcPersistentStorage, getTokens, registerClient, refresh } from '@inrupt/oidc-client-ext';
 
 //
 // Copyright Inrupt Inc.
@@ -264,8 +263,7 @@ class AuthorizationCodeWithPkceOidcHandler extends AuthorizationCodeWithPkceOidc
             authority: oidcLoginOptions.issuer.toString(),
             client_id: oidcLoginOptions.client.clientId,
             client_secret: oidcLoginOptions.client.clientSecret,
-            redirect_uri: oidcLoginOptions.redirectUrl.toString(),
-            post_logout_redirect_uri: oidcLoginOptions.redirectUrl.toString(),
+            redirect_uri: oidcLoginOptions.redirectUrl,
             response_type: "code",
             scope: DEFAULT_SCOPES,
             filterProtocolClaims: true,
@@ -444,7 +442,7 @@ class IssuerConfigFetcher {
         // Make sure to append a slash at issuer URL, so that the .well-known URL
         // includes the full issuer path. See https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig.
         issuer.endsWith("/") ? issuer : `${issuer}/`).href;
-        const issuerConfigRequestBody = await fetch$1.call(globalThis, openIdConfigUrl);
+        const issuerConfigRequestBody = await fetch(openIdConfigUrl);
         // Check the validity of the fetched config
         try {
             issuerConfig = processConfig(await issuerConfigRequestBody.json());
@@ -626,14 +624,6 @@ class FallbackRedirectHandler {
 // OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 // SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 //
-/**
- * @hidden
- * @packageDocumentation
- */
-// FIXME: The following doesn't work in the browser, it results in all the fetches
-// being unauthenticated. This should be looked into when migrating to universal-fetch.
-// import { fetch } from "cross-fetch";
-const globalFetch = (...args) => fetch$1.call(globalThis, ...args);
 /**
  * @hidden
  */
@@ -681,25 +671,18 @@ class AuthCodeRedirectHandler {
             throw new Error(`The redirect URL for session ${storedSessionId} is missing from storage.`);
         }
         const client = await this.clientRegistrar.getClient({ sessionId: storedSessionId }, issuerConfig);
-        let tokens;
         const tokenCreatedAt = Date.now();
-        if (isDpop) {
-            tokens = await getDpopToken(issuerConfig, client, {
-                grantType: "authorization_code",
-                // We rely on our 'canHandle' function checking that the OAuth 'code'
-                // parameter is present in our query string.
-                code: url.searchParams.get("code"),
-                codeVerifier,
-                redirectUrl: storedRedirectIri,
-            });
-            // Delete oidc-client-specific session information from storage. This is
-            // done automatically when retrieving a bearer token, but since the DPoP
-            // binding uses our custom code, this needs to be done manually.
-            window.localStorage.removeItem(`oidc.${oauthState}`);
-        }
-        else {
-            tokens = await getBearerToken(url.toString());
-        }
+        const tokens = await getTokens(issuerConfig, client, {
+            grantType: "authorization_code",
+            // We rely on our 'canHandle' function checking that the OAuth 'code'
+            // parameter is present in our query string.
+            code: url.searchParams.get("code"),
+            codeVerifier,
+            redirectUrl: storedRedirectIri,
+        }, isDpop);
+        // Delete oidc-client-specific session information from storage. oidc-client
+        // is no longer used for the token exchange, so it doesn't perform this automatically.
+        window.localStorage.removeItem(`oidc.${oauthState}`);
         let refreshOptions;
         if (tokens.refreshToken !== undefined) {
             refreshOptions = {
@@ -708,7 +691,7 @@ class AuthCodeRedirectHandler {
                 tokenRefresher: this.tokerRefresher,
             };
         }
-        const authFetch = await buildAuthenticatedFetch(globalFetch, tokens.accessToken, {
+        const authFetch = await buildAuthenticatedFetch(tokens.accessToken, {
             dpopKey: tokens.dpopKey,
             refreshOptions,
             eventEmitter,
@@ -869,25 +852,27 @@ class ClientRegistrar {
     }
     async getClient(options, issuerConfig) {
         // If client secret and/or client id are stored in storage, use those.
-        const [storedClientId, storedClientSecret,
-        // storedClientName,
-        ] = await Promise.all([
+        const [storedClientId, storedClientSecret, storedClientName, storedClientType,] = await Promise.all([
             this.storageUtility.getForUser(options.sessionId, "clientId", {
                 secure: false,
             }),
             this.storageUtility.getForUser(options.sessionId, "clientSecret", {
                 secure: false,
             }),
-            // this.storageUtility.getForUser(options.sessionId, "clientName", {
-            //   // FIXME: figure out how to persist secure storage at reload
-            //   secure: false,
-            // }),
+            this.storageUtility.getForUser(options.sessionId, "clientName", {
+                secure: false,
+            }),
+            this.storageUtility.getForUser(options.sessionId, "clientType", {
+                secure: false,
+            }),
         ]);
-        if (storedClientId) {
+        if (storedClientId && isKnownClientType(storedClientType)) {
             return {
                 clientId: storedClientId,
                 clientSecret: storedClientSecret,
-                clientType: "dynamic",
+                clientName: storedClientName,
+                // Note: static clients are not applicable in a browser context.
+                clientType: storedClientType,
             };
         }
         try {
@@ -895,6 +880,7 @@ class ClientRegistrar {
             // Save info
             const infoToSave = {
                 clientId: registeredClient.clientId,
+                clientType: "dynamic",
             };
             if (registeredClient.clientSecret) {
                 infoToSave.clientSecret = registeredClient.clientSecret;
@@ -1042,9 +1028,8 @@ class TokenRefresher {
 // SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 //
 /**
- *
  * @param dependencies
- * @deprecated This function will be removed from the external API in an upcoming release.
+ * @hidden
  */
 function getClientAuthenticationWithDependencies(dependencies) {
     const inMemoryStorage = new InMemoryStorage();
@@ -1139,7 +1124,7 @@ function isLoggedIn(sessionInfo) {
 /**
  * A {@link Session} object represents a user's session on an application. The session holds state, as it stores information enabling acces to private resources after login for instance.
  */
-class Session extends EventEmitter {
+class Session {
     /**
      * Session object constructor. Typically called as follows:
      *
@@ -1156,7 +1141,6 @@ class Session extends EventEmitter {
      *
      */
     constructor(sessionOptions = {}, sessionId = undefined) {
-        super();
         this.tokenRequestInProgress = false;
         /**
          * Triggers the login process. Note that this method will redirect the user away from your app.
@@ -1247,7 +1231,7 @@ class Session extends EventEmitter {
          * Completes the login process by processing the information provided by the
          * Solid identity provider through redirect.
          *
-         * @param options See {@see IHandleIncomingRedirectOptions}.
+         * @param options See {@link IHandleIncomingRedirectOptions}.
          */
         this.handleIncomingRedirect = async (inputOptions = {}) => {
             var _a;
@@ -1300,11 +1284,7 @@ class Session extends EventEmitter {
             this.tokenRequestInProgress = false;
             return sessionInfo;
         };
-        // Until Session no longer implements EventEmitter, this.events is just a proxy
-        // to this (with some interface filtering). When we make the breaking change,
-        // this.events will be a regular EventEmitter (implementing ISessionEventEmitter):
-        // this.events = new EventEmitter();
-        this.events = new Proxy(this, buildProxyHandler(Session.prototype, "events only implements ISessionEventListener"));
+        this.events = new EventEmitter();
         if (sessionOptions.clientAuthentication) {
             this.clientAuthentication = sessionOptions.clientAuthentication;
         }
@@ -1338,58 +1318,6 @@ class Session extends EventEmitter {
         this.events.on(EVENTS.SESSION_EXPIRED, () => this.internalLogout(false));
         this.events.on(EVENTS.ERROR, () => this.internalLogout(false));
     }
-    /**
-     * Register a callback function to be called when a user completes login.
-     *
-     * The callback is called when {@link handleIncomingRedirect} completes successfully.
-     *
-     * @param callback The function called when a user completes login.
-     * @deprecated Prefer session.events.on(EVENTS.LOGIN, callback)
-     */
-    onLogin(callback) {
-        this.events.on(EVENTS.LOGIN, callback);
-    }
-    /**
-     * Register a callback function to be called when a user logs out:
-     *
-     * @param callback The function called when a user completes logout.
-     * @deprecated Prefer session.events.on(EVENTS.LOGOUT, callback)
-     */
-    onLogout(callback) {
-        this.events.on(EVENTS.LOGOUT, callback);
-    }
-    /**
-     * Register a callback function to be called when a user logs out:
-     *
-     * @param callback The function called when an error occurs.
-     * @since 1.11.0
-     * @deprecated Prefer session.events.on(EVENTS.ERROR, callback)
-     */
-    onError(callback) {
-        this.events.on(EVENTS.ERROR, callback);
-    }
-    /**
-     * Register a callback function to be called when a session is restored.
-     *
-     * Note: the callback will be called with the saved value of the 'current URL'
-     * at the time the session was restored.
-     *
-     * @param callback The function called when a user's already logged-in session is restored, e.g., after a silent authentication is completed after a page refresh.
-     * @deprecated Prefer session.events.on(EVENTS.SESSION_RESTORED, callback)
-     */
-    onSessionRestore(callback) {
-        this.events.on(EVENTS.SESSION_RESTORED, callback);
-    }
-    /**
-     * Register a callback that runs when the session expires and can no longer
-     * make authenticated requests, but following a user logout.
-     * @param callback The function that runs on session expiration.
-     * @since 1.11.0
-     * @deprecated Prefer session.events.on(EVENTS.SESSION_EXPIRED, callback)
-     */
-    onSessionExpiration(callback) {
-        this.events.on(EVENTS.SESSION_EXPIRED, callback);
-    }
     setSessionInfo(sessionInfo) {
         this.info.isLoggedIn = sessionInfo.isLoggedIn;
         this.info.webId = sessionInfo.webId;
@@ -1447,7 +1375,7 @@ function getDefaultSession() {
  * @since 1.3.0
  */
 /* eslint-disable-next-line no-shadow */
-const fetch = (...args) => {
+const fetch$1 = (...args) => {
     const session = getDefaultSession();
     return session.fetch(...args);
 };
@@ -1485,43 +1413,6 @@ const handleIncomingRedirect = (...args) => {
     const session = getDefaultSession();
     return session.handleIncomingRedirect(...args);
 };
-/**
- * Register a callback function to be called when a user completes login.
- *
- * The callback is called when {@link handleIncomingRedirect} completes successfully.
- * @since 1.3.0
- *
- * @param callback The function called when a user completes login.
- * @deprecated Prefer events.on(EVENTS.LOGIN, callback)
-
- */
-const onLogin = (...args) => {
-    const session = getDefaultSession();
-    return session.onLogin(...args);
-};
-/**
- * Register a callback function to be called when a user logs out:
- *
- * @param callback The function called when a user completes logout.
- * @since 1.3.0
- * @deprecated Prefer events.on(EVENTS.LOGOUT, callback)
- *
- */
-const onLogout = (...args) => {
-    const session = getDefaultSession();
-    return session.onLogout(...args);
-};
-/**
- * Register a callback function to be called when a session is restored:
- *
- * @param callback The function called when a session is restored.
- * @since 1.3.0
- * @deprecated Prefer events.on(EVENTS.SESSION_RESTORED, callback)
- */
-const onSessionRestore = (...args) => {
-    const session = getDefaultSession();
-    return session.onSessionRestore(...args);
-};
 /**
  * {@link SessionEventEmitter} instance to subscribe to events by the default session.
  *
@@ -1531,5 +1422,5 @@ const events = () => {
     return getDefaultSession().events;
 };
 
-export { Session, events, fetch, getClientAuthenticationWithDependencies, getDefaultSession, handleIncomingRedirect, login, logout, onLogin, onLogout, onSessionRestore };
+export { Session, events, fetch$1 as fetch, getDefaultSession, handleIncomingRedirect, login, logout };
 //# sourceMappingURL=index.mjs.map