@supabase/gotrue-js 1.22.21 → 1.23.0-next.10

package/dist/main/GoTrueClient.js

@@ -16,9 +16,11 @@ const GoTrueApi_1 = __importDefault(require("./GoTrueApi"));
 const helpers_1 = require("./lib/helpers");
 const constants_1 = require("./lib/constants");
 const polyfills_1 = require("./lib/polyfills");
+const errors_1 = require("./lib/errors");
 (0, polyfills_1.polyfillGlobalThis)(); // Make "globalThis" available
 const DEFAULT_OPTIONS = {
     url: constants_1.GOTRUE_URL,
+    storageKey: constants_1.STORAGE_KEY,
     autoRefreshToken: true,
     persistSession: true,
     detectSessionInUrl: true,
@@ -30,9 +32,10 @@ class GoTrueClient {
      * Create a new client for use in the browser.
      * @param options.url The URL of the GoTrue server.
      * @param options.headers Any additional headers to send to the GoTrue server.
+     * @param options.storageKey Optional key name used for storing tokens in local storage
      * @param options.detectSessionInUrl Set to "true" if you want to automatically detects OAuth grants in the URL and signs in the user.
      * @param options.autoRefreshToken Set to "true" if you want to automatically refresh the token before expiring.
-     * @param options.persistSession Set to "true" if you want to automatically save the user session into local storage.
+     * @param options.persistSession Set to "true" if you want to automatically save the user session into local storage. If set to false, session will just be saved in memory.
      * @param options.localStorage Provide your own local storage implementation to use instead of the browser's local storage.
      * @param options.multiTab Set to "false" if you want to disable multi-tab/window events.
      * @param options.cookieOptions
@@ -40,13 +43,14 @@ class GoTrueClient {
      */
     constructor(options) {
         this.stateChangeEmitters = new Map();
+        // eslint-disable-next-line @typescript-eslint/no-inferrable-types
         this.networkRetries = 0;
+        this.refreshingDeferred = null;
         const settings = Object.assign(Object.assign({}, DEFAULT_OPTIONS), options);
-        this.currentUser = null;
-        this.currentSession = null;
+        this.inMemorySession = null;
+        this.storageKey = settings.storageKey;
         this.autoRefreshToken = settings.autoRefreshToken;
         this.persistSession = settings.persistSession;
-        this.multiTab = settings.multiTab;
         this.localStorage = settings.localStorage || globalThis.localStorage;
         this.api = new GoTrueApi_1.default({
             url: settings.url,
@@ -54,15 +58,13 @@ class GoTrueClient {
             cookieOptions: settings.cookieOptions,
             fetch: settings.fetch,
         });
-        this._recoverSession();
         this._recoverAndRefresh();
-        this._listenForMultiTabEvents();
         this._handleVisibilityChange();
         if (settings.detectSessionInUrl && (0, helpers_1.isBrowser)() && !!(0, helpers_1.getParameterByName)('access_token')) {
             // Handle the OAuth redirect
             this.getSessionFromUrl({ storeSession: true }).then(({ error }) => {
                 if (error) {
-                    throw new Error('Error getting session from URL.');
+                    throw new errors_1.AuthUnknownError('Error getting session from URL.', error);
                 }
             });
         }
@@ -102,83 +104,109 @@ class GoTrueClient {
                     session = data;
                     user = session.user;
                     this._saveSession(session);
-                    this._notifyAllSubscribers('SIGNED_IN');
+                    this._notifyAllSubscribers('SIGNED_IN', session);
                 }
-                if (data.id) {
+                else {
                     user = data;
                 }
                 return { user, session, error: null };
             }
-            catch (e) {
-                return { user: null, session: null, error: e };
+            catch (error) {
+                if ((0, errors_1.isAuthError)(error)) {
+                    return { user: null, session: null, error };
+                }
+                throw error;
             }
         });
     }
     /**
      * Log in an existing user, or login via a third-party provider.
-     * @type UserCredentials
+     * @type SignInWithPasswordCredentials
      * @param email The user's email address.
      * @param phone The user's phone number.
      * @param password The user's password.
-     * @param refreshToken A valid refresh token that was returned on login.
+     * @param options Valid options for password sign-ins.
+     */
+    signInWithPassword(credentials) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                this._removeSession();
+                if ('email' in credentials) {
+                    const { email, password, options } = credentials;
+                    return this._handleEmailSignIn(email, password, {
+                        captchaToken: options === null || options === void 0 ? void 0 : options.captchaToken,
+                    });
+                }
+                if ('phone' in credentials) {
+                    const { phone, password, options } = credentials;
+                    return this._handlePhoneSignIn(phone, password, {
+                        captchaToken: options === null || options === void 0 ? void 0 : options.captchaToken,
+                    });
+                }
+                throw new errors_1.AuthInvalidCredentialsError('You must provide either an email or phone number and a password.');
+            }
+            catch (error) {
+                if ((0, errors_1.isAuthError)(error)) {
+                    return { user: null, session: null, error };
+                }
+                throw error;
+            }
+        });
+    }
+    /**
+     * Log in an existing user via a third-party provider.
+     * @type SignInWithOAuthCredentials
      * @param provider One of the providers supported by GoTrue.
      * @param redirectTo A URL to send the user to after they are confirmed (OAuth logins only).
-     * @param shouldCreateUser A boolean flag to indicate whether to automatically create a user on magiclink / otp sign-ins if the user doesn't exist. Defaults to true.
      * @param scopes A space-separated list of scopes granted to the OAuth application.
+     * @param queryParams An object of query params
      */
-    signIn({ email, phone, password, refreshToken, provider, oidc }, options = {}) {
+    signInWithOAuth(credentials) {
+        var _a, _b, _c;
+        return __awaiter(this, void 0, void 0, function* () {
+            this._removeSession();
+            return this._handleProviderSignIn(credentials.provider, {
+                redirectTo: (_a = credentials.options) === null || _a === void 0 ? void 0 : _a.redirectTo,
+                scopes: (_b = credentials.options) === null || _b === void 0 ? void 0 : _b.scopes,
+                queryParams: (_c = credentials.options) === null || _c === void 0 ? void 0 : _c.queryParams,
+            });
+        });
+    }
+    /**
+     * Passwordless method for logging in an existing user.
+     * @type SignInWithPasswordlessCredentials
+     * @param email The user's email address.
+     * @param phone The user's phone number.
+     * @param options Valid options for passwordless sign-ins.
+     */
+    signInWithOtp(credentials) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
                 this._removeSession();
-                if (email && !password) {
+                if ('email' in credentials) {
+                    const { email, options } = credentials;
                     const { error } = yield this.api.sendMagicLinkEmail(email, {
-                        redirectTo: options.redirectTo,
-                        shouldCreateUser: options.shouldCreateUser,
-                        captchaToken: options.captchaToken,
+                        redirectTo: options === null || options === void 0 ? void 0 : options.emailRedirectTo,
+                        shouldCreateUser: options === null || options === void 0 ? void 0 : options.shouldCreateUser,
+                        captchaToken: options === null || options === void 0 ? void 0 : options.captchaToken,
                     });
                     return { user: null, session: null, error };
                 }
-                if (email && password) {
-                    return this._handleEmailSignIn(email, password, {
-                        redirectTo: options.redirectTo,
-                        captchaToken: options.captchaToken,
-                    });
-                }
-                if (phone && !password) {
+                if ('phone' in credentials) {
+                    const { phone, options } = credentials;
                     const { error } = yield this.api.sendMobileOTP(phone, {
-                        shouldCreateUser: options.shouldCreateUser,
-                        captchaToken: options.captchaToken,
+                        shouldCreateUser: options === null || options === void 0 ? void 0 : options.shouldCreateUser,
+                        captchaToken: options === null || options === void 0 ? void 0 : options.captchaToken,
                     });
                     return { user: null, session: null, error };
                 }
-                if (phone && password) {
-                    return this._handlePhoneSignIn(phone, password);
-                }
-                if (refreshToken) {
-                    // currentSession and currentUser will be updated to latest on _callRefreshToken using the passed refreshToken
-                    const { error } = yield this._callRefreshToken(refreshToken);
-                    if (error)
-                        throw error;
-                    return {
-                        user: this.currentUser,
-                        session: this.currentSession,
-                        error: null,
-                    };
-                }
-                if (provider) {
-                    return this._handleProviderSignIn(provider, {
-                        redirectTo: options.redirectTo,
-                        scopes: options.scopes,
-                        queryParams: options.queryParams,
-                    });
-                }
-                if (oidc) {
-                    return this._handleOpenIDConnectSignIn(oidc);
-                }
-                throw new Error(`You must provide either an email, phone number, a third-party provider or OpenID Connect.`);
+                throw new errors_1.AuthInvalidCredentialsError('You must provide either an email or phone number.');
             }
-            catch (e) {
-                return { user: null, session: null, error: e };
+            catch (error) {
+                if ((0, errors_1.isAuthError)(error)) {
+                    return { user: null, session: null, error };
+                }
+                throw error;
             }
         });
     }
@@ -207,73 +235,92 @@ class GoTrueClient {
                     session = data;
                     user = session.user;
                     this._saveSession(session);
-                    this._notifyAllSubscribers('SIGNED_IN');
+                    this._notifyAllSubscribers('SIGNED_IN', session);
                 }
                 if (data.id) {
                     user = data;
                 }
                 return { user, session, error: null };
             }
-            catch (e) {
-                return { user: null, session: null, error: e };
+            catch (error) {
+                if ((0, errors_1.isAuthError)(error)) {
+                    return { user: null, session: null, error };
+                }
+                throw error;
             }
         });
     }
     /**
-     * Inside a browser context, `user()` will return the user data, if there is a logged in user.
-     *
-     * For server-side management, you can get a user through `auth.api.getUserByCookie()`
-     */
-    user() {
-        return this.currentUser;
-    }
-    /**
-     * Returns the session data, if there is an active session.
+     * Returns the session data, refreshing it if necessary.
      */
-    session() {
-        return this.currentSession;
+    getSession() {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            let currentSession = null;
+            if (this.persistSession) {
+                const persistedSession = yield (0, helpers_1.getItemAsync)(this.localStorage, this.storageKey);
+                currentSession = (_a = persistedSession === null || persistedSession === void 0 ? void 0 : persistedSession.currentSession) !== null && _a !== void 0 ? _a : null;
+            }
+            else {
+                currentSession = this.inMemorySession;
+            }
+            if (!currentSession) {
+                return { session: null, error: null };
+            }
+            const hasExpired = currentSession.expires_at
+                ? currentSession.expires_at <= Date.now() / 1000
+                : false;
+            if (!hasExpired) {
+                return { session: currentSession, error: null };
+            }
+            const { session, error } = yield this._callRefreshToken(currentSession.refresh_token);
+            if (error) {
+                return { session: null, error };
+            }
+            return { session, error: null };
+        });
     }
     /**
-     * Force refreshes the session including the user data in case it was updated in a different session.
+     * Returns the user data, refreshing the session if necessary.
      */
-    refreshSession() {
-        var _a;
+    getUser() {
         return __awaiter(this, void 0, void 0, function* () {
-            try {
-                if (!((_a = this.currentSession) === null || _a === void 0 ? void 0 : _a.access_token))
-                    throw new Error('Not logged in.');
-                // currentSession and currentUser will be updated to latest on _callRefreshToken
-                const { error } = yield this._callRefreshToken();
-                if (error)
-                    throw error;
-                return { data: this.currentSession, user: this.currentUser, error: null };
+            const { session, error } = yield this.getSession();
+            if (error) {
+                return { user: null, error };
             }
-            catch (e) {
-                return { data: null, user: null, error: e };
+            if (!session) {
+                return { user: null, error: null };
             }
+            return { user: session.user, error: null };
         });
     }
     /**
      * Updates user data, if there is a logged in user.
      */
     update(attributes) {
-        var _a;
         return __awaiter(this, void 0, void 0, function* () {
             try {
-                if (!((_a = this.currentSession) === null || _a === void 0 ? void 0 : _a.access_token))
-                    throw new Error('Not logged in.');
-                const { user, error } = yield this.api.updateUser(this.currentSession.access_token, attributes);
-                if (error)
-                    throw error;
-                if (!user)
-                    throw Error('Invalid user data.');
-                const session = Object.assign(Object.assign({}, this.currentSession), { user });
+                const { session, error: sessionError } = yield this.getSession();
+                if (sessionError) {
+                    throw sessionError;
+                }
+                if (!session) {
+                    throw new errors_1.AuthSessionMissingError();
+                }
+                const { user, error: userError } = yield this.api.updateUser(session.access_token, attributes);
+                if (userError)
+                    throw userError;
+                session.user = user;
                 this._saveSession(session);
-                this._notifyAllSubscribers('USER_UPDATED');
-                return { data: user, user, error: null };
+                this._notifyAllSubscribers('USER_UPDATED', session);
+                return { user, error: null };
             }
-            catch (e) {
-                return { data: null, user: null, error: e };
+            catch (error) {
+                if ((0, errors_1.isAuthError)(error)) {
+                    return { user: null, error };
+                }
+                throw error;
             }
         });
     }
@@ -285,30 +332,24 @@ class GoTrueClient {
         return __awaiter(this, void 0, void 0, function* () {
             try {
                 if (!refresh_token) {
-                    throw new Error('No current session.');
+                    throw new errors_1.AuthSessionMissingError();
                 }
-                const { data, error } = yield this.api.refreshAccessToken(refresh_token);
+                const { session, error } = yield this.api.refreshAccessToken(refresh_token);
                 if (error) {
                     return { session: null, error: error };
                 }
-                this._saveSession(data);
-                this._notifyAllSubscribers('SIGNED_IN');
-                return { session: data, error: null };
+                this._saveSession(session);
+                this._notifyAllSubscribers('TOKEN_REFRESHED', session);
+                return { session: session, error: null };
             }
-            catch (e) {
-                return { error: e, session: null };
+            catch (error) {
+                if ((0, errors_1.isAuthError)(error)) {
+                    return { session: null, error };
+                }
+                throw error;
             }
         });
     }
-    /**
-     * Overrides the JWT on the current client. The JWT will then be sent in all subsequent network requests.
-     * @param access_token a jwt access token
-     */
-    setAuth(access_token) {
-        this.currentSession = Object.assign(Object.assign({}, this.currentSession), { access_token, token_type: 'bearer', user: this.user() });
-        this._notifyAllSubscribers('TOKEN_REFRESHED');
-        return this.currentSession;
-    }
     /**
      * Gets the session data from a URL string
      * @param options.storeSession Optionally store the session in the browser
@@ -317,23 +358,23 @@ class GoTrueClient {
         return __awaiter(this, void 0, void 0, function* () {
             try {
                 if (!(0, helpers_1.isBrowser)())
-                    throw new Error('No browser detected.');
+                    throw new errors_1.AuthApiError('No browser detected.', 500);
                 const error_description = (0, helpers_1.getParameterByName)('error_description');
                 if (error_description)
-                    throw new Error(error_description);
+                    throw new errors_1.AuthApiError(error_description, 500);
                 const provider_token = (0, helpers_1.getParameterByName)('provider_token');
                 const access_token = (0, helpers_1.getParameterByName)('access_token');
                 if (!access_token)
-                    throw new Error('No access_token detected.');
+                    throw new errors_1.AuthApiError('No access_token detected.', 500);
                 const expires_in = (0, helpers_1.getParameterByName)('expires_in');
                 if (!expires_in)
-                    throw new Error('No expires_in detected.');
+                    throw new errors_1.AuthApiError('No expires_in detected.', 500);
                 const refresh_token = (0, helpers_1.getParameterByName)('refresh_token');
                 if (!refresh_token)
-                    throw new Error('No refresh_token detected.');
+                    throw new errors_1.AuthApiError('No refresh_token detected.', 500);
                 const token_type = (0, helpers_1.getParameterByName)('token_type');
                 if (!token_type)
-                    throw new Error('No token_type detected.');
+                    throw new errors_1.AuthApiError('No token_type detected.', 500);
                 const timeNow = Math.round(Date.now() / 1000);
                 const expires_at = timeNow + parseInt(expires_in);
                 const { user, error } = yield this.api.getUser(access_token);
@@ -351,17 +392,20 @@ class GoTrueClient {
                 if (options === null || options === void 0 ? void 0 : options.storeSession) {
                     this._saveSession(session);
                     const recoveryMode = (0, helpers_1.getParameterByName)('type');
-                    this._notifyAllSubscribers('SIGNED_IN');
+                    this._notifyAllSubscribers('SIGNED_IN', session);
                     if (recoveryMode === 'recovery') {
-                        this._notifyAllSubscribers('PASSWORD_RECOVERY');
+                        this._notifyAllSubscribers('PASSWORD_RECOVERY', session);
                     }
                 }
                 // Remove tokens from URL
                 window.location.hash = '';
-                return { data: session, error: null };
+                return { session, error: null };
             }
-            catch (e) {
-                return { data: null, error: e };
+            catch (error) {
+                if ((0, errors_1.isAuthError)(error)) {
+                    return { session: null, error };
+                }
+                throw error;
             }
         });
     }
@@ -372,16 +416,19 @@ class GoTrueClient {
      * For server-side management, you can revoke all refresh tokens for a user by passing a user's JWT through to `auth.api.signOut(JWT: string)`. There is no way to revoke a user's session JWT before it automatically expires
      */
     signOut() {
-        var _a;
         return __awaiter(this, void 0, void 0, function* () {
-            const accessToken = (_a = this.currentSession) === null || _a === void 0 ? void 0 : _a.access_token;
-            this._removeSession();
-            this._notifyAllSubscribers('SIGNED_OUT');
+            const { session, error: sessionError } = yield this.getSession();
+            if (sessionError) {
+                return { error: sessionError };
+            }
+            const accessToken = session === null || session === void 0 ? void 0 : session.access_token;
             if (accessToken) {
                 const { error } = yield this.api.signOut(accessToken);
                 if (error)
                     return { error };
             }
+            this._removeSession();
+            this._notifyAllSubscribers('SIGNED_OUT', null);
             return { error: null };
         });
     }
@@ -400,10 +447,13 @@ class GoTrueClient {
                 },
             };
             this.stateChangeEmitters.set(id, subscription);
-            return { data: subscription, error: null };
+            return { subscription, error: null };
         }
-        catch (e) {
-            return { data: null, error: e };
+        catch (error) {
+            if ((0, errors_1.isAuthError)(error)) {
+                return { subscription: null, error };
+            }
+            throw error;
         }
     }
     _handleEmailSignIn(email, password, options = {}) {
@@ -411,19 +461,21 @@ class GoTrueClient {
         return __awaiter(this, void 0, void 0, function* () {
             try {
                 const { data, error } = yield this.api.signInWithEmail(email, password, {
-                    redirectTo: options.redirectTo,
                     captchaToken: options.captchaToken,
                 });
                 if (error || !data)
-                    return { data: null, user: null, session: null, error };
+                    return { user: null, session: null, error };
                 if (((_a = data === null || data === void 0 ? void 0 : data.user) === null || _a === void 0 ? void 0 : _a.confirmed_at) || ((_b = data === null || data === void 0 ? void 0 : data.user) === null || _b === void 0 ? void 0 : _b.email_confirmed_at)) {
                     this._saveSession(data);
-                    this._notifyAllSubscribers('SIGNED_IN');
+                    this._notifyAllSubscribers('SIGNED_IN', data);
                 }
-                return { data, user: data.user, session: data, error: null };
+                return { user: data.user, session: data, error: null };
             }
-            catch (e) {
-                return { data: null, user: null, session: null, error: e };
+            catch (error) {
+                if ((0, errors_1.isAuthError)(error)) {
+                    return { user: null, session: null, error };
+                }
+                throw error;
             }
         });
     }
@@ -431,17 +483,22 @@ class GoTrueClient {
         var _a;
         return __awaiter(this, void 0, void 0, function* () {
             try {
-                const { data, error } = yield this.api.signInWithPhone(phone, password, options);
-                if (error || !data)
-                    return { data: null, user: null, session: null, error };
-                if ((_a = data === null || data === void 0 ? void 0 : data.user) === null || _a === void 0 ? void 0 : _a.phone_confirmed_at) {
-                    this._saveSession(data);
-                    this._notifyAllSubscribers('SIGNED_IN');
+                const { session, error } = yield this.api.signInWithPhone(phone, password, {
+                    captchaToken: options.captchaToken,
+                });
+                if (error || !session)
+                    return { session: null, user: null, error };
+                if ((_a = session === null || session === void 0 ? void 0 : session.user) === null || _a === void 0 ? void 0 : _a.phone_confirmed_at) {
+                    this._saveSession(session);
+                    this._notifyAllSubscribers('SIGNED_IN', session);
                 }
-                return { data, user: data.user, session: data, error: null };
+                return { session, user: session.user, error: null };
             }
-            catch (e) {
-                return { data: null, user: null, session: null, error: e };
+            catch (error) {
+                if ((0, errors_1.isAuthError)(error)) {
+                    return { session: null, user: null, error };
+                }
+                throw error;
             }
         });
     }
@@ -451,64 +508,39 @@ class GoTrueClient {
             scopes: options.scopes,
             queryParams: options.queryParams,
         });
-        try {
-            // try to open on the browser
-            if ((0, helpers_1.isBrowser)()) {
-                window.location.href = url;
-            }
-            return { provider, url, data: null, session: null, user: null, error: null };
-        }
-        catch (e) {
-            // fallback to returning the URL
-            if (url)
-                return { provider, url, data: null, session: null, user: null, error: null };
-            return { data: null, user: null, session: null, error: e };
+        // try to open on the browser
+        if ((0, helpers_1.isBrowser)()) {
+            window.location.href = url;
         }
+        return { provider, url, error: null };
     }
     _handleOpenIDConnectSignIn({ id_token, nonce, client_id, issuer, provider, }) {
         return __awaiter(this, void 0, void 0, function* () {
             if (id_token && nonce && ((client_id && issuer) || provider)) {
                 try {
-                    const { data, error } = yield this.api.signInWithOpenIDConnect({
+                    const { session, error } = yield this.api.signInWithOpenIDConnect({
                         id_token,
                         nonce,
                         client_id,
                         issuer,
                         provider,
                     });
-                    if (error || !data)
+                    if (error || !session)
                         return { user: null, session: null, error };
-                    this._saveSession(data);
-                    this._notifyAllSubscribers('SIGNED_IN');
-                    return { user: data.user, session: data, error: null };
+                    this._saveSession(session);
+                    this._notifyAllSubscribers('SIGNED_IN', session);
+                    return { user: session.user, session: session, error: null };
                 }
-                catch (e) {
-                    return { user: null, session: null, error: e };
+                catch (error) {
+                    if ((0, errors_1.isAuthError)(error)) {
+                        return { user: null, session: null, error };
+                    }
+                    throw error;
                 }
             }
-            throw new Error(`You must provide a OpenID Connect provider with your id token and nonce.`);
+            throw new errors_1.AuthInvalidCredentialsError('You must provide an OpenID Connect provider with your id token and nonce.');
         });
     }
-    /**
-     * Attempts to get the session from LocalStorage
-     * Note: this should never be async (even for React Native), as we need it to return immediately in the constructor.
-     */
-    _recoverSession() {
-        try {
-            const data = (0, helpers_1.getItemSynchronously)(this.localStorage, constants_1.STORAGE_KEY);
-            if (!data)
-                return null;
-            const { currentSession, expiresAt } = data;
-            const timeNow = Math.round(Date.now() / 1000);
-            if (expiresAt >= timeNow + constants_1.EXPIRY_MARGIN && (currentSession === null || currentSession === void 0 ? void 0 : currentSession.user)) {
-                this._saveSession(currentSession);
-                this._notifyAllSubscribers('SIGNED_IN');
-            }
-        }
-        catch (error) {
-            console.log('error', error);
-        }
-    }
     /**
      * Recovers the session from LocalStorage and refreshes
      * Note: this method is async to accommodate for AsyncStorage e.g. in React native.
@@ -516,7 +548,7 @@ class GoTrueClient {
     _recoverAndRefresh() {
         return __awaiter(this, void 0, void 0, function* () {
             try {
-                const data = yield (0, helpers_1.getItemAsync)(this.localStorage, constants_1.STORAGE_KEY);
+                const data = yield (0, helpers_1.getItemAsync)(this.localStorage, this.storageKey);
                 if (!data)
                     return null;
                 const { currentSession, expiresAt } = data;
@@ -548,10 +580,10 @@ class GoTrueClient {
                     this._removeSession();
                 }
                 else {
-                    // should be handled on _recoverSession method already
-                    // But we still need the code here to accommodate for AsyncStorage e.g. in React native
-                    this._saveSession(currentSession);
-                    this._notifyAllSubscribers('SIGNED_IN');
+                    if (this.persistSession) {
+                        this._saveSession(currentSession);
+                    }
+                    this._notifyAllSubscribers('SIGNED_IN', currentSession);
                 }
             }
             catch (err) {
@@ -560,115 +592,101 @@ class GoTrueClient {
             }
         });
     }
-    _callRefreshToken(refresh_token) {
-        var _a;
-        if (refresh_token === void 0) { refresh_token = (_a = this.currentSession) === null || _a === void 0 ? void 0 : _a.refresh_token; }
+    _callRefreshToken(refreshToken) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
-                if (!refresh_token) {
-                    throw new Error('No current session.');
+                // refreshing is already in progress
+                if (this.refreshingDeferred) {
+                    return yield this.refreshingDeferred.promise;
+                }
+                this.refreshingDeferred = new helpers_1.Deferred();
+                if (!refreshToken) {
+                    throw new errors_1.AuthSessionMissingError();
                 }
-                const { data, error } = yield this.api.refreshAccessToken(refresh_token);
+                const { session, error } = yield this.api.refreshAccessToken(refreshToken);
                 if (error)
                     throw error;
-                if (!data)
-                    throw Error('Invalid session data.');
-                this._saveSession(data);
-                this._notifyAllSubscribers('TOKEN_REFRESHED');
-                this._notifyAllSubscribers('SIGNED_IN');
-                return { data, error: null };
+                if (!session)
+                    throw new errors_1.AuthSessionMissingError();
+                this._saveSession(session);
+                this._notifyAllSubscribers('TOKEN_REFRESHED', session);
+                const result = { session, error: null };
+                this.refreshingDeferred.resolve(result);
+                this.refreshingDeferred = null;
+                return result;
             }
-            catch (e) {
-                return { data: null, error: e };
+            catch (error) {
+                if ((0, errors_1.isAuthError)(error)) {
+                    return { session: null, error };
+                }
+                throw error;
             }
         });
     }
-    _notifyAllSubscribers(event) {
-        this.stateChangeEmitters.forEach((x) => x.callback(event, this.currentSession));
+    _notifyAllSubscribers(event, session) {
+        this.stateChangeEmitters.forEach((x) => x.callback(event, session));
     }
     /**
      * set currentSession and currentUser
      * process to _startAutoRefreshToken if possible
      */
     _saveSession(session) {
-        this.currentSession = session;
-        this.currentUser = session.user;
+        if (!this.persistSession) {
+            this.inMemorySession = session;
+        }
         const expiresAt = session.expires_at;
         if (expiresAt) {
             const timeNow = Math.round(Date.now() / 1000);
             const expiresIn = expiresAt - timeNow;
             const refreshDurationBeforeExpires = expiresIn > constants_1.EXPIRY_MARGIN ? constants_1.EXPIRY_MARGIN : 0.5;
-            this._startAutoRefreshToken((expiresIn - refreshDurationBeforeExpires) * 1000);
+            this._startAutoRefreshToken((expiresIn - refreshDurationBeforeExpires) * 1000, session);
         }
         // Do we need any extra check before persist session
         // access_token or user ?
         if (this.persistSession && session.expires_at) {
-            this._persistSession(this.currentSession);
+            this._persistSession(session);
         }
     }
     _persistSession(currentSession) {
         const data = { currentSession, expiresAt: currentSession.expires_at };
-        (0, helpers_1.setItemAsync)(this.localStorage, constants_1.STORAGE_KEY, data);
+        (0, helpers_1.setItemAsync)(this.localStorage, this.storageKey, data);
     }
     _removeSession() {
         return __awaiter(this, void 0, void 0, function* () {
-            this.currentSession = null;
-            this.currentUser = null;
-            if (this.refreshTokenTimer)
+            if (this.persistSession) {
+                (0, helpers_1.removeItemAsync)(this.localStorage, this.storageKey);
+            }
+            else {
+                this.inMemorySession = null;
+            }
+            if (this.refreshTokenTimer) {
                 clearTimeout(this.refreshTokenTimer);
-            (0, helpers_1.removeItemAsync)(this.localStorage, constants_1.STORAGE_KEY);
+            }
         });
     }
     /**
      * Clear and re-create refresh token timer
      * @param value time intervals in milliseconds
      */
-    _startAutoRefreshToken(value) {
+    _startAutoRefreshToken(value, session) {
         if (this.refreshTokenTimer)
             clearTimeout(this.refreshTokenTimer);
         if (value <= 0 || !this.autoRefreshToken)
             return;
         this.refreshTokenTimer = setTimeout(() => __awaiter(this, void 0, void 0, function* () {
             this.networkRetries++;
-            const { error } = yield this._callRefreshToken();
+            const { error } = yield this._callRefreshToken(session.refresh_token);
             if (!error)
                 this.networkRetries = 0;
             if ((error === null || error === void 0 ? void 0 : error.message) === constants_1.NETWORK_FAILURE.ERROR_MESSAGE &&
                 this.networkRetries < constants_1.NETWORK_FAILURE.MAX_RETRIES)
-                this._startAutoRefreshToken(Math.pow(constants_1.NETWORK_FAILURE.RETRY_INTERVAL, this.networkRetries) * 100); // exponential backoff
+                this._startAutoRefreshToken(Math.pow(constants_1.NETWORK_FAILURE.RETRY_INTERVAL, this.networkRetries) * 100, session); // exponential backoff
         }), value);
         if (typeof this.refreshTokenTimer.unref === 'function')
             this.refreshTokenTimer.unref();
     }
-    /**
-     * Listens for changes to LocalStorage and updates the current session.
-     */
-    _listenForMultiTabEvents() {
-        if (!this.multiTab || !(0, helpers_1.isBrowser)() || !(window === null || window === void 0 ? void 0 : window.addEventListener)) {
-            return false;
-        }
-        try {
-            window === null || window === void 0 ? void 0 : window.addEventListener('storage', (e) => {
-                var _a;
-                if (e.key === constants_1.STORAGE_KEY) {
-                    const newSession = JSON.parse(String(e.newValue));
-                    if ((_a = newSession === null || newSession === void 0 ? void 0 : newSession.currentSession) === null || _a === void 0 ? void 0 : _a.access_token) {
-                        this._saveSession(newSession.currentSession);
-                        this._notifyAllSubscribers('SIGNED_IN');
-                    }
-                    else {
-                        this._removeSession();
-                        this._notifyAllSubscribers('SIGNED_OUT');
-                    }
-                }
-            });
-        }
-        catch (error) {
-            console.error('_listenForMultiTabEvents', error);
-        }
-    }
     _handleVisibilityChange() {
-        if (!this.multiTab || !(0, helpers_1.isBrowser)() || !(window === null || window === void 0 ? void 0 : window.addEventListener)) {
+        if (!(0, helpers_1.isBrowser)() || !(window === null || window === void 0 ? void 0 : window.addEventListener)) {
             return false;
         }
         try {