@umbraco-cms/backoffice 17.6.2 → 17.7.0-rc

package/dist-cms/packages/core/auth/auth.context.d.ts

@@ -16,26 +16,31 @@ export declare class UmbAuthContext extends UmbContextBase {
     #private;
     readonly session$: Observable<UmbAuthSession | undefined>;
     /**
-     * Observable that emits true when the auth context is initialized.
-     * @remark It will only emit once and then complete itself.
+     * Observable that emits once, without a value, when the auth context is initialized.
+     * For consumers: the boot sequence already awaits app entry points before the router evaluates
+     * its guards, so by the time any extension code runs this has long since completed.
+     * @internal
+     * @deprecated Internal boot signal, never intended for public use. Scheduled for removal in Umbraco 19.
+     * @remarks It will only emit once and then complete itself.
+     * @returns {Observable<void>} An observable that emits once when the auth context is initialized.
      */
-    readonly isInitialized: Observable<void>;
+    get isInitialized(): Observable<void>;
     /**
      * Observable that emits true if the user is authorized, otherwise false.
-     * @remark It will only emit when the authorization state changes.
+     * @remarks It will only emit when the authorization state changes.
      */
     readonly isAuthorized: Observable<boolean>;
     /**
      * Observable that acts as a signal and emits when the user has timed out, i.e. the token has expired.
      * This can be used to show a timeout message to the user.
-     * @remark It will emit once per second, so it can be used to trigger UI updates or other actions when the user has timed out.
+     * @remarks It will emit once per second, so it can be used to trigger UI updates or other actions when the user has timed out.
      */
     readonly timeoutSignal: Observable<void>;
     /**
      * Observable that acts as a signal for when the authorization state changes.
      * @deprecated Observe isAuthorized instead. Scheduled for removal in Umbraco 19.
-     * @remark It will emit once per second, so it can be used to trigger UI updates or other actions when the authorization state changes.
-     * @returns An observable that emits when the authorization state changes.
+     * @remarks It will emit once per second, so it can be used to trigger UI updates or other actions when the authorization state changes.
+     * @returns {Observable<void>} An observable that emits when the authorization state changes.
      */
     get authorizationSignal(): Observable<void>;
     /**
@@ -47,21 +52,21 @@ export declare class UmbAuthContext extends UmbContextBase {
     destroy(): void;
     /**
      * Initiates the login flow.
-     * @param identityProvider The provider to use for login. Default is 'Umbraco'.
-     * @param redirect If true, the user will be redirected to the login page.
-     * @param usernameHint The username hint to use for login.
-     * @param manifest The manifest for the registered provider.
+     * @param {string} identityProvider The provider to use for login. Default is 'Umbraco'.
+     * @param {boolean} redirect If true, the user will be redirected to the login page.
+     * @param {string} usernameHint The username hint to use for login.
+     * @param {ManifestAuthProvider} manifest The manifest for the registered provider.
      */
     makeAuthorizationRequest(identityProvider?: string, redirect?: boolean, usernameHint?: string, manifest?: ManifestAuthProvider): Promise<void>;
     /**
      * Completes the login flow.
      * This is called on the oauth_complete page to exchange the authorization code for tokens.
-     * @returns The token response timing, or null if no authorization was pending.
+     * @returns {Promise<UmbTokenEndpointResponse | null>} The token response timing, or null if no authorization was pending.
      */
     completeAuthorizationRequest(): Promise<UmbTokenEndpointResponse | null>;
     /**
      * Checks if the user is authorized. If Authorization is bypassed, the user is always authorized.
-     * @returns True if the user is authorized, otherwise false.
+     * @returns {boolean} True if the user is authorized, otherwise false.
      */
     getIsAuthorized(): boolean;
     /**
@@ -75,7 +80,6 @@ export declare class UmbAuthContext extends UmbContextBase {
      * Gets the latest token from the Management API.
      * With cookie auth, this returns '[redacted]' — the real token is in the httpOnly cookie.
      * If the session has expired, it will attempt a refresh first.
-     *
      * @example <caption>Using the latest token</caption>
      * ```js
      *   const token = await authContext.getLatestToken();
@@ -84,7 +88,7 @@ export declare class UmbAuthContext extends UmbContextBase {
      * @see {@link configureClient} for automatic token handling with `@hey-api/openapi-ts` clients.
      * @see {@link getOpenApiConfiguration} for manual fetch calls with cookie-based auth.
      * @memberof UmbAuthContext
-     * @returns The latest token from the Management API
+     * @returns {Promise<string>} The latest token from the Management API
      */
     getLatestToken(): Promise<string>;
     /**
@@ -94,17 +98,18 @@ export declare class UmbAuthContext extends UmbContextBase {
      * call when the access token is still valid.
      * Uses Web Locks to deduplicate concurrent refresh requests across tabs.
      * @memberof UmbAuthContext
-     * @returns True if the refresh succeeded, otherwise false
+     * @returns {Promise<boolean>} True if the refresh succeeded, otherwise false
      */
     validateToken(): Promise<boolean>;
     /**
      * Attempts to refresh the token using Web Locks to prevent concurrent refresh requests.
-     * @returns True if the refresh was successful, otherwise false.
+     * @returns {Promise<boolean>} True if the refresh was successful, otherwise false.
      */
     makeRefreshTokenRequest(): Promise<boolean>;
     /**
      * Checks if the current session is still valid.
-     * @returns True if the session has not expired.
+     * @deprecated Use {@link getIsAuthorized} or observe {@link session$} instead. Scheduled for removal in Umbraco 19.
+     * @returns {boolean} True if the session has not expired.
      */
     isSessionValid(): boolean;
     /**
@@ -139,12 +144,13 @@ export declare class UmbAuthContext extends UmbContextBase {
      * 		headers: { Authorization: `Bearer ${await config.token()}` },
      * 	});
      * ```
-     * @returns The server url to the Management API
+     * @deprecated Consume {@link UMB_SERVER_CONTEXT} and use its `getServerUrl()` — the canonical source for the server URL. Scheduled for removal in Umbraco 19.
+     * @returns {string} The server url to the Management API
      */
     getServerUrl(): string;
     /**
      * Get the default OpenAPI configuration, which is set up to communicate with the Management API.
-     * @remark This is useful if you want to communicate with your own resources generated by the [@hey-api/openapi-ts](https://github.com/hey-api/openapi-ts) library.
+     * @remarks This is useful if you want to communicate with your own resources generated by the [@hey-api/openapi-ts](https://github.com/hey-api/openapi-ts) library.
      * @memberof UmbAuthContext
      * @example <caption>Using the default OpenAPI configuration</caption>
      * ```js
@@ -169,46 +175,54 @@ export declare class UmbAuthContext extends UmbContextBase {
      * the lifetime of the host (`<umb-app>`), so it's safe to call this method for
      * multiple clients (the core's {@link umbHttpClient} *and* an extension's own
      * generated client) without registering duplicate auth-signaler contexts.
-     *
      * @example
      * ```js
      * const authContext = await this.getContext(UMB_AUTH_CONTEXT);
      * authContext.configureClient(myClient);
      * // Now myClient automatically includes auth headers and interceptors
      * ```
-     * @param client A `@hey-api/openapi-ts` client instance — either {@link umbHttpClient}
+     * @param {UmbApiClient} client A `@hey-api/openapi-ts` client instance — either {@link umbHttpClient}
      * or one regenerated by an extension package against its own OpenAPI document.
      */
     configureClient(client: UmbApiClient): void;
     /**
      * Sets the auth context as initialized, which means that the auth context is ready to be used.
-     * @remark This is used to let the app context know that the core module is ready, which means that the core auth providers are available.
+     * No code outside Umbraco core should ever call this — doing so opens the provider-discovery gate early.
+     * @internal
+     * @deprecated Internal boot hook, never intended for public use. Scheduled for removal in Umbraco 19.
+     * @remarks The constructor already does this, so calling it again is a no-op on an
+     * already-completed subject. It emits once, without a value.
      */
     setInitialized(): void;
     /**
      * Gets all registered auth providers.
-     * @param extensionsRegistry
+     * @deprecated Query the extension registry directly: `umbExtensionsRegistry.byType('authProvider')`. Scheduled for removal in Umbraco 19.
+     * @remarks The initialization gate this used to add is redundant — the app awaits app entry points
+     * before the router evaluates its guards, so the provider list has already settled by then.
+     * @param {UmbBackofficeExtensionRegistry} extensionsRegistry The extension registry to query.
+     * @returns {Observable<Array<ManifestAuthProvider>>} An observable of the registered auth providers.
      */
     getAuthProviders(extensionsRegistry: UmbBackofficeExtensionRegistry): Observable<ManifestAuthProvider[]>;
     /**
      * Gets the authorized redirect url.
-     * @returns The redirect url, which is the backoffice path.
+     * @returns {string} The redirect url, which is the backoffice path.
      */
     getRedirectUrl(): string;
     /**
      * Gets the post logout redirect url.
-     * @returns The post logout redirect url, which is the backoffice path with the logout path appended.
+     * @returns {string} The post logout redirect url, which is the backoffice path with the logout path appended.
      */
     getPostLogoutRedirectUrl(): string;
     /**
      * Links the current user to the specified provider by redirecting to the link endpoint.
-     * @param provider The provider to link to.
+     * @param {string} provider The provider to link to.
      */
     linkLogin(provider: string): Promise<void>;
     /**
      * Unlinks the current user from the specified provider.
-     * @param loginProvider
-     * @param providerKey
+     * @param {string} loginProvider The login provider to unlink from.
+     * @param {string} providerKey The provider's key for the current user.
+     * @returns {Promise<boolean>} True if the unlink succeeded.
      */
     unlinkLogin(loginProvider: string, providerKey: string): Promise<boolean>;
 }

package/dist-cms/packages/core/auth/auth.context.js

@@ -4,7 +4,7 @@ import { UmbAuthSessionTimeoutController } from './controllers/auth-session-time
 import { UmbContextBase } from '../../../libs/class-api/index.js';
 import { UmbApiInterceptorController, UMB_AUTH_SIGNALER_CONTEXT } from '../resources/index.js';
 import { UmbBooleanState, UmbObjectState } from '../../../libs/observable-api/index.js';
-import { ReplaySubject, Subject, switchMap, distinctUntilChanged, throttleTime, auditTime, } from '../../../external/rxjs/index.js';
+import { ReplaySubject, Subject, distinctUntilChanged, throttleTime, auditTime, } from '../../../external/rxjs/index.js';
 import { isTestEnvironment, UmbDeprecation } from '../utils/index.js';
 /**
  * The multiplier for the token expiry time.
@@ -55,11 +55,30 @@ export class UmbAuthContext extends UmbContextBase {
     #linkKeyEndpoint;
     #unlinkEndpoint;
     #postLogoutRedirectUri;
+    /**
+     * Observable that emits once, without a value, when the auth context is initialized.
+     * For consumers: the boot sequence already awaits app entry points before the router evaluates
+     * its guards, so by the time any extension code runs this has long since completed.
+     * @internal
+     * @deprecated Internal boot signal, never intended for public use. Scheduled for removal in Umbraco 19.
+     * @remarks It will only emit once and then complete itself.
+     * @returns {Observable<void>} An observable that emits once when the auth context is initialized.
+     */
+    get isInitialized() {
+        new UmbDeprecation({
+            deprecated: 'UmbAuthContext.isInitialized',
+            solution: 'Remove the dependency on this signal. It is an internal boot detail — the app awaits app entry points before routing, so extension code always runs after initialization. Scheduled for removal in Umbraco 19.',
+            removeInVersion: '19.0.0',
+        }).warn();
+        return this.#isInitializedObservable;
+    }
+    /** Internal, non-warning view of {@link UmbAuthContext#isInitialized} for use inside this class. */
+    #isInitializedObservable;
     /**
      * Observable that acts as a signal for when the authorization state changes.
      * @deprecated Observe isAuthorized instead. Scheduled for removal in Umbraco 19.
-     * @remark It will emit once per second, so it can be used to trigger UI updates or other actions when the authorization state changes.
-     * @returns An observable that emits when the authorization state changes.
+     * @remarks It will emit once per second, so it can be used to trigger UI updates or other actions when the authorization state changes.
+     * @returns {Observable<void>} An observable that emits when the authorization state changes.
      */
     get authorizationSignal() {
         new UmbDeprecation({
@@ -96,20 +115,17 @@ export class UmbAuthContext extends UmbContextBase {
         this.#authorizationSignal = new Subject();
         // Track clients that have been configured to prevent duplicate interceptor binding
         this.#configuredClients = new WeakSet();
-        /**
-         * Observable that emits true when the auth context is initialized.
-         * @remark It will only emit once and then complete itself.
-         */
-        this.isInitialized = this.#isInitialized.asObservable();
+        /** Internal, non-warning view of {@link UmbAuthContext#isInitialized} for use inside this class. */
+        this.#isInitializedObservable = this.#isInitialized.asObservable();
         /**
          * Observable that emits true if the user is authorized, otherwise false.
-         * @remark It will only emit when the authorization state changes.
+         * @remarks It will only emit when the authorization state changes.
          */
         this.isAuthorized = this.#isAuthorized.asObservable().pipe(distinctUntilChanged());
         /**
          * Observable that acts as a signal and emits when the user has timed out, i.e. the token has expired.
          * This can be used to show a timeout message to the user.
-         * @remark It will emit once per second, so it can be used to trigger UI updates or other actions when the user has timed out.
+         * @remarks It will emit once per second, so it can be used to trigger UI updates or other actions when the user has timed out.
          */
         this.timeoutSignal = this.#isTimeout.asObservable().pipe(
         // Audit the timeout signal to ensure that it waits for 1s before allowing another emission, which prevents rapid firing of the signal.
@@ -135,57 +151,16 @@ export class UmbAuthContext extends UmbContextBase {
         this.#client = new UmbAuthClient(endpoints, redirectUri);
         // Set up cross-tab coordination via BroadcastChannel
         this.#channel = new BroadcastChannel('umb:auth');
-        this.#channel.onmessage = (evt) => {
-            switch (evt.data?.type) {
-                case 'authorized': {
-                    // Apply locally — do NOT call #updateSession which would re-broadcast.
-                    this.#setSessionLocally(evt.data.expiresIn, evt.data.issuedAt);
-                    this.#authorizationSignal.next();
-                    break;
-                }
-                case 'sessionUpdate':
-                    // Peer broadcast already-computed timestamps, so set the session
-                    // directly. We still go through the `#inSessionUpdateCallback` guard
-                    // so observers triggered re-entrantly skip a redundant /token call.
-                    this.#sessionDead = false;
-                    this.#inSessionUpdateCallback = true;
-                    try {
-                        this.#session.setValue({
-                            accessTokenExpiresAt: evt.data.accessTokenExpiresAt,
-                            expiresAt: evt.data.expiresAt,
-                        });
-                        this.#isAuthorized.setValue(true);
-                    }
-                    finally {
-                        this.#inSessionUpdateCallback = false;
-                    }
-                    break;
-                case 'sessionCleared':
-                    this.#session.setValue(undefined);
-                    this.#isAuthorized.setValue(false);
-                    break;
-                case 'signedOut':
-                    this.#session.setValue(undefined);
-                    this.#isAuthorized.setValue(false);
-                    // Redirect to logout page — cookies already cleared by the tab that initiated sign-out
-                    location.href = this.#postLogoutRedirectUri;
-                    break;
-                case 'sessionRequest': {
-                    // Another tab is asking for the current session state (e.g. new tab opening).
-                    // Only share the session if it is still valid — an expired session would cause
-                    // the recipient (e.g. a popup) to believe it is already authorized and skip
-                    // the authorization code exchange.
-                    if (this.isSessionValid()) {
-                        this.#channel.postMessage({ type: 'sessionResponse', session: this.#session.getValue() });
-                    }
-                    break;
-                }
-            }
-        };
+        this.#channel.onmessage = (evt) => this.#handleChannelMessage(evt);
         if (!isTestEnvironment()) {
             // Start the session timeout controller
             new UmbAuthSessionTimeoutController(this);
         }
+        // The context is usable as soon as it is constructed. This used to be driven from the core
+        // entry point via setInitialized(), but the gate is redundant: app.element.ts awaits app entry
+        // points before the router evaluates its guards, so provider discovery has already settled by
+        // the time anything consumes this.
+        this.#setInitialized();
         // When an HTTP interceptor is active it registers an UmbAuthSignalerContext on the host.
         // Consume it to keep authorization state in sync and to react to timeout requests.
         this.consumeContext(UMB_AUTH_SIGNALER_CONTEXT, (signaler) => {
@@ -204,10 +179,10 @@ export class UmbAuthContext extends UmbContextBase {
     }
     /**
      * Initiates the login flow.
-     * @param identityProvider The provider to use for login. Default is 'Umbraco'.
-     * @param redirect If true, the user will be redirected to the login page.
-     * @param usernameHint The username hint to use for login.
-     * @param manifest The manifest for the registered provider.
+     * @param {string} identityProvider The provider to use for login. Default is 'Umbraco'.
+     * @param {boolean} redirect If true, the user will be redirected to the login page.
+     * @param {string} usernameHint The username hint to use for login.
+     * @param {ManifestAuthProvider} manifest The manifest for the registered provider.
      */
     async makeAuthorizationRequest(identityProvider = 'Umbraco', redirect, usernameHint, manifest) {
         const redirectUrl = await this.#client.buildAuthorizationUrl(identityProvider, usernameHint);
@@ -280,7 +255,7 @@ export class UmbAuthContext extends UmbContextBase {
     /**
      * Completes the login flow.
      * This is called on the oauth_complete page to exchange the authorization code for tokens.
-     * @returns The token response timing, or null if no authorization was pending.
+     * @returns {Promise<UmbTokenEndpointResponse | null>} The token response timing, or null if no authorization was pending.
      */
     async completeAuthorizationRequest() {
         const searchParams = new URLSearchParams(window.location.search);
@@ -338,7 +313,7 @@ export class UmbAuthContext extends UmbContextBase {
     }
     /**
      * Checks if the user is authorized. If Authorization is bypassed, the user is always authorized.
-     * @returns True if the user is authorized, otherwise false.
+     * @returns {boolean} True if the user is authorized, otherwise false.
      */
     getIsAuthorized() {
         if (this.#isBypassed) {
@@ -379,7 +354,6 @@ export class UmbAuthContext extends UmbContextBase {
      * Gets the latest token from the Management API.
      * With cookie auth, this returns '[redacted]' — the real token is in the httpOnly cookie.
      * If the session has expired, it will attempt a refresh first.
-     *
      * @example <caption>Using the latest token</caption>
      * ```js
      *   const token = await authContext.getLatestToken();
@@ -388,7 +362,7 @@ export class UmbAuthContext extends UmbContextBase {
      * @see {@link configureClient} for automatic token handling with `@hey-api/openapi-ts` clients.
      * @see {@link getOpenApiConfiguration} for manual fetch calls with cookie-based auth.
      * @memberof UmbAuthContext
-     * @returns The latest token from the Management API
+     * @returns {Promise<string>} The latest token from the Management API
      */
     async getLatestToken() {
         await this.#ensureTokenReady();
@@ -401,14 +375,14 @@ export class UmbAuthContext extends UmbContextBase {
      * call when the access token is still valid.
      * Uses Web Locks to deduplicate concurrent refresh requests across tabs.
      * @memberof UmbAuthContext
-     * @returns True if the refresh succeeded, otherwise false
+     * @returns {Promise<boolean>} True if the refresh succeeded, otherwise false
      */
     async validateToken() {
         return this.#isBypassed || this.makeRefreshTokenRequest();
     }
     /**
      * Attempts to refresh the token using Web Locks to prevent concurrent refresh requests.
-     * @returns True if the refresh was successful, otherwise false.
+     * @returns {Promise<boolean>} True if the refresh was successful, otherwise false.
      */
     async makeRefreshTokenRequest() {
         // A previous refresh was definitively rejected — retrying cannot succeed
@@ -473,9 +447,22 @@ export class UmbAuthContext extends UmbContextBase {
     }
     /**
      * Checks if the current session is still valid.
-     * @returns True if the session has not expired.
+     * @deprecated Use {@link getIsAuthorized} or observe {@link session$} instead. Scheduled for removal in Umbraco 19.
+     * @returns {boolean} True if the session has not expired.
      */
     isSessionValid() {
+        new UmbDeprecation({
+            deprecated: 'UmbAuthContext.isSessionValid()',
+            solution: 'Use getIsAuthorized() for a synchronous check, or observe session$ to react to session changes. Scheduled for removal in Umbraco 19.',
+            removeInVersion: '19.0.0',
+        }).warn();
+        return this.#isSessionValid();
+    }
+    /**
+     * Internal, non-warning implementation of {@link isSessionValid}.
+     * @returns {boolean} True if the session has not expired.
+     */
+    #isSessionValid() {
         const session = this.#session.getValue();
         return !!session && session.expiresAt > Math.floor(Date.now() / 1000);
     }
@@ -483,6 +470,7 @@ export class UmbAuthContext extends UmbContextBase {
      * Local-only check — no network call.
      * Returns true if the cached access token has not yet reached its expiry timestamp.
      * Does NOT check the refresh token or server state.
+     * @returns {boolean} True if the access token has not yet expired.
      */
     #isAccessTokenValid() {
         const session = this.#session.getValue();
@@ -566,14 +554,20 @@ export class UmbAuthContext extends UmbContextBase {
      * 		headers: { Authorization: `Bearer ${await config.token()}` },
      * 	});
      * ```
-     * @returns The server url to the Management API
+     * @deprecated Consume {@link UMB_SERVER_CONTEXT} and use its `getServerUrl()` — the canonical source for the server URL. Scheduled for removal in Umbraco 19.
+     * @returns {string} The server url to the Management API
      */
     getServerUrl() {
+        new UmbDeprecation({
+            deprecated: 'UmbAuthContext.getServerUrl()',
+            solution: 'Consume UMB_SERVER_CONTEXT from @umbraco-cms/backoffice/server and use its getServerUrl(), which is the canonical source. Scheduled for removal in Umbraco 19.',
+            removeInVersion: '19.0.0',
+        }).warn();
         return this.#serverUrl;
     }
     /**
      * Get the default OpenAPI configuration, which is set up to communicate with the Management API.
-     * @remark This is useful if you want to communicate with your own resources generated by the [@hey-api/openapi-ts](https://github.com/hey-api/openapi-ts) library.
+     * @remarks This is useful if you want to communicate with your own resources generated by the [@hey-api/openapi-ts](https://github.com/hey-api/openapi-ts) library.
      * @memberof UmbAuthContext
      * @example <caption>Using the default OpenAPI configuration</caption>
      * ```js
@@ -604,14 +598,13 @@ export class UmbAuthContext extends UmbContextBase {
      * the lifetime of the host (`<umb-app>`), so it's safe to call this method for
      * multiple clients (the core's {@link umbHttpClient} *and* an extension's own
      * generated client) without registering duplicate auth-signaler contexts.
-     *
      * @example
      * ```js
      * const authContext = await this.getContext(UMB_AUTH_CONTEXT);
      * authContext.configureClient(myClient);
      * // Now myClient automatically includes auth headers and interceptors
      * ```
-     * @param client A `@hey-api/openapi-ts` client instance — either {@link umbHttpClient}
+     * @param {UmbApiClient} client A `@hey-api/openapi-ts` client instance — either {@link umbHttpClient}
      * or one regenerated by an extension package against its own OpenAPI document.
      */
     configureClient(client) {
@@ -634,36 +627,69 @@ export class UmbAuthContext extends UmbContextBase {
     }
     /**
      * Sets the auth context as initialized, which means that the auth context is ready to be used.
-     * @remark This is used to let the app context know that the core module is ready, which means that the core auth providers are available.
+     * No code outside Umbraco core should ever call this — doing so opens the provider-discovery gate early.
+     * @internal
+     * @deprecated Internal boot hook, never intended for public use. Scheduled for removal in Umbraco 19.
+     * @remarks The constructor already does this, so calling it again is a no-op on an
+     * already-completed subject. It emits once, without a value.
      */
     setInitialized() {
+        new UmbDeprecation({
+            deprecated: 'UmbAuthContext.setInitialized()',
+            solution: 'Do not call this. It is an internal boot hook owned by the core entry point. Scheduled for removal in Umbraco 19.',
+            removeInVersion: '19.0.0',
+        }).warn();
+        this.#setInitialized();
+    }
+    /** Internal, non-warning implementation of {@link setInitialized}. */
+    #setInitialized() {
         this.#isInitialized.next();
         this.#isInitialized.complete();
     }
     /**
      * Gets all registered auth providers.
-     * @param extensionsRegistry
+     * @deprecated Query the extension registry directly: `umbExtensionsRegistry.byType('authProvider')`. Scheduled for removal in Umbraco 19.
+     * @remarks The initialization gate this used to add is redundant — the app awaits app entry points
+     * before the router evaluates its guards, so the provider list has already settled by then.
+     * @param {UmbBackofficeExtensionRegistry} extensionsRegistry The extension registry to query.
+     * @returns {Observable<Array<ManifestAuthProvider>>} An observable of the registered auth providers.
      */
     getAuthProviders(extensionsRegistry) {
-        return this.#isInitialized.pipe(switchMap(() => extensionsRegistry.byType('authProvider')));
+        new UmbDeprecation({
+            deprecated: 'UmbAuthContext.getAuthProviders()',
+            solution: "Query the extension registry directly with byType('authProvider'). The boot sequence already awaits app entry points before routing, so the provider list has settled. Scheduled for removal in Umbraco 19.",
+            removeInVersion: '19.0.0',
+        }).warn();
+        return this.#getAuthProviders(extensionsRegistry);
+    }
+    /**
+     * Internal, non-warning implementation of {@link getAuthProviders}.
+     * No initialization gate: the constructor completes #isInitialized, so piping through it only
+     * added a micro-task delay. Ordering is guaranteed by the boot sequence awaiting app entry
+     * points before the router evaluates its guards.
+     * @param {UmbBackofficeExtensionRegistry} extensionsRegistry The extension registry to query.
+     * @returns {Observable<Array<ManifestAuthProvider>>} An observable of the registered auth providers.
+     */
+    #getAuthProviders(extensionsRegistry) {
+        return extensionsRegistry.byType('authProvider');
     }
     /**
      * Gets the authorized redirect url.
-     * @returns The redirect url, which is the backoffice path.
+     * @returns {string} The redirect url, which is the backoffice path.
      */
     getRedirectUrl() {
         return `${window.location.origin}${this.#backofficePath}${this.#backofficePath.endsWith('/') ? '' : '/'}oauth_complete`;
     }
     /**
      * Gets the post logout redirect url.
-     * @returns The post logout redirect url, which is the backoffice path with the logout path appended.
+     * @returns {string} The post logout redirect url, which is the backoffice path with the logout path appended.
      */
     getPostLogoutRedirectUrl() {
         return `${window.location.origin}${this.#backofficePath}${this.#backofficePath.endsWith('/') ? '' : '/'}logout`;
     }
     /**
      * Links the current user to the specified provider by redirecting to the link endpoint.
-     * @param provider The provider to link to.
+     * @param {string} provider The provider to link to.
      */
     async linkLogin(provider) {
         const linkKey = await this.#makeLinkTokenRequest(provider);
@@ -684,8 +710,9 @@ export class UmbAuthContext extends UmbContextBase {
     }
     /**
      * Unlinks the current user from the specified provider.
-     * @param loginProvider
-     * @param providerKey
+     * @param {string} loginProvider The login provider to unlink from.
+     * @param {string} providerKey The provider's key for the current user.
+     * @returns {Promise<boolean>} True if the unlink succeeded.
      */
     async unlinkLogin(loginProvider, providerKey) {
         const request = new Request(this.#unlinkEndpoint, {
@@ -705,6 +732,57 @@ export class UmbAuthContext extends UmbContextBase {
         await this.signOut();
         return true;
     }
+    /**
+     * Handles a cross-tab message from the `umb:auth` BroadcastChannel.
+     * @param {MessageEvent} evt The message event received from the channel.
+     */
+    #handleChannelMessage(evt) {
+        switch (evt.data?.type) {
+            case 'authorized': {
+                // Apply locally — do NOT call #updateSession which would re-broadcast.
+                this.#setSessionLocally(evt.data.expiresIn, evt.data.issuedAt);
+                this.#authorizationSignal.next();
+                break;
+            }
+            case 'sessionUpdate':
+                // Peer broadcast already-computed timestamps, so set the session
+                // directly. We still go through the `#inSessionUpdateCallback` guard
+                // so observers triggered re-entrantly skip a redundant /token call.
+                this.#sessionDead = false;
+                this.#inSessionUpdateCallback = true;
+                try {
+                    this.#session.setValue({
+                        accessTokenExpiresAt: evt.data.accessTokenExpiresAt,
+                        expiresAt: evt.data.expiresAt,
+                    });
+                    this.#isAuthorized.setValue(true);
+                }
+                finally {
+                    this.#inSessionUpdateCallback = false;
+                }
+                break;
+            case 'sessionCleared':
+                this.#session.setValue(undefined);
+                this.#isAuthorized.setValue(false);
+                break;
+            case 'signedOut':
+                this.#session.setValue(undefined);
+                this.#isAuthorized.setValue(false);
+                // Redirect to logout page — cookies already cleared by the tab that initiated sign-out
+                location.href = this.#postLogoutRedirectUri;
+                break;
+            case 'sessionRequest': {
+                // Another tab is asking for the current session state (e.g. new tab opening).
+                // Only share the session if it is still valid — an expired session would cause
+                // the recipient (e.g. a popup) to believe it is already authorized and skip
+                // the authorization code exchange.
+                if (this.#isSessionValid()) {
+                    this.#channel.postMessage({ type: 'sessionResponse', session: this.#session.getValue() });
+                }
+                break;
+            }
+        }
+    }
     /**
      * Sets the in-memory session state without broadcasting.
      * Use when the caller handles broadcasting separately (e.g. completeAuthorizationRequest).
@@ -712,6 +790,8 @@ export class UmbAuthContext extends UmbContextBase {
      * Sets #inSessionUpdateCallback around the setValue calls to prevent re-entrant /token
      * requests triggered by session$ observers firing synchronously (e.g. keepUserLoggedIn=true
      * with a short expiresIn causes #onSessionExpiring to fire immediately).
+     * @param {number} expiresIn Seconds until the access token expires.
+     * @param {number} issuedAt Unix timestamp (seconds) when the token was issued.
      */
     #setSessionLocally(expiresIn, issuedAt) {
         const accessTokenExpiresAt = issuedAt + expiresIn;
@@ -730,6 +810,8 @@ export class UmbAuthContext extends UmbContextBase {
     }
     /**
      * Updates the in-memory session state and broadcasts to other tabs.
+     * @param {number} expiresIn Seconds until the access token expires.
+     * @param {number} issuedAt Unix timestamp (seconds) when the token was issued.
      */
     #updateSession(expiresIn, issuedAt) {
         this.#setSessionLocally(expiresIn, issuedAt);
@@ -745,6 +827,7 @@ export class UmbAuthContext extends UmbContextBase {
      * Returns the first response within 300ms, or undefined if no peer responds.
      * The 300ms window is empirical — long enough for a loaded peer tab to respond
      * via the event loop, short enough to not noticeably delay login.
+     * @returns {Promise<UmbAuthSession | undefined>} The peer's session, or undefined if none responded.
      */
     #requestSessionFromPeers() {
         return new Promise((resolve) => {
@@ -765,6 +848,8 @@ export class UmbAuthContext extends UmbContextBase {
     }
     /**
      * Requests the code_verifier from the parent window via postMessage (popup flow).
+     * @param {string | null} state The PKCE state to match against the opener's response.
+     * @returns {Promise<string | undefined>} The code_verifier, or undefined if the opener didn't respond.
      */
     #requestCodeVerifierFromOpener(state) {
         return new Promise((resolve) => {

package/dist-cms/packages/core/auth/controllers/auth-session-timeout.controller.js

@@ -30,12 +30,12 @@ export class UmbAuthSessionTimeoutController extends UmbControllerBase {
                 const expiresAt = host.keepUserLoggedIn ? session.accessTokenExpiresAt : session.expiresAt;
                 this.#scheduleCheck(expiresAt);
             }
-        }, '_sessionState');
+        }, null);
         // When the user times out, clean up
         this.observe(host.timeoutSignal, async () => {
             this.#clearScheduledCheck();
             await this.#closeTimeoutModal();
-        }, '_timeoutSignal');
+        }, null);
     }
     destroy() {
         super.destroy();