@okta/okta-auth-js 5.5.0 → 5.9.0

package/CHANGELOG.md

@@ -1,5 +1,67 @@
 # Changelog
 
+## 5.9.0
+
+### Features
+
+- [#1004](https://github.com/okta/okta-auth-js/pull/1004) Allows extra query parameters to be added to the `authorize` url
+
+### Other
+
+- [#1000](https://github.com/okta/okta-auth-js/pull/1000)
+  - Fixes broken ES module bundle
+  - Updates `browser` field in `package.json` to enable bundlers to use the ES module bundle by default
+
+### Fixes
+
+- [#1005](https://github.com/okta/okta-auth-js/pull/1005)
+  - Handles `rememberMe` boolean in IDX Identify remediation adapter
+  - Typescript: Adds `type` field for `Input` type in NextStep object
+- [#1012](https://github.com/okta/okta-auth-js/pull/1012) Fixes null access when crypto is not present
+
+## 5.8.0
+
+### Features
+
+- [#990](https://github.com/okta/okta-auth-js/pull/990) Supports email verify callback
+
+## 5.7.0
+
+### Features
+
+- [#983](https://github.com/okta/okta-auth-js/pull/983) Adds new method `setHeaders`
+- [#990](https://github.com/okta/okta-auth-js/pull/990) Supports email verify callback
+
+### Fixes
+
+- [#988](https://github.com/okta/okta-auth-js/pull/988) Fixes Safari & Firefox browsers block `getWithPopup` issue
+- [#995](https://github.com/okta/okta-auth-js/pull/995) Sends cookie for `authn` related requests
+- [#985](https://github.com/okta/okta-auth-js/pull/985) Fixes issue with renewTokens that would drop scopes passed to `getToken`
+
+### Other
+
+- [#981](https://github.com/okta/okta-auth-js/pull/981) TypeScript: Allows optional paramters for IDX methods
+- [#986](https://github.com/okta/okta-auth-js/pull/986) TypeScript: Interface `SignInWithRedirectOptions` should extend `TokenParams`
+- [#992](https://github.com/okta/okta-auth-js/pull/992) TypeScript: Adds fields for `Input` type in NextStep object
+- [#997](https://github.com/okta/okta-auth-js/pull/997) Validates `scopes` config param is an `array`
+
+## 5.6.0
+
+### Features
+
+- [#963](https://github.com/okta/okta-auth-js/pull/963)
+  - Adds `getPreviousAuthState` method to `AuthStateManager`
+  - Allows null type for authState related methods / fields
+- [#948](https://github.com/okta/okta-auth-js/pull/948) Adds `Google Authenticator` support in idx module
+
+### Other
+
+- [#947](https://github.com/okta/okta-auth-js/pull/947) TypeScript: Allow custom keys in `AuthState` interface
+
+### Bug Fixes
+
+- [#967](https://github.com/okta/okta-auth-js/pull/967) Throw error in `parseFromUrl` if can't load transaction meta
+
 ## 5.5.0
 
 ### Features
@@ -324,7 +386,7 @@
     - `autoRemove`
     - `devMode`
 - [#469](https://github.com/okta/okta-auth-js/pull/469) Adds "rate limiting" logic to token autoRenew process to prevent too many requests be sent out which may cause application rate limit issue.
-- [#503](https://github.com/okta/okta-auth-js/pull/503) Supports relative uri for [options.redirectUri](README.md#additional-options)
+- [#503](https://github.com/okta/okta-auth-js/pull/503) Supports relative uri for [options.redirectUri](README.md#configuration-options)
 - [#478](https://github.com/okta/okta-auth-js/pull/478) Adds cross tabs communication to sync `AuthState`.
 - [#525](https://github.com/okta/okta-auth-js/pull/525) Adds new methods `hasResponseType`, `isPKCE`, `isAuthorizationCodeFlow`. The option `responseType` is now accepted in the constructor.
 
@@ -364,7 +426,7 @@
 
 - [#444](https://github.com/okta/okta-auth-js/pull/444)
   - Implements "active" autoRenew.  Previously tokens would be renewed or removed when calling `tokenManager.get`. Now they will be renewed or removed in the background. If autoRenew is true, tokens will be renewed before expiration. If autoRenew is false, tokens will be removed from storage on expiration.
-  - `onSessionExpired` option has been removed. [TokenManager events](#tokenmanageronevent-callback-context) can be used to detect and handle token renewal errors.
+  - `onSessionExpired` option has been removed. [TokenManager events](README.md#tokenmanageronevent-callback-context) can be used to detect and handle token renewal errors.
   - `tokenManager.get` no longer implements autoRenew functionality (autoRenew is done by a separate process within `TokenManager`). Even with `autoRenew`, it is possible that the token returned from the TokenManager may be expired, since renewal is an asynchronous process. New method `tokenManager.hasExpired` can be used to test the token and avoid this potential race condition.
 
 ## 3.2.6
@@ -463,7 +525,7 @@
 
 ### Features
 
-New [option](README.md#additional-options) `cookies` allows overriding default `secure` and `sameSite` values.
+New [option](README.md#configuration-options) `cookies` allows overriding default `secure` and `sameSite` values.
 
 ### Breaking Changes
 
@@ -483,7 +545,7 @@ New [option](README.md#additional-options) `cookies` allows overriding default `
 
 - [#316](https://github.com/okta/okta-auth-js/pull/316) - Option `issuer` is [required](README.md#configuration-reference). Option `url` has been deprecated and is no longer used.
 
-- [#317](https://github.com/okta/okta-auth-js/pull/317) - `pkce` [option](README.md#additional-options)  is now `true` by default. `grantType` option is removed.
+- [#317](https://github.com/okta/okta-auth-js/pull/317) - `pkce` [option](README.md#configuration-options)  is now `true` by default. `grantType` option is removed.
 
 - [#320](https://github.com/okta/okta-auth-js/pull/320) - `getWithRedirect`, `getWithPopup`, and `getWithoutPrompt` previously took 2 sets of option objects as parameters, a set of "oauthOptions" and additional options. These methods now take a single options object which can hold all [available options](README.md#authorize-options). Passing a second options object will cause an exception to be thrown.
 

package/README.md

@@ -428,11 +428,11 @@ Default value is `true` which enables the [PKCE OAuth Flow](#pkce-oauth-20-flow)
 
 #### responseMode
 
-When requesting tokens using [token.getWithRedirect](#tokengetwithredirectoptions) values will be returned as parameters appended to the [redirectUri](#additional-options).
+When requesting tokens using [token.getWithRedirect](#tokengetwithredirectoptions) values will be returned as parameters appended to the [redirectUri](#configuration-options).
 
 In most cases you will not need to set a value for `responseMode`. Defaults are set according to the [OpenID Connect 1.0 specification](https://openid.net/specs/openid-connect-core-1_0.html#Authentication).
 
-* For [PKCE OAuth Flow](#pkce-oauth-20-flow)), the authorization code will be in search query of the URL. Clients using the PKCE flow can opt to instead receive the authorization code in the hash fragment by setting the [responseMode](#additional-options) option to "fragment".
+* For [PKCE OAuth Flow](#pkce-oauth-20-flow)), the authorization code will be in search query of the URL. Clients using the PKCE flow can opt to instead receive the authorization code in the hash fragment by setting the [responseMode](#configuration-options) option to "fragment".
 
 * For [Implicit OAuth Flow](#implicit-oauth-20-flow)), tokens will be in the hash fragment of the URL. This cannot be changed.
 
@@ -512,7 +512,11 @@ const config = {
 
 const oktaAuth = new OktaAuth(config);
 if (oktaAuth.isLoginRedirect()) {
-  oktaAuth.handleLoginRedirect();
+  try {
+    await oktaAuth.handleLoginRedirect();
+  } catch (e) {
+    // log or display error details
+  }
 }
 ```
 
@@ -819,10 +823,11 @@ Defaults to `none` if the `secure` option is `true`, or `lax` if the `secure` op
 * [getAccessToken](#getaccesstoken)
 * [storeTokensFromRedirect](#storetokensfromredirect)
 * [setOriginalUri](#setoriginaluriuri)
-* [getOriginalUri](#getoriginaluri)
+* [getOriginalUri](#getoriginaluristate)
 * [removeOriginalUri](#removeoriginaluri)
 * [isLoginRedirect](#isloginredirect)
 * [handleLoginRedirect](#handleloginredirecttokens)
+* [setHeaders](#setheaders)
 * [tx.resume](#txresume)
 * [tx.exists](#txexists)
 * [transaction.status](#transactionstatus)
@@ -883,13 +888,18 @@ See [authn API](docs/authn.md#signinwithcredentials).
 ### `signInWithRedirect(options)`
 
 > :link: web browser only <br>
+> :hourglass: async
 
 Starts the full-page redirect to Okta with [optional request parameters](#authorize-options). In this flow, there is a originalUri parameter in options to track the route before the user signIn, and the addtional params are mapped to the [Authorize options](#authorize-options).
-You can use [storeTokensFromRedirect](#storetokensfromredirect) to store tokens and [getOriginalUri](#getoriginaluri) to clear the intermediate state (the originalUri) after successful authentication.
+You can use [storeTokensFromRedirect](#storetokensfromredirect) to store tokens and [getOriginalUri](#getoriginaluristate) to clear the intermediate state (the originalUri) after successful authentication.
 
 ```javascript
 if (authClient.isLoginRedirect()) {
-  await authClient.handleLoginRedirect();
+  try {
+    await authClient.handleLoginRedirect();
+  } catch (e) {
+    // log or display error details
+  }
 } else if (!await authClient.isAuthenticated()) {
   // Start the browser based oidc flow, then parse tokens from the redirect callback url
   authClient.signInWithRedirect();
@@ -1064,11 +1074,11 @@ Parses tokens from the redirect url and stores them.
 
 ### `setOriginalUri(uri?)`
 
-Stores the current URL state before a redirect occurs. By default it stores `window.location.href`.
+Stores the current URL state before a redirect occurs.
 
-### `getOriginalUri()`
+### `getOriginalUri(state?)`
 
-Returns the stored URI string stored by [setOriginal](#setoriginaluriuri). By default it returns `window.location.origin`.
+Returns the stored URI string stored by [setOriginal](#setoriginaluriuri). An OAuth `state` parameter is optional. If no value is passed for `state`, the URI is retrieved from isolated session storage and will work in a single browser. If a valid OAuth `state` is passed this method can return the URI stored from another browser tab.
 
 ### `removeOriginalUri()`
 
@@ -1083,17 +1093,49 @@ Check `window.location` to verify if the app is in OAuth callback state or not.
 ```javascript
 if (authClient.isLoginRedirect()) {
   // callback flow
-  await authClient.handleLoginRedirect();
+  try {
+    await authClient.handleLoginRedirect();
+  } catch (e) {
+    // log or display error details
+  }
 } else {
   // normal app flow
 }
 ```
 
-### `handleLoginRedirect(tokens?)`
+### `handleLoginRedirect(tokens?, originalUri?)`
 
 > :link: web browser only <br>
+> :hourglass: async
+
+Stores passed in tokens or tokens from redirect url into storage, then redirect users back to the [originalUri](#setoriginaluriuri). When using `PKCE` authorization code flow, this method also exchanges authorization code for tokens. By default it calls `window.location.replace` for the redirection. The default behavior can be overrided by providing [options.restoreOriginalUri](#configuration-options). By default, [originalUri](#getoriginaluristate) will be retrieved from storage, but this can be overridden by passing a value fro `originalUri` to this function in the 2nd parameter.
 
-Stores passed in tokens or tokens from redirect url into storage, then redirect users back to the [originalUri](#setoriginaluriuri). By default it calls `window.location.replace` for the redirection. The default behavior can be overrided by providing [options.restoreOriginalUri](#additional-options).
+> **Note:** `handleLoginRedirect` throws `OAuthError` or `AuthSdkError` in case there are errors during token retrieval.
+
+### `setHeaders()`
+
+Can set (or unset) request headers after construction.
+
+```javascript
+const authClient = new OktaAuth({
+  issuer: 'https://{yourOktaDomain}',
+
+  // headers can be set during construction
+  headers: {
+    foo: 'bar'
+  }
+});
+
+// Headers can be set (or modified) after construction
+authClient.setHeaders({
+  foo: 'baz'
+});
+
+// Headers can be removed
+authClient.setHeaders({
+  foo: undefined
+})
+```
 
 ### `tx.resume()`
 
@@ -1273,7 +1315,7 @@ authClient.token.getWithPopup(options)
 > :link: web browser only <br>
 > :hourglass: async
 
-Create token using a redirect. After a successful authentication, the browser will be redirected to the configured [redirectUri](#additional-options). The authorization code, access, or ID Tokens will be available as parameters appended to this URL. Values will be returned in either the search query or hash fragment portion of the URL depending on the [responseMode](#responsemode)
+Create token using a redirect. After a successful authentication, the browser will be redirected to the configured [redirectUri](#configuration-options). The authorization code, access, or ID Tokens will be available as parameters appended to this URL. Values will be returned in either the search query or hash fragment portion of the URL depending on the [responseMode](#responsemode)
 
 * `options` - See [Authorize options](#authorize-options)
 
@@ -1318,7 +1360,7 @@ authClient.token.parseFromUrl()
 });
 ```
 
-After reading values, this method will rewrite either the hash fragment or search query portion of the URL (depending on the [responseMode](#responsemode)) so that the code or tokens are no longer present or visible to the user. For this reason, it is recommended to use a dedicated route or path for the [redirectUri](#additional-options) so that this URL rewrite does not interfere with other URL parameters which may be used by your application. A complete login flow will usually save the current URL before calling `getWithRedirect` and restore the URL after saving tokens from `parseFromUrl`.
+After reading values, this method will rewrite either the hash fragment or search query portion of the URL (depending on the [responseMode](#responsemode)) so that the code or tokens are no longer present or visible to the user. For this reason, it is recommended to use a dedicated route or path for the [redirectUri](#configuration-options) so that this URL rewrite does not interfere with other URL parameters which may be used by your application. A complete login flow will usually save the current URL before calling `getWithRedirect` and restore the URL after saving tokens from `parseFromUrl`.
 
 ```javascript
 // On any page while unauthenticated. Begin login flow
@@ -1643,6 +1685,10 @@ authClient.authStateManager.subscribe((authState) => {
 
 Gets latest evaluated `authState` from the `authStateManager`. The `authState` (a unique new object) is re-evaluated when `authStateManager.updateAuthState()` is called. If `updateAuthState` has not been called, or it has not finished calculating an initial state, `getAuthState` will return `null`.
 
+#### `authStateManager.getPreviousAuthState()`
+
+Gets the previous evaluated `authState` from the `authStateManager`. This state can be used to tell when the new authState is evaluated. For example, the `authState` is evaluated duing app initialization if the `previousAuthState` is `null`, and the `authState` is evaluated during tokens auto renew process if the `previousAuthState` exists.
+
 #### `authStateManager.updateAuthState()`
 
 Produces a unique `authState` object and emits an `authStateChange` event. The [authState](#authstatemanager) object contains tokens from the `tokenManager` and a calculated `isAuthenticated` value. By default, `authState.isAuthenticated` will be true if both `idToken` and `accessToken` are present. This logic can be customized by defining a custom [transformAuthState](#transformauthstate) function.
@@ -1834,4 +1880,4 @@ const OktaAuth = require('@okta/okta-auth-js').OktaAuth;
 
 ## Contributing
 
-We're happy to accept contributions and PRs! Please see the [contribution guide](contributing.md) to understand how to structure a contribution.
+We're happy to accept contributions and PRs! Please see the [contribution guide](CONTRIBUTING.md) to understand how to structure a contribution.

package/cjs/AuthStateManager.js

@@ -81,6 +81,10 @@ class AuthStateManager {
     return this._authState;
   }
 
+  getPreviousAuthState() {
+    return this._prevAuthState;
+  }
+
   async updateAuthState() {
     const {
       transformAuthState,
@@ -107,6 +111,7 @@ class AuthStateManager {
         return;
       }
 
+      this._prevAuthState = this._authState;
       this._authState = authState; // emit new authState object
 
       this._sdk.emitter.emit(EVENT_AUTH_STATE_CHANGE, { ...authState

package/cjs/AuthStateManager.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../lib/AuthStateManager.ts"],"names":["PCancelable","require","INITIAL_AUTH_STATE","DEFAULT_PENDING","updateAuthStatePromise","canceledTimes","EVENT_AUTH_STATE_CHANGE","MAX_PROMISE_CANCEL_TIMES","isSameAuthState","prevState","state","isAuthenticated","JSON","stringify","idToken","accessToken","error","AuthStateManager","constructor","sdk","emitter","AuthSdkError","_sdk","_pending","_authState","_logOptions","tokenManager","on","EVENT_ADDED","key","token","_setLogOptions","event","updateAuthState","EVENT_REMOVED","options","getAuthState","transformAuthState","devMode","log","status","group","groupEnd","emitAuthStateChange","authState","emit","finalPromise","origPromise","then","curPromise","cancel","cancelablePromise","resolve","_","onCancel","shouldReject","emitAndResolve","isCanceled","refreshToken","getTokensSync","promise","Promise","catch","subscribe","handler","unsubscribe","off"],"mappings":";;;;AAaA;;AAGA;;AACA;;AAjBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAQA,MAAMA,WAAW,GAAGC,OAAO,CAAC,cAAD,CAA3B;;AAEO,MAAMC,kBAAkB,GAAG,IAA3B;;AACP,MAAMC,eAAe,GAAG;AACtBC,EAAAA,sBAAsB,EAAE,IADF;AAEtBC,EAAAA,aAAa,EAAE;AAFO,CAAxB;AAIA,MAAMC,uBAAuB,GAAG,iBAAhC;AACA,MAAMC,wBAAwB,GAAG,EAAjC,C,CAEA;;AACA,MAAMC,eAAe,GAAG,CAACC,SAAD,EAAuBC,KAAvB,KAA4C;AAClE;AACA,MAAI,CAACD,SAAL,EAAgB;AACd,WAAO,KAAP;AACD;;AAED,SAAOA,SAAS,CAACE,eAAV,KAA8BD,KAAK,CAACC,eAApC,IACFC,IAAI,CAACC,SAAL,CAAeJ,SAAS,CAACK,OAAzB,MAAsCF,IAAI,CAACC,SAAL,CAAeH,KAAK,CAACI,OAArB,CADpC,IAEFF,IAAI,CAACC,SAAL,CAAeJ,SAAS,CAACM,WAAzB,MAA0CH,IAAI,CAACC,SAAL,CAAeH,KAAK,CAACK,WAArB,CAFxC,IAGFN,SAAS,CAACO,KAAV,KAAoBN,KAAK,CAACM,KAH/B;AAID,CAVD;;AAYO,MAAMC,gBAAN,CAAuB;AAU5BC,EAAAA,WAAW,CAACC,GAAD,EAAgB;AACzB,QAAI,CAACA,GAAG,CAACC,OAAT,EAAkB;AAChB,YAAM,IAAIC,oBAAJ,CAAiB,uDAAjB,CAAN;AACD;;AAED,SAAKC,IAAL,GAAYH,GAAZ;AACA,SAAKI,QAAL,GAAgB,EAAE,GAAGpB;AAAL,KAAhB;AACA,SAAKqB,UAAL,GAAkBtB,kBAAlB;AACA,SAAKuB,WAAL,GAAmB,EAAnB,CARyB,CAUzB;AACA;AACA;;AACAN,IAAAA,GAAG,CAACO,YAAJ,CAAiBC,EAAjB,CAAoBC,yBAApB,EAAiC,CAACC,GAAD,EAAMC,KAAN,KAAgB;AAC/C,WAAKC,cAAL,CAAoB;AAAEC,QAAAA,KAAK,EAAEJ,yBAAT;AAAsBC,QAAAA,GAAtB;AAA2BC,QAAAA;AAA3B,OAApB;;AACA,WAAKG,eAAL;AACD,KAHD;AAIAd,IAAAA,GAAG,CAACO,YAAJ,CAAiBC,EAAjB,CAAoBO,2BAApB,EAAmC,CAACL,GAAD,EAAMC,KAAN,KAAgB;AACjD,WAAKC,cAAL,CAAoB;AAAEC,QAAAA,KAAK,EAAEE,2BAAT;AAAwBL,QAAAA,GAAxB;AAA6BC,QAAAA;AAA7B,OAApB;;AACA,WAAKG,eAAL;AACD,KAHD;AAID;;AAEDF,EAAAA,cAAc,CAACI,OAAD,EAAU;AACtB,SAAKV,WAAL,GAAmBU,OAAnB;AACD;;AAEDC,EAAAA,YAAY,GAAc;AACxB,WAAO,KAAKZ,UAAZ;AACD;;AAEoB,QAAfS,eAAe,GAAuB;AAC1C,UAAM;AAAEI,MAAAA,kBAAF;AAAsBC,MAAAA;AAAtB,QAAkC,KAAKhB,IAAL,CAAUa,OAAlD;;AAEA,UAAMI,GAAG,GAAIC,MAAD,IAAY;AACtB,YAAM;AAAER,QAAAA,KAAF;AAASH,QAAAA,GAAT;AAAcC,QAAAA;AAAd,UAAwB,KAAKL,WAAnC;AACA,8BAAagB,KAAb,CAAoB,uCAAsCT,KAAM,WAAUQ,MAAO,EAAjF;AACA,8BAAaD,GAAb,CAAiBV,GAAjB,EAAsBC,KAAtB;AACA,8BAAaS,GAAb,CAAiB,mBAAjB,EAAsC,KAAKf,UAA3C;AACA,8BAAakB,QAAb,GALsB,CAOtB;;AACA,WAAKjB,WAAL,GAAmB,EAAnB;AACD,KATD;;AAWA,UAAMkB,mBAAmB,GAAIC,SAAD,IAAe;AACzC,UAAIpC,eAAe,CAAC,KAAKgB,UAAN,EAAkBoB,SAAlB,CAAnB,EAAiD;AAC/CN,QAAAA,OAAO,IAAIC,GAAG,CAAC,WAAD,CAAd;AACA;AACD;;AACD,WAAKf,UAAL,GAAkBoB,SAAlB,CALyC,CAMzC;;AACA,WAAKtB,IAAL,CAAUF,OAAV,CAAkByB,IAAlB,CAAuBvC,uBAAvB,EAAgD,EAAE,GAAGsC;AAAL,OAAhD;;AACAN,MAAAA,OAAO,IAAIC,GAAG,CAAC,SAAD,CAAd;AACD,KATD;;AAWA,UAAMO,YAAY,GAAIC,WAAD,IAAiB;AACpC,aAAO,KAAKxB,QAAL,CAAcnB,sBAAd,CAAqC4C,IAArC,CAA0C,MAAM;AACrD,cAAMC,UAAU,GAAG,KAAK1B,QAAL,CAAcnB,sBAAjC;;AACA,YAAI6C,UAAU,IAAIA,UAAU,KAAKF,WAAjC,EAA8C;AAC5C,iBAAOD,YAAY,CAACG,UAAD,CAAnB;AACD;;AACD,eAAO,KAAKb,YAAL,EAAP;AACD,OANM,CAAP;AAOD,KARD;;AAUA,QAAI,KAAKb,QAAL,CAAcnB,sBAAlB,EAA0C;AACxC,UAAI,KAAKmB,QAAL,CAAclB,aAAd,IAA+BE,wBAAnC,EAA6D;AAC3D;AACA;AACA+B,QAAAA,OAAO,IAAIC,GAAG,CAAC,YAAD,CAAd;AACA,eAAOO,YAAY,CAAC,KAAKvB,QAAL,CAAcnB,sBAAf,CAAnB;AACD,OALD,MAKO;AACL,aAAKmB,QAAL,CAAcnB,sBAAd,CAAqC8C,MAArC;AACD;AACF;AAED;;;AACA,UAAMC,iBAAiB,GAAG,IAAInD,WAAJ,CAAgB,CAACoD,OAAD,EAAUC,CAAV,EAAaC,QAAb,KAA0B;AAClEA,MAAAA,QAAQ,CAACC,YAAT,GAAwB,KAAxB;AACAD,MAAAA,QAAQ,CAAC,MAAM;AACb,aAAK/B,QAAL,CAAcnB,sBAAd,GAAuC,IAAvC;AACA,aAAKmB,QAAL,CAAclB,aAAd,GAA8B,KAAKkB,QAAL,CAAclB,aAAd,GAA8B,CAA5D;AACAiC,QAAAA,OAAO,IAAIC,GAAG,CAAC,UAAD,CAAd;AACD,OAJO,CAAR;;AAMA,YAAMiB,cAAc,GAAIZ,SAAD,IAAe;AACpC,YAAIO,iBAAiB,CAACM,UAAtB,EAAkC;AAChCL,UAAAA,OAAO;AACP;AACD,SAJmC,CAKpC;;;AACAT,QAAAA,mBAAmB,CAACC,SAAD,CAAnB;AACAQ,QAAAA,OAAO,GAP6B,CASpC;;AACA,aAAK7B,QAAL,GAAgB,EAAE,GAAGpB;AAAL,SAAhB;AACD,OAXD;;AAaA,WAAKmB,IAAL,CAAUX,eAAV,GACGqC,IADH,CACQ,MAAM;AACV,YAAIG,iBAAiB,CAACM,UAAtB,EAAkC;AAChCL,UAAAA,OAAO;AACP;AACD;;AAED,cAAM;AAAErC,UAAAA,WAAF;AAAeD,UAAAA,OAAf;AAAwB4C,UAAAA;AAAxB,YAAyC,KAAKpC,IAAL,CAAUI,YAAV,CAAuBiC,aAAvB,EAA/C;;AACA,cAAMf,SAAS,GAAG;AAChB7B,UAAAA,WADgB;AAEhBD,UAAAA,OAFgB;AAGhB4C,UAAAA,YAHgB;AAIhB/C,UAAAA,eAAe,EAAE,CAAC,EAAEI,WAAW,IAAID,OAAjB;AAJF,SAAlB;AAMA,cAAM8C,OAA2B,GAAGvB,kBAAkB,GAClDA,kBAAkB,CAAC,KAAKf,IAAN,EAAYsB,SAAZ,CADgC,GAElDiB,OAAO,CAACT,OAAR,CAAgBR,SAAhB,CAFJ;AAIAgB,QAAAA,OAAO,CACJZ,IADH,CACQJ,SAAS,IAAIY,cAAc,CAACZ,SAAD,CADnC,EAEGkB,KAFH,CAES9C,KAAK,IAAIwC,cAAc,CAAC;AAC7BzC,UAAAA,WAD6B;AAE7BD,UAAAA,OAF6B;AAG7B4C,UAAAA,YAH6B;AAI7B/C,UAAAA,eAAe,EAAE,KAJY;AAK7BK,UAAAA;AAL6B,SAAD,CAFhC;AASD,OA3BH;AA4BD,KAjDyB,CAA1B;AAkDA;;AACA,SAAKO,QAAL,CAAcnB,sBAAd,GAAuC+C,iBAAvC;AAEA,WAAOL,YAAY,CAACK,iBAAD,CAAnB;AACD;;AAEDY,EAAAA,SAAS,CAACC,OAAD,EAAgB;AACvB,SAAK1C,IAAL,CAAUF,OAAV,CAAkBO,EAAlB,CAAqBrB,uBAArB,EAA8C0D,OAA9C;AACD;;AAEDC,EAAAA,WAAW,CAACD,OAAD,EAAiB;AAC1B,SAAK1C,IAAL,CAAUF,OAAV,CAAkB8C,GAAlB,CAAsB5D,uBAAtB,EAA+C0D,OAA/C;AACD;;AAtJ2B","sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * \n * See the License for the specific language governing permissions and limitations under the License.\n */\n\n\nimport { AuthSdkError } from './errors';\nimport { AuthState, AuthStateLogOptions } from './types';\nimport { OktaAuth } from '.';\nimport { getConsole } from './util';\nimport { EVENT_ADDED, EVENT_REMOVED } from './TokenManager';\nconst PCancelable = require('p-cancelable');\n\nexport const INITIAL_AUTH_STATE = null;\nconst DEFAULT_PENDING = {\n  updateAuthStatePromise: null,\n  canceledTimes: 0\n};\nconst EVENT_AUTH_STATE_CHANGE = 'authStateChange';\nconst MAX_PROMISE_CANCEL_TIMES = 10;\n\n// only compare first level of authState\nconst isSameAuthState = (prevState: AuthState, state: AuthState) => {\n  // initial state is null\n  if (!prevState) {\n    return false;\n  }\n\n  return prevState.isAuthenticated === state.isAuthenticated \n    && JSON.stringify(prevState.idToken) === JSON.stringify(state.idToken)\n    && JSON.stringify(prevState.accessToken) === JSON.stringify(state.accessToken)\n    && prevState.error === state.error;\n};\n\nexport class AuthStateManager {\n  _sdk: OktaAuth;\n  _pending: { \n    updateAuthStatePromise: typeof PCancelable;\n    canceledTimes: number; \n  };\n  _authState: AuthState;\n  _logOptions: AuthStateLogOptions;\n  _lastEventTimestamp: number;\n\n  constructor(sdk: OktaAuth) {\n    if (!sdk.emitter) {\n      throw new AuthSdkError('Emitter should be initialized before AuthStateManager');\n    }\n\n    this._sdk = sdk;\n    this._pending = { ...DEFAULT_PENDING };\n    this._authState = INITIAL_AUTH_STATE;\n    this._logOptions = {};\n\n    // Listen on tokenManager events to start updateState process\n    // \"added\" event is emitted in both add and renew process\n    // Only listen on \"added\" event to update auth state\n    sdk.tokenManager.on(EVENT_ADDED, (key, token) => {\n      this._setLogOptions({ event: EVENT_ADDED, key, token });\n      this.updateAuthState();\n    });\n    sdk.tokenManager.on(EVENT_REMOVED, (key, token) => {\n      this._setLogOptions({ event: EVENT_REMOVED, key, token });\n      this.updateAuthState();\n    });\n  }\n\n  _setLogOptions(options) {\n    this._logOptions = options;\n  }\n\n  getAuthState(): AuthState {\n    return this._authState;\n  }\n\n  async updateAuthState(): Promise<AuthState> {\n    const { transformAuthState, devMode } = this._sdk.options;\n\n    const log = (status) => {\n      const { event, key, token } = this._logOptions;\n      getConsole().group(`OKTA-AUTH-JS:updateAuthState: Event:${event} Status:${status}`);\n      getConsole().log(key, token);\n      getConsole().log('Current authState', this._authState);\n      getConsole().groupEnd();\n      \n      // clear log options after logging\n      this._logOptions = {};\n    };\n\n    const emitAuthStateChange = (authState) => {\n      if (isSameAuthState(this._authState, authState)) {\n        devMode && log('unchanged'); \n        return;\n      }\n      this._authState = authState;\n      // emit new authState object\n      this._sdk.emitter.emit(EVENT_AUTH_STATE_CHANGE, { ...authState });\n      devMode && log('emitted');\n    };\n\n    const finalPromise = (origPromise) => {       \n      return this._pending.updateAuthStatePromise.then(() => {\n        const curPromise = this._pending.updateAuthStatePromise;\n        if (curPromise && curPromise !== origPromise) {\n          return finalPromise(curPromise);\n        }\n        return this.getAuthState();\n      });\n    };\n\n    if (this._pending.updateAuthStatePromise) {\n      if (this._pending.canceledTimes >= MAX_PROMISE_CANCEL_TIMES) {\n        // stop canceling then starting a new promise\n        // let existing promise finish to prevent running into loops\n        devMode && log('terminated');\n        return finalPromise(this._pending.updateAuthStatePromise);\n      } else {\n        this._pending.updateAuthStatePromise.cancel();\n      }\n    }\n\n    /* eslint-disable complexity */\n    const cancelablePromise = new PCancelable((resolve, _, onCancel) => {\n      onCancel.shouldReject = false;\n      onCancel(() => {\n        this._pending.updateAuthStatePromise = null;\n        this._pending.canceledTimes = this._pending.canceledTimes + 1;\n        devMode && log('canceled');\n      });\n\n      const emitAndResolve = (authState) => {\n        if (cancelablePromise.isCanceled) {\n          resolve();\n          return;\n        }\n        // emit event and resolve promise \n        emitAuthStateChange(authState);\n        resolve();\n\n        // clear pending states after resolve\n        this._pending = { ...DEFAULT_PENDING };\n      };\n\n      this._sdk.isAuthenticated()\n        .then(() => {\n          if (cancelablePromise.isCanceled) {\n            resolve();\n            return;\n          }\n\n          const { accessToken, idToken, refreshToken } = this._sdk.tokenManager.getTokensSync();\n          const authState = {\n            accessToken,\n            idToken,\n            refreshToken,\n            isAuthenticated: !!(accessToken && idToken)\n          };\n          const promise: Promise<AuthState> = transformAuthState\n            ? transformAuthState(this._sdk, authState)\n            : Promise.resolve(authState);\n\n          promise\n            .then(authState => emitAndResolve(authState))\n            .catch(error => emitAndResolve({\n              accessToken, \n              idToken, \n              refreshToken,\n              isAuthenticated: false, \n              error\n            }));\n        });\n    });\n    /* eslint-enable complexity */\n    this._pending.updateAuthStatePromise = cancelablePromise;\n\n    return finalPromise(cancelablePromise);\n  }\n\n  subscribe(handler): void {\n    this._sdk.emitter.on(EVENT_AUTH_STATE_CHANGE, handler);\n  }\n\n  unsubscribe(handler?): void {\n    this._sdk.emitter.off(EVENT_AUTH_STATE_CHANGE, handler);\n  }\n}\n"],"file":"AuthStateManager.js"}
+{"version":3,"sources":["../../lib/AuthStateManager.ts"],"names":["PCancelable","require","INITIAL_AUTH_STATE","DEFAULT_PENDING","updateAuthStatePromise","canceledTimes","EVENT_AUTH_STATE_CHANGE","MAX_PROMISE_CANCEL_TIMES","isSameAuthState","prevState","state","isAuthenticated","JSON","stringify","idToken","accessToken","error","AuthStateManager","constructor","sdk","emitter","AuthSdkError","_sdk","_pending","_authState","_logOptions","tokenManager","on","EVENT_ADDED","key","token","_setLogOptions","event","updateAuthState","EVENT_REMOVED","options","getAuthState","getPreviousAuthState","_prevAuthState","transformAuthState","devMode","log","status","group","groupEnd","emitAuthStateChange","authState","emit","finalPromise","origPromise","then","curPromise","cancel","cancelablePromise","resolve","_","onCancel","shouldReject","emitAndResolve","isCanceled","refreshToken","getTokensSync","promise","Promise","catch","subscribe","handler","unsubscribe","off"],"mappings":";;;;AAaA;;AAGA;;AACA;;AAjBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAQA,MAAMA,WAAW,GAAGC,OAAO,CAAC,cAAD,CAA3B;;AAEO,MAAMC,kBAAkB,GAAG,IAA3B;;AACP,MAAMC,eAAe,GAAG;AACtBC,EAAAA,sBAAsB,EAAE,IADF;AAEtBC,EAAAA,aAAa,EAAE;AAFO,CAAxB;AAIA,MAAMC,uBAAuB,GAAG,iBAAhC;AACA,MAAMC,wBAAwB,GAAG,EAAjC,C,CAEA;;AACA,MAAMC,eAAe,GAAG,CAACC,SAAD,EAAuBC,KAAvB,KAA4C;AAClE;AACA,MAAI,CAACD,SAAL,EAAgB;AACd,WAAO,KAAP;AACD;;AAED,SAAOA,SAAS,CAACE,eAAV,KAA8BD,KAAK,CAACC,eAApC,IACFC,IAAI,CAACC,SAAL,CAAeJ,SAAS,CAACK,OAAzB,MAAsCF,IAAI,CAACC,SAAL,CAAeH,KAAK,CAACI,OAArB,CADpC,IAEFF,IAAI,CAACC,SAAL,CAAeJ,SAAS,CAACM,WAAzB,MAA0CH,IAAI,CAACC,SAAL,CAAeH,KAAK,CAACK,WAArB,CAFxC,IAGFN,SAAS,CAACO,KAAV,KAAoBN,KAAK,CAACM,KAH/B;AAID,CAVD;;AAYO,MAAMC,gBAAN,CAAuB;AAW5BC,EAAAA,WAAW,CAACC,GAAD,EAAgB;AACzB,QAAI,CAACA,GAAG,CAACC,OAAT,EAAkB;AAChB,YAAM,IAAIC,oBAAJ,CAAiB,uDAAjB,CAAN;AACD;;AAED,SAAKC,IAAL,GAAYH,GAAZ;AACA,SAAKI,QAAL,GAAgB,EAAE,GAAGpB;AAAL,KAAhB;AACA,SAAKqB,UAAL,GAAkBtB,kBAAlB;AACA,SAAKuB,WAAL,GAAmB,EAAnB,CARyB,CAUzB;AACA;AACA;;AACAN,IAAAA,GAAG,CAACO,YAAJ,CAAiBC,EAAjB,CAAoBC,yBAApB,EAAiC,CAACC,GAAD,EAAMC,KAAN,KAAgB;AAC/C,WAAKC,cAAL,CAAoB;AAAEC,QAAAA,KAAK,EAAEJ,yBAAT;AAAsBC,QAAAA,GAAtB;AAA2BC,QAAAA;AAA3B,OAApB;;AACA,WAAKG,eAAL;AACD,KAHD;AAIAd,IAAAA,GAAG,CAACO,YAAJ,CAAiBC,EAAjB,CAAoBO,2BAApB,EAAmC,CAACL,GAAD,EAAMC,KAAN,KAAgB;AACjD,WAAKC,cAAL,CAAoB;AAAEC,QAAAA,KAAK,EAAEE,2BAAT;AAAwBL,QAAAA,GAAxB;AAA6BC,QAAAA;AAA7B,OAApB;;AACA,WAAKG,eAAL;AACD,KAHD;AAID;;AAEDF,EAAAA,cAAc,CAACI,OAAD,EAAU;AACtB,SAAKV,WAAL,GAAmBU,OAAnB;AACD;;AAEDC,EAAAA,YAAY,GAAqB;AAC/B,WAAO,KAAKZ,UAAZ;AACD;;AAEDa,EAAAA,oBAAoB,GAAqB;AACvC,WAAO,KAAKC,cAAZ;AACD;;AAEoB,QAAfL,eAAe,GAAuB;AAC1C,UAAM;AAAEM,MAAAA,kBAAF;AAAsBC,MAAAA;AAAtB,QAAkC,KAAKlB,IAAL,CAAUa,OAAlD;;AAEA,UAAMM,GAAG,GAAIC,MAAD,IAAY;AACtB,YAAM;AAAEV,QAAAA,KAAF;AAASH,QAAAA,GAAT;AAAcC,QAAAA;AAAd,UAAwB,KAAKL,WAAnC;AACA,8BAAakB,KAAb,CAAoB,uCAAsCX,KAAM,WAAUU,MAAO,EAAjF;AACA,8BAAaD,GAAb,CAAiBZ,GAAjB,EAAsBC,KAAtB;AACA,8BAAaW,GAAb,CAAiB,mBAAjB,EAAsC,KAAKjB,UAA3C;AACA,8BAAaoB,QAAb,GALsB,CAOtB;;AACA,WAAKnB,WAAL,GAAmB,EAAnB;AACD,KATD;;AAWA,UAAMoB,mBAAmB,GAAIC,SAAD,IAAe;AACzC,UAAItC,eAAe,CAAC,KAAKgB,UAAN,EAAkBsB,SAAlB,CAAnB,EAAiD;AAC/CN,QAAAA,OAAO,IAAIC,GAAG,CAAC,WAAD,CAAd;AACA;AACD;;AACD,WAAKH,cAAL,GAAsB,KAAKd,UAA3B;AACA,WAAKA,UAAL,GAAkBsB,SAAlB,CANyC,CAOzC;;AACA,WAAKxB,IAAL,CAAUF,OAAV,CAAkB2B,IAAlB,CAAuBzC,uBAAvB,EAAgD,EAAE,GAAGwC;AAAL,OAAhD;;AACAN,MAAAA,OAAO,IAAIC,GAAG,CAAC,SAAD,CAAd;AACD,KAVD;;AAYA,UAAMO,YAAY,GAAIC,WAAD,IAAiB;AACpC,aAAO,KAAK1B,QAAL,CAAcnB,sBAAd,CAAqC8C,IAArC,CAA0C,MAAM;AACrD,cAAMC,UAAU,GAAG,KAAK5B,QAAL,CAAcnB,sBAAjC;;AACA,YAAI+C,UAAU,IAAIA,UAAU,KAAKF,WAAjC,EAA8C;AAC5C,iBAAOD,YAAY,CAACG,UAAD,CAAnB;AACD;;AACD,eAAO,KAAKf,YAAL,EAAP;AACD,OANM,CAAP;AAOD,KARD;;AAUA,QAAI,KAAKb,QAAL,CAAcnB,sBAAlB,EAA0C;AACxC,UAAI,KAAKmB,QAAL,CAAclB,aAAd,IAA+BE,wBAAnC,EAA6D;AAC3D;AACA;AACAiC,QAAAA,OAAO,IAAIC,GAAG,CAAC,YAAD,CAAd;AACA,eAAOO,YAAY,CAAC,KAAKzB,QAAL,CAAcnB,sBAAf,CAAnB;AACD,OALD,MAKO;AACL,aAAKmB,QAAL,CAAcnB,sBAAd,CAAqCgD,MAArC;AACD;AACF;AAED;;;AACA,UAAMC,iBAAiB,GAAG,IAAIrD,WAAJ,CAAgB,CAACsD,OAAD,EAAUC,CAAV,EAAaC,QAAb,KAA0B;AAClEA,MAAAA,QAAQ,CAACC,YAAT,GAAwB,KAAxB;AACAD,MAAAA,QAAQ,CAAC,MAAM;AACb,aAAKjC,QAAL,CAAcnB,sBAAd,GAAuC,IAAvC;AACA,aAAKmB,QAAL,CAAclB,aAAd,GAA8B,KAAKkB,QAAL,CAAclB,aAAd,GAA8B,CAA5D;AACAmC,QAAAA,OAAO,IAAIC,GAAG,CAAC,UAAD,CAAd;AACD,OAJO,CAAR;;AAMA,YAAMiB,cAAc,GAAIZ,SAAD,IAAe;AACpC,YAAIO,iBAAiB,CAACM,UAAtB,EAAkC;AAChCL,UAAAA,OAAO;AACP;AACD,SAJmC,CAKpC;;;AACAT,QAAAA,mBAAmB,CAACC,SAAD,CAAnB;AACAQ,QAAAA,OAAO,GAP6B,CASpC;;AACA,aAAK/B,QAAL,GAAgB,EAAE,GAAGpB;AAAL,SAAhB;AACD,OAXD;;AAaA,WAAKmB,IAAL,CAAUX,eAAV,GACGuC,IADH,CACQ,MAAM;AACV,YAAIG,iBAAiB,CAACM,UAAtB,EAAkC;AAChCL,UAAAA,OAAO;AACP;AACD;;AAED,cAAM;AAAEvC,UAAAA,WAAF;AAAeD,UAAAA,OAAf;AAAwB8C,UAAAA;AAAxB,YAAyC,KAAKtC,IAAL,CAAUI,YAAV,CAAuBmC,aAAvB,EAA/C;;AACA,cAAMf,SAAS,GAAG;AAChB/B,UAAAA,WADgB;AAEhBD,UAAAA,OAFgB;AAGhB8C,UAAAA,YAHgB;AAIhBjD,UAAAA,eAAe,EAAE,CAAC,EAAEI,WAAW,IAAID,OAAjB;AAJF,SAAlB;AAMA,cAAMgD,OAA2B,GAAGvB,kBAAkB,GAClDA,kBAAkB,CAAC,KAAKjB,IAAN,EAAYwB,SAAZ,CADgC,GAElDiB,OAAO,CAACT,OAAR,CAAgBR,SAAhB,CAFJ;AAIAgB,QAAAA,OAAO,CACJZ,IADH,CACQJ,SAAS,IAAIY,cAAc,CAACZ,SAAD,CADnC,EAEGkB,KAFH,CAEShD,KAAK,IAAI0C,cAAc,CAAC;AAC7B3C,UAAAA,WAD6B;AAE7BD,UAAAA,OAF6B;AAG7B8C,UAAAA,YAH6B;AAI7BjD,UAAAA,eAAe,EAAE,KAJY;AAK7BK,UAAAA;AAL6B,SAAD,CAFhC;AASD,OA3BH;AA4BD,KAjDyB,CAA1B;AAkDA;;AACA,SAAKO,QAAL,CAAcnB,sBAAd,GAAuCiD,iBAAvC;AAEA,WAAOL,YAAY,CAACK,iBAAD,CAAnB;AACD;;AAEDY,EAAAA,SAAS,CAACC,OAAD,EAAgB;AACvB,SAAK5C,IAAL,CAAUF,OAAV,CAAkBO,EAAlB,CAAqBrB,uBAArB,EAA8C4D,OAA9C;AACD;;AAEDC,EAAAA,WAAW,CAACD,OAAD,EAAiB;AAC1B,SAAK5C,IAAL,CAAUF,OAAV,CAAkBgD,GAAlB,CAAsB9D,uBAAtB,EAA+C4D,OAA/C;AACD;;AA5J2B","sourcesContent":["/*!\n * Copyright (c) 2015-present, Okta, Inc. and/or its affiliates. All rights reserved.\n * The Okta software accompanied by this notice is provided pursuant to the Apache License, Version 2.0 (the \"License.\")\n *\n * You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS, WITHOUT\n * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * \n * See the License for the specific language governing permissions and limitations under the License.\n */\n\n\nimport { AuthSdkError } from './errors';\nimport { AuthState, AuthStateLogOptions } from './types';\nimport { OktaAuth } from '.';\nimport { getConsole } from './util';\nimport { EVENT_ADDED, EVENT_REMOVED } from './TokenManager';\nconst PCancelable = require('p-cancelable');\n\nexport const INITIAL_AUTH_STATE = null;\nconst DEFAULT_PENDING = {\n  updateAuthStatePromise: null,\n  canceledTimes: 0\n};\nconst EVENT_AUTH_STATE_CHANGE = 'authStateChange';\nconst MAX_PROMISE_CANCEL_TIMES = 10;\n\n// only compare first level of authState\nconst isSameAuthState = (prevState: AuthState, state: AuthState) => {\n  // initial state is null\n  if (!prevState) {\n    return false;\n  }\n\n  return prevState.isAuthenticated === state.isAuthenticated \n    && JSON.stringify(prevState.idToken) === JSON.stringify(state.idToken)\n    && JSON.stringify(prevState.accessToken) === JSON.stringify(state.accessToken)\n    && prevState.error === state.error;\n};\n\nexport class AuthStateManager {\n  _sdk: OktaAuth;\n  _pending: { \n    updateAuthStatePromise: typeof PCancelable;\n    canceledTimes: number; \n  };\n  _authState: AuthState | null;\n  _prevAuthState: AuthState | null;\n  _logOptions: AuthStateLogOptions;\n  _lastEventTimestamp: number;\n\n  constructor(sdk: OktaAuth) {\n    if (!sdk.emitter) {\n      throw new AuthSdkError('Emitter should be initialized before AuthStateManager');\n    }\n\n    this._sdk = sdk;\n    this._pending = { ...DEFAULT_PENDING };\n    this._authState = INITIAL_AUTH_STATE;\n    this._logOptions = {};\n\n    // Listen on tokenManager events to start updateState process\n    // \"added\" event is emitted in both add and renew process\n    // Only listen on \"added\" event to update auth state\n    sdk.tokenManager.on(EVENT_ADDED, (key, token) => {\n      this._setLogOptions({ event: EVENT_ADDED, key, token });\n      this.updateAuthState();\n    });\n    sdk.tokenManager.on(EVENT_REMOVED, (key, token) => {\n      this._setLogOptions({ event: EVENT_REMOVED, key, token });\n      this.updateAuthState();\n    });\n  }\n\n  _setLogOptions(options) {\n    this._logOptions = options;\n  }\n\n  getAuthState(): AuthState | null {\n    return this._authState;\n  }\n\n  getPreviousAuthState(): AuthState | null {\n    return this._prevAuthState;\n  }\n\n  async updateAuthState(): Promise<AuthState> {\n    const { transformAuthState, devMode } = this._sdk.options;\n\n    const log = (status) => {\n      const { event, key, token } = this._logOptions;\n      getConsole().group(`OKTA-AUTH-JS:updateAuthState: Event:${event} Status:${status}`);\n      getConsole().log(key, token);\n      getConsole().log('Current authState', this._authState);\n      getConsole().groupEnd();\n      \n      // clear log options after logging\n      this._logOptions = {};\n    };\n\n    const emitAuthStateChange = (authState) => {\n      if (isSameAuthState(this._authState, authState)) {\n        devMode && log('unchanged'); \n        return;\n      }\n      this._prevAuthState = this._authState;\n      this._authState = authState;\n      // emit new authState object\n      this._sdk.emitter.emit(EVENT_AUTH_STATE_CHANGE, { ...authState });\n      devMode && log('emitted');\n    };\n\n    const finalPromise = (origPromise) => {       \n      return this._pending.updateAuthStatePromise.then(() => {\n        const curPromise = this._pending.updateAuthStatePromise;\n        if (curPromise && curPromise !== origPromise) {\n          return finalPromise(curPromise);\n        }\n        return this.getAuthState();\n      });\n    };\n\n    if (this._pending.updateAuthStatePromise) {\n      if (this._pending.canceledTimes >= MAX_PROMISE_CANCEL_TIMES) {\n        // stop canceling then starting a new promise\n        // let existing promise finish to prevent running into loops\n        devMode && log('terminated');\n        return finalPromise(this._pending.updateAuthStatePromise);\n      } else {\n        this._pending.updateAuthStatePromise.cancel();\n      }\n    }\n\n    /* eslint-disable complexity */\n    const cancelablePromise = new PCancelable((resolve, _, onCancel) => {\n      onCancel.shouldReject = false;\n      onCancel(() => {\n        this._pending.updateAuthStatePromise = null;\n        this._pending.canceledTimes = this._pending.canceledTimes + 1;\n        devMode && log('canceled');\n      });\n\n      const emitAndResolve = (authState) => {\n        if (cancelablePromise.isCanceled) {\n          resolve();\n          return;\n        }\n        // emit event and resolve promise \n        emitAuthStateChange(authState);\n        resolve();\n\n        // clear pending states after resolve\n        this._pending = { ...DEFAULT_PENDING };\n      };\n\n      this._sdk.isAuthenticated()\n        .then(() => {\n          if (cancelablePromise.isCanceled) {\n            resolve();\n            return;\n          }\n\n          const { accessToken, idToken, refreshToken } = this._sdk.tokenManager.getTokensSync();\n          const authState = {\n            accessToken,\n            idToken,\n            refreshToken,\n            isAuthenticated: !!(accessToken && idToken)\n          };\n          const promise: Promise<AuthState> = transformAuthState\n            ? transformAuthState(this._sdk, authState)\n            : Promise.resolve(authState);\n\n          promise\n            .then(authState => emitAndResolve(authState))\n            .catch(error => emitAndResolve({\n              accessToken, \n              idToken, \n              refreshToken,\n              isAuthenticated: false, \n              error\n            }));\n        });\n    });\n    /* eslint-enable complexity */\n    this._pending.updateAuthStatePromise = cancelablePromise;\n\n    return finalPromise(cancelablePromise);\n  }\n\n  subscribe(handler): void {\n    this._sdk.emitter.on(EVENT_AUTH_STATE_CHANGE, handler);\n  }\n\n  unsubscribe(handler?): void {\n    this._sdk.emitter.off(EVENT_AUTH_STATE_CHANGE, handler);\n  }\n}\n"],"file":"AuthStateManager.js"}

package/cjs/OktaAuth.js

@@ -44,6 +44,8 @@ var _headers = require("./idx/headers");
 
 var _OktaUserAgent = require("./OktaUserAgent");
 
+var _parseFromUrl = require("./oidc/parseFromUrl");
+
 function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
 
 function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
@@ -74,23 +76,18 @@ class OktaAuth {
   // TODO: remove in version 6
   // JIRA: https://oktainc.atlassian.net/browse/OKTA-419417
   constructor(args) {
-    this.options = (0, _options.buildOptions)(args);
-    const {
-      storageManager,
-      cookies,
-      storageUtil
-    } = this.options;
-    this.storageManager = new _StorageManager.default(storageManager, cookies, storageUtil);
+    const options = this.options = (0, _options.buildOptions)(args);
+    this.storageManager = new _StorageManager.default(options.storageManager, options.cookies, options.storageUtil);
     this.transactionManager = new _TransactionManager.default(Object.assign({
       storageManager: this.storageManager
-    }, args.transactionManager));
+    }, options.transactionManager));
     this._oktaUserAgent = new _OktaUserAgent.OktaUserAgent();
     this.tx = {
       status: _tx.transactionStatus.bind(null, this),
       resume: _tx.resumeTransaction.bind(null, this),
       exists: Object.assign(_tx.transactionExists.bind(null, this), {
         _get: name => {
-          const storage = storageUtil.storage;
+          const storage = options.storageUtil.storage;
           return storage.get(name);
         }
       }),
@@ -115,9 +112,9 @@ class OktaAuth {
         redirectUri: (0, _util.toAbsoluteUrl)(args.redirectUri, window.location.origin) // allow relative URIs
 
       });
-      this.userAgent = (0, _builderUtil.getUserAgent)(args, `okta-auth-js/${"5.5.0"}`);
+      this.userAgent = (0, _builderUtil.getUserAgent)(args, `okta-auth-js/${"5.9.0"}`);
     } else {
-      this.userAgent = (0, _builderUtil.getUserAgent)(args, `okta-auth-js-server/${"5.5.0"}`);
+      this.userAgent = (0, _builderUtil.getUserAgent)(args, `okta-auth-js-server/${"5.9.0"}`);
     } // Digital clocks will drift over time, so the server
     // can misalign with the time reported by the browser.
     // The maxClockSkew allows relaxing the time-based
@@ -198,10 +195,18 @@ class OktaAuth {
       introspect: _idx.introspect.bind(null, this),
       authenticate: _idx.authenticate.bind(null, this),
       register: _idx.register.bind(null, this),
+      proceed: _idx.proceed.bind(null, this),
       cancel: _idx.cancel.bind(null, this),
       recoverPassword: _idx.recoverPassword.bind(null, this),
       handleInteractionCodeRedirect: _idx.handleInteractionCodeRedirect.bind(null, this),
-      startTransaction: _idx.startTransaction.bind(null, this)
+      startTransaction: _idx.startTransaction.bind(null, this),
+      setFlow: flow => {
+        this.options.flow = flow;
+      },
+      getFlow: () => {
+        return this.options.flow;
+      },
+      canProceed: _idx.canProceed.bind(null, this)
     };
     (0, _headers.setGlobalRequestInterceptor)((0, _headers.createGlobalRequestInterceptor)(this)); // to pass custom headers to IDX endpoints
     // HTTP
@@ -228,17 +233,30 @@ class OktaAuth {
 
   stop() {
     this.tokenManager.stop();
+  }
+
+  setHeaders(headers) {
+    this.options.headers = Object.assign({}, this.options.headers, headers);
   } // ES6 module users can use named exports to access all symbols
   // CommonJS module users (CDN) need all exports on this object
   // Utility methods for interaction code flow
 
 
-  isInteractionRequired() {
-    return (0, _oidc.isInteractionRequired)(this);
+  isInteractionRequired(hashOrSearch) {
+    return (0, _oidc.isInteractionRequired)(this, hashOrSearch);
   }
 
   isInteractionRequiredError(error) {
     return (0, _oidc.isInteractionRequiredError)(error);
+  } // Utility methods for email verify callback
+
+
+  isEmailVerifyCallback(urlPath) {
+    return (0, _util.isEmailVerifyCallback)(urlPath);
+  }
+
+  parseEmailVerifyCallback(urlPath) {
+    return (0, _util.parseEmailVerifyCallback)(urlPath);
   }
 
   async signIn(opts) {
@@ -251,8 +269,6 @@ class OktaAuth {
     opts = (0, _util.clone)(opts || {});
 
     const _postToTransaction = options => {
-      options = options || {};
-      options.withCredentials = true;
       delete opts.sendFingerprint;
       return (0, _tx.postToTransaction)(this, '/api/v1/authn', opts, options);
     };
@@ -525,44 +541,77 @@ class OktaAuth {
     this.tokenManager.setTokens(tokens);
   }
 
-  setOriginalUri(originalUri) {
-    const storage = _browserStorage.default.getSessionStorage();
+  setOriginalUri(originalUri, state) {
+    // always store in session storage
+    const sessionStorage = _browserStorage.default.getSessionStorage();
+
+    sessionStorage.setItem(constants.REFERRER_PATH_STORAGE_KEY, originalUri); // to support multi-tab flows, set a state in constructor or pass as param
+
+    state = state || this.options.state;
 
-    storage.setItem(constants.REFERRER_PATH_STORAGE_KEY, originalUri);
+    if (state) {
+      const sharedStorage = this.storageManager.getOriginalUriStorage();
+      sharedStorage.setItem(state, originalUri);
+    }
   }
 
-  getOriginalUri() {
+  getOriginalUri(state) {
+    // Prefer shared storage (if state is available)
+    state = state || this.options.state;
+
+    if (state) {
+      const sharedStorage = this.storageManager.getOriginalUriStorage();
+      const originalUri = sharedStorage.getItem(state);
+
+      if (originalUri) {
+        return originalUri;
+      }
+    } // Try to load from session storage
+
+
     const storage = _browserStorage.default.getSessionStorage();
 
-    const originalUri = storage.getItem(constants.REFERRER_PATH_STORAGE_KEY);
-    return originalUri;
+    return storage ? storage.getItem(constants.REFERRER_PATH_STORAGE_KEY) : undefined;
   }
 
-  removeOriginalUri() {
+  removeOriginalUri(state) {
+    // Remove from sessionStorage
     const storage = _browserStorage.default.getSessionStorage();
 
-    storage.removeItem(constants.REFERRER_PATH_STORAGE_KEY);
+    storage.removeItem(constants.REFERRER_PATH_STORAGE_KEY); // Also remove from shared storage
+
+    state = state || this.options.state;
+
+    if (state) {
+      const sharedStorage = this.storageManager.getOriginalUriStorage();
+      sharedStorage.removeItem(state);
+    }
   }
 
   isLoginRedirect() {
     return (0, _oidc.isLoginRedirect)(this);
   }
 
-  async handleLoginRedirect(tokens) {
-    // Store tokens and update AuthState by the emitted events
+  async handleLoginRedirect(tokens, originalUri) {
+    let state = this.options.state; // Store tokens and update AuthState by the emitted events
+
     if (tokens) {
       this.tokenManager.setTokens(tokens);
+      originalUri = originalUri || this.getOriginalUri(this.options.state);
     } else if (this.isLoginRedirect()) {
+      // For redirect flow, get state from the URL and use it to retrieve the originalUri
+      const oAuthResponse = await (0, _parseFromUrl.parseOAuthResponseFromUrl)(this, {});
+      state = oAuthResponse.state;
+      originalUri = originalUri || this.getOriginalUri(state);
       await this.storeTokensFromRedirect();
     } else {
       return; // nothing to do
     } // ensure auth state has been updated
 
 
-    await this.authStateManager.updateAuthState(); // Get and clear originalUri from storage
+    await this.authStateManager.updateAuthState(); // clear originalUri from storage
 
-    const originalUri = this.getOriginalUri();
-    this.removeOriginalUri(); // Redirect to originalUri
+    this.removeOriginalUri(state); // Redirect to originalUri
 
     const {
       restoreOriginalUri