antaeus.keycloak.react 2.6.1 → 2.6.4

package/dist/index.mjs

@@ -1,6 +1,6 @@
 import { createContext, useContext, useState, useRef, useCallback, useEffect, useMemo } from 'react';
 import { useAuth as useAuth$1, AuthContext, AuthProvider } from 'react-oidc-context';
-import { WebStorageStateStore, User } from 'oidc-client-ts';
+import { WebStorageStateStore, User, ErrorResponse } from 'oidc-client-ts';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
 import { useLocation } from 'react-router-dom';
 import { QRCodeSVG } from 'qrcode.react';
@@ -33,7 +33,8 @@ var defaultConfig = {
     // 30 days in seconds
     showLoadingIndicator: false,
     loadingMessage: "Refreshing session...",
-    useRefreshToken: true
+    useRefreshToken: true,
+    refreshOnResume: true
   },
   advanced: {
     responseType: "code",
@@ -162,6 +163,20 @@ var isTransientNetworkError = (error) => {
   }
   return message.includes("network") || message.includes("failed to fetch") || message.includes("fetch") || message.includes("timeout") || message.includes("temporarily unavailable") || message.includes("dns") || message.includes("offline");
 };
+var isInvalidRefreshTokenError = (error) => {
+  if (error instanceof ErrorResponse) {
+    const code = error.error?.toLowerCase?.();
+    if (code === "invalid_grant" || code === "invalid_token") {
+      return true;
+    }
+    const description = error.error_description?.toLowerCase?.();
+    if (description?.includes("refresh token")) {
+      return true;
+    }
+  }
+  const message = error.message?.toLowerCase?.() ?? "";
+  return message.includes("invalid_grant") || message.includes("refresh token") || message.includes("invalid token");
+};
 function useTokenLifecycle(options) {
   const {
     config,
@@ -174,6 +189,7 @@ function useTokenLifecycle(options) {
   const auth = useAuth();
   const [isRefreshing, setIsRefreshing] = useState(false);
   const [isRefreshTokenExpired, setIsRefreshTokenExpired] = useState(false);
+  const isRefreshingRef = useRef(false);
   const hasCheckedOnStartup = useRef(false);
   const supportsRefreshTokens = config.silentRenew?.useRefreshToken !== false;
   const [pendingRetry, setPendingRetry] = useState(null);
@@ -226,10 +242,11 @@ function useTokenLifecycle(options) {
     return elapsedSeconds >= maxLifetime;
   }, [config.silentRenew?.maxRefreshTokenLifetime, getStorageKey, log, storeFirstLoginTime]);
   const refreshToken = useCallback(async () => {
-    if (isRefreshing) {
+    if (isRefreshingRef.current) {
       log("Refresh already in progress, skipping");
       return;
     }
+    isRefreshingRef.current = true;
     setIsRefreshing(true);
     deferredRefreshReasonRef.current = null;
     try {
@@ -252,6 +269,20 @@ function useTokenLifecycle(options) {
       onRefreshSuccess?.();
     } catch (error) {
       const err = error instanceof Error ? error : new Error(String(error));
+      if (isInvalidRefreshTokenError(err)) {
+        log("Refresh token rejected by the identity provider, clearing stored session");
+        setIsRefreshTokenExpired(true);
+        onRefreshTokenExpired?.();
+        const key = getStorageKey();
+        localStorage.removeItem(key);
+        try {
+          await auth.removeUser();
+        } catch (removeError) {
+          log("Error removing user after invalid refresh token:", removeError);
+        }
+        onRefreshError?.(err);
+        throw err;
+      }
       if (isTransientNetworkError(err)) {
         const reason = isNavigatorOffline() ? "offline" : "network";
         deferredRefreshReasonRef.current = reason;
@@ -271,10 +302,10 @@ function useTokenLifecycle(options) {
       onRefreshError?.(err);
       throw err;
     } finally {
+      isRefreshingRef.current = false;
       setIsRefreshing(false);
     }
   }, [
-    isRefreshing,
     auth,
     checkRefreshTokenLifetime,
     onRefreshStart,
@@ -282,6 +313,39 @@ function useTokenLifecycle(options) {
     onRefreshError,
     onRefreshTokenExpired,
     enqueueRetry,
+    getStorageKey,
+    log
+  ]);
+  const shouldRefreshOnResume = useCallback((reason) => {
+    const silentRenewEnabled = config.silentRenew?.enabled !== false;
+    const refreshOnResume = config.silentRenew?.refreshOnResume !== false;
+    const strategy = config.silentRenew?.refreshStrategy || "both";
+    const strategyAllowsResume = strategy === "startup" || strategy === "both";
+    const hasRefreshToken = Boolean(auth.user?.refresh_token);
+    if (!silentRenewEnabled || !refreshOnResume || !strategyAllowsResume) {
+      return false;
+    }
+    if (auth.isLoading) {
+      return false;
+    }
+    if (!auth.user) {
+      return false;
+    }
+    if (supportsRefreshTokens && !hasRefreshToken) {
+      log("Skipping resume token check because no refresh token is available:", reason);
+      return false;
+    }
+    if (reason !== "online" && typeof document !== "undefined" && document.visibilityState === "hidden") {
+      return false;
+    }
+    return true;
+  }, [
+    auth.isLoading,
+    auth.user,
+    config.silentRenew?.enabled,
+    config.silentRenew?.refreshOnResume,
+    config.silentRenew?.refreshStrategy,
+    supportsRefreshTokens,
     log
   ]);
   const checkAndRefreshTokens = useCallback(async () => {
@@ -431,6 +495,38 @@ function useTokenLifecycle(options) {
     checkAndRefreshTokens,
     log
   ]);
+  useEffect(() => {
+    if (typeof window === "undefined" || typeof document === "undefined") {
+      return;
+    }
+    const runResumeCheck = (reason) => {
+      if (!shouldRefreshOnResume(reason)) {
+        return;
+      }
+      log("Running resume token check after:", reason);
+      checkAndRefreshTokens().catch((error) => {
+        log("Resume token check failed:", error);
+      });
+    };
+    const handleVisibilityChange = () => {
+      if (document.visibilityState === "visible") {
+        runResumeCheck("visibilitychange");
+      }
+    };
+    const handlePageShow = () => runResumeCheck("pageshow");
+    const handleFocus = () => runResumeCheck("focus");
+    const handleOnline = () => runResumeCheck("online");
+    document.addEventListener("visibilitychange", handleVisibilityChange);
+    window.addEventListener("pageshow", handlePageShow);
+    window.addEventListener("focus", handleFocus);
+    window.addEventListener("online", handleOnline);
+    return () => {
+      document.removeEventListener("visibilitychange", handleVisibilityChange);
+      window.removeEventListener("pageshow", handlePageShow);
+      window.removeEventListener("focus", handleFocus);
+      window.removeEventListener("online", handleOnline);
+    };
+  }, [checkAndRefreshTokens, log, shouldRefreshOnResume]);
   useEffect(() => {
     if (hasCheckedOnStartup.current) {
       const hasUser = Boolean(auth.user);
@@ -445,6 +541,11 @@ function useTokenLifecycle(options) {
       storeFirstLoginTime();
     }
   }, [auth.user, auth.isLoading, storeFirstLoginTime]);
+  useEffect(() => {
+    if (auth.isAuthenticated && isRefreshTokenExpired) {
+      setIsRefreshTokenExpired(false);
+    }
+  }, [auth.isAuthenticated, isRefreshTokenExpired]);
   useEffect(() => {
     if (!auth.isAuthenticated || auth.isLoading) {
       return;
@@ -848,7 +949,8 @@ var CONFIG_PRESETS = {
       maxRefreshTokenLifetime: 2592e3,
       // 30 days
       showLoadingIndicator: false,
-      loadingMessage: "Refreshing session..."
+      loadingMessage: "Refreshing session...",
+      refreshOnResume: true
     },
     advanced: {
       responseType: "code",
@@ -884,7 +986,8 @@ var CONFIG_PRESETS = {
       // 30 days
       showLoadingIndicator: true,
       // Show loading for better UX
-      loadingMessage: "Restoring your session..."
+      loadingMessage: "Restoring your session...",
+      refreshOnResume: true
     },
     advanced: {
       responseType: "code",
@@ -921,7 +1024,8 @@ var CONFIG_PRESETS = {
       // 24 hours only
       showLoadingIndicator: false,
       // Silent for security
-      loadingMessage: "Validating session..."
+      loadingMessage: "Validating session...",
+      refreshOnResume: true
     },
     advanced: {
       responseType: "code",
@@ -955,7 +1059,8 @@ var CONFIG_PRESETS = {
       maxRefreshTokenLifetime: 604800,
       // 7 days
       showLoadingIndicator: false,
-      loadingMessage: "Refreshing session..."
+      loadingMessage: "Refreshing session...",
+      refreshOnResume: true
     },
     advanced: {
       responseType: "code",
@@ -992,7 +1097,8 @@ var CONFIG_PRESETS = {
       // No limit (for convenience)
       showLoadingIndicator: true,
       // Show for debugging
-      loadingMessage: "[DEV] Refreshing tokens..."
+      loadingMessage: "[DEV] Refreshing tokens...",
+      refreshOnResume: true
     },
     advanced: {
       responseType: "code",