@opengeoweb/authentication 19.5.1 → 19.6.1

package/dist/index.esm.js

@@ -192,6 +192,67 @@ function _regeneratorDefine(e, r, n, t) {
   }, _regeneratorDefine(e, r, n, t);
 }
 
+/* *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright 2026 - Koninklijk Nederlands Meteorologisch Instituut (KNMI)
+ * Copyright 2026 - Finnish Meteorological Institute (FMI)
+ * Copyright 2026 - The Norwegian Meteorological Institute (MET Norway)
+ * */
+// OIDC error codes for "prompt=none couldn't be honoured silently"
+var OIDC_NO_INTERACTION_ERROR_CODES = ['login_required', 'interaction_required', 'consent_required'];
+var buildSilentLoginUrl = function buildSilentLoginUrl(loginUrl) {
+  return "" + loginUrl + (loginUrl.includes('?') ? '&' : '?') + "prompt=none";
+};
+// Force-auth already redirects to /login on a live IdP session, so silent login is redundant there. Keep them mutually exclusive
+var isSilentLoginEnabled = function isSilentLoginEnabled(config) {
+  return Boolean((config == null ? void 0 : config.GW_FEATURE_SILENT_LOGIN) && !(config != null && config.GW_FEATURE_FORCE_AUTHENTICATION));
+};
+var SILENT_LOGIN_ATTEMPT_STORAGE_KEY = 'gw_silent_login_attempted_at';
+var SILENT_LOGIN_COOLDOWN_MS = 5 * 60 * 1000;
+// Limits retries if the IdP doesn't honour prompt=none
+var hasRecentSilentLoginAttempt = function hasRecentSilentLoginAttempt() {
+  var lastAttempt = Number(localStorage.getItem(SILENT_LOGIN_ATTEMPT_STORAGE_KEY));
+  return Boolean(lastAttempt) && Date.now() - lastAttempt < SILENT_LOGIN_COOLDOWN_MS;
+};
+var recordSilentLoginAttempt = function recordSilentLoginAttempt() {
+  localStorage.setItem(SILENT_LOGIN_ATTEMPT_STORAGE_KEY, String(Date.now()));
+};
+var clearSilentLoginAttempt = function clearSilentLoginAttempt() {
+  localStorage.removeItem(SILENT_LOGIN_ATTEMPT_STORAGE_KEY);
+};
+var SILENT_LOGIN_SUPPRESSED_STORAGE_KEY = 'gw_silent_login_suppressed';
+// Set on logout; never expires on its own (unlike the cooldown above), only clearSilentLoginSuppression lifts it
+var suppressSilentLogin = function suppressSilentLogin() {
+  localStorage.setItem(SILENT_LOGIN_SUPPRESSED_STORAGE_KEY, 'true');
+};
+var isSilentLoginSuppressed = function isSilentLoginSuppressed() {
+  return localStorage.getItem(SILENT_LOGIN_SUPPRESSED_STORAGE_KEY) === 'true';
+};
+var clearSilentLoginSuppression = function clearSilentLoginSuppression() {
+  localStorage.removeItem(SILENT_LOGIN_SUPPRESSED_STORAGE_KEY);
+};
+// Tells tabs already open to log out now (suppressSilentLogin only blocks future attempts)
+var LOGOUT_BROADCAST_CHANNEL_NAME = 'gw_auth_logout';
+var broadcastLogout = function broadcastLogout() {
+  var channel = new BroadcastChannel(LOGOUT_BROADCAST_CHANNEL_NAME);
+  channel.postMessage('logout');
+  channel.close();
+};
+var createLogoutBroadcastChannel = function createLogoutBroadcastChannel() {
+  return new BroadcastChannel(LOGOUT_BROADCAST_CHANNEL_NAME);
+};
+
 var DEFAULT_TIMEOUT = 15000;
 var KEEP_ALIVE_POLLER_IN_SECONDS = 60; // Number of seconds between the checks if the token should be refreshed.
 var REFRESH_TOKEN_WHEN_PCT_EXPIRED = 75; // Refresh token when 75% expired. Set to (10 / 3600) * 100 = 0.2777778% to test with 10 second interval (assuming 1 hour token expiration).
@@ -579,7 +640,9 @@ var authConfigKeys = {
   GW_BE_VERSION_BASE_URL: null,
   GW_AUTH_CLIENT_ID: null,
   GW_AUTH_ROLE_CLAIM_NAME: null,
-  GW_AUTH_ROLE_CLAIM_VALUE_PRESETS_ADMIN: null
+  GW_AUTH_ROLE_CLAIM_VALUE_PRESETS_ADMIN: null,
+  GW_FEATURE_SILENT_LOGIN: false,
+  GW_FEATURE_FORCE_AUTHENTICATION: false
 };
 var getRandomString = function getRandomString() {
   var array = new Uint32Array(8);
@@ -620,7 +683,9 @@ var getAuthConfig = function getAuthConfig(_configUrls) {
     GW_BE_VERSION_BASE_URL = _configUrls.GW_BE_VERSION_BASE_URL,
     GW_AUTH_CLIENT_ID = _configUrls.GW_AUTH_CLIENT_ID,
     GW_AUTH_ROLE_CLAIM_NAME = _configUrls.GW_AUTH_ROLE_CLAIM_NAME,
-    GW_AUTH_ROLE_CLAIM_VALUE_PRESETS_ADMIN = _configUrls.GW_AUTH_ROLE_CLAIM_VALUE_PRESETS_ADMIN;
+    GW_AUTH_ROLE_CLAIM_VALUE_PRESETS_ADMIN = _configUrls.GW_AUTH_ROLE_CLAIM_VALUE_PRESETS_ADMIN,
+    GW_FEATURE_SILENT_LOGIN = _configUrls.GW_FEATURE_SILENT_LOGIN,
+    GW_FEATURE_FORCE_AUTHENTICATION = _configUrls.GW_FEATURE_FORCE_AUTHENTICATION;
   var loginUrl = replaceTemplateKeys(GW_AUTH_LOGIN_URL, GW_AUTH_CLIENT_ID, GW_APP_URL, sessionStorageProvider.getOauthState(), sessionStorageProvider.getOauthCodeChallenge());
   var logOutUrl = replaceTemplateKeys(GW_AUTH_LOGOUT_URL, GW_AUTH_CLIENT_ID, GW_APP_URL);
   return {
@@ -631,7 +696,9 @@ var getAuthConfig = function getAuthConfig(_configUrls) {
     GW_BE_VERSION_BASE_URL: GW_BE_VERSION_BASE_URL,
     GW_AUTH_CLIENT_ID: GW_AUTH_CLIENT_ID,
     GW_AUTH_ROLE_CLAIM_NAME: GW_AUTH_ROLE_CLAIM_NAME,
-    GW_AUTH_ROLE_CLAIM_VALUE_PRESETS_ADMIN: GW_AUTH_ROLE_CLAIM_VALUE_PRESETS_ADMIN
+    GW_AUTH_ROLE_CLAIM_VALUE_PRESETS_ADMIN: GW_AUTH_ROLE_CLAIM_VALUE_PRESETS_ADMIN,
+    GW_FEATURE_SILENT_LOGIN: GW_FEATURE_SILENT_LOGIN,
+    GW_FEATURE_FORCE_AUTHENTICATION: GW_FEATURE_FORCE_AUTHENTICATION
   };
 };
 var AuthenticationContext = /*#__PURE__*/React.createContext({
@@ -647,6 +714,11 @@ var authChangeListener = null;
 var setAuthChangeListener = function setAuthChangeListener(listener) {
   authChangeListener = listener;
 };
+var clearSession = function clearSession(onSetAuth, onLogin, sessionStorageProviderArg) {
+  onSetAuth(null);
+  onLogin(false);
+  sessionStorageProviderArg.removeHasAuthenticated();
+};
 var useAuthenticationDefaultProps = function useAuthenticationDefaultProps() {
   var _auth$roles$, _auth$roles;
   var _React$useState = React.useState(false),
@@ -756,6 +828,20 @@ var AuthenticationProvider = function AuthenticationProvider(_ref2) {
       clearInterval(interval.current);
     };
   }, [auth, configURLS.GW_APP_URL, configURLS.GW_AUTH_CLIENT_ID, configURLS.GW_AUTH_TOKEN_URL, onSetAuth, configURLS, onLogin]);
+  // Propagates an explicit logout (see Logout.tsx) to every other open tab.
+  var silentLoginEnabled = isSilentLoginEnabled(authConfig);
+  React.useEffect(function () {
+    if (!silentLoginEnabled) {
+      return undefined;
+    }
+    var channel = createLogoutBroadcastChannel();
+    channel.onmessage = function () {
+      clearSession(onSetAuth, onLogin, sessionStorageProvider);
+    };
+    return function () {
+      channel.close();
+    };
+  }, [silentLoginEnabled, onSetAuth, onLogin, sessionStorageProvider]);
   var contextValue = React.useMemo(function () {
     return {
       isLoggedIn: isLoggedIn,
@@ -790,23 +876,53 @@ var HandleOAuth2Code = function HandleOAuth2Code() {
   var _React$useState = React.useState(null),
     error = _React$useState[0],
     setError = _React$useState[1];
+  // Set when an automatic silent-login attempt (see Workspace.tsx) comes back
+  // with an OIDC "no interaction possible" error — i.e. "you're just not
+  // logged in", not a real failure, so this returns quietly instead of
+  // showing the /error page.
+  var _React$useState2 = React.useState(false),
+    returnWithoutLogin = _React$useState2[0],
+    setReturnWithoutLogin = _React$useState2[1];
   var _useIsMounted = useIsMounted(),
     isMounted = _useIsMounted.isMounted;
   var loginInProgress = React.useRef(false);
   var authenticate = React.useCallback(/*#__PURE__*/_asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee() {
-    var _Object$fromEntries, code, state, isStateRequired, isPkceRequired, payload, useDefaultContentType, data, config, res, newAuth, _t;
+    var _Object$fromEntries, code, state, oidcError, isStateRequired, isPkceRequired, payload, useDefaultContentType, data, config, res, newAuth, _t;
     return _regenerator().w(function (_context) {
       while (1) switch (_context.p = _context.n) {
         case 0:
-          _Object$fromEntries = Object.fromEntries(new URLSearchParams(window.location.search)), code = _Object$fromEntries.code, state = _Object$fromEntries.state;
+          _Object$fromEntries = Object.fromEntries(new URLSearchParams(window.location.search)), code = _Object$fromEntries.code, state = _Object$fromEntries.state, oidcError = _Object$fromEntries.error;
+          if (!oidcError) {
+            _context.n = 2;
+            break;
+          }
+          // Arm the cooldown for any IdP error, not just the whitelisted ones, so Workspace.tsx doesn't immediately retry
+          recordSilentLoginAttempt();
+          if (!OIDC_NO_INTERACTION_ERROR_CODES.includes(oidcError)) {
+            _context.n = 1;
+            break;
+          }
+          if (isMounted.current) {
+            setReturnWithoutLogin(true);
+          }
+          return _context.a(2);
+        case 1:
+          setError(function () {
+            return {
+              message: 'Login failed',
+              stack: "OIDC error: " + oidcError
+            };
+          });
+          return _context.a(2);
+        case 2:
           isStateRequired = authConfig.GW_AUTH_LOGIN_URL.includes('&state=');
           isPkceRequired = authConfig.GW_AUTH_LOGIN_URL.includes('&code_challenge=');
           if (!isStateRequired) {
-            _context.n = 1;
+            _context.n = 3;
             break;
           }
           if (!(!state || state !== sessionStorageProvider.getOauthState())) {
-            _context.n = 1;
+            _context.n = 3;
             break;
           }
           setError(function () {
@@ -816,13 +932,13 @@ var HandleOAuth2Code = function HandleOAuth2Code() {
             };
           });
           return _context.a(2);
-        case 1:
+        case 3:
           if (!isPkceRequired) {
-            _context.n = 2;
+            _context.n = 4;
             break;
           }
           if (!(!code || !sessionStorageProvider.getOauthCodeVerifier())) {
-            _context.n = 2;
+            _context.n = 4;
             break;
           }
           setError(function () {
@@ -832,7 +948,7 @@ var HandleOAuth2Code = function HandleOAuth2Code() {
             };
           });
           return _context.a(2);
-        case 2:
+        case 4:
           payload = Object.assign({
             client_id: authConfig.GW_AUTH_CLIENT_ID,
             code: code,
@@ -851,26 +967,28 @@ var HandleOAuth2Code = function HandleOAuth2Code() {
             },
             timeout: 30000
           };
-          _context.p = 3;
-          _context.n = 4;
+          _context.p = 5;
+          _context.n = 6;
           return axiosInstance.post(authConfig.GW_AUTH_TOKEN_URL, data, config);
-        case 4:
+        case 6:
           res = _context.v;
           newAuth = makeCredentialsFromTokenResponse(res, authConfig);
           if (isMounted.current) {
             onSetAuth(newAuth);
             onLogin(true);
             sessionStorageProvider.setHasAuthenticated('true');
+            clearSilentLoginSuppression();
+            clearSilentLoginAttempt();
             if (sessionStorageProvider) {
               sessionStorageProvider.removeOauthState();
               sessionStorageProvider.removeOauthCodeVerifier();
               sessionStorageProvider.removeOauthCodeChallenge();
             }
           }
-          _context.n = 6;
+          _context.n = 8;
           break;
-        case 5:
-          _context.p = 5;
+        case 7:
+          _context.p = 7;
           _t = _context.v;
           if (isMounted.current) {
             if (_t instanceof Error) {
@@ -889,10 +1007,10 @@ var HandleOAuth2Code = function HandleOAuth2Code() {
               sessionStorageProvider.removeHasAuthenticated();
             }
           }
-        case 6:
+        case 8:
           return _context.a(2);
       }
-    }, _callee, null, [[3, 5]]);
+    }, _callee, null, [[5, 7]]);
   })), [authConfig, isMounted, onLogin, onSetAuth, sessionStorageProvider]);
   React.useEffect(function () {
     var authenticateWithLock = /*#__PURE__*/function () {
@@ -932,7 +1050,7 @@ var HandleOAuth2Code = function HandleOAuth2Code() {
         }
       },
       to: "/error"
-    }) : null, isLoggedIn ? jsx(Navigate, {
+    }) : null, isLoggedIn || returnWithoutLogin ? jsx(Navigate, {
       replace: true,
       to: sessionStorageProvider.getCallbackUrl()
     }) : null]
@@ -984,7 +1102,10 @@ var OAuth2Login = function OAuth2Login() {
     var callbackUrl = getCurrentUrlLocation(sessionStorageProvider.getCallbackUrl(), authConfig.GW_APP_URL);
     sessionStorageProvider.setCallbackUrl(callbackUrl);
     window.location.assign(authConfig.GW_AUTH_LOGIN_URL);
-  });
+    // Runs once and navigates away immediately; doesn't need to re-fire if
+    // authConfig happens to change before that navigation completes.
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
   return null;
 };
 
@@ -1012,7 +1133,8 @@ var useAuthenticationTranslation = function useAuthenticationTranslation() {
   return useTranslation(ns);
 };
 
-var OAuth2Logout = function OAuth2Logout() {
+var OAuth2Logout = function OAuth2Logout(_ref) {
+  var config = _ref.config;
   var _useAuthenticationCon = useAuthenticationContext(),
     onSetAuth = _useAuthenticationCon.onSetAuth,
     authConfig = _useAuthenticationCon.authConfig,
@@ -1024,15 +1146,21 @@ var OAuth2Logout = function OAuth2Logout() {
     setShowAlert = _React$useState[1];
   var _useAuthenticationTra = useAuthenticationTranslation(),
     t = _useAuthenticationTra.t;
+  var silentLoginEnabled = isSilentLoginEnabled(config);
   React.useEffect(function () {
     if (isLoggedIn) {
       setShowAlert(false);
-      onSetAuth(null);
-      onLogin(false);
-      sessionStorageProvider.removeHasAuthenticated();
+      clearSession(onSetAuth, onLogin, sessionStorageProvider);
+      if (silentLoginEnabled) {
+        // GW_AUTH_LOGOUT_URL doesn't necessarily end the IdP's own session
+        // (e.g. it's just the app's own URL), so without these, silent login
+        // will immediately log the user back in.
+        suppressSilentLogin();
+        broadcastLogout();
+      }
       window.location.assign(authConfig.GW_AUTH_LOGOUT_URL);
     }
-  }, [isLoggedIn, onSetAuth, onLogin, sessionStorageProvider, authConfig.GW_AUTH_LOGOUT_URL]);
+  }, [isLoggedIn, onSetAuth, onLogin, sessionStorageProvider, authConfig.GW_AUTH_LOGOUT_URL, silentLoginEnabled]);
   return showAlert ? jsx(ThemeWrapper, {
     children: jsx(AlertBanner, {
       info: jsx("p", {
@@ -1187,4 +1315,4 @@ params, callbacks) {
   };
 };
 
-export { AUTH_NAMESPACE, AuthenticationContext, AuthenticationProvider, HandleOAuth2Code as Code, GEOWEB_ROLE_PRESETS_ADMIN, GEOWEB_ROLE_USER, KEEP_ALIVE_POLLER_IN_SECONDS, OAuth2Login as Login, OAuth2Logout as Logout, MILLISECOND_TO_SECOND, REFRESH_TOKEN_WHEN_PCT_EXPIRED, UserMenuRoles, apiTranslations, authTranslations, createApiInstance, createFakeApiInstance, createNonAuthApiInstance, fakeApiRequest, getAuthConfig, getCodeChallenge, getCurrentTimeInSeconds, getCurrentUrlLocation, getRandomString, groupsToRoles, makeCredentialsFromTokenResponse, refreshAccessToken, refreshAccessTokenAndSetAuthContext, setAuthChangeListener, useApi, useAuthenticationContext, useAuthenticationDefaultProps };
+export { AUTH_NAMESPACE, AuthenticationContext, AuthenticationProvider, HandleOAuth2Code as Code, GEOWEB_ROLE_PRESETS_ADMIN, GEOWEB_ROLE_USER, KEEP_ALIVE_POLLER_IN_SECONDS, OAuth2Login as Login, OAuth2Logout as Logout, MILLISECOND_TO_SECOND, OIDC_NO_INTERACTION_ERROR_CODES, REFRESH_TOKEN_WHEN_PCT_EXPIRED, UserMenuRoles, apiTranslations, authTranslations, broadcastLogout, buildSilentLoginUrl, clearSession, clearSilentLoginAttempt, clearSilentLoginSuppression, createApiInstance, createFakeApiInstance, createLogoutBroadcastChannel, createNonAuthApiInstance, fakeApiRequest, getAuthConfig, getCodeChallenge, getCurrentTimeInSeconds, getCurrentUrlLocation, getRandomString, groupsToRoles, hasRecentSilentLoginAttempt, isSilentLoginEnabled, isSilentLoginSuppressed, makeCredentialsFromTokenResponse, recordSilentLoginAttempt, refreshAccessToken, refreshAccessTokenAndSetAuthContext, setAuthChangeListener, suppressSilentLogin, useApi, useAuthenticationContext, useAuthenticationDefaultProps };

package/dist/src/index.d.ts

@@ -8,5 +8,6 @@ export * from './lib/components/AuthenticationContext';
 export * from './lib/components/ApiContext';
 export * from './lib/components/apiHooks';
 export * from './lib/utils/utils';
+export * from './lib/utils/silentLogin';
 export { AUTH_NAMESPACE } from './lib/utils/i18n';
 export { authTranslations, apiTranslations };

package/dist/src/lib/components/AuthenticationContext/AuthenticationContext.d.ts

@@ -8,6 +8,7 @@ export declare const getAuthConfig: (_configUrls: AuthenticationConfig) => Authe
 export declare const AuthenticationContext: React.Context<AuthenticationContextProps>;
 type OnAuthChange = (isLoggedIn: boolean, auth: Credentials | null) => void;
 export declare const setAuthChangeListener: (listener: OnAuthChange) => void;
+export declare const clearSession: (onSetAuth: AuthenticationDefaultStateProps["onSetAuth"], onLogin: AuthenticationDefaultStateProps["onLogin"], sessionStorageProviderArg: AuthenticationDefaultStateProps["sessionStorageProvider"]) => void;
 export declare const useAuthenticationDefaultProps: () => AuthenticationDefaultStateProps;
 export interface AuthenticationProviderProps {
     children: React.ReactNode;

package/dist/src/lib/components/AuthenticationContext/index.d.ts

@@ -1,2 +1,2 @@
-export { useAuthenticationContext, AuthenticationProvider, useAuthenticationDefaultProps, AuthenticationContext, getAuthConfig, getRandomString, getCodeChallenge, setAuthChangeListener, } from './AuthenticationContext';
+export { useAuthenticationContext, AuthenticationProvider, useAuthenticationDefaultProps, AuthenticationContext, clearSession, getAuthConfig, getRandomString, getCodeChallenge, setAuthChangeListener, } from './AuthenticationContext';
 export type * from './types';

package/dist/src/lib/components/AuthenticationContext/types.d.ts

@@ -9,6 +9,8 @@ export interface AuthenticationConfig {
     GW_APP_URL: string;
     GW_BE_VERSION_BASE_URL?: string;
     GW_AUTH_CLIENT_ID: string;
+    GW_FEATURE_SILENT_LOGIN?: boolean;
+    GW_FEATURE_FORCE_AUTHENTICATION?: boolean;
 }
 export interface AuthenticationDefaultStateProps {
     isLoggedIn: boolean;

package/dist/src/lib/components/pages/Logout.d.ts

@@ -1,3 +1,7 @@
 import React from 'react';
-declare const OAuth2Logout: React.FC;
+import type { ConfigType } from '@opengeoweb/shared';
+interface OAuth2LogoutProps {
+    config?: ConfigType;
+}
+declare const OAuth2Logout: React.FC<OAuth2LogoutProps>;
 export default OAuth2Logout;

package/dist/src/lib/utils/silentLogin.d.ts

@@ -0,0 +1,14 @@
+export declare const OIDC_NO_INTERACTION_ERROR_CODES: string[];
+export declare const buildSilentLoginUrl: (loginUrl: string) => string;
+export declare const isSilentLoginEnabled: (config?: {
+    GW_FEATURE_SILENT_LOGIN?: boolean;
+    GW_FEATURE_FORCE_AUTHENTICATION?: boolean;
+}) => boolean;
+export declare const hasRecentSilentLoginAttempt: () => boolean;
+export declare const recordSilentLoginAttempt: () => void;
+export declare const clearSilentLoginAttempt: () => void;
+export declare const suppressSilentLogin: () => void;
+export declare const isSilentLoginSuppressed: () => boolean;
+export declare const clearSilentLoginSuppression: () => void;
+export declare const broadcastLogout: () => void;
+export declare const createLogoutBroadcastChannel: () => BroadcastChannel;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeoweb/authentication",
-  "version": "19.5.1",
+  "version": "19.6.1",
   "description": "GeoWeb authentication library for the opengeoweb project",
   "license": "Apache-2.0",
   "repository": {
@@ -26,7 +26,7 @@
     "i18next": "^25.0.1",
     "react-i18next": "^15.1.1",
     "@mui/material": "^9.0.1",
-    "react-router": "^7.15.1"
+    "react-router": "^7.18.2"
   },
   "peerDependencies": {
     "react": "19",