antaeus.keycloak.react 2.6.1 → 2.6.2

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { createContext, useContext, useState, useRef, useCallback, useEffect, useMemo } from 'react';
 import { useAuth as useAuth$1, AuthContext, AuthProvider } from 'react-oidc-context';
-import { WebStorageStateStore, User } from 'oidc-client-ts';
+import { WebStorageStateStore, User, ErrorResponse } from 'oidc-client-ts';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
 import { useLocation } from 'react-router-dom';
 import { QRCodeSVG } from 'qrcode.react';
@@ -162,6 +162,20 @@ var isTransientNetworkError = (error) => {
   }
   return message.includes("network") || message.includes("failed to fetch") || message.includes("fetch") || message.includes("timeout") || message.includes("temporarily unavailable") || message.includes("dns") || message.includes("offline");
 };
+var isInvalidRefreshTokenError = (error) => {
+  if (error instanceof ErrorResponse) {
+    const code = error.error?.toLowerCase?.();
+    if (code === "invalid_grant" || code === "invalid_token") {
+      return true;
+    }
+    const description = error.error_description?.toLowerCase?.();
+    if (description?.includes("refresh token")) {
+      return true;
+    }
+  }
+  const message = error.message?.toLowerCase?.() ?? "";
+  return message.includes("invalid_grant") || message.includes("refresh token") || message.includes("invalid token");
+};
 function useTokenLifecycle(options) {
   const {
     config,
@@ -252,6 +266,20 @@ function useTokenLifecycle(options) {
       onRefreshSuccess?.();
     } catch (error) {
       const err = error instanceof Error ? error : new Error(String(error));
+      if (isInvalidRefreshTokenError(err)) {
+        log("Refresh token rejected by the identity provider, clearing stored session");
+        setIsRefreshTokenExpired(true);
+        onRefreshTokenExpired?.();
+        const key = getStorageKey();
+        localStorage.removeItem(key);
+        try {
+          await auth.removeUser();
+        } catch (removeError) {
+          log("Error removing user after invalid refresh token:", removeError);
+        }
+        onRefreshError?.(err);
+        throw err;
+      }
       if (isTransientNetworkError(err)) {
         const reason = isNavigatorOffline() ? "offline" : "network";
         deferredRefreshReasonRef.current = reason;
@@ -282,6 +310,7 @@ function useTokenLifecycle(options) {
     onRefreshError,
     onRefreshTokenExpired,
     enqueueRetry,
+    getStorageKey,
     log
   ]);
   const checkAndRefreshTokens = useCallback(async () => {
@@ -445,6 +474,11 @@ function useTokenLifecycle(options) {
       storeFirstLoginTime();
     }
   }, [auth.user, auth.isLoading, storeFirstLoginTime]);
+  useEffect(() => {
+    if (auth.isAuthenticated && isRefreshTokenExpired) {
+      setIsRefreshTokenExpired(false);
+    }
+  }, [auth.isAuthenticated, isRefreshTokenExpired]);
   useEffect(() => {
     if (!auth.isAuthenticated || auth.isLoading) {
       return;