@thunderid/node 1.2.2 → 1.3.1

package/dist/ThunderIDNodeClient.d.ts

@@ -1,8 +1,9 @@
-import { BackchannelLogoutResult, ExtendedAuthorizeRequestUrlParams, IdToken, OIDCEndpoints, Storage, ThunderIDJavaScriptClient, TokenExchangeRequestConfig, TokenResponse, User } from '@thunderid/javascript';
+import { BackchannelLogoutResult, ExtendedAuthorizeRequestUrlParams, IdToken, ManagedFlowListResponse, ManagedUserListResponse, ManagedUserTypeListResponse, OIDCEndpoints, Storage, ThunderIDJavaScriptClient, TokenExchangeRequestConfig, TokenResponse, User } from '@thunderid/javascript';
 import { ThunderIDNodeConfig } from './models/config';
 declare class ThunderIDNodeClient<T extends ThunderIDNodeConfig = ThunderIDNodeConfig> extends ThunderIDJavaScriptClient<T> {
     private _nodeInstanceId;
     private _handledLogoutTokens;
+    private _refreshesInFlight;
     constructor(instanceId?: number);
     initialize(config: T, storage?: Storage): Promise<boolean>;
     getInstanceId(): number;
@@ -45,8 +46,17 @@ declare class ThunderIDNodeClient<T extends ThunderIDNodeConfig = ThunderIDNodeC
      */
     private assertNotReplayed;
     private rememberHandled;
+    /**
+     * Whether the session holds a valid access token. An expired access token is refreshed when the
+     * session holds a refresh token. A session whose access token expired and cannot be refreshed is
+     * removed.
+     */
     isSignedIn(userId?: string): Promise<boolean>;
     getIdToken(userId?: string): Promise<string>;
+    /**
+     * Refreshes the session's tokens. Concurrent calls for one session share a single request, so a
+     * rotated refresh token is not sent twice.
+     */
     refreshAccessToken(userId?: string): Promise<TokenResponse | User>;
     revokeAccessToken(userId?: string): Promise<Response | boolean>;
     getDecodedIdToken(userId?: string, idToken?: string): Promise<IdToken>;
@@ -59,6 +69,43 @@ declare class ThunderIDNodeClient<T extends ThunderIDNodeConfig = ThunderIDNodeC
      * attribute the user type schema declares `credential: true`).
      */
     updateUserCredentials(payload: Record<string, string>, userId?: string): Promise<void>;
+    /**
+     * The URL inputs and bearer token for a management request made on behalf of the session identified by
+     * `userId`. The access token stays on the server.
+     */
+    private managementRequestConfig;
+    /**
+     * Retrieves one page of the user directory on behalf of the session identified by `userId`.
+     *
+     * Makes a single request and does not follow `links`. The access token stays on the server.
+     */
+    getUsers(options?: {
+        filter?: string;
+        limit?: number;
+        offset?: number;
+        signal?: AbortSignal;
+    }, userId?: string): Promise<ManagedUserListResponse>;
+    /**
+     * Retrieves one page of flows on behalf of the session identified by `userId`.
+     *
+     * Makes a single request and does not follow `links`. The access token stays on the server.
+     */
+    getFlows(options?: {
+        flowType?: string;
+        limit?: number;
+        offset?: number;
+        signal?: AbortSignal;
+    }, userId?: string): Promise<ManagedFlowListResponse>;
+    /**
+     * Retrieves one page of user types on behalf of the session identified by `userId`.
+     *
+     * Makes a single request and does not follow `links`. The access token stays on the server.
+     */
+    getUserTypes(options?: {
+        limit?: number;
+        offset?: number;
+        signal?: AbortSignal;
+    }, userId?: string): Promise<ManagedUserTypeListResponse>;
 }
 export default ThunderIDNodeClient;
 //# sourceMappingURL=ThunderIDNodeClient.d.ts.map

package/dist/ThunderIDNodeClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDNodeClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDNodeClient.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,uBAAuB,EACvB,iCAAiC,EACjC,OAAO,EAIP,aAAa,EAGb,OAAO,EAEP,yBAAyB,EACzB,0BAA0B,EAC1B,aAAa,EAEb,IAAI,EACL,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAC,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAMpD,cAAM,mBAAmB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB,CAAE,SAAQ,yBAAyB,CAAC,CAAC,CAAC;IACjH,OAAO,CAAC,eAAe,CAAK;IAG5B,OAAO,CAAC,oBAAoB,CAAkD;gBAE3D,UAAU,SAAI;IAKX,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAMhE,aAAa,IAAI,MAAM;IAIjB,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAsE9C,YAAY,CAChC,aAAa,CAAC,EAAE,iCAAiC,EACjD,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC;IAcI,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAe9D;;;;;;;;;;;;;OAaG;IACU,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAsD3F;;;;;OAKG;YACW,aAAa;IAYX,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;cAI7B,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7E;;;OAGG;YACW,YAAY;YAYZ,kBAAkB;IAgBhC;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAezB,OAAO,CAAC,eAAe;IAID,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsB7C,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa5C,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAIlE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC;IAO/D,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAItE,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIhD,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAI7D,aAAa,CACjC,MAAM,EAAE,0BAA0B,EAClC,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,GAAG,QAAQ,GAAG,IAAI,CAAC;IAI3C;;;OAGG;IACU,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAapG;AAED,eAAe,mBAAmB,CAAC"}
+{"version":3,"file":"ThunderIDNodeClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDNodeClient.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,uBAAuB,EACvB,iCAAiC,EAIjC,OAAO,EAIP,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,aAAa,EAGb,OAAO,EAEP,yBAAyB,EACzB,0BAA0B,EAC1B,aAAa,EAEb,IAAI,EACL,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAC,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AAKpD,cAAM,mBAAmB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB,CAAE,SAAQ,yBAAyB,CAAC,CAAC,CAAC;IACjH,OAAO,CAAC,eAAe,CAAK;IAG5B,OAAO,CAAC,oBAAoB,CAAkD;IAG9E,OAAO,CAAC,kBAAkB,CAGtB;gBAEe,UAAU,SAAI;IAKX,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAMhE,aAAa,IAAI,MAAM;IAIjB,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAsE9C,YAAY,CAChC,aAAa,CAAC,EAAE,iCAAiC,EACjD,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC;IAcI,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAe9D;;;;;;;;;;;;;OAaG;IACU,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAsD3F;;;;;OAKG;YACW,aAAa;IAYX,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;cAI7B,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7E;;;OAGG;YACW,YAAY;YAYZ,kBAAkB;IAgBhC;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAezB,OAAO,CAAC,eAAe;IAIvB;;;;OAIG;IACmB,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkC7C,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAalE;;;OAGG;IACmB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAsBlE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC;IAO/D,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAItE,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIhD,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAI7D,aAAa,CACjC,MAAM,EAAE,0BAA0B,EAClC,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,GAAG,QAAQ,GAAG,IAAI,CAAC;IAI3C;;;OAGG;IACU,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcnG;;;OAGG;YACW,uBAAuB;IAerC;;;;OAIG;IACU,QAAQ,CACnB,OAAO,GAAE;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,EACtF,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,uBAAuB,CAAC;IAInC;;;;OAIG;IACU,QAAQ,CACnB,OAAO,GAAE;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,EACxF,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,uBAAuB,CAAC;IAInC;;;;OAIG;IACU,YAAY,CACvB,OAAO,GAAE;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,EACrE,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,2BAA2B,CAAC;CAGxC;AAED,eAAe,mBAAmB,CAAC"}

package/dist/cjs/index.cjs

@@ -31,8 +31,10 @@ let base64url = require("base64url");
 base64url = __toESM(base64url);
 let fast_sha256 = require("fast-sha256");
 fast_sha256 = __toESM(fast_sha256);
-let jose = require("jose");
-jose = __toESM(jose);
+let jose_key_import = require("jose/key/import");
+jose_key_import = __toESM(jose_key_import);
+let jose_jwt_verify = require("jose/jwt/verify");
+jose_jwt_verify = __toESM(jose_jwt_verify);
 let secure_random_bytes = require("secure-random-bytes");
 secure_random_bytes = __toESM(secure_random_bytes);
 let uuid = require("uuid");
@@ -76,8 +78,7 @@ var NodeCryptoUtils = class {
 		return (0, secure_random_bytes.default)(length);
 	}
 	async verifyJwt(idToken, jwk, algorithms, clientId, issuer, subject, clockTolerance) {
-		const key = await jose.importJWK(jwk);
-		return jose.jwtVerify(idToken, key, {
+		return (0, jose_jwt_verify.jwtVerify)(idToken, await (0, jose_key_import.importJWK)(jwk), {
 			algorithms,
 			audience: [clientId],
 			clockTolerance,
@@ -164,49 +165,12 @@ var SessionIndex = class {
 };
 var SessionIndex_default = SessionIndex;
 
-//#endregion
-//#region src/utils/SessionUtils.ts
-const UUID_VERSION = 4;
-/**
-* Utility class for session validation and UUID management.
-*/
-var SessionUtils = class {
-	constructor() {}
-	/**
-	* Generates a new UUID v4 string.
-	*
-	* @returns A new UUID string.
-	*/
-	static createUUID() {
-		return (0, uuid.v4)();
-	}
-	/**
-	* Returns `true` if the given string is a valid UUID v4.
-	*
-	* @param uuid - The UUID string to validate.
-	*/
-	static validateUUID(uuid$1) {
-		if ((0, uuid.validate)(uuid$1) && (0, uuid.version)(uuid$1) === UUID_VERSION) return Promise.resolve(true);
-		return Promise.resolve(false);
-	}
-	/**
-	* Returns `true` if the session token is still within its validity window.
-	*
-	* @param sessionData - The session data to check.
-	*/
-	static validateSession(sessionData) {
-		const currentTime = Date.now();
-		const expiryTimeStamp = sessionData.created_at + parseInt(sessionData.expires_in, 10) * 60 * 1e3;
-		return Promise.resolve(currentTime < expiryTimeStamp);
-	}
-};
-var SessionUtils_default = SessionUtils;
-
 //#endregion
 //#region src/ThunderIDNodeClient.ts
 var ThunderIDNodeClient = class extends __thunderid_javascript.ThunderIDJavaScriptClient {
 	_nodeInstanceId = 0;
 	_handledLogoutTokens = /* @__PURE__ */ new Map();
+	_refreshesInFlight = /* @__PURE__ */ new Map();
 	constructor(instanceId = 0) {
 		super(void 0, new NodeCryptoUtils_default());
 		this._nodeInstanceId = instanceId;
@@ -382,13 +346,23 @@ var ThunderIDNodeClient = class extends __thunderid_javascript.ThunderIDJavaScri
 	rememberHandled(claims) {
 		this._handledLogoutTokens.set(claims.jti, claims.exp * 1e3);
 	}
+	/**
+	* Whether the session holds a valid access token. An expired access token is refreshed when the
+	* session holds a refresh token. A session whose access token expired and cannot be refreshed is
+	* removed.
+	*/
 	async isSignedIn(userId) {
 		try {
-			if (!await super.isSignedIn(userId)) return false;
+			if (await super.isSignedIn(userId)) return true;
 			const sm = this.getStorageManager();
 			const sessionData = await sm.getSessionData(userId);
-			if (await SessionUtils_default.validateSession(sessionData)) return true;
-			if (await this.refreshAccessToken(userId)) return true;
+			if (!sessionData?.access_token) return false;
+			if (sessionData.refresh_token) try {
+				await this.refreshAccessToken(userId);
+				return true;
+			} catch (error) {
+				__thunderid_javascript.logger.debug("The expired session could not be refreshed, so it is removed.", error);
+			}
 			await this.forgetSession(userId, sessionData);
 			await sm.removeSessionData(userId);
 			return false;
@@ -400,8 +374,22 @@ var ThunderIDNodeClient = class extends __thunderid_javascript.ThunderIDJavaScri
 		if (!await this.isSignedIn(userId)) return Promise.reject(new __thunderid_javascript.ThunderIDAuthException("NODE-AUTH_CLIENT-GIT-NF01", "The user is not logged in.", "No session was found for the requested user."));
 		return super.getIdToken(userId);
 	}
+	/**
+	* Refreshes the session's tokens. Concurrent calls for one session share a single request, so a
+	* rotated refresh token is not sent twice.
+	*/
 	async refreshAccessToken(userId) {
-		return super.refreshAccessToken(userId);
+		const key = userId ?? "";
+		const inFlight = this._refreshesInFlight.get(key);
+		if (inFlight) return inFlight;
+		const refresh = (async () => {
+			await this.loadOpenIDProviderConfiguration(false);
+			return super.refreshAccessToken(userId);
+		})().finally(() => {
+			this._refreshesInFlight.delete(key);
+		});
+		this._refreshesInFlight.set(key, refresh);
+		return refresh;
 	}
 	async revokeAccessToken(userId) {
 		await this.forgetSession(userId);
@@ -436,6 +424,51 @@ var ThunderIDNodeClient = class extends __thunderid_javascript.ThunderIDJavaScri
 			url: (0, __thunderid_javascript.resolveResourceEndpoint)("usersMeCredentials", configData)
 		});
 	}
+	/**
+	* The URL inputs and bearer token for a management request made on behalf of the session identified by
+	* `userId`. The access token stays on the server.
+	*/
+	async managementRequestConfig(key, userId) {
+		const configData = await this.getStorageManager().getConfigData();
+		return {
+			baseUrl: configData?.baseUrl,
+			headers: { Authorization: `Bearer ${await this.getAccessToken(userId)}` },
+			url: (0, __thunderid_javascript.resolveResourceEndpoint)(key, configData)
+		};
+	}
+	/**
+	* Retrieves one page of the user directory on behalf of the session identified by `userId`.
+	*
+	* Makes a single request and does not follow `links`. The access token stays on the server.
+	*/
+	async getUsers(options = {}, userId) {
+		return (0, __thunderid_javascript.getUsers)({
+			...options,
+			...await this.managementRequestConfig("users", userId)
+		});
+	}
+	/**
+	* Retrieves one page of flows on behalf of the session identified by `userId`.
+	*
+	* Makes a single request and does not follow `links`. The access token stays on the server.
+	*/
+	async getFlows(options = {}, userId) {
+		return (0, __thunderid_javascript.getFlows)({
+			...options,
+			...await this.managementRequestConfig("flows", userId)
+		});
+	}
+	/**
+	* Retrieves one page of user types on behalf of the session identified by `userId`.
+	*
+	* Makes a single request and does not follow `links`. The access token stays on the server.
+	*/
+	async getUserTypes(options = {}, userId) {
+		return (0, __thunderid_javascript.getUserTypes)({
+			...options,
+			...await this.managementRequestConfig("userTypes", userId)
+		});
+	}
 };
 var ThunderIDNodeClient_default = ThunderIDNodeClient;
 
@@ -544,6 +577,45 @@ var CookieChunking = class CookieChunking {
 };
 var CookieChunking_default = CookieChunking;
 
+//#endregion
+//#region src/utils/SessionUtils.ts
+const UUID_VERSION = 4;
+/**
+* Utility class for session validation and UUID management.
+*/
+var SessionUtils = class {
+	constructor() {}
+	/**
+	* Generates a new UUID v4 string.
+	*
+	* @returns A new UUID string.
+	*/
+	static createUUID() {
+		return (0, uuid.v4)();
+	}
+	/**
+	* Returns `true` if the given string is a valid UUID v4.
+	*
+	* @param uuid - The UUID string to validate.
+	*/
+	static validateUUID(uuid$1) {
+		if ((0, uuid.validate)(uuid$1) && (0, uuid.version)(uuid$1) === UUID_VERSION) return Promise.resolve(true);
+		return Promise.resolve(false);
+	}
+	/**
+	* Returns `true` if the session token is still within its validity window.
+	*
+	* @param sessionData - The session data to check. `expires_in` is in seconds, as the token
+	* endpoint returns it, and `created_at` in milliseconds.
+	*/
+	static validateSession(sessionData) {
+		const currentTime = Date.now();
+		const expiryTimeStamp = sessionData.created_at + parseInt(sessionData.expires_in, 10) * 1e3;
+		return Promise.resolve(currentTime < expiryTimeStamp);
+	}
+};
+var SessionUtils_default = SessionUtils;
+
 //#endregion
 //#region src/utils/LoggedOutSessions.ts
 /**

package/dist/index.js

@@ -1,9 +1,10 @@
 import fetch, { Headers, Request, Response } from "cross-fetch";
-import { BackchannelLogoutConstants, InvalidLogoutTokenError, ThunderIDAuthException, ThunderIDJavaScriptClient, getVendorPrefix, logger, resolveResourceEndpoint, updateMeCredentials } from "@thunderid/javascript";
+import { BackchannelLogoutConstants, InvalidLogoutTokenError, ThunderIDAuthException, ThunderIDJavaScriptClient, getFlows, getUserTypes, getUsers, getVendorPrefix, logger, resolveResourceEndpoint, updateMeCredentials } from "@thunderid/javascript";
 import cache from "memory-cache";
 import base64url from "base64url";
 import sha256 from "fast-sha256";
-import * as jose from "jose";
+import { importJWK } from "jose/key/import";
+import { jwtVerify } from "jose/jwt/verify";
 import randombytes from "secure-random-bytes";
 import { v4, validate, version } from "uuid";
 
@@ -47,8 +48,7 @@ var NodeCryptoUtils = class {
 		return randombytes(length);
 	}
 	async verifyJwt(idToken, jwk, algorithms, clientId, issuer, subject, clockTolerance) {
-		const key = await jose.importJWK(jwk);
-		return jose.jwtVerify(idToken, key, {
+		return jwtVerify(idToken, await importJWK(jwk), {
 			algorithms,
 			audience: [clientId],
 			clockTolerance,
@@ -135,49 +135,12 @@ var SessionIndex = class {
 };
 var SessionIndex_default = SessionIndex;
 
-//#endregion
-//#region src/utils/SessionUtils.ts
-const UUID_VERSION = 4;
-/**
-* Utility class for session validation and UUID management.
-*/
-var SessionUtils = class {
-	constructor() {}
-	/**
-	* Generates a new UUID v4 string.
-	*
-	* @returns A new UUID string.
-	*/
-	static createUUID() {
-		return v4();
-	}
-	/**
-	* Returns `true` if the given string is a valid UUID v4.
-	*
-	* @param uuid - The UUID string to validate.
-	*/
-	static validateUUID(uuid) {
-		if (validate(uuid) && version(uuid) === UUID_VERSION) return Promise.resolve(true);
-		return Promise.resolve(false);
-	}
-	/**
-	* Returns `true` if the session token is still within its validity window.
-	*
-	* @param sessionData - The session data to check.
-	*/
-	static validateSession(sessionData) {
-		const currentTime = Date.now();
-		const expiryTimeStamp = sessionData.created_at + parseInt(sessionData.expires_in, 10) * 60 * 1e3;
-		return Promise.resolve(currentTime < expiryTimeStamp);
-	}
-};
-var SessionUtils_default = SessionUtils;
-
 //#endregion
 //#region src/ThunderIDNodeClient.ts
 var ThunderIDNodeClient = class extends ThunderIDJavaScriptClient {
 	_nodeInstanceId = 0;
 	_handledLogoutTokens = /* @__PURE__ */ new Map();
+	_refreshesInFlight = /* @__PURE__ */ new Map();
 	constructor(instanceId = 0) {
 		super(void 0, new NodeCryptoUtils_default());
 		this._nodeInstanceId = instanceId;
@@ -353,13 +316,23 @@ var ThunderIDNodeClient = class extends ThunderIDJavaScriptClient {
 	rememberHandled(claims) {
 		this._handledLogoutTokens.set(claims.jti, claims.exp * 1e3);
 	}
+	/**
+	* Whether the session holds a valid access token. An expired access token is refreshed when the
+	* session holds a refresh token. A session whose access token expired and cannot be refreshed is
+	* removed.
+	*/
 	async isSignedIn(userId) {
 		try {
-			if (!await super.isSignedIn(userId)) return false;
+			if (await super.isSignedIn(userId)) return true;
 			const sm = this.getStorageManager();
 			const sessionData = await sm.getSessionData(userId);
-			if (await SessionUtils_default.validateSession(sessionData)) return true;
-			if (await this.refreshAccessToken(userId)) return true;
+			if (!sessionData?.access_token) return false;
+			if (sessionData.refresh_token) try {
+				await this.refreshAccessToken(userId);
+				return true;
+			} catch (error) {
+				logger.debug("The expired session could not be refreshed, so it is removed.", error);
+			}
 			await this.forgetSession(userId, sessionData);
 			await sm.removeSessionData(userId);
 			return false;
@@ -371,8 +344,22 @@ var ThunderIDNodeClient = class extends ThunderIDJavaScriptClient {
 		if (!await this.isSignedIn(userId)) return Promise.reject(new ThunderIDAuthException("NODE-AUTH_CLIENT-GIT-NF01", "The user is not logged in.", "No session was found for the requested user."));
 		return super.getIdToken(userId);
 	}
+	/**
+	* Refreshes the session's tokens. Concurrent calls for one session share a single request, so a
+	* rotated refresh token is not sent twice.
+	*/
 	async refreshAccessToken(userId) {
-		return super.refreshAccessToken(userId);
+		const key = userId ?? "";
+		const inFlight = this._refreshesInFlight.get(key);
+		if (inFlight) return inFlight;
+		const refresh = (async () => {
+			await this.loadOpenIDProviderConfiguration(false);
+			return super.refreshAccessToken(userId);
+		})().finally(() => {
+			this._refreshesInFlight.delete(key);
+		});
+		this._refreshesInFlight.set(key, refresh);
+		return refresh;
 	}
 	async revokeAccessToken(userId) {
 		await this.forgetSession(userId);
@@ -407,6 +394,51 @@ var ThunderIDNodeClient = class extends ThunderIDJavaScriptClient {
 			url: resolveResourceEndpoint("usersMeCredentials", configData)
 		});
 	}
+	/**
+	* The URL inputs and bearer token for a management request made on behalf of the session identified by
+	* `userId`. The access token stays on the server.
+	*/
+	async managementRequestConfig(key, userId) {
+		const configData = await this.getStorageManager().getConfigData();
+		return {
+			baseUrl: configData?.baseUrl,
+			headers: { Authorization: `Bearer ${await this.getAccessToken(userId)}` },
+			url: resolveResourceEndpoint(key, configData)
+		};
+	}
+	/**
+	* Retrieves one page of the user directory on behalf of the session identified by `userId`.
+	*
+	* Makes a single request and does not follow `links`. The access token stays on the server.
+	*/
+	async getUsers(options = {}, userId) {
+		return getUsers({
+			...options,
+			...await this.managementRequestConfig("users", userId)
+		});
+	}
+	/**
+	* Retrieves one page of flows on behalf of the session identified by `userId`.
+	*
+	* Makes a single request and does not follow `links`. The access token stays on the server.
+	*/
+	async getFlows(options = {}, userId) {
+		return getFlows({
+			...options,
+			...await this.managementRequestConfig("flows", userId)
+		});
+	}
+	/**
+	* Retrieves one page of user types on behalf of the session identified by `userId`.
+	*
+	* Makes a single request and does not follow `links`. The access token stays on the server.
+	*/
+	async getUserTypes(options = {}, userId) {
+		return getUserTypes({
+			...options,
+			...await this.managementRequestConfig("userTypes", userId)
+		});
+	}
 };
 var ThunderIDNodeClient_default = ThunderIDNodeClient;
 
@@ -515,6 +547,45 @@ var CookieChunking = class CookieChunking {
 };
 var CookieChunking_default = CookieChunking;
 
+//#endregion
+//#region src/utils/SessionUtils.ts
+const UUID_VERSION = 4;
+/**
+* Utility class for session validation and UUID management.
+*/
+var SessionUtils = class {
+	constructor() {}
+	/**
+	* Generates a new UUID v4 string.
+	*
+	* @returns A new UUID string.
+	*/
+	static createUUID() {
+		return v4();
+	}
+	/**
+	* Returns `true` if the given string is a valid UUID v4.
+	*
+	* @param uuid - The UUID string to validate.
+	*/
+	static validateUUID(uuid) {
+		if (validate(uuid) && version(uuid) === UUID_VERSION) return Promise.resolve(true);
+		return Promise.resolve(false);
+	}
+	/**
+	* Returns `true` if the session token is still within its validity window.
+	*
+	* @param sessionData - The session data to check. `expires_in` is in seconds, as the token
+	* endpoint returns it, and `created_at` in milliseconds.
+	*/
+	static validateSession(sessionData) {
+		const currentTime = Date.now();
+		const expiryTimeStamp = sessionData.created_at + parseInt(sessionData.expires_in, 10) * 1e3;
+		return Promise.resolve(currentTime < expiryTimeStamp);
+	}
+};
+var SessionUtils_default = SessionUtils;
+
 //#endregion
 //#region src/utils/LoggedOutSessions.ts
 /**

package/dist/utils/NodeCryptoUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"NodeCryptoUtils.d.ts","sourceRoot":"","sources":["../../src/utils/NodeCryptoUtils.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,uBAAuB,CAAC;AAM3D;;;GAGG;AACH,cAAM,eAAgB,YAAW,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAC/C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM;IAI/C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAItC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM;IAIzC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM;IAI9C,SAAS,CACpB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,EAC1B,UAAU,EAAE,MAAM,EAAE,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,OAAO,CAAC;CAYpB;AAED,eAAe,eAAe,CAAC"}
+{"version":3,"file":"NodeCryptoUtils.d.ts","sourceRoot":"","sources":["../../src/utils/NodeCryptoUtils.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,uBAAuB,CAAC;AAS3D;;;GAGG;AACH,cAAM,eAAgB,YAAW,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAC/C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM;IAI/C,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAItC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM;IAIzC,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM;IAI9C,SAAS,CACpB,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,EAC1B,UAAU,EAAE,MAAM,EAAE,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,OAAO,CAAC;CAUpB;AAED,eAAe,eAAe,CAAC"}

package/dist/utils/SessionUtils.d.ts

@@ -19,7 +19,8 @@ declare class SessionUtils {
     /**
      * Returns `true` if the session token is still within its validity window.
      *
-     * @param sessionData - The session data to check.
+     * @param sessionData - The session data to check. `expires_in` is in seconds, as the token
+     * endpoint returns it, and `created_at` in milliseconds.
      */
     static validateSession(sessionData: SessionData): Promise<boolean>;
 }

package/dist/utils/SessionUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionUtils.d.ts","sourceRoot":"","sources":["../../src/utils/SessionUtils.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,WAAW,EAAC,MAAM,uBAAuB,CAAC;AAKlD;;GAEG;AACH,cAAM,YAAY;IAChB,OAAO;IAEP;;;;OAIG;WACW,UAAU,IAAI,MAAM;IAIlC;;;;OAIG;WACW,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO1D;;;;OAIG;WACW,eAAe,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;CAK1E;AAED,eAAe,YAAY,CAAC"}
+{"version":3,"file":"SessionUtils.d.ts","sourceRoot":"","sources":["../../src/utils/SessionUtils.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,WAAW,EAAC,MAAM,uBAAuB,CAAC;AAKlD;;GAEG;AACH,cAAM,YAAY;IAChB,OAAO;IAEP;;;;OAIG;WACW,UAAU,IAAI,MAAM;IAIlC;;;;OAIG;WACW,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAO1D;;;;;OAKG;WACW,eAAe,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;CAK1E;AAED,eAAe,YAAY,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thunderid/node",
-  "version": "1.2.2",
+  "version": "1.3.1",
   "description": "Node.js runtime SDK for ThunderID",
   "keywords": [
     "thunderid",
@@ -44,7 +44,7 @@
     "vitest": "4.1.11"
   },
   "dependencies": {
-    "@thunderid/javascript": "^1.3.2",
+    "@thunderid/javascript": "^1.4.1",
     "base64url": "3.0.1",
     "cross-fetch": "4.1.0",
     "fast-sha256": "1.3.0",