oidc-spa 3.0.3 → 4.1.0

package/react.js

@@ -27,17 +27,18 @@ var __read = (this && this.__read) || function (o, n) {
     return ar;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createUseOidc = exports.createOidcProvider = void 0;
+exports.createReactOidc = void 0;
 var jsx_runtime_1 = require("react/jsx-runtime");
 var react_1 = require("react");
 var oidc_1 = require("./oidc");
 var assert_1 = require("tsafe/assert");
-var decodeJwt_1 = require("./tools/decodeJwt");
 var id_1 = require("tsafe/id");
+var useGuaranteedMemo_1 = require("./tools/powerhooks/useGuaranteedMemo");
 var oidcContext = (0, react_1.createContext)(undefined);
 /** @see: https://github.com/garronej/oidc-spa#option-2-usage-directly-within-react */
-function createOidcProvider(params) {
+function createReactOidc(params) {
     var prOidc = (0, oidc_1.createOidc)(params);
+    var decodedIdTokenSchema = params.decodedIdTokenSchema;
     function OidcProvider(props) {
         var children = props.children, fallback = props.fallback;
         var _a = __read((0, react_1.useState)(undefined), 2), oidc = _a[0], setOidc = _a[1];
@@ -47,18 +48,16 @@ function createOidcProvider(params) {
         if (oidc === undefined) {
             return (0, jsx_runtime_1.jsx)(jsx_runtime_1.Fragment, { children: fallback === undefined ? null : fallback });
         }
-        return (0, jsx_runtime_1.jsx)(oidcContext.Provider, { value: oidc, children: children });
+        return ((0, jsx_runtime_1.jsx)(oidcContext.Provider, { value: { oidc: oidc, decodedIdTokenSchema: decodedIdTokenSchema }, children: children }));
     }
-    return { OidcProvider: OidcProvider, prOidc: prOidc };
-}
-exports.createOidcProvider = createOidcProvider;
-function createUseOidc(params) {
-    var decodedIdTokenSchema = (params !== null && params !== void 0 ? params : {}).decodedIdTokenSchema;
     function useOidc(params) {
         var _a = (params !== null && params !== void 0 ? params : {}).assertUserLoggedIn, assertUserLoggedIn = _a === void 0 ? false : _a;
-        var oidc = (0, react_1.useContext)(oidcContext);
-        (0, assert_1.assert)(oidc !== undefined, "You must use useOidc inside a OidcProvider");
-        var _b = __read((0, react_1.useReducer)(function () { return []; }, []), 2), forceUpdate = _b[1];
+        var _b = (function useClosure() {
+            var context = (0, react_1.useContext)(oidcContext);
+            (0, assert_1.assert)(context !== undefined, "You must use useOidc inside a OidcProvider");
+            return context;
+        })(), oidc = _b.oidc, decodedIdTokenSchema_context = _b.decodedIdTokenSchema;
+        var _c = __read((0, react_1.useReducer)(function () { return []; }, []), 2), forceUpdate = _c[1];
         (0, react_1.useEffect)(function () {
             if (!oidc.isUserLoggedIn) {
                 return;
@@ -69,25 +68,53 @@ function createUseOidc(params) {
         if (assertUserLoggedIn && !oidc.isUserLoggedIn) {
             throw new Error("The user must be logged in to use this hook (assertUserLoggedIn was set to true)");
         }
-        var tokens = oidc.isUserLoggedIn ? oidc.getTokens() : undefined;
-        var decodedIdToken = (0, react_1.useMemo)(function () {
-            if ((tokens === null || tokens === void 0 ? void 0 : tokens.idToken) === undefined) {
-                return undefined;
-            }
-            var decodedIdToken = (0, decodeJwt_1.decodeJwt)(tokens.idToken);
-            if (decodedIdTokenSchema !== undefined) {
-                decodedIdTokenSchema.parse((0, decodeJwt_1.decodeJwt)(tokens.idToken));
-            }
-            return decodedIdToken;
-        }, [tokens === null || tokens === void 0 ? void 0 : tokens.idToken]);
+        var oidcTokens = (function useClosure() {
+            var tokens = oidc.isUserLoggedIn ? oidc.getTokens() : undefined;
+            var oidcTokens = (0, useGuaranteedMemo_1.useGuaranteedMemo)(function () {
+                if (tokens === undefined) {
+                    return undefined;
+                }
+                var oidcTokens = {
+                    "accessToken": tokens.accessToken,
+                    "accessTokenExpirationTime": tokens.accessTokenExpirationTime,
+                    "idToken": tokens.idToken,
+                    "refreshToken": tokens.refreshToken,
+                    "refreshTokenExpirationTime": tokens.refreshTokenExpirationTime,
+                    "decodedIdToken": null
+                };
+                var cache = undefined;
+                Object.defineProperty(oidcTokens, "decodedIdToken", {
+                    "get": function () {
+                        if (cache !== undefined) {
+                            return cache.decodedIdToken;
+                        }
+                        var decodedIdToken = tokens.decodedIdToken;
+                        if (decodedIdTokenSchema !== undefined &&
+                            decodedIdTokenSchema !== decodedIdTokenSchema_context) {
+                            decodedIdToken = decodedIdTokenSchema.parse(decodedIdToken);
+                        }
+                        cache = { decodedIdToken: decodedIdToken };
+                        return decodedIdToken;
+                    }
+                });
+                return oidcTokens;
+            }, [
+                tokens === null || tokens === void 0 ? void 0 : tokens.accessToken,
+                tokens === null || tokens === void 0 ? void 0 : tokens.accessTokenExpirationTime,
+                tokens === null || tokens === void 0 ? void 0 : tokens.idToken,
+                tokens === null || tokens === void 0 ? void 0 : tokens.refreshToken,
+                tokens === null || tokens === void 0 ? void 0 : tokens.refreshTokenExpirationTime
+            ]);
+            return { oidcTokens: oidcTokens };
+        })().oidcTokens;
         var common = {
             "params": oidc.params
         };
         return oidc.isUserLoggedIn
-            ? (0, id_1.id)(__assign(__assign({}, common), { "isUserLoggedIn": true, "oidcTokens": __assign(__assign({}, tokens), { "decodedIdToken": decodedIdToken }), "logout": oidc.logout, "renewTokens": oidc.renewTokens, "login": undefined }))
-            : (0, id_1.id)(__assign(__assign({}, common), { "isUserLoggedIn": false, "login": oidc.login, "oidcTokens": undefined, "logout": undefined }));
+            ? (0, id_1.id)(((0, assert_1.assert)(oidcTokens !== undefined), __assign(__assign({}, common), { "isUserLoggedIn": true, oidcTokens: oidcTokens, "logout": oidc.logout, "renewTokens": oidc.renewTokens })))
+            : (0, id_1.id)(__assign(__assign({}, common), { "isUserLoggedIn": false, "login": oidc.login }));
     }
-    return { useOidc: useOidc };
+    return { OidcProvider: OidcProvider, useOidc: useOidc, prOidc: prOidc };
 }
-exports.createUseOidc = createUseOidc;
+exports.createReactOidc = createReactOidc;
 //# sourceMappingURL=react.js.map

package/react.js.map

@@ -1 +1 @@
-{"version":3,"file":"react.js","sourceRoot":"","sources":["src/react.tsx"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+BAQe;AACf,+BAA+C;AAC/C,uCAAsC;AACtC,+CAA8C;AAC9C,+BAA8B;AAE9B,IAAM,WAAW,GAAG,IAAA,qBAAa,EAAmB,SAAS,CAAC,CAAC;AAE/D,sFAAsF;AACtF,SAAgB,kBAAkB,CAAC,MAAwC;IACvE,IAAM,MAAM,GAAG,IAAA,iBAAU,EAAC,MAAM,CAAC,CAAC;IAElC,SAAS,YAAY,CAAC,KAAoD;QAC9D,IAAA,QAAQ,GAAe,KAAK,SAApB,EAAE,QAAQ,GAAK,KAAK,SAAV,CAAW;QAE/B,IAAA,KAAA,OAAkB,IAAA,gBAAQ,EAAmB,SAAS,CAAC,IAAA,EAAtD,IAAI,QAAA,EAAE,OAAO,QAAyC,CAAC;QAE9D,IAAA,iBAAS,EAAC;YACN,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC,EAAE,EAAE,CAAC,CAAC;QAEP,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,OAAO,2DAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,GAAI,CAAC;QAC3D,CAAC;QAED,OAAO,uBAAC,WAAW,CAAC,QAAQ,IAAC,KAAK,EAAE,IAAI,YAAG,QAAQ,GAAwB,CAAC;IAChF,CAAC;IAED,OAAO,EAAE,YAAY,cAAA,EAAE,MAAM,QAAA,EAAE,CAAC;AACpC,CAAC;AApBD,gDAoBC;AA2BD,SAAgB,aAAa,CAE3B,MAAoF;IAC1E,IAAA,oBAAoB,GAAK,CAAA,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAA,qBAAjB,CAAkB;IAI9C,SAAS,OAAO,CAAC,MAAwC;QAC7C,IAAA,KAA+B,CAAA,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAA,mBAAjB,EAA1B,kBAAkB,mBAAG,KAAK,KAAA,CAAkB;QAEpD,IAAM,IAAI,GAAG,IAAA,kBAAU,EAAC,WAAW,CAAC,CAAC;QAErC,IAAA,eAAM,EAAC,IAAI,KAAK,SAAS,EAAE,4CAA4C,CAAC,CAAC;QAEnE,IAAA,KAAA,OAAkB,IAAA,kBAAU,EAAC,cAAM,OAAA,EAAE,EAAF,CAAE,EAAE,EAAE,CAAC,IAAA,EAAvC,WAAW,QAA4B,CAAC;QAEjD,IAAA,iBAAS,EAAC;YACN,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBACvB,OAAO;YACX,CAAC;YAEO,IAAA,WAAW,GAAK,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,YAA9C,CAA+C;YAElE,OAAO,WAAW,CAAC;QACvB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAEX,IAAI,kBAAkB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACX,kFAAkF,CACrF,CAAC;QACN,CAAC;QAED,IAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAElE,IAAM,cAAc,GAAG,IAAA,eAAO,EAAC;YAC3B,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,MAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,SAAS,CAAC;YACrB,CAAC;YAED,IAAM,cAAc,GAAG,IAAA,qBAAS,EAAC,MAAM,CAAC,OAAO,CAAuB,CAAC;YAEvE,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;gBACrC,oBAAoB,CAAC,KAAK,CAAC,IAAA,qBAAS,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1D,CAAC;YAED,OAAO,cAAc,CAAC;QAC1B,CAAC,EAAE,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,CAAC,CAAC,CAAC;QAEtB,IAAM,MAAM,GAAwB;YAChC,QAAQ,EAAE,IAAI,CAAC,MAAM;SACxB,CAAC;QAEF,OAAO,IAAI,CAAC,cAAc;YACtB,CAAC,CAAC,IAAA,OAAE,wBACK,MAAM,KACT,gBAAgB,EAAE,IAAI,EACtB,YAAY,wBACL,MAAO,KACV,gBAAgB,EAAE,cAAe,KAErC,QAAQ,EAAE,IAAI,CAAC,MAAM,EACrB,aAAa,EAAE,IAAI,CAAC,WAAW,EAC/B,OAAO,EAAE,SAAS,IACpB;YACJ,CAAC,CAAC,IAAA,OAAE,wBACK,MAAM,KACT,gBAAgB,EAAE,KAAK,EACvB,OAAO,EAAE,IAAI,CAAC,KAAK,EACnB,YAAY,EAAE,SAAS,EACvB,QAAQ,EAAE,SAAS,IACrB,CAAC;IACb,CAAC;IAED,OAAO,EAAE,OAAO,SAAA,EAAE,CAAC;AACvB,CAAC;AA1ED,sCA0EC"}
+{"version":3,"file":"react.js","sourceRoot":"","sources":["src/react.tsx"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+BAAmG;AACnG,+BAAwE;AACxE,uCAAsC;AACtC,+BAA8B;AAC9B,0EAAyE;AAyBzE,IAAM,WAAW,GAAG,IAAA,qBAAa,EAM/B,SAAS,CAAC,CAAC;AAEb,sFAAsF;AACtF,SAAgB,eAAe,CAE7B,MAA0C;IACxC,IAAM,MAAM,GAAG,IAAA,iBAAU,EAAC,MAAM,CAAC,CAAC;IAE1B,IAAA,oBAAoB,GAAK,MAAM,qBAAX,CAAY;IAExC,SAAS,YAAY,CAAC,KAAoD;QAC9D,IAAA,QAAQ,GAAe,KAAK,SAApB,EAAE,QAAQ,GAAK,KAAK,SAAV,CAAW;QAE/B,IAAA,KAAA,OAAkB,IAAA,gBAAQ,EAAmB,SAAS,CAAC,IAAA,EAAtD,IAAI,QAAA,EAAE,OAAO,QAAyC,CAAC;QAE9D,IAAA,iBAAS,EAAC;YACN,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC,EAAE,EAAE,CAAC,CAAC;QAEP,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,OAAO,2DAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,GAAI,CAAC;QAC3D,CAAC;QAED,OAAO,CACH,uBAAC,WAAW,CAAC,QAAQ,IAAC,KAAK,EAAE,EAAE,IAAI,MAAA,EAAE,oBAAoB,sBAAA,EAAE,YACtD,QAAQ,GACU,CAC1B,CAAC;IACN,CAAC;IAID,SAAS,OAAO,CAAC,MAAwC;QAC7C,IAAA,KAA+B,CAAA,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAA,mBAAjB,EAA1B,kBAAkB,mBAAG,KAAK,KAAA,CAAkB;QAE9C,IAAA,KAA+D,CAAC,SAAS,UAAU;YACrF,IAAM,OAAO,GAAG,IAAA,kBAAU,EAAC,WAAW,CAAC,CAAC;YAExC,IAAA,eAAM,EAAC,OAAO,KAAK,SAAS,EAAE,4CAA4C,CAAC,CAAC;YAE5E,OAAO,OAAO,CAAC;QACnB,CAAC,CAAC,EAAE,EANI,IAAI,UAAA,EAAwB,4BAA4B,0BAM5D,CAAC;QAEC,IAAA,KAAA,OAAkB,IAAA,kBAAU,EAAC,cAAM,OAAA,EAAE,EAAF,CAAE,EAAE,EAAE,CAAC,IAAA,EAAvC,WAAW,QAA4B,CAAC;QAEjD,IAAA,iBAAS,EAAC;YACN,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBACvB,OAAO;YACX,CAAC;YAEO,IAAA,WAAW,GAAK,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,YAA9C,CAA+C;YAElE,OAAO,WAAW,CAAC;QACvB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAEX,IAAI,kBAAkB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACX,kFAAkF,CACrF,CAAC;QACN,CAAC;QAEO,IAAA,UAAU,GAAK,CAAC,SAAS,UAAU;YACvC,IAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAElE,IAAM,UAAU,GAAG,IAAA,qCAAiB,EAAC;gBACjC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACvB,OAAO,SAAS,CAAC;gBACrB,CAAC;gBAED,IAAM,UAAU,GAAgC;oBAC5C,aAAa,EAAE,MAAM,CAAC,WAAW;oBACjC,2BAA2B,EAAE,MAAM,CAAC,yBAAyB;oBAC7D,SAAS,EAAE,MAAM,CAAC,OAAO;oBACzB,cAAc,EAAE,MAAM,CAAC,YAAY;oBACnC,4BAA4B,EAAE,MAAM,CAAC,0BAA0B;oBAC/D,gBAAgB,EAAE,IAAW;iBAChC,CAAC;gBAEF,IAAI,KAAK,GAA4D,SAAS,CAAC;gBAE/E,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,gBAAgB,EAAE;oBAChD,KAAK,EAAE;wBACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;4BACtB,OAAO,KAAK,CAAC,cAAc,CAAC;wBAChC,CAAC;wBAEK,IAAA,cAAc,GAAK,MAAM,eAAX,CAAY;wBAEhC,IACI,oBAAoB,KAAK,SAAS;4BAClC,oBAAoB,KAAK,4BAA4B,EACvD,CAAC;4BACC,cAAc,GAAG,oBAAoB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;wBAChE,CAAC;wBAED,KAAK,GAAG,EAAE,cAAc,gBAAA,EAAE,CAAC;wBAE3B,OAAO,cAAc,CAAC;oBAC1B,CAAC;iBACJ,CAAC,CAAC;gBAEH,OAAO,UAAU,CAAC;YACtB,CAAC,EAAE;gBACC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,WAAW;gBACnB,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,yBAAyB;gBACjC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO;gBACf,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY;gBACpB,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,0BAA0B;aACrC,CAAC,CAAC;YAEH,OAAO,EAAE,UAAU,YAAA,EAAE,CAAC;QAC1B,CAAC,CAAC,EAAE,WAlDc,CAkDb;QAEL,IAAM,MAAM,GAAqB;YAC7B,QAAQ,EAAE,IAAI,CAAC,MAAM;SACxB,CAAC;QAEF,OAAO,IAAI,CAAC,cAAc;YACtB,CAAC,CAAC,IAAA,OAAE,EACE,CAAC,IAAA,eAAM,EAAC,UAAU,KAAK,SAAS,CAAC,wBAE1B,MAAM,KACT,gBAAgB,EAAE,IAAI,EACtB,UAAU,YAAA,EACV,QAAQ,EAAE,IAAI,CAAC,MAAM,EACrB,aAAa,EAAE,IAAI,CAAC,WAAW,GAClC,CAAC,CACL;YACH,CAAC,CAAC,IAAA,OAAE,wBACK,MAAM,KACT,gBAAgB,EAAE,KAAK,EACvB,OAAO,EAAE,IAAI,CAAC,KAAK,IACrB,CAAC;IACb,CAAC;IAED,OAAO,EAAE,YAAY,cAAA,EAAE,OAAO,SAAA,EAAE,MAAM,QAAA,EAAE,CAAC;AAC7C,CAAC;AArID,0CAqIC"}

package/src/oidc.ts

@@ -1,12 +1,15 @@
-import { UserManager, type User } from "oidc-client-ts";
+import { UserManager as OidcClientTsUserManager, type User as OidcClientTsUser } from "oidc-client-ts";
 import { id } from "tsafe/id";
 import { readExpirationTimeInJwt } from "./tools/readExpirationTimeInJwt";
 import { assert, type Equals } from "tsafe/assert";
 import { addQueryParamToUrl, retrieveQueryParamFromUrl } from "./tools/urlQueryParams";
 import { fnv1aHashToHex } from "./tools/fnv1aHashToHex";
 import { Deferred } from "./tools/Deferred";
+import { decodeJwt } from "./tools/decodeJwt";
 
-export declare type Oidc = Oidc.LoggedIn | Oidc.NotLoggedIn;
+export declare type Oidc<DecodedIdToken extends Record<string, unknown> = Record<string, unknown>> =
+    | Oidc.LoggedIn<DecodedIdToken>
+    | Oidc.NotLoggedIn;
 
 export declare namespace Oidc {
     export type Common = {
@@ -24,33 +27,47 @@ export declare namespace Oidc {
         }) => Promise<never>;
     };
 
-    export type LoggedIn = Common & {
-        isUserLoggedIn: true;
-        renewTokens(): Promise<void>;
-        getTokens: () => Tokens;
-        subscribeToTokensChange: (onTokenChange: () => void) => { unsubscribe: () => void };
-        logout: (
-            params: { redirectTo: "home" | "current page" } | { redirectTo: "specific url"; url: string }
-        ) => Promise<never>;
-    };
+    export type LoggedIn<DecodedIdToken extends Record<string, unknown> = Record<string, unknown>> =
+        Common & {
+            isUserLoggedIn: true;
+            renewTokens(): Promise<void>;
+            getTokens: () => Tokens<DecodedIdToken>;
+            subscribeToTokensChange: (onTokenChange: () => void) => { unsubscribe: () => void };
+            logout: (
+                params:
+                    | { redirectTo: "home" | "current page" }
+                    | { redirectTo: "specific url"; url: string }
+            ) => Promise<never>;
+        };
 
-    export type Tokens = {
-        accessToken: string;
-        accessTokenExpirationTime: number;
-        idToken: string;
-        refreshToken: string;
-        refreshTokenExpirationTime: number;
-    };
+    export type Tokens<DecodedIdToken extends Record<string, unknown> = Record<string, unknown>> =
+        Readonly<{
+            accessToken: string;
+            accessTokenExpirationTime: number;
+            idToken: string;
+            refreshToken: string;
+            refreshTokenExpirationTime: number;
+            decodedIdToken: DecodedIdToken;
+        }>;
 }
 
 const paramsToRetrieveFromSuccessfulLogin = ["code", "state", "session_state", "iss"] as const;
 
-/** @see: https://github.com/garronej/oidc-spa#option-1-usage-without-involving-the-ui-framework */
-export async function createOidc(params: {
+export type ParamsOfCreateOidc<
+    DecodedIdToken extends Record<string, unknown> = Record<string, unknown>
+> = {
     issuerUri: string;
     clientId: string;
+    clientSecret?: string;
     transformUrlBeforeRedirect?: (url: string) => string;
-    getExtraQueryParams?: () => Record<string, string>;
+    /**
+     * Extra query params to be added on the login url.
+     * You can provide a function that returns those extra query params, it will be called
+     * when login() is called.
+     *
+     * Example: extraQueryParams: ()=> ({ ui_locales: "fr" })
+     */
+    extraQueryParams?: Record<string, string> | (() => Record<string, string>);
     /**
      * This parameter have to be provided if your App is not hosted at the origin of the subdomain.
      * For example if your site is hosted by navigating to `https://www.example.com`
@@ -64,15 +81,35 @@ export async function createOidc(params: {
      * you are supposed to have created in your `public/` directory.
      */
     publicUrl?: string;
-}): Promise<Oidc> {
+    decodedIdTokenSchema?: { parse: (data: unknown) => DecodedIdToken };
+};
+
+/** @see: https://github.com/garronej/oidc-spa#option-1-usage-without-involving-the-ui-framework */
+export async function createOidc<
+    DecodedIdToken extends Record<string, unknown> = Record<string, unknown>
+>(params: ParamsOfCreateOidc<DecodedIdToken>): Promise<Oidc<DecodedIdToken>> {
     const {
         issuerUri,
         clientId,
+        clientSecret,
         transformUrlBeforeRedirect = url => url,
-        getExtraQueryParams,
-        publicUrl: publicUrl_params
+        extraQueryParams: extraQueryParamsOrGetter,
+        publicUrl: publicUrl_params,
+        decodedIdTokenSchema
     } = params;
 
+    const getExtraQueryParams = (() => {
+        if (typeof extraQueryParamsOrGetter === "function") {
+            return extraQueryParamsOrGetter;
+        }
+
+        if (extraQueryParamsOrGetter !== undefined) {
+            return () => extraQueryParamsOrGetter;
+        }
+
+        return undefined;
+    })();
+
     const publicUrl = (() => {
         if (publicUrl_params === undefined) {
             return window.location.origin;
@@ -88,9 +125,10 @@ export async function createOidc(params: {
     const configHash = fnv1aHashToHex(`${issuerUri} ${clientId}`);
     const configHashKey = "configHash";
 
-    const userManager = new UserManager({
+    const oidcClientTsUserManager = new OidcClientTsUserManager({
         "authority": issuerUri,
         "client_id": clientId,
+        "client_secret": clientSecret,
         "redirect_uri": "" /* provided when calling login */,
         "response_type": "code",
         "scope": "openid profile",
@@ -181,14 +219,14 @@ export async function createOidc(params: {
             document.addEventListener("visibilitychange", callback);
         }
 
-        await userManager.signinRedirect({
+        await oidcClientTsUserManager.signinRedirect({
             redirect_uri,
             "redirectMethod": doesCurrentHrefRequiresAuth ? "replace" : "assign"
         });
         return new Promise<never>(() => {});
     };
 
-    const currentTokens = await (async function getUser() {
+    const initialTokens = await (async function getUser() {
         read_successful_login_query_params: {
             let url = window.location.href;
 
@@ -233,33 +271,33 @@ export async function createOidc(params: {
 
             window.history.pushState(null, "", url);
 
-            let user: User | undefined = undefined;
+            let oidcClientTsUser: OidcClientTsUser | undefined = undefined;
 
             try {
-                user = await userManager.signinRedirectCallback(loginSuccessUrl);
+                oidcClientTsUser = await oidcClientTsUserManager.signinRedirectCallback(loginSuccessUrl);
             } catch {
                 //NOTE: The user has likely pressed the back button just after logging in.
                 return undefined;
             }
 
-            return user;
+            return oidcClientTsUser;
         }
 
         restore_from_session: {
-            const user = await userManager.getUser();
+            const oidcClientTsUser = await oidcClientTsUserManager.getUser();
 
-            if (user === null) {
+            if (oidcClientTsUser === null) {
                 break restore_from_session;
             }
 
             // The server might have restarted and the session might have been lost.
             try {
-                await userManager.signinSilent();
+                await oidcClientTsUserManager.signinSilent();
             } catch {
                 return undefined;
             }
 
-            return user;
+            return oidcClientTsUser;
         }
 
         restore_from_http_only_cookie: {
@@ -334,7 +372,7 @@ export async function createOidc(params: {
 
             window.addEventListener("message", listener, false);
 
-            userManager
+            oidcClientTsUserManager
                 .signinSilent({ "silentRequestTimeoutInSeconds": timeoutDelayMs / 1000 })
                 .catch(() => {
                     /* error expected */
@@ -346,19 +384,24 @@ export async function createOidc(params: {
                 break restore_from_http_only_cookie;
             }
 
-            const user = await userManager.signinRedirectCallback(loginSuccessUrl);
+            const oidcClientTsUser = await oidcClientTsUserManager.signinRedirectCallback(
+                loginSuccessUrl
+            );
 
-            return user;
+            return oidcClientTsUser;
         }
 
         return undefined;
     })().then(
-        user => {
-            if (user === undefined) {
+        oidcClientTsUser => {
+            if (oidcClientTsUser === undefined) {
                 return undefined;
             }
 
-            const tokens = userToTokens(user);
+            const tokens = oidcClientTsUserToTokens({
+                oidcClientTsUser,
+                decodedIdTokenSchema
+            });
 
             if (tokens.refreshTokenExpirationTime < tokens.accessTokenExpirationTime) {
                 console.warn(
@@ -385,8 +428,8 @@ export async function createOidc(params: {
         }
     };
 
-    if (currentTokens instanceof Error) {
-        const error = currentTokens;
+    if (initialTokens instanceof Error) {
+        const error = initialTokens;
 
         console.error(`The OIDC server is down or misconfigured: ${error.message}`);
 
@@ -400,7 +443,7 @@ export async function createOidc(params: {
         });
     }
 
-    if (currentTokens === undefined) {
+    if (initialTokens === undefined) {
         return id<Oidc.NotLoggedIn>({
             ...common,
             "isUserLoggedIn": false,
@@ -408,20 +451,16 @@ export async function createOidc(params: {
         });
     }
 
+    let currentTokens = initialTokens;
+
     const onTokenChanges = new Set<() => void>();
 
-    const oidc = id<Oidc.LoggedIn>({
+    const oidc = id<Oidc.LoggedIn<DecodedIdToken>>({
         ...common,
         "isUserLoggedIn": true,
-        "getTokens": () => ({
-            "accessToken": currentTokens.accessToken,
-            "idToken": currentTokens.idToken,
-            "refreshToken": currentTokens.refreshToken,
-            "refreshTokenExpirationTime": currentTokens.refreshTokenExpirationTime,
-            "accessTokenExpirationTime": currentTokens.accessTokenExpirationTime
-        }),
+        "getTokens": () => currentTokens,
         "logout": async params => {
-            await userManager.signoutRedirect({
+            await oidcClientTsUserManager.signoutRedirect({
                 "post_logout_redirect_uri": (() => {
                     switch (params.redirectTo) {
                         case "current page":
@@ -437,11 +476,24 @@ export async function createOidc(params: {
             return new Promise<never>(() => {});
         },
         "renewTokens": async () => {
-            const user = await userManager.signinSilent();
+            const oidcClientTsUser = await oidcClientTsUserManager.signinSilent();
+
+            assert(oidcClientTsUser !== null);
 
-            assert(user !== null);
+            const decodedIdTokenPropertyDescriptor = Object.getOwnPropertyDescriptor(
+                currentTokens,
+                "decodedIdToken"
+            );
 
-            Object.assign(currentTokens, userToTokens(user));
+            assert(decodedIdTokenPropertyDescriptor !== undefined);
+
+            currentTokens = oidcClientTsUserToTokens({
+                oidcClientTsUser,
+                decodedIdTokenSchema
+            });
+
+            // NOTE: We do that to preserve the cache and the object reference.
+            Object.defineProperty(currentTokens, "decodedIdToken", decodedIdTokenPropertyDescriptor);
 
             onTokenChanges.forEach(onTokenChange => onTokenChange());
         },
@@ -475,12 +527,17 @@ export async function createOidc(params: {
     return oidc;
 }
 
-function userToTokens(user: User): Oidc.Tokens {
-    const accessToken = user.access_token;
+function oidcClientTsUserToTokens<DecodedIdToken extends Record<string, unknown>>(params: {
+    oidcClientTsUser: OidcClientTsUser;
+    decodedIdTokenSchema?: { parse: (data: unknown) => DecodedIdToken };
+}): Oidc.Tokens<DecodedIdToken> {
+    const { oidcClientTsUser, decodedIdTokenSchema } = params;
+
+    const accessToken = oidcClientTsUser.access_token;
 
     const accessTokenExpirationTime = (() => {
         read_from_metadata: {
-            const { expires_at } = user;
+            const { expires_at } = oidcClientTsUser;
 
             if (expires_at === undefined) {
                 break read_from_metadata;
@@ -502,7 +559,7 @@ function userToTokens(user: User): Oidc.Tokens {
         assert(false, "Failed to get access token expiration time");
     })();
 
-    const refreshToken = user.refresh_token;
+    const refreshToken = oidcClientTsUser.refresh_token;
 
     assert(refreshToken !== undefined, "No refresh token provided by the oidc server");
 
@@ -520,15 +577,48 @@ function userToTokens(user: User): Oidc.Tokens {
         assert(false, "Failed to get refresh token expiration time");
     })();
 
-    const idToken = user.id_token;
+    const idToken = oidcClientTsUser.id_token;
 
     assert(idToken !== undefined, "No id token provided by the oidc server");
 
-    return {
+    const tokens: Oidc.Tokens<DecodedIdToken> = {
         accessToken,
         accessTokenExpirationTime,
         refreshToken,
         refreshTokenExpirationTime,
-        idToken
+        idToken,
+        "decodedIdToken": null as any
     };
+
+    let cache:
+        | {
+              idToken: string;
+              decodedIdToken: DecodedIdToken;
+          }
+        | undefined = undefined;
+
+    Object.defineProperty(tokens, "decodedIdToken", {
+        "get": function (this: Oidc.Tokens<DecodedIdToken>) {
+            if (cache !== undefined && cache.idToken === this.idToken) {
+                return cache.decodedIdToken;
+            }
+
+            let decodedIdToken = decodeJwt(this.idToken) as DecodedIdToken;
+
+            if (decodedIdTokenSchema !== undefined) {
+                decodedIdToken = decodedIdTokenSchema.parse(decodedIdToken);
+            }
+
+            cache = {
+                "idToken": this.idToken,
+                decodedIdToken
+            };
+
+            return decodedIdToken;
+        },
+        "configurable": true,
+        "enumerable": true
+    });
+
+    return tokens;
 }