@osdk/oauth 1.2.0-beta.1 → 1.2.0-beta.3

package/build/browser/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":["invariant","processOptionsAndAssignDefaults","url","redirect_uri","useHistory","loginPage","postLoginPage","scopes","fetchFn","ctxPath","options","process","env","NODE_ENV","window","location","toString","globalThis","fetch","refreshTokenMarker"],"sources":["utils.ts"],"sourcesContent":["/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport invariant from \"tiny-invariant\";\nimport type { PublicOauthClientOptions } from \"./createPublicOauthClient.js\";\n\ninterface ProcessedPublicOauthClientOptions\n  extends\n    Omit<Required<PublicOauthClientOptions>, \"loginPage\" | \"refreshTokenMarker\">\n{\n  loginPage?: string;\n  refreshTokenMarker?: string;\n}\n\nexport function processOptionsAndAssignDefaults(\n  url: string,\n  redirect_uri: string,\n  useHistory?: boolean | PublicOauthClientOptions,\n  loginPage?: string,\n  postLoginPage?: string,\n  scopes?: string[],\n  fetchFn?: typeof globalThis.fetch,\n  ctxPath?: string,\n): ProcessedPublicOauthClientOptions {\n  let options: PublicOauthClientOptions = {};\n\n  if (typeof useHistory === \"object\") {\n    invariant(\n      !loginPage && !postLoginPage && !scopes && !fetchFn && !ctxPath,\n      \"If useHistory is an object, other options should not be provided\",\n    );\n    options = useHistory;\n  } else {\n    options = {\n      useHistory,\n      loginPage,\n      postLoginPage,\n      scopes,\n      fetchFn,\n      ctxPath,\n    };\n  }\n\n  invariant(url, \"url is required\");\n  invariant(redirect_uri, \"redirectUrl is required\");\n\n  // Assign defaults\n  return {\n    useHistory: options.useHistory ?? true,\n    loginPage: options.loginPage,\n    postLoginPage: options.postLoginPage || window.location.toString(),\n    scopes: options.scopes ?? [\"api:read-data\", \"api:write-data\"],\n    fetchFn: options.fetchFn ?? globalThis.fetch,\n    ctxPath: options.ctxPath ?? \"multipass\",\n    refreshTokenMarker: options.refreshTokenMarker,\n  };\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,OAAOA,SAAS,MAAM,gBAAgB;AAWtC,OAAO,SAASC,+BAA+BA,CAC7CC,GAAW,EACXC,YAAoB,EACpBC,UAA+C,EAC/CC,SAAkB,EAClBC,aAAsB,EACtBC,MAAiB,EACjBC,OAAiC,EACjCC,OAAgB,EACmB;EACnC,IAAIC,OAAiC,GAAG,CAAC,CAAC;EAE1C,IAAI,OAAON,UAAU,KAAK,QAAQ,EAAE;IAClC,EACE,CAACC,SAAS,IAAI,CAACC,aAAa,IAAI,CAACC,MAAM,IAAI,CAACC,OAAO,IAAI,CAACC,OAAO,IAAAE,OAAA,CAAAC,GAAA,CAAAC,QAAA,oBADjEb,SAAS,QAEP,kEAAkE,IAFpEA,SAAS;IAITU,OAAO,GAAGN,UAAU;EACtB,CAAC,MAAM;IACLM,OAAO,GAAG;MACRN,UAAU;MACVC,SAAS;MACTC,aAAa;MACbC,MAAM;MACNC,OAAO;MACPC;IACF,CAAC;EACH;EAEA,CAAUP,GAAG,GAAAS,OAAA,CAAAC,GAAA,CAAAC,QAAA,oBAAbb,SAAS,QAAM,iBAAiB,IAAhCA,SAAS;EACT,CAAUG,YAAY,GAAAQ,OAAA,CAAAC,GAAA,CAAAC,QAAA,oBAAtBb,SAAS,QAAe,yBAAyB,IAAjDA,SAAS;;EAET;EACA,OAAO;IACLI,UAAU,EAAEM,OAAO,CAACN,UAAU,IAAI,IAAI;IACtCC,SAAS,EAAEK,OAAO,CAACL,SAAS;IAC5BC,aAAa,EAAEI,OAAO,CAACJ,aAAa,IAAIQ,MAAM,CAACC,QAAQ,CAACC,QAAQ,CAAC,CAAC;IAClET,MAAM,EAAEG,OAAO,CAACH,MAAM,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAC7DC,OAAO,EAAEE,OAAO,CAACF,OAAO,IAAIS,UAAU,CAACC,KAAK;IAC5CT,OAAO,EAAEC,OAAO,CAACD,OAAO,IAAI,WAAW;IACvCU,kBAAkB,EAAET,OAAO,CAACS;EAC9B,CAAC;AACH","ignoreList":[]}
+{"version":3,"file":"utils.js","names":["invariant","processOptionsAndAssignDefaults","url","redirect_uri","useHistory","loginPage","postLoginPage","scopes","fetchFn","ctxPath","options","process","env","NODE_ENV","window","location","toString","joinedScopes","sort","join","globalThis","fetch","refreshTokenMarker"],"sources":["utils.ts"],"sourcesContent":["/*\n * Copyright 2024 Palantir Technologies, Inc. All rights reserved.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport invariant from \"tiny-invariant\";\nimport type { PublicOauthClientOptions } from \"./createPublicOauthClient.js\";\n\ninterface ProcessedPublicOauthClientOptions extends\n  Omit<\n    Required<PublicOauthClientOptions>,\n    \"loginPage\" | \"refreshTokenMarker\" | \"scopes\"\n  >\n{\n  loginPage?: string;\n  refreshTokenMarker?: string;\n  joinedScopes: string;\n}\n\nexport function processOptionsAndAssignDefaults(\n  url: string,\n  redirect_uri: string,\n  useHistory?: boolean | PublicOauthClientOptions,\n  loginPage?: string,\n  postLoginPage?: string,\n  scopes?: string[],\n  fetchFn?: typeof globalThis.fetch,\n  ctxPath?: string,\n): ProcessedPublicOauthClientOptions {\n  let options: PublicOauthClientOptions = {};\n\n  if (typeof useHistory === \"object\") {\n    invariant(\n      !loginPage && !postLoginPage && !scopes && !fetchFn && !ctxPath,\n      \"If useHistory is an object, other options should not be provided\",\n    );\n    options = useHistory;\n  } else {\n    options = {\n      useHistory,\n      loginPage,\n      postLoginPage,\n      scopes,\n      fetchFn,\n      ctxPath,\n    };\n  }\n\n  invariant(url, \"url is required\");\n  invariant(redirect_uri, \"redirectUrl is required\");\n\n  // Assign defaults\n  return {\n    useHistory: options.useHistory ?? true,\n    loginPage: options.loginPage,\n    postLoginPage: options.postLoginPage || window.location.toString(),\n    joinedScopes: [\n      ...options.scopes\n        ?? [\n          \"api:read-data\",\n          \"api:write-data\",\n          \"api:use-ontologies-read\",\n          \"api:use-ontologies-write\",\n        ],\n    ]\n      .sort().join(\" \"),\n    fetchFn: options.fetchFn ?? globalThis.fetch,\n    ctxPath: options.ctxPath ?? \"multipass\",\n    refreshTokenMarker: options.refreshTokenMarker,\n  };\n}\n"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,OAAOA,SAAS,MAAM,gBAAgB;AActC,OAAO,SAASC,+BAA+BA,CAC7CC,GAAW,EACXC,YAAoB,EACpBC,UAA+C,EAC/CC,SAAkB,EAClBC,aAAsB,EACtBC,MAAiB,EACjBC,OAAiC,EACjCC,OAAgB,EACmB;EACnC,IAAIC,OAAiC,GAAG,CAAC,CAAC;EAE1C,IAAI,OAAON,UAAU,KAAK,QAAQ,EAAE;IAClC,EACE,CAACC,SAAS,IAAI,CAACC,aAAa,IAAI,CAACC,MAAM,IAAI,CAACC,OAAO,IAAI,CAACC,OAAO,IAAAE,OAAA,CAAAC,GAAA,CAAAC,QAAA,oBADjEb,SAAS,QAEP,kEAAkE,IAFpEA,SAAS;IAITU,OAAO,GAAGN,UAAU;EACtB,CAAC,MAAM;IACLM,OAAO,GAAG;MACRN,UAAU;MACVC,SAAS;MACTC,aAAa;MACbC,MAAM;MACNC,OAAO;MACPC;IACF,CAAC;EACH;EAEA,CAAUP,GAAG,GAAAS,OAAA,CAAAC,GAAA,CAAAC,QAAA,oBAAbb,SAAS,QAAM,iBAAiB,IAAhCA,SAAS;EACT,CAAUG,YAAY,GAAAQ,OAAA,CAAAC,GAAA,CAAAC,QAAA,oBAAtBb,SAAS,QAAe,yBAAyB,IAAjDA,SAAS;;EAET;EACA,OAAO;IACLI,UAAU,EAAEM,OAAO,CAACN,UAAU,IAAI,IAAI;IACtCC,SAAS,EAAEK,OAAO,CAACL,SAAS;IAC5BC,aAAa,EAAEI,OAAO,CAACJ,aAAa,IAAIQ,MAAM,CAACC,QAAQ,CAACC,QAAQ,CAAC,CAAC;IAClEC,YAAY,EAAE,CACZ,IAAGP,OAAO,CAACH,MAAM,IACZ,CACD,eAAe,EACf,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,CAC3B,EACJ,CACEW,IAAI,CAAC,CAAC,CAACC,IAAI,CAAC,GAAG,CAAC;IACnBX,OAAO,EAAEE,OAAO,CAACF,OAAO,IAAIY,UAAU,CAACC,KAAK;IAC5CZ,OAAO,EAAEC,OAAO,CAACD,OAAO,IAAI,WAAW;IACvCa,kBAAkB,EAAEZ,OAAO,CAACY;EAC9B,CAAC;AACH","ignoreList":[]}

package/build/cjs/index.cjs

@@ -82,7 +82,7 @@ var LRU = class {
       this.update(key, v);
       return v;
     }
-    return undefined;
+    return void 0;
   }
   has(key) {
     return this.cache.has(key) || this._cache.has(key);
@@ -205,7 +205,7 @@ function getKeyAndKid(input) {
   if (!(input?.key instanceof CryptoKey)) {
     return {};
   }
-  if (input.kid !== undefined && !validateString(input.kid)) {
+  if (input.kid !== void 0 && !validateString(input.kid)) {
     throw new TypeError('"kid" must be a non-empty string');
   }
   return {
@@ -327,12 +327,12 @@ function assertClientSecret(clientSecret) {
   return clientSecret;
 }
 function assertNoClientPrivateKey(clientAuthMethod, clientPrivateKey) {
-  if (clientPrivateKey !== undefined) {
+  if (clientPrivateKey !== void 0) {
     throw new TypeError(`"options.clientPrivateKey" property must not be provided when ${clientAuthMethod} client authentication method is used.`);
   }
 }
 function assertNoClientSecret(clientAuthMethod, clientSecret) {
-  if (clientSecret !== undefined) {
+  if (clientSecret !== void 0) {
     throw new TypeError(`"client.client_secret" property must not be provided when ${clientAuthMethod} client authentication method is used.`);
   }
 }
@@ -341,7 +341,7 @@ async function clientAuthentication(as, client, body, headers, clientPrivateKey)
   body.delete("client_assertion_type");
   body.delete("client_assertion");
   switch (client.token_endpoint_auth_method) {
-    case undefined:
+    case void 0:
     case "client_secret_basic": {
       assertNoClientPrivateKey("client_secret_basic", clientPrivateKey);
       headers.set("authorization", clientSecretBasic(client.client_id, assertClientSecret(client.client_secret)));
@@ -355,7 +355,7 @@ async function clientAuthentication(as, client, body, headers, clientPrivateKey)
     }
     case "private_key_jwt": {
       assertNoClientSecret("private_key_jwt", client.client_secret);
-      if (clientPrivateKey === undefined) {
+      if (clientPrivateKey === void 0) {
         throw new TypeError('"options.clientPrivateKey" must be provided when "client.token_endpoint_auth_method" is "private_key_jwt"');
       }
       const {
@@ -402,7 +402,7 @@ async function dpopProofJwt(headers, options, url, htm, clockSkew2, accessToken)
   if (!isPublicKey(publicKey)) {
     throw new TypeError('"DPoP.publicKey" must be a public CryptoKey');
   }
-  if (nonce !== undefined && !validateString(nonce)) {
+  if (nonce !== void 0 && !validateString(nonce)) {
     throw new TypeError('"DPoP.nonce" must be a non-empty string or undefined');
   }
   if (!publicKey.extractable) {
@@ -419,7 +419,7 @@ async function dpopProofJwt(headers, options, url, htm, clockSkew2, accessToken)
     htm,
     nonce,
     htu: `${url.origin}${url.pathname}`,
-    ath: undefined
+    ath: void 0
   }, privateKey);
   headers.set("dpop", proof);
 }
@@ -468,7 +468,7 @@ function isOAuth2Error(input) {
   if (typeof value !== "object" || Array.isArray(value) || value === null) {
     return false;
   }
-  return value.error !== undefined;
+  return value.error !== void 0;
 }
 async function authenticatedRequest(as, client, method, url, body, headers, options) {
   await clientAuthentication(as, client, body, headers, options?.clientPrivateKey);
@@ -486,7 +486,7 @@ async function tokenEndpointRequest(as, client, grantType, parameters, options)
   parameters.set("grant_type", grantType);
   const headers = prepareHeaders(options?.headers);
   headers.set("accept", "application/json");
-  if (options?.DPoP !== undefined) {
+  if (options?.DPoP !== void 0) {
     await dpopProofJwt(headers, options.DPoP, url, "POST", getClockSkew(client));
   }
   return authenticatedRequest(as, client, "POST", url, parameters, headers, options);
@@ -537,23 +537,23 @@ async function processGenericAccessTokenResponse(as, client, response, ignoreIdT
   if (json.token_type !== "dpop" && json.token_type !== "bearer") {
     throw new UnsupportedOperationError("unsupported `token_type` value");
   }
-  if (json.expires_in !== undefined && (typeof json.expires_in !== "number" || json.expires_in <= 0)) {
+  if (json.expires_in !== void 0 && (typeof json.expires_in !== "number" || json.expires_in <= 0)) {
     throw new OPE('"response" body "expires_in" property must be a positive number');
   }
-  if (!ignoreRefreshToken && json.refresh_token !== undefined && !validateString(json.refresh_token)) {
+  if (!ignoreRefreshToken && json.refresh_token !== void 0 && !validateString(json.refresh_token)) {
     throw new OPE('"response" body "refresh_token" property must be a non-empty string');
   }
-  if (json.scope !== undefined && typeof json.scope !== "string") {
+  if (json.scope !== void 0 && typeof json.scope !== "string") {
     throw new OPE('"response" body "scope" property must be a string');
   }
   if (!ignoreIdToken) {
-    if (json.id_token !== undefined && !validateString(json.id_token)) {
+    if (json.id_token !== void 0 && !validateString(json.id_token)) {
       throw new OPE('"response" body "id_token" property must be a non-empty string');
     }
     if (json.id_token) {
       const {
         claims
-      } = await validateJwt(json.id_token, checkSigningAlgorithm.bind(undefined, client.id_token_signed_response_alg, as.id_token_signing_alg_values_supported), noSignatureCheck, getClockSkew(client), getClockTolerance(client)).then(validatePresence.bind(undefined, ["aud", "exp", "iat", "iss", "sub"])).then(validateIssuer.bind(undefined, as.issuer)).then(validateAudience.bind(undefined, client.client_id));
+      } = await validateJwt(json.id_token, checkSigningAlgorithm.bind(void 0, client.id_token_signed_response_alg, as.id_token_signing_alg_values_supported), noSignatureCheck, getClockSkew(client), getClockTolerance(client)).then(validatePresence.bind(void 0, ["aud", "exp", "iat", "iss", "sub"])).then(validateIssuer.bind(void 0, as.issuer)).then(validateAudience.bind(void 0, client.client_id));
       if (Array.isArray(claims.aud) && claims.aud.length !== 1 && claims.azp !== client.client_id) {
         throw new OPE('unexpected ID Token "azp" (authorized party) claim value');
       }
@@ -626,7 +626,7 @@ var jwtClaimNames = {
 };
 function validatePresence(required, result) {
   for (const claim of required) {
-    if (result.claims[claim] === undefined) {
+    if (result.claims[claim] === void 0) {
       throw new OPE(`JWT "${claim}" (${jwtClaimNames[claim]}) claim missing`);
     }
   }
@@ -637,7 +637,7 @@ async function processAuthorizationCodeOAuth2Response(as, client, response) {
   if (isOAuth2Error(result)) {
     return result;
   }
-  if (result.id_token !== undefined) {
+  if (result.id_token !== void 0) {
     if (typeof result.id_token === "string" && result.id_token.length) {
       throw new OPE("Unexpected ID Token returned, use processAuthorizationCodeOpenIDResponse() for OpenID Connect callback processing");
     }
@@ -681,7 +681,7 @@ async function processRevocationResponse(response) {
     }
     throw new OPE('"response" is not a conform Revocation Endpoint response');
   }
-  return undefined;
+  return void 0;
 }
 function assertReadableResponse(response) {
   if (response.bodyUsed) {
@@ -711,7 +711,7 @@ async function handleOAuthBodyError(response) {
     } catch {
     }
   }
-  return undefined;
+  return void 0;
 }
 function checkRsaKeyAlgorithm(algorithm) {
   if (typeof algorithm.modulusLength !== "number" || algorithm.modulusLength < 2048) {
@@ -786,7 +786,7 @@ async function validateJwt(jws, checkAlg, getKey, clockSkew2, clockTolerance2) {
     throw new OPE("JWT Header must be a top level object");
   }
   checkAlg(header);
-  if (header.crit !== undefined) {
+  if (header.crit !== void 0) {
     throw new OPE('unexpected JWT "crit" header parameter');
   }
   const signature = b64u(encodedSignature);
@@ -811,7 +811,7 @@ async function validateJwt(jws, checkAlg, getKey, clockSkew2, clockTolerance2) {
     throw new OPE("JWT Payload must be a top level object");
   }
   const now = epochTime() + clockSkew2;
-  if (claims.exp !== undefined) {
+  if (claims.exp !== void 0) {
     if (typeof claims.exp !== "number") {
       throw new OPE('unexpected JWT "exp" (expiration time) claim type');
     }
@@ -819,17 +819,17 @@ async function validateJwt(jws, checkAlg, getKey, clockSkew2, clockTolerance2) {
       throw new OPE('unexpected JWT "exp" (expiration time) claim value, timestamp is <= now()');
     }
   }
-  if (claims.iat !== undefined) {
+  if (claims.iat !== void 0) {
     if (typeof claims.iat !== "number") {
       throw new OPE('unexpected JWT "iat" (issued at) claim type');
     }
   }
-  if (claims.iss !== undefined) {
+  if (claims.iss !== void 0) {
     if (typeof claims.iss !== "string") {
       throw new OPE('unexpected JWT "iss" (issuer) claim type');
     }
   }
-  if (claims.nbf !== undefined) {
+  if (claims.nbf !== void 0) {
     if (typeof claims.nbf !== "number") {
       throw new OPE('unexpected JWT "nbf" (not before) claim type');
     }
@@ -837,7 +837,7 @@ async function validateJwt(jws, checkAlg, getKey, clockSkew2, clockTolerance2) {
       throw new OPE('unexpected JWT "nbf" (not before) claim value, timestamp is > now()');
     }
   }
-  if (claims.aud !== undefined) {
+  if (claims.aud !== void 0) {
     if (typeof claims.aud !== "string" && !Array.isArray(claims.aud)) {
       throw new OPE('unexpected JWT "aud" (audience) claim type');
     }
@@ -850,7 +850,7 @@ async function validateJwt(jws, checkAlg, getKey, clockSkew2, clockTolerance2) {
   };
 }
 function checkSigningAlgorithm(client, issuer, header) {
-  if (client !== undefined) {
+  if (client !== void 0) {
     if (header.alg !== client) {
       throw new OPE('unexpected JWT "alg" header parameter');
     }
@@ -899,9 +899,9 @@ function validateAuthResponse(as, client, parameters, expectedState) {
     throw new OPE('unexpected "iss" (issuer) response parameter value');
   }
   switch (expectedState) {
-    case undefined:
+    case void 0:
     case expectNoState:
-      if (state !== undefined) {
+      if (state !== void 0) {
         throw new OPE('unexpected "state" response parameter encountered');
       }
       break;
@@ -911,7 +911,7 @@ function validateAuthResponse(as, client, parameters, expectedState) {
       if (!validateString(expectedState)) {
         throw new OPE('"expectedState" must be a non-empty string');
       }
-      if (state === undefined) {
+      if (state === void 0) {
         throw new OPE('response parameter "state" missing');
       }
       if (state !== expectedState) {
@@ -928,7 +928,7 @@ function validateAuthResponse(as, client, parameters, expectedState) {
   }
   const id_token = getURLSearchParameter(parameters, "id_token");
   const token = getURLSearchParameter(parameters, "token");
-  if (id_token !== undefined || token !== undefined) {
+  if (id_token !== void 0 || token !== void 0) {
     throw new UnsupportedOperationError("implicit and hybrid flows are not supported");
   }
   return brand(new URLSearchParams(parameters));
@@ -980,7 +980,7 @@ function readSession(client) {
     globalThis.sessionStorage?.getItem(localStorageKey(client)) ?? "{}"
   );
 }
-function common(client, as, _signIn, oauthHttpOptions, refresh, refreshTokenMarker) {
+function common(client, as, _signIn, oauthHttpOptions, refresh, refreshTokenMarker, scopes) {
   let token;
   const eventTarget = new typescriptEventTarget.TypedEventTarget();
   function makeTokenAndSaveRefresh(resp, type) {
@@ -989,10 +989,11 @@ function common(client, as, _signIn, oauthHttpOptions, refresh, refreshTokenMark
       expires_in,
       access_token
     } = resp;
-    !(expires_in != null) ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false) : invariant2__default.default(false) : undefined;
+    !(expires_in != null) ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false) : invariant2__default.default(false) : void 0;
     saveLocal(client, {
       refresh_token,
-      refreshTokenMarker
+      refreshTokenMarker,
+      requestedScopes: scopes
     });
     token = {
       refresh_token,
@@ -1016,11 +1017,11 @@ function common(client, as, _signIn, oauthHttpOptions, refresh, refreshTokenMark
     }
   }
   async function signOut() {
-    !token ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false, "not signed in") : invariant2__default.default(false) : undefined;
+    !token ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false, "not signed in") : invariant2__default.default(false) : void 0;
     const result = await processRevocationResponse(await revocationRequest(as, client, token.access_token, oauthHttpOptions));
     rmTimeout();
     removeLocal(client);
-    token = undefined;
+    token = void 0;
     throwIfError(result);
     eventTarget.dispatchTypedEvent("signOut", new Event("signOut"));
   }
@@ -1033,14 +1034,14 @@ function common(client, as, _signIn, oauthHttpOptions, refresh, refreshTokenMark
       pendingSignIn = _signIn();
       return await pendingSignIn;
     } finally {
-      pendingSignIn = undefined;
+      pendingSignIn = void 0;
     }
   }
   eventTarget.addEventListener("signIn", restartRefreshTimer);
   eventTarget.addEventListener("refresh", restartRefreshTimer);
   function getTokenOrUndefined() {
     if (!token || Date.now() >= token.expires_at) {
-      return undefined;
+      return void 0;
     }
     return token?.access_token;
   }
@@ -1074,7 +1075,7 @@ function createAuthorizationServer(ctxPath, url) {
 }
 
 // src/createConfidentialOauthClient.ts
-function createConfidentialOauthClient(client_id, client_secret, url, scopes = ["api:read-data", "api:write-data"], fetchFn = globalThis.fetch, ctxPath = "multipass") {
+function createConfidentialOauthClient(client_id, client_secret, url, scopes = ["api:read-data", "api:write-data", "api:use-ontologies-read", "api:use-ontologies-write"], fetchFn = globalThis.fetch, ctxPath = "multipass") {
   const client = {
     client_id,
     client_secret
@@ -1083,13 +1084,14 @@ function createConfidentialOauthClient(client_id, client_secret, url, scopes = [
   const oauthHttpOptions = {
     [customFetch]: fetchFn
   };
+  const joinedScopes = scopes.join(" ");
   const {
     getToken,
     makeTokenAndSaveRefresh
-  } = common(client, authServer, _signIn, oauthHttpOptions, undefined, undefined);
+  } = common(client, authServer, _signIn, oauthHttpOptions, void 0, void 0, joinedScopes);
   async function _signIn() {
     return makeTokenAndSaveRefresh(throwIfError(await processClientCredentialsResponse(authServer, client, await clientCredentialsGrantRequest(authServer, client, new URLSearchParams({
-      scope: scopes.join(" ")
+      scope: joinedScopes
     }), oauthHttpOptions))), "signIn");
   }
   return getToken;
@@ -1152,7 +1154,7 @@ var delay_default = delay;
 function processOptionsAndAssignDefaults(url, redirect_uri, useHistory, loginPage, postLoginPage, scopes, fetchFn, ctxPath) {
   let options = {};
   if (typeof useHistory === "object") {
-    !(!loginPage && !postLoginPage && !scopes && !fetchFn && !ctxPath) ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false, "If useHistory is an object, other options should not be provided") : invariant2__default.default(false) : undefined;
+    !(!loginPage && !postLoginPage && !scopes && !fetchFn && !ctxPath) ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false, "If useHistory is an object, other options should not be provided") : invariant2__default.default(false) : void 0;
     options = useHistory;
   } else {
     options = {
@@ -1164,13 +1166,13 @@ function processOptionsAndAssignDefaults(url, redirect_uri, useHistory, loginPag
       ctxPath
     };
   }
-  !url ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false, "url is required") : invariant2__default.default(false) : undefined;
-  !redirect_uri ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false, "redirectUrl is required") : invariant2__default.default(false) : undefined;
+  !url ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false, "url is required") : invariant2__default.default(false) : void 0;
+  !redirect_uri ? process.env.NODE_ENV !== "production" ? invariant2__default.default(false, "redirectUrl is required") : invariant2__default.default(false) : void 0;
   return {
     useHistory: options.useHistory ?? true,
     loginPage: options.loginPage,
     postLoginPage: options.postLoginPage || window.location.toString(),
-    scopes: options.scopes ?? ["api:read-data", "api:write-data"],
+    joinedScopes: [...options.scopes ?? ["api:read-data", "api:write-data", "api:use-ontologies-read", "api:use-ontologies-write"]].sort().join(" "),
     fetchFn: options.fetchFn ?? globalThis.fetch,
     ctxPath: options.ctxPath ?? "multipass",
     refreshTokenMarker: options.refreshTokenMarker
@@ -1180,11 +1182,12 @@ function processOptionsAndAssignDefaults(url, redirect_uri, useHistory, loginPag
 // src/createPublicOauthClient.ts
 function createPublicOauthClient(client_id, url, redirect_uri, useHistory, loginPage, postLoginPage, scopes, fetchFn, ctxPath) {
   let refreshTokenMarker;
+  let joinedScopes;
   ({
     useHistory,
     loginPage,
     postLoginPage,
-    scopes,
+    joinedScopes,
     fetchFn,
     ctxPath,
     refreshTokenMarker
@@ -1200,7 +1203,7 @@ function createPublicOauthClient(client_id, url, redirect_uri, useHistory, login
   const {
     makeTokenAndSaveRefresh,
     getToken
-  } = common(client, authServer, _signIn, oauthHttpOptions, maybeRefresh.bind(globalThis, true), refreshTokenMarker);
+  } = common(client, authServer, _signIn, oauthHttpOptions, maybeRefresh.bind(globalThis, true), refreshTokenMarker, joinedScopes);
   const go = async (x) => {
     if (useHistory) {
       window.history.replaceState({}, "", x);
@@ -1212,9 +1215,11 @@ function createPublicOauthClient(client_id, url, redirect_uri, useHistory, login
   async function maybeRefresh(expectRefreshToken) {
     const {
       refresh_token,
-      refreshTokenMarker: lastRefreshTokenMarker
+      refreshTokenMarker: lastRefreshTokenMarker,
+      requestedScopes: initialRequestedScopes
     } = readLocal(client);
-    if (!refresh_token || lastRefreshTokenMarker !== refreshTokenMarker) {
+    const areScopesEqual = initialRequestedScopes != null && joinedScopes === initialRequestedScopes;
+    if (!refresh_token || lastRefreshTokenMarker !== refreshTokenMarker || !areScopesEqual) {
       if (expectRefreshToken) throw new Error("No refresh token found");
       return;
     }
@@ -1282,7 +1287,7 @@ function createPublicOauthClient(client_id, url, redirect_uri, useHistory, login
       redirect_uri,
       code_challenge: await calculatePKCECodeChallenge(codeVerifier),
       code_challenge_method: "S256",
-      scope: ["offline_access", ...scopes].join(" ")
+      scope: `offline_access ${joinedScopes}`
     })}`);
     await delay_default(1e3);
     throw new Error("Unable to redirect");