antaeus.keycloak.react 2.6.0 → 2.6.2

package/dist/index.js

@@ -165,6 +165,20 @@ var isTransientNetworkError = (error) => {
   }
   return message.includes("network") || message.includes("failed to fetch") || message.includes("fetch") || message.includes("timeout") || message.includes("temporarily unavailable") || message.includes("dns") || message.includes("offline");
 };
+var isInvalidRefreshTokenError = (error) => {
+  if (error instanceof oidcClientTs.ErrorResponse) {
+    const code = error.error?.toLowerCase?.();
+    if (code === "invalid_grant" || code === "invalid_token") {
+      return true;
+    }
+    const description = error.error_description?.toLowerCase?.();
+    if (description?.includes("refresh token")) {
+      return true;
+    }
+  }
+  const message = error.message?.toLowerCase?.() ?? "";
+  return message.includes("invalid_grant") || message.includes("refresh token") || message.includes("invalid token");
+};
 function useTokenLifecycle(options) {
   const {
     config,
@@ -255,6 +269,20 @@ function useTokenLifecycle(options) {
       onRefreshSuccess?.();
     } catch (error) {
       const err = error instanceof Error ? error : new Error(String(error));
+      if (isInvalidRefreshTokenError(err)) {
+        log("Refresh token rejected by the identity provider, clearing stored session");
+        setIsRefreshTokenExpired(true);
+        onRefreshTokenExpired?.();
+        const key = getStorageKey();
+        localStorage.removeItem(key);
+        try {
+          await auth.removeUser();
+        } catch (removeError) {
+          log("Error removing user after invalid refresh token:", removeError);
+        }
+        onRefreshError?.(err);
+        throw err;
+      }
       if (isTransientNetworkError(err)) {
         const reason = isNavigatorOffline() ? "offline" : "network";
         deferredRefreshReasonRef.current = reason;
@@ -285,6 +313,7 @@ function useTokenLifecycle(options) {
     onRefreshError,
     onRefreshTokenExpired,
     enqueueRetry,
+    getStorageKey,
     log
   ]);
   const checkAndRefreshTokens = react.useCallback(async () => {
@@ -438,16 +467,21 @@ function useTokenLifecycle(options) {
     if (hasCheckedOnStartup.current) {
       const hasUser = Boolean(auth.user);
       const hasRefreshToken = Boolean(auth.user?.refresh_token);
-      if (auth.isLoading || !auth.isAuthenticated && (!supportsRefreshTokens || !hasUser || !hasRefreshToken)) {
+      if (!auth.isAuthenticated && (!supportsRefreshTokens || !hasUser || !hasRefreshToken)) {
         hasCheckedOnStartup.current = false;
       }
     }
-  }, [auth.isAuthenticated, auth.isLoading, auth.user, supportsRefreshTokens]);
+  }, [auth.isAuthenticated, auth.user, supportsRefreshTokens]);
   react.useEffect(() => {
     if (auth.user && !auth.isLoading) {
       storeFirstLoginTime();
     }
   }, [auth.user, auth.isLoading, storeFirstLoginTime]);
+  react.useEffect(() => {
+    if (auth.isAuthenticated && isRefreshTokenExpired) {
+      setIsRefreshTokenExpired(false);
+    }
+  }, [auth.isAuthenticated, isRefreshTokenExpired]);
   react.useEffect(() => {
     if (!auth.isAuthenticated || auth.isLoading) {
       return;