@inrupt/solid-client-authn-browser 2.3.0 → 2.4.1

package/dist/index.mjs

@@ -61,82 +61,77 @@ class StorageUtilityBrowser extends StorageUtility {
  * @hidden
  */
 class ClientAuthentication extends ClientAuthentication$1 {
-    constructor() {
-        super(...arguments);
-        // Define these functions as properties so that they don't get accidentally re-bound.
-        // Isn't Javascript fun?
-        this.login = async (options, eventEmitter) => {
-            var _a, _b;
-            // In order to get a clean start, make sure that the session is logged out
-            // on login.
-            // But we may want to preserve our client application info, particularly if
-            // we used Dynamic Client Registration to register (since we don't
-            // necessarily want the user to have to register this app each time they
-            // login).
+    // Define these functions as properties so that they don't get accidentally re-bound.
+    // Isn't Javascript fun?
+    login = async (options, eventEmitter) => {
+        // In order to get a clean start, make sure that the session is logged out
+        // on login, except when doing a silent login so that Dynamic Client information
+        // is preserved.
+        if (options.prompt !== "none") {
             await this.sessionInfoManager.clear(options.sessionId);
-            // In the case of the user hitting the 'back' button in their browser, they
-            // could return to a previous redirect URL that contains OIDC params that
-            // are now longer valid. To be safe, strip relevant params now.
-            // If the user is providing a redirect IRI, it should not be modified, so
-            // normalization only applies if we default to the current location (which is
-            // a bad practice and should be discouraged).
-            const redirectUrl = (_a = options.redirectUrl) !== null && _a !== void 0 ? _a : normalizeCallbackUrl(window.location.href);
-            if (!isValidRedirectUrl(redirectUrl)) {
-                throw new Error(`${redirectUrl} is not a valid redirect URL, it is either a malformed IRI, includes a hash fragment, or reserved query parameters ('code' or 'state').`);
-            }
-            await this.loginHandler.handle({
-                ...options,
-                redirectUrl,
-                // If no clientName is provided, the clientId may be used instead.
-                clientName: (_b = options.clientName) !== null && _b !== void 0 ? _b : options.clientId,
-                eventEmitter,
-            });
-        };
-        // Collects session information from storage, and returns them. Returns null
-        // if the expected information cannot be found.
-        // Note that the ID token is not stored, which means the session information
-        // cannot be validated at this point.
-        this.validateCurrentSession = async (currentSessionId) => {
-            const sessionInfo = await this.sessionInfoManager.get(currentSessionId);
-            if (sessionInfo === undefined ||
-                sessionInfo.clientAppId === undefined ||
-                sessionInfo.issuer === undefined) {
-                return null;
-            }
-            return sessionInfo;
-        };
-        this.handleIncomingRedirect = async (url, eventEmitter) => {
-            try {
-                const redirectInfo = await this.redirectHandler.handle(url, eventEmitter, undefined);
-                // The `FallbackRedirectHandler` directly returns the global `fetch` for
-                // his value, so we should ensure it's bound to `window` rather than to
-                // ClientAuthentication, to avoid the following error:
-                // > 'fetch' called on an object that does not implement interface Window.
-                this.fetch = redirectInfo.fetch.bind(window);
-                this.boundLogout = redirectInfo.getLogoutUrl;
-                // Strip the oauth params:
-                await this.cleanUrlAfterRedirect(url);
-                return {
-                    isLoggedIn: redirectInfo.isLoggedIn,
-                    webId: redirectInfo.webId,
-                    sessionId: redirectInfo.sessionId,
-                    expirationDate: redirectInfo.expirationDate,
-                    clientAppId: redirectInfo.clientAppId,
-                };
-            }
-            catch (err) {
-                // Strip the oauth params:
-                await this.cleanUrlAfterRedirect(url);
-                // FIXME: EVENTS.ERROR should be errorCode, errorDescription
-                //
-                // I'm not sure if "redirect" is a good error code, and in theory `err`
-                // maybe an Error object and not a string; Maybe we want to just hardcode
-                // a description instead?
-                eventEmitter.emit(EVENTS.ERROR, "redirect", err);
-                return undefined;
-            }
-        };
-    }
+        }
+        // In the case of the user hitting the 'back' button in their browser, they
+        // could return to a previous redirect URL that contains OIDC params that
+        // are now longer valid. To be safe, strip relevant params now.
+        // If the user is providing a redirect IRI, it should not be modified, so
+        // normalization only applies if we default to the current location (which is
+        // a bad practice and should be discouraged).
+        const redirectUrl = options.redirectUrl ?? normalizeCallbackUrl(window.location.href);
+        if (!isValidRedirectUrl(redirectUrl)) {
+            throw new Error(`${redirectUrl} is not a valid redirect URL, it is either a malformed IRI, includes a hash fragment, or reserved query parameters ('code' or 'state').`);
+        }
+        await this.loginHandler.handle({
+            ...options,
+            redirectUrl,
+            // If no clientName is provided, the clientId may be used instead.
+            clientName: options.clientName ?? options.clientId,
+            eventEmitter,
+        });
+    };
+    // Collects session information from storage, and returns them. Returns null
+    // if the expected information cannot be found.
+    // Note that the ID token is not stored, which means the session information
+    // cannot be validated at this point.
+    validateCurrentSession = async (currentSessionId) => {
+        const sessionInfo = await this.sessionInfoManager.get(currentSessionId);
+        if (sessionInfo === undefined ||
+            sessionInfo.clientAppId === undefined ||
+            sessionInfo.issuer === undefined) {
+            return null;
+        }
+        return sessionInfo;
+    };
+    handleIncomingRedirect = async (url, eventEmitter) => {
+        try {
+            const redirectInfo = await this.redirectHandler.handle(url, eventEmitter, undefined);
+            // The `FallbackRedirectHandler` directly returns the global `fetch` for
+            // his value, so we should ensure it's bound to `window` rather than to
+            // ClientAuthentication, to avoid the following error:
+            // > 'fetch' called on an object that does not implement interface Window.
+            this.fetch = redirectInfo.fetch.bind(window);
+            this.boundLogout = redirectInfo.getLogoutUrl;
+            // Strip the oauth params:
+            await this.cleanUrlAfterRedirect(url);
+            return {
+                isLoggedIn: redirectInfo.isLoggedIn,
+                webId: redirectInfo.webId,
+                sessionId: redirectInfo.sessionId,
+                expirationDate: redirectInfo.expirationDate,
+                clientAppId: redirectInfo.clientAppId,
+            };
+        }
+        catch (err) {
+            // Strip the oauth params:
+            await this.cleanUrlAfterRedirect(url);
+            // FIXME: EVENTS.ERROR should be errorCode, errorDescription
+            //
+            // I'm not sure if "redirect" is a good error code, and in theory `err`
+            // maybe an Error object and not a string; Maybe we want to just hardcode
+            // a description instead?
+            eventEmitter.emit(EVENTS.ERROR, "redirect", err);
+            return undefined;
+        }
+    };
     async cleanUrlAfterRedirect(url) {
         const cleanedUpUrl = removeOpenIdParams(url).href;
         // Remove OAuth-specific query params (since the login flow finishes with
@@ -189,6 +184,10 @@ function hasRedirectUrl(options) {
  * @hidden
  */
 class OidcLoginHandler {
+    storageUtility;
+    oidcHandler;
+    issuerConfigFetcher;
+    clientRegistrar;
     constructor(storageUtility, oidcHandler, issuerConfigFetcher, clientRegistrar) {
         this.storageUtility = storageUtility;
         this.oidcHandler = oidcHandler;
@@ -258,7 +257,6 @@ class OidcLoginHandler {
  */
 class AuthorizationCodeWithPkceOidcHandler extends AuthorizationCodeWithPkceOidcHandlerBase {
     async handle(oidcLoginOptions) {
-        var _a;
         /* eslint-disable camelcase */
         const oidcOptions = {
             authority: oidcLoginOptions.issuer.toString(),
@@ -273,7 +271,7 @@ class AuthorizationCodeWithPkceOidcHandler extends AuthorizationCodeWithPkceOidc
             // profile referenced by the WebId.
             loadUserInfo: false,
             code_verifier: true,
-            prompt: (_a = oidcLoginOptions.prompt) !== null && _a !== void 0 ? _a : "consent",
+            prompt: oidcLoginOptions.prompt ?? "consent",
         };
         /* eslint-enable camelcase */
         const oidcClientLibrary = new OidcClient(oidcOptions);
@@ -428,6 +426,7 @@ function processConfig(config) {
  * @hidden
  */
 class IssuerConfigFetcher {
+    storageUtility;
     constructor(storageUtility) {
         this.storageUtility = storageUtility;
         this.storageUtility = storageUtility;
@@ -546,7 +545,7 @@ class SessionInfoManager extends SessionInfoManagerBase {
             clientAppId: clientId,
             clientAppSecret: clientSecret,
             // Default the token type to DPoP if unspecified.
-            tokenType: tokenType !== null && tokenType !== void 0 ? tokenType : "DPoP",
+            tokenType: tokenType ?? "DPoP",
         };
     }
     /**
@@ -629,6 +628,11 @@ class FallbackRedirectHandler {
  * @hidden
  */
 class AuthCodeRedirectHandler {
+    storageUtility;
+    sessionInfoManager;
+    issuerConfigFetcher;
+    clientRegistrar;
+    tokerRefresher;
     constructor(storageUtility, sessionInfoManager, issuerConfigFetcher, clientRegistrar, tokerRefresher) {
         this.storageUtility = storageUtility;
         this.sessionInfoManager = sessionInfoManager;
@@ -692,7 +696,7 @@ class AuthCodeRedirectHandler {
                 tokenRefresher: this.tokerRefresher,
             };
         }
-        const authFetch = await buildAuthenticatedFetch(tokens.accessToken, {
+        const authFetch = buildAuthenticatedFetch(tokens.accessToken, {
             dpopKey: tokens.dpopKey,
             refreshOptions,
             eventEmitter,
@@ -844,19 +848,23 @@ class Redirector {
  * @hidden
  */
 class ClientRegistrar {
+    storageUtility;
     constructor(storageUtility) {
         this.storageUtility = storageUtility;
         this.storageUtility = storageUtility;
     }
     async getClient(options, issuerConfig) {
         // If client secret and/or client id are stored in storage, use those.
-        const [storedClientId, storedClientSecret, storedClientName, storedClientType,] = await Promise.all([
+        const [storedClientId, storedClientSecret, expiresAt, storedClientName, storedClientType,] = await Promise.all([
             this.storageUtility.getForUser(options.sessionId, "clientId", {
                 secure: false,
             }),
             this.storageUtility.getForUser(options.sessionId, "clientSecret", {
                 secure: false,
             }),
+            this.storageUtility.getForUser(options.sessionId, "expiresAt", {
+                secure: false,
+            }),
             this.storageUtility.getForUser(options.sessionId, "clientName", {
                 secure: false,
             }),
@@ -864,14 +872,30 @@ class ClientRegistrar {
                 secure: false,
             }),
         ]);
-        if (storedClientId && isKnownClientType(storedClientType)) {
-            return {
-                clientId: storedClientId,
-                clientSecret: storedClientSecret,
-                clientName: storedClientName,
-                // Note: static clients are not applicable in a browser context.
-                clientType: storedClientType,
-            };
+        // -1 is used as a default to identify legacy cases when a value should
+        // have been stored, but wasn't. It will be treated as an expired client.
+        const expirationDate = expiresAt !== undefined ? Number.parseInt(expiresAt, 10) : -1;
+        // Expiration is only applicable to confidential clients.
+        // Note that Date.now() is in milliseconds, and expirationDate in seconds.
+        const expired = storedClientSecret !== undefined &&
+            Math.floor(Date.now() / 1000) > expirationDate;
+        if (storedClientId && isKnownClientType(storedClientType) && !expired) {
+            return storedClientSecret !== undefined
+                ? {
+                    clientId: storedClientId,
+                    clientSecret: storedClientSecret,
+                    clientName: storedClientName,
+                    // Note: static clients are not applicable in a browser context.
+                    clientType: "dynamic",
+                    expiresAt: expirationDate,
+                }
+                : {
+                    clientId: storedClientId,
+                    clientName: storedClientName,
+                    // Note: static clients are not applicable in a browser context.
+                    clientType: storedClientType,
+                    // The type assertion is required even though the type should match the declaration.
+                };
         }
         try {
             const registeredClient = await registerClient(options, issuerConfig);
@@ -880,8 +904,9 @@ class ClientRegistrar {
                 clientId: registeredClient.clientId,
                 clientType: "dynamic",
             };
-            if (registeredClient.clientSecret) {
+            if (registeredClient.clientSecret !== undefined) {
                 infoToSave.clientSecret = registeredClient.clientSecret;
+                infoToSave.expiresAt = String(registeredClient.expiresAt);
             }
             if (registeredClient.idTokenSignedResponseAlg) {
                 infoToSave.idTokenSignedResponseAlg =
@@ -896,7 +921,7 @@ class ClientRegistrar {
             return registeredClient;
         }
         catch (error) {
-            throw new Error(`Client registration failed: [${error}]`);
+            throw new Error(`Client registration failed.`, { cause: error });
         }
     }
 }
@@ -975,6 +1000,9 @@ class ErrorOidcHandler {
  * @hidden
  */
 class TokenRefresher {
+    storageUtility;
+    issuerConfigFetcher;
+    clientRegistrar;
     constructor(storageUtility, issuerConfigFetcher, clientRegistrar) {
         this.storageUtility = storageUtility;
         this.issuerConfigFetcher = issuerConfigFetcher;
@@ -996,7 +1024,7 @@ class TokenRefresher {
         }
         const tokenSet = await refresh(refreshToken, oidcContext.issuerConfig, clientInfo, dpopKey);
         if (tokenSet.refreshToken !== undefined) {
-            eventEmitter === null || eventEmitter === void 0 ? void 0 : eventEmitter.emit(EVENTS.NEW_REFRESH_TOKEN, tokenSet.refreshToken);
+            eventEmitter?.emit(EVENTS.NEW_REFRESH_TOKEN, tokenSet.refreshToken);
         }
         return tokenSet;
     }
@@ -1092,7 +1120,6 @@ const KEY_CURRENT_URL = `${SOLID_CLIENT_AUTHN_KEY_PREFIX}currentUrl`;
 // SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 //
 async function silentlyAuthenticate(sessionId, clientAuthn, session) {
-    var _a;
     const storedSessionInfo = await clientAuthn.validateCurrentSession(sessionId);
     if (storedSessionInfo !== null) {
         // It can be really useful to save the user's current browser location,
@@ -1107,19 +1134,31 @@ async function silentlyAuthenticate(sessionId, clientAuthn, session) {
             redirectUrl: storedSessionInfo.redirectUrl,
             clientId: storedSessionInfo.clientAppId,
             clientSecret: storedSessionInfo.clientAppSecret,
-            tokenType: (_a = storedSessionInfo.tokenType) !== null && _a !== void 0 ? _a : "DPoP",
+            tokenType: storedSessionInfo.tokenType ?? "DPoP",
         }, session.events);
         return true;
     }
     return false;
 }
 function isLoggedIn(sessionInfo) {
-    return !!(sessionInfo === null || sessionInfo === void 0 ? void 0 : sessionInfo.isLoggedIn);
+    return !!sessionInfo?.isLoggedIn;
 }
 /**
  * A {@link Session} object represents a user's session on an application. The session holds state, as it stores information enabling access to private resources after login for instance.
  */
 class Session {
+    /**
+     * Information regarding the current session.
+     */
+    info;
+    /**
+     * Session attribute exposing the EventEmitter interface, to listen on session
+     * events such as login, logout, etc.
+     * @since 1.15.0
+     */
+    events;
+    clientAuthentication;
+    tokenRequestInProgress = false;
     /**
      * Session object constructor. Typically called as follows:
      *
@@ -1136,149 +1175,6 @@ class Session {
      *
      */
     constructor(sessionOptions = {}, sessionId = undefined) {
-        this.tokenRequestInProgress = false;
-        /**
-         * Triggers the login process. Note that this method will redirect the user away from your app.
-         *
-         * @param options Parameter to customize the login behaviour. In particular, two options are mandatory: `options.oidcIssuer`, the user's identity provider, and `options.redirectUrl`, the URL to which the user will be redirected after logging in their identity provider.
-         * @returns This method should redirect the user away from the app: it does not return anything. The login process is completed by {@linkcode handleIncomingRedirect}.
-         */
-        // Define these functions as properties so that they don't get accidentally re-bound.
-        // Isn't Javascript fun?
-        this.login = async (options) => {
-            var _a;
-            await this.clientAuthentication.login({
-                sessionId: this.info.sessionId,
-                ...options,
-                // Defaults the token type to DPoP
-                tokenType: (_a = options.tokenType) !== null && _a !== void 0 ? _a : "DPoP",
-            }, this.events);
-            // `login` redirects the user away from the app,
-            // so unless it throws an error, there is no code that should run afterwards
-            // (since there is no "after" in the lifetime of the script).
-            // Hence, this Promise never resolves:
-            return new Promise(() => { });
-        };
-        /**
-         * Fetches data using available login information. If the user is not logged in, this will behave as a regular `fetch`. The signature of this method is identical to the [canonical `fetch`](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API).
-         *
-         * @param url The URL from which data should be fetched.
-         * @param init Optional parameters customizing the request, by specifying an HTTP method, headers, a body, etc. Follows the [WHATWG Fetch Standard](https://fetch.spec.whatwg.org/).
-         */
-        this.fetch = (url, init) => this.clientAuthentication.fetch(url, init);
-        /**
-         * An internal logout function, to control whether or not the logout signal
-         * should be sent, i.e. if the logout was user-initiated or is the result of
-         * an external event.
-         *
-         * @hidden
-         */
-        this.internalLogout = async (emitSignal, options) => {
-            // Clearing this value means that silent refresh will no longer be attempted.
-            // In particular, in the case of a silent authentication error it prevents
-            // from getting stuck in an authentication retries loop.
-            window.localStorage.removeItem(KEY_CURRENT_SESSION);
-            await this.clientAuthentication.logout(this.info.sessionId, options);
-            this.info.isLoggedIn = false;
-            if (emitSignal) {
-                this.events.emit(EVENTS.LOGOUT);
-            }
-        };
-        /**
-         * Logs the user out of the application.
-         *
-         * There are 2 types of logout supported by this library,
-         * `app` logout and `idp` logout.
-         *
-         * App logout will log the user out within the application
-         * by clearing any session data from the browser. It does
-         * not log the user out of their Solid identity provider,
-         * and should not redirect the user away.
-         * App logout can be performed as follows:
-         * ```typescript
-         * await session.logout({ logoutType: 'app' });
-         * ```
-         *
-         * IDP logout will log the user out of their Solid identity provider,
-         * and will redirect the user away from the application to do so. In order
-         * for users to be redirected back to `postLogoutUrl` you MUST include the
-         * `postLogoutUrl` value in the `post_logout_redirect_uris` field in the
-         * [Client ID Document](https://docs.inrupt.com/ess/latest/security/authentication/#client-identifier-client-id).
-         * IDP logout can be performed as follows:
-         * ```typescript
-         * await session.logout({
-         *  logoutType: 'idp',
-         *  // An optional URL to redirect to after logout has completed;
-         *  // this MUST match a logout URL listed in the Client ID Document
-         *  // of the application that is logged in.
-         *  // If the application is logged in with a Client ID that is not
-         *  // a URI dereferencing to a Client ID Document then users will
-         *  // not be redirected back to the `postLogoutUrl` after logout.
-         *  postLogoutUrl: 'https://example.com/logout',
-         *  // An optional value to be included in the query parameters
-         *  // when the IDP provider redirects the user to the postLogoutRedirectUrl.
-         *  state: "my-state"
-         * });
-         * ```
-         */
-        this.logout = async (options) => this.internalLogout(true, options);
-        /**
-         * Completes the login process by processing the information provided by the
-         * Solid identity provider through redirect.
-         *
-         * @param options See {@link IHandleIncomingRedirectOptions}.
-         */
-        this.handleIncomingRedirect = async (inputOptions = {}) => {
-            var _a;
-            if (this.info.isLoggedIn) {
-                return this.info;
-            }
-            if (this.tokenRequestInProgress) {
-                return undefined;
-            }
-            const options = typeof inputOptions === "string" ? { url: inputOptions } : inputOptions;
-            const url = (_a = options.url) !== null && _a !== void 0 ? _a : window.location.href;
-            this.tokenRequestInProgress = true;
-            const sessionInfo = await this.clientAuthentication.handleIncomingRedirect(url, this.events);
-            if (isLoggedIn(sessionInfo)) {
-                this.setSessionInfo(sessionInfo);
-                const currentUrl = window.localStorage.getItem(KEY_CURRENT_URL);
-                if (currentUrl === null) {
-                    // The login event can only be triggered **after** the user has been
-                    // redirected from the IdP with access and ID tokens.
-                    this.events.emit(EVENTS.LOGIN);
-                }
-                else {
-                    // If an URL is stored in local storage, we are being logged in after a
-                    // silent authentication, so remove our currently stored URL location
-                    // to clean up our state now that we are completing the re-login process.
-                    window.localStorage.removeItem(KEY_CURRENT_URL);
-                    this.events.emit(EVENTS.SESSION_RESTORED, currentUrl);
-                }
-            }
-            else if (options.restorePreviousSession === true) {
-                // Silent authentication happens after a refresh, which means there are no
-                // OAuth params in the current location IRI. It can only succeed if a session
-                // was previously logged in, in which case its ID will be present with a known
-                // identifier in local storage.
-                // Check if we have a locally stored session ID...
-                const storedSessionId = window.localStorage.getItem(KEY_CURRENT_SESSION);
-                // ...if not, then there is no ID token, and so silent authentication cannot happen, but
-                // if we do have a stored session ID, attempt to re-authenticate now silently.
-                if (storedSessionId !== null) {
-                    const attemptedSilentAuthentication = await silentlyAuthenticate(storedSessionId, this.clientAuthentication, this);
-                    // At this point, we know that the main window will imminently be redirected.
-                    // However, this redirect is asynchronous and there is no way to halt execution
-                    // until it happens precisely. That's why the current Promise simply does not
-                    // resolve.
-                    if (attemptedSilentAuthentication) {
-                        return new Promise(() => { });
-                    }
-                }
-            }
-            this.tokenRequestInProgress = false;
-            return sessionInfo;
-        };
         this.events = new EventEmitter();
         if (sessionOptions.clientAuthentication) {
             this.clientAuthentication = sessionOptions.clientAuthentication;
@@ -1302,7 +1198,7 @@ class Session {
         }
         else {
             this.info = {
-                sessionId: sessionId !== null && sessionId !== void 0 ? sessionId : v4(),
+                sessionId: sessionId ?? v4(),
                 isLoggedIn: false,
             };
         }
@@ -1314,6 +1210,146 @@ class Session {
         this.events.on(EVENTS.SESSION_EXPIRED, () => this.internalLogout(false));
         this.events.on(EVENTS.ERROR, () => this.internalLogout(false));
     }
+    /**
+     * Triggers the login process. Note that this method will redirect the user away from your app.
+     *
+     * @param options Parameter to customize the login behaviour. In particular, two options are mandatory: `options.oidcIssuer`, the user's identity provider, and `options.redirectUrl`, the URL to which the user will be redirected after logging in their identity provider.
+     * @returns This method should redirect the user away from the app: it does not return anything. The login process is completed by {@linkcode handleIncomingRedirect}.
+     */
+    // Define these functions as properties so that they don't get accidentally re-bound.
+    // Isn't Javascript fun?
+    login = async (options) => {
+        await this.clientAuthentication.login({
+            sessionId: this.info.sessionId,
+            ...options,
+            // Defaults the token type to DPoP
+            tokenType: options.tokenType ?? "DPoP",
+        }, this.events);
+        // `login` redirects the user away from the app,
+        // so unless it throws an error, there is no code that should run afterwards
+        // (since there is no "after" in the lifetime of the script).
+        // Hence, this Promise never resolves:
+        return new Promise(() => { });
+    };
+    /**
+     * Fetches data using available login information. If the user is not logged in, this will behave as a regular `fetch`. The signature of this method is identical to the [canonical `fetch`](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API).
+     *
+     * @param url The URL from which data should be fetched.
+     * @param init Optional parameters customizing the request, by specifying an HTTP method, headers, a body, etc. Follows the [WHATWG Fetch Standard](https://fetch.spec.whatwg.org/).
+     */
+    fetch = (url, init) => this.clientAuthentication.fetch(url, init);
+    /**
+     * An internal logout function, to control whether or not the logout signal
+     * should be sent, i.e. if the logout was user-initiated or is the result of
+     * an external event.
+     *
+     * @hidden
+     */
+    internalLogout = async (emitSignal, options) => {
+        // Clearing this value means that silent refresh will no longer be attempted.
+        // In particular, in the case of a silent authentication error it prevents
+        // from getting stuck in an authentication retries loop.
+        window.localStorage.removeItem(KEY_CURRENT_SESSION);
+        await this.clientAuthentication.logout(this.info.sessionId, options);
+        this.info.isLoggedIn = false;
+        if (emitSignal) {
+            this.events.emit(EVENTS.LOGOUT);
+        }
+    };
+    /**
+     * Logs the user out of the application.
+     *
+     * There are 2 types of logout supported by this library,
+     * `app` logout and `idp` logout.
+     *
+     * App logout will log the user out within the application
+     * by clearing any session data from the browser. It does
+     * not log the user out of their Solid identity provider,
+     * and should not redirect the user away.
+     * App logout can be performed as follows:
+     * ```typescript
+     * await session.logout({ logoutType: 'app' });
+     * ```
+     *
+     * IDP logout will log the user out of their Solid identity provider,
+     * and will redirect the user away from the application to do so. In order
+     * for users to be redirected back to `postLogoutUrl` you MUST include the
+     * `postLogoutUrl` value in the `post_logout_redirect_uris` field in the
+     * [Client ID Document](https://docs.inrupt.com/ess/latest/security/authentication/#client-identifier-client-id).
+     * IDP logout can be performed as follows:
+     * ```typescript
+     * await session.logout({
+     *  logoutType: 'idp',
+     *  // An optional URL to redirect to after logout has completed;
+     *  // this MUST match a logout URL listed in the Client ID Document
+     *  // of the application that is logged in.
+     *  // If the application is logged in with a Client ID that is not
+     *  // a URI dereferencing to a Client ID Document then users will
+     *  // not be redirected back to the `postLogoutUrl` after logout.
+     *  postLogoutUrl: 'https://example.com/logout',
+     *  // An optional value to be included in the query parameters
+     *  // when the IDP provider redirects the user to the postLogoutRedirectUrl.
+     *  state: "my-state"
+     * });
+     * ```
+     */
+    logout = async (options) => this.internalLogout(true, options);
+    /**
+     * Completes the login process by processing the information provided by the
+     * Solid identity provider through redirect.
+     *
+     * @param options See {@link IHandleIncomingRedirectOptions}.
+     */
+    handleIncomingRedirect = async (inputOptions = {}) => {
+        if (this.info.isLoggedIn) {
+            return this.info;
+        }
+        if (this.tokenRequestInProgress) {
+            return undefined;
+        }
+        const options = typeof inputOptions === "string" ? { url: inputOptions } : inputOptions;
+        const url = options.url ?? window.location.href;
+        this.tokenRequestInProgress = true;
+        const sessionInfo = await this.clientAuthentication.handleIncomingRedirect(url, this.events);
+        if (isLoggedIn(sessionInfo)) {
+            this.setSessionInfo(sessionInfo);
+            const currentUrl = window.localStorage.getItem(KEY_CURRENT_URL);
+            if (currentUrl === null) {
+                // The login event can only be triggered **after** the user has been
+                // redirected from the IdP with access and ID tokens.
+                this.events.emit(EVENTS.LOGIN);
+            }
+            else {
+                // If an URL is stored in local storage, we are being logged in after a
+                // silent authentication, so remove our currently stored URL location
+                // to clean up our state now that we are completing the re-login process.
+                window.localStorage.removeItem(KEY_CURRENT_URL);
+                this.events.emit(EVENTS.SESSION_RESTORED, currentUrl);
+            }
+        }
+        else if (options.restorePreviousSession === true) {
+            // Silent authentication happens after a refresh, which means there are no
+            // OAuth params in the current location IRI. It can only succeed if a session
+            // was previously logged in, in which case its ID will be present with a known
+            // identifier in local storage.
+            // Check if we have a locally stored session ID...
+            const storedSessionId = window.localStorage.getItem(KEY_CURRENT_SESSION);
+            // ...if not, then there is no ID token, and so silent authentication cannot happen, but
+            // if we do have a stored session ID, attempt to re-authenticate now silently.
+            if (storedSessionId !== null) {
+                const attemptedSilentAuthentication = await silentlyAuthenticate(storedSessionId, this.clientAuthentication, this);
+                // At this point, we know that the main window will imminently be redirected.
+                // However, this redirect is asynchronous and there is no way to halt execution
+                // until it happens precisely. That's why the current Promise simply does not
+                // resolve.
+                if (attemptedSilentAuthentication) {
+                    return new Promise(() => { });
+                }
+            }
+        }
+        this.tokenRequestInProgress = false;
+        return sessionInfo;
+    };
     setSessionInfo(sessionInfo) {
         this.info.isLoggedIn = sessionInfo.isLoggedIn;
         this.info.webId = sessionInfo.webId;