@logto/browser 0.1.2-rc.1 → 0.1.4

package/lib/index.d.ts

@@ -1,4 +1,4 @@
-import { IdTokenClaims, OidcConfigResponse, Requester, UserInfoResponse } from '@logto/js';
+import { IdTokenClaims, Requester, UserInfoResponse } from '@logto/js';
 import { Nullable } from '@silverhand/essentials';
 import { Infer } from 'superstruct';
 export type { IdTokenClaims, UserInfoResponse } from '@logto/js';
@@ -26,29 +26,41 @@ export declare const LogtoSignInSessionItemSchema: import("superstruct").Struct<
 }>;
 export declare type LogtoSignInSessionItem = Infer<typeof LogtoSignInSessionItemSchema>;
 export default class LogtoClient {
-    protected logtoConfig: LogtoConfig;
-    protected oidcConfig?: OidcConfigResponse;
-    protected logtoStorageKey: string;
-    protected requester: Requester;
-    protected accessTokenMap: Map<string, AccessToken>;
+    protected readonly logtoConfig: LogtoConfig;
+    protected readonly getOidcConfig: () => Promise<import("@silverhand/essentials").KeysToCamelCase<{
+        authorization_endpoint: string;
+        token_endpoint: string;
+        userinfo_endpoint: string;
+        end_session_endpoint: string;
+        revocation_endpoint: string;
+        jwks_uri: string;
+        issuer: string;
+    }>>;
+    protected readonly getJwtVerifyGetKey: () => Promise<import("jose/dist/types/types").GetKeyFunction<import("jose").JWSHeaderParameters, import("jose").FlattenedJWSInput>>;
+    protected readonly logtoStorageKey: string;
+    protected readonly requester: Requester;
+    protected readonly accessTokenMap: Map<string, AccessToken>;
+    private readonly getAccessTokenPromiseMap;
     private _refreshToken;
     private _idToken;
     constructor(logtoConfig: LogtoConfig, requester?: <T>(input: RequestInfo, init?: RequestInit | undefined) => Promise<T>);
     get isAuthenticated(): boolean;
     protected get signInSession(): Nullable<LogtoSignInSessionItem>;
     protected set signInSession(logtoSignInSessionItem: Nullable<LogtoSignInSessionItem>);
-    private get refreshToken();
+    get refreshToken(): Nullable<string>;
     private set refreshToken(value);
-    private get idToken();
+    get idToken(): Nullable<string>;
     private set idToken(value);
-    getAccessToken(resource?: string): Promise<Nullable<string>>;
+    getAccessToken(resource?: string): Promise<string>;
     getIdTokenClaims(): IdTokenClaims;
     fetchUserInfo(): Promise<UserInfoResponse>;
     signIn(redirectUri: string): Promise<void>;
     isSignInRedirected(url: string): boolean;
     handleSignInCallback(callbackUri: string): Promise<void>;
     signOut(postLogoutRedirectUri?: string): Promise<void>;
-    private getOidcConfig;
+    private getAccessTokenByRefreshToken;
+    private _getOidcConfig;
+    private _getJwtVerifyGetKey;
     private verifyIdToken;
     private saveCodeToken;
 }

package/lib/index.js

@@ -9,10 +9,14 @@ var __createBinding = (this && this.__createBinding) || (Object.create ? (functi
 var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LogtoSignInSessionItemSchema = void 0;
 const js_1 = require("@logto/js");
 const jose_1 = require("jose");
+const lodash_once_1 = __importDefault(require("lodash.once"));
 const superstruct_1 = require("superstruct");
 const errors_1 = require("./errors");
 const utils_1 = require("./utils");
@@ -24,7 +28,10 @@ exports.LogtoSignInSessionItemSchema = (0, superstruct_1.type)({
 });
 class LogtoClient {
     constructor(logtoConfig, requester = (0, js_1.createRequester)()) {
+        this.getOidcConfig = (0, lodash_once_1.default)(this._getOidcConfig);
+        this.getJwtVerifyGetKey = (0, lodash_once_1.default)(this._getJwtVerifyGetKey);
         this.accessTokenMap = new Map();
+        this.getAccessTokenPromiseMap = new Map();
         this.logtoConfig = logtoConfig;
         this.logtoStorageKey = (0, utils_1.buildLogtoKey)(logtoConfig.clientId);
         this.requester = requester;
@@ -89,33 +96,28 @@ class LogtoClient {
         if (accessToken && accessToken.expiresAt > Date.now() / 1000) {
             return accessToken.token;
         }
-        // Token expired, remove it from the map
+        // Since the access token has expired, delete it from the map.
         if (accessToken) {
             this.accessTokenMap.delete(accessTokenKey);
         }
-        // Fetch new access token by refresh token
-        const { clientId } = this.logtoConfig;
-        if (!this.refreshToken) {
-            throw new errors_1.LogtoClientError('not_authenticated');
-        }
-        try {
-            const { tokenEndpoint } = await this.getOidcConfig();
-            const { accessToken, refreshToken, idToken, scope, expiresIn } = await (0, js_1.fetchTokenByRefreshToken)({ clientId, tokenEndpoint, refreshToken: this.refreshToken, resource }, this.requester);
-            this.accessTokenMap.set(accessTokenKey, {
-                token: accessToken,
-                scope,
-                expiresAt: Math.round(Date.now() / 1000) + expiresIn,
-            });
-            this.refreshToken = refreshToken;
-            if (idToken) {
-                await this.verifyIdToken(idToken);
-                this.idToken = idToken;
-            }
-            return accessToken;
-        }
-        catch (error) {
-            throw new errors_1.LogtoClientError('get_access_token_by_refresh_token_failed', error);
+        /**
+         * Need to fetch a new access token using refresh token.
+         * Reuse the cached promise if exists.
+         */
+        const cachedPromise = this.getAccessTokenPromiseMap.get(accessTokenKey);
+        if (cachedPromise) {
+            return cachedPromise;
         }
+        /**
+         * Create a new promise and cache in map to avoid race condition.
+         * Since we enable "refresh token rotation" by default,
+         * it will be problematic when calling multiple `getAccessToken()` closely.
+         */
+        const promise = this.getAccessTokenByRefreshToken(resource);
+        this.getAccessTokenPromiseMap.set(accessTokenKey, promise);
+        const token = await promise;
+        this.getAccessTokenPromiseMap.delete(accessTokenKey);
+        return token;
     }
     getIdTokenClaims() {
         if (!this.idToken) {
@@ -202,19 +204,46 @@ class LogtoClient {
         this.idToken = null;
         window.location.assign(url);
     }
-    async getOidcConfig() {
-        if (!this.oidcConfig) {
-            const { endpoint } = this.logtoConfig;
-            const discoveryEndpoint = (0, utils_1.getDiscoveryEndpoint)(endpoint);
-            this.oidcConfig = await (0, js_1.fetchOidcConfig)(discoveryEndpoint, this.requester);
+    async getAccessTokenByRefreshToken(resource) {
+        if (!this.refreshToken) {
+            throw new errors_1.LogtoClientError('not_authenticated');
+        }
+        try {
+            const accessTokenKey = (0, utils_1.buildAccessTokenKey)(resource);
+            const { clientId } = this.logtoConfig;
+            const { tokenEndpoint } = await this.getOidcConfig();
+            const { accessToken, refreshToken, idToken, scope, expiresIn } = await (0, js_1.fetchTokenByRefreshToken)({ clientId, tokenEndpoint, refreshToken: this.refreshToken, resource }, this.requester);
+            this.accessTokenMap.set(accessTokenKey, {
+                token: accessToken,
+                scope,
+                expiresAt: Math.round(Date.now() / 1000) + expiresIn,
+            });
+            this.refreshToken = refreshToken;
+            if (idToken) {
+                await this.verifyIdToken(idToken);
+                this.idToken = idToken;
+            }
+            return accessToken;
         }
-        return this.oidcConfig;
+        catch (error) {
+            throw new errors_1.LogtoClientError('get_access_token_by_refresh_token_failed', error);
+        }
+    }
+    async _getOidcConfig() {
+        const { endpoint } = this.logtoConfig;
+        const discoveryEndpoint = (0, utils_1.getDiscoveryEndpoint)(endpoint);
+        return (0, js_1.fetchOidcConfig)(discoveryEndpoint, this.requester);
+    }
+    async _getJwtVerifyGetKey() {
+        const { jwksUri } = await this.getOidcConfig();
+        return (0, jose_1.createRemoteJWKSet)(new URL(jwksUri));
     }
     async verifyIdToken(idToken) {
         const { clientId } = this.logtoConfig;
-        const { issuer, jwksUri } = await this.getOidcConfig();
+        const { issuer } = await this.getOidcConfig();
+        const jwtVerifyGetKey = await this.getJwtVerifyGetKey();
         try {
-            await (0, js_1.verifyIdToken)(idToken, clientId, issuer, (0, jose_1.createRemoteJWKSet)(new URL(jwksUri)));
+            await (0, js_1.verifyIdToken)(idToken, clientId, issuer, jwtVerifyGetKey);
         }
         catch (error) {
             throw new errors_1.LogtoClientError('invalid_id_token', error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logto/browser",
-  "version": "0.1.2-rc.1",
+  "version": "0.1.4",
   "main": "./lib/index.js",
   "exports": "./lib/index.js",
   "typings": "./lib/index.d.ts",
@@ -8,6 +8,11 @@
     "lib"
   ],
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/logto-io/js.git",
+    "directory": "packages/browser"
+  },
   "scripts": {
     "dev:tsc": "tsc -p tsconfig.build.json -w --preserveWatchOutput",
     "preinstall": "npx only-allow pnpm",
@@ -19,10 +24,11 @@
     "prepack": "pnpm test && pnpm build"
   },
   "dependencies": {
-    "@logto/js": "^0.1.2-rc.1",
+    "@logto/js": "^0.1.3",
     "@silverhand/essentials": "^1.1.6",
     "jose": "^4.5.0",
     "lodash.get": "^4.4.2",
+    "lodash.once": "^4.1.1",
     "superstruct": "^0.15.3"
   },
   "devDependencies": {
@@ -31,6 +37,7 @@
     "@silverhand/ts-config": "^0.9.1",
     "@types/jest": "^27.4.0",
     "@types/lodash.get": "^4.4.6",
+    "@types/lodash.once": "^4.1.6",
     "eslint": "^8.9.0",
     "jest": "^27.5.1",
     "jest-location-mock": "^1.0.9",
@@ -48,5 +55,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "8d5713ffeff62c3d12954e7ce194406f260a9546"
+  "gitHead": "a5eed81a3e3db3184a53f04f843db8ac707dd3ad"
 }