@opensourcekd/ng-common-libs 2.0.10 → 2.0.11

package/dist/index.d.ts

@@ -413,6 +413,7 @@ declare function buildUserData(userInfo: UserInfo): UserData;
 declare class AuthService {
     private auth0Client;
     private initializationPromise;
+    /** Remains false if callback processing fails, allowing the callback to be retried. */
     private callbackHandled;
     private callbackPromise;
     private userSubject;
@@ -447,6 +448,13 @@ declare class AuthService {
      * @throws {Error} When required config fields (domain, clientId) are missing
      */
     private initializeAuth0;
+    /**
+     * Ensure the Auth0 client instance is created, without triggering callback detection.
+     * Used internally by {@link handleCallback} to avoid a circular async dependency:
+     * `ensureInitialized` → `checkAndHandleCallback` → `handleCallback` → `ensureInitialized`.
+     * @throws {Error} When the Auth0 client fails to initialize
+     */
+    private ensureAuth0Client;
     /**
      * Ensure the Auth0 client is initialized before use
      * Lazy-initializes on the first call and auto-handles OAuth callbacks when detected
@@ -459,6 +467,10 @@ declare class AuthService {
      * The Auth0 SDK's `handleRedirectCallback` validates the `state` parameter
      * to prevent CSRF attacks. This method only detects presence of callback
      * params before delegating securely to the SDK.
+     *
+     * Uses an async IIFE to store the in-flight promise for concurrency deduplication
+     * (concurrent callers await the same promise) while still using async/await
+     * internally instead of `.then()/.catch()` chains.
      */
     private checkAndHandleCallback;
     /**
@@ -474,11 +486,20 @@ declare class AuthService {
     /**
      * Handle the OAuth2 redirect callback after successful authorization
      * Stores the user info and access token, then cleans up the callback URL
+     *
+     * Uses {@link ensureAuth0Client} (not {@link ensureInitialized}) to avoid a circular
+     * async dependency: `ensureInitialized` → `checkAndHandleCallback` → `handleCallback`
+     * → `ensureInitialized`. Only the Auth0 client instance is needed here.
      * @returns {@link CallbackResult} with `success` flag and optional `appState`
      */
     handleCallback(): Promise<CallbackResult>;
     /**
      * Log the user out, clear all stored auth data, and redirect to the logout URI
+     *
+     * Uses {@link ensureAuth0Client} (not {@link ensureInitialized}) to avoid triggering
+     * callback detection during logout. Calling `ensureInitialized` here would invoke
+     * `checkAndHandleCallback`, which re-authenticates the user if callback URL params
+     * are present, causing them to be sent back to Auth0 instead of the logout URI.
      */
     logout(): Promise<void>;
     /**

package/dist/index.mjs

@@ -446,6 +446,7 @@ function e(e,t){var n={};for(var o in e)Object.prototype.hasOwnProperty.call(e,o
 class AuthService {
     auth0Client = null;
     initializationPromise = null;
+    /** Remains false if callback processing fails, allowing the callback to be retried. */
     callbackHandled = false;
     callbackPromise = null;
     userSubject;
@@ -480,6 +481,14 @@ class AuthService {
         const existingUserInfo = this.getUserInfoFromStorage();
         this.userSubject = new BehaviorSubject(existingUserInfo);
         this.user$ = this.userSubject.asObservable();
+        // Eagerly begin Auth0 client initialization so logs are visible immediately.
+        // The .catch() only suppresses an unhandled-rejection warning; the rejected
+        // promise is stored in initializationPromise and re-throws when awaited by
+        // ensureInitialized() or ensureAuth0Client(), surfacing the error to callers.
+        this.initializationPromise = this.initializeAuth0();
+        this.initializationPromise.catch(error => {
+            console.error('[AuthService] Failed to initialize Auth0 client:', error);
+        });
     }
     /**
      * Get the identifier of this AuthService instance
@@ -519,6 +528,25 @@ class AuthService {
         console.log('[AuthService] Auth0 client initialized successfully');
         this.emitAuthEvent('init', null);
     }
+    /**
+     * Ensure the Auth0 client instance is created, without triggering callback detection.
+     * Used internally by {@link handleCallback} to avoid a circular async dependency:
+     * `ensureInitialized` → `checkAndHandleCallback` → `handleCallback` → `ensureInitialized`.
+     * @throws {Error} When the Auth0 client fails to initialize
+     */
+    async ensureAuth0Client() {
+        if (this.auth0Client)
+            return;
+        if (this.initializationPromise) {
+            await this.initializationPromise;
+            return;
+        }
+        this.initializationPromise = this.initializeAuth0();
+        await this.initializationPromise;
+        if (!this.auth0Client) {
+            throw new Error('[AuthService] Auth0 client failed to initialize');
+        }
+    }
     /**
      * Ensure the Auth0 client is initialized before use
      * Lazy-initializes on the first call and auto-handles OAuth callbacks when detected
@@ -547,6 +575,10 @@ class AuthService {
      * The Auth0 SDK's `handleRedirectCallback` validates the `state` parameter
      * to prevent CSRF attacks. This method only detects presence of callback
      * params before delegating securely to the SDK.
+     *
+     * Uses an async IIFE to store the in-flight promise for concurrency deduplication
+     * (concurrent callers await the same promise) while still using async/await
+     * internally instead of `.then()/.catch()` chains.
      */
     async checkAndHandleCallback() {
         if (this.callbackHandled || typeof window === 'undefined')
@@ -556,15 +588,22 @@ class AuthService {
             return;
         }
         const urlParams = new URLSearchParams(window.location.search);
-        if (urlParams.has('code') && urlParams.has('state')) {
-            console.log('[AuthService] Auth0 callback detected in URL, processing...');
-            this.emitAuthEvent('callback_detected', null);
-            this.callbackPromise = this.handleCallback()
-                .then(() => { this.callbackHandled = true; })
-                .catch(error => { throw error; })
-                .finally(() => { this.callbackPromise = null; });
+        if (!urlParams.has('code') || !urlParams.has('state'))
+            return;
+        console.log('[AuthService] Auth0 callback detected in URL, processing...');
+        this.emitAuthEvent('callback_detected', null);
+        // Store the promise before the first await so concurrent callers see it
+        // and deduplicate by awaiting the same in-flight promise.
+        this.callbackPromise = (async () => {
+            await this.handleCallback();
+            this.callbackHandled = true;
+        })();
+        try {
             await this.callbackPromise;
         }
+        finally {
+            this.callbackPromise = null;
+        }
     }
     /**
      * Redirect the user to Auth0 Universal Login
@@ -601,11 +640,15 @@ class AuthService {
     /**
      * Handle the OAuth2 redirect callback after successful authorization
      * Stores the user info and access token, then cleans up the callback URL
+     *
+     * Uses {@link ensureAuth0Client} (not {@link ensureInitialized}) to avoid a circular
+     * async dependency: `ensureInitialized` → `checkAndHandleCallback` → `handleCallback`
+     * → `ensureInitialized`. Only the Auth0 client instance is needed here.
      * @returns {@link CallbackResult} with `success` flag and optional `appState`
      */
     async handleCallback() {
         try {
-            await this.ensureInitialized();
+            await this.ensureAuth0Client();
             console.log('[AuthService] Processing Auth0 redirect callback...');
             const result = await this.auth0Client.handleRedirectCallback();
             const user = await this.auth0Client.getUser();
@@ -629,6 +672,11 @@ class AuthService {
     }
     /**
      * Log the user out, clear all stored auth data, and redirect to the logout URI
+     *
+     * Uses {@link ensureAuth0Client} (not {@link ensureInitialized}) to avoid triggering
+     * callback detection during logout. Calling `ensureInitialized` here would invoke
+     * `checkAndHandleCallback`, which re-authenticates the user if callback URL params
+     * are present, causing them to be sent back to Auth0 instead of the logout URI.
      */
     async logout() {
         console.log('[AuthService] User logging out...');
@@ -638,7 +686,7 @@ class AuthService {
         this.userSubject.next(null);
         this.emitAuthEvent('logout', null);
         try {
-            await this.ensureInitialized();
+            await this.ensureAuth0Client();
             await this.auth0Client.logout({
                 logoutParams: { returnTo: this.config.logoutUri }
             });