oidc-spa 4.13.0 → 4.13.2

package/oidc.js

@@ -1,744 +1,967 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createOidc = createOidc;
-const oidc_client_ts_and_jwt_decode_1 = require("./vendor/frontend/oidc-client-ts-and-jwt-decode");
-const tsafe_1 = require("./vendor/frontend/tsafe");
-const readExpirationTimeInJwt_1 = require("./tools/readExpirationTimeInJwt");
-const tsafe_2 = require("./vendor/frontend/tsafe");
-const urlQueryParams_1 = require("./tools/urlQueryParams");
-const fnv1aHashToHex_1 = require("./tools/fnv1aHashToHex");
-const Deferred_1 = require("./tools/Deferred");
-const decodeJwt_1 = require("./tools/decodeJwt");
-const getDownlinkAndRtt_1 = require("./tools/getDownlinkAndRtt");
-const createIsUserActive_1 = require("./tools/createIsUserActive");
-const startCountdown_1 = require("./tools/startCountdown");
-const worker_timers_1 = require("./vendor/frontend/worker-timers");
-const OidcInitializationError_1 = require("./OidcInitializationError");
-const PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN = ["code", "state", "session_state", "iss"];
-let $isUserActive = undefined;
-const prOidcByConfigHash = new Map();
-const URL_real = window.URL;
-/** @see: https://github.com/garronej/oidc-spa#option-1-usage-without-involving-the-ui-framework */
-async function createOidc(params) {
-    const { issuerUri, clientId, clientSecret, scopes = ["profile"], transformUrlBeforeRedirect = url => url, extraQueryParams: extraQueryParamsOrGetter, publicUrl: publicUrl_params, decodedIdTokenSchema, __unsafe_ssoSessionIdleSeconds, autoLogoutParams = { "redirectTo": "current page" }, isAuthGloballyRequired = false, postLoginRedirectUrl } = params;
-    const getExtraQueryParams = (() => {
-        if (typeof extraQueryParamsOrGetter === "function") {
-            return extraQueryParamsOrGetter;
-        }
-        if (extraQueryParamsOrGetter !== undefined) {
-            return () => extraQueryParamsOrGetter;
-        }
-        return undefined;
-    })();
-    const publicUrl = (() => {
-        if (publicUrl_params === undefined) {
-            return undefined;
-        }
-        return (publicUrl_params.startsWith("http")
-            ? publicUrl_params
-            : `${window.location.origin}${publicUrl_params}`).replace(/\/$/, "");
-    })();
-    const configHash = (0, fnv1aHashToHex_1.fnv1aHashToHex)(`${issuerUri} ${clientId} ${clientSecret !== null && clientSecret !== void 0 ? clientSecret : ""} ${scopes.join(" ")}`);
-    use_previous_instance: {
-        const prOidc = prOidcByConfigHash.get(configHash);
-        if (prOidc === undefined) {
-            break use_previous_instance;
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
         }
-        console.warn([
-            `oidc-spa has been instantiated more than once with the same configuration.`,
-            `If you are in development mode with hot module replacement this is expected you can ignore this warning.`,
-            `In production however this is something that should be addressed.`
-        ].join(" "));
-        return prOidc;
-    }
-    const dOidc = new Deferred_1.Deferred();
-    prOidcByConfigHash.set(configHash, dOidc.pr);
-    const silentSso = publicUrl === undefined
-        ? {
-            "hasDedicatedHtmlFile": false,
-            "redirectUri": window.location.href
-        }
-        : {
-            "hasDedicatedHtmlFile": true,
-            "redirectUri": `${publicUrl}/silent-sso.html`
-        };
-    const SILENT_SSO_KEY = "oidcSpaSilentSso";
-    const CONFIG_HASH_KEY = "configHash";
-    silent_sso_polyfill: {
-        if (!(0, urlQueryParams_1.retrieveQueryParamFromUrl)({
-            "url": window.location.href,
-            "name": SILENT_SSO_KEY
-        }).wasPresent) {
-            break silent_sso_polyfill;
-        }
-        {
-            const result = (0, urlQueryParams_1.retrieveQueryParamFromUrl)({
-                "url": window.location.href,
-                "name": CONFIG_HASH_KEY
-            });
-            if (!result.wasPresent || result.value !== configHash) {
-                break silent_sso_polyfill;
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
             }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
         }
-        if (silentSso.hasDedicatedHtmlFile) {
-            // Here the user forget to create the silent-sso.html file or or the web server is not serving it correctly
-            // we shouldn't fall back to the SPA page.
-            // In this case we want to let the timeout of the parent expire to provide the correct error message.
-            await new Promise(() => { });
-        }
-        parent.postMessage(location.href, location.origin);
-        await new Promise(() => { });
+    return t;
+};
+var __read = (this && this.__read) || function (o, n) {
+    var m = typeof Symbol === "function" && o[Symbol.iterator];
+    if (!m) return o;
+    var i = m.call(o), r, ar = [], e;
+    try {
+        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
     }
-    const oidcClientTsUserManager = new oidc_client_ts_and_jwt_decode_1.UserManager({
-        "authority": issuerUri,
-        "client_id": clientId,
-        "client_secret": clientSecret,
-        "redirect_uri": "" /* provided when calling login */,
-        "response_type": "code",
-        "scope": Array.from(new Set(["openid", ...scopes])).join(" "),
-        "automaticSilentRenew": false,
-        "silent_redirect_uri": (() => {
-            let { redirectUri } = silentSso;
-            redirectUri = (0, urlQueryParams_1.addQueryParamToUrl)({
-                "url": redirectUri,
-                "name": CONFIG_HASH_KEY,
-                "value": configHash
-            }).newUrl;
-            redirectUri = (0, urlQueryParams_1.addQueryParamToUrl)({
-                "url": redirectUri,
-                "name": SILENT_SSO_KEY,
-                "value": "true"
-            }).newUrl;
-            return redirectUri;
-        })()
-    });
-    let lastPublicRoute = undefined;
-    // NOTE: To call only if not logged in.
-    const startTrackingLastPublicRoute = () => {
-        const realPushState = history.pushState.bind(history);
-        history.pushState = function pushState(...args) {
-            lastPublicRoute = window.location.href;
-            return realPushState(...args);
-        };
-    };
-    let hasLoginBeenCalled = false;
-    const loginOrGoToAuthServer = async (params) => {
-        const { extraQueryParams: extraQueryParams_fromLoginFn, redirectUrl, transformUrlBeforeRedirect: transformUrlBeforeRedirect_fromLoginFn = url => url, ...rest } = params;
-        login_only: {
-            if (rest.action !== "login") {
-                break login_only;
-            }
-            if (hasLoginBeenCalled) {
-                return new Promise(() => { });
-            }
-            hasLoginBeenCalled = true;
+    catch (error) { e = { error: error }; }
+    finally {
+        try {
+            if (r && !r.done && (m = i["return"])) m.call(i);
         }
-        const { newUrl: redirect_uri } = (0, urlQueryParams_1.addQueryParamToUrl)({
-            "url": (() => {
-                if (redirectUrl === undefined) {
-                    return window.location.href;
-                }
-                return redirectUrl.startsWith("/")
-                    ? `${window.location.origin}${redirectUrl}`
-                    : redirectUrl;
-            })(),
-            "name": CONFIG_HASH_KEY,
-            "value": configHash
-        });
-        // NOTE: This is for handling cases when user press the back button on the login pages.
-        // When the app is hosted on https (so not in dev mode) the browser will restore the state of the app
-        // instead of reloading the page.
-        login_only: {
-            if (rest.action !== "login") {
-                break login_only;
-            }
-            const callback = () => {
-                if (document.visibilityState === "visible") {
-                    document.removeEventListener("visibilitychange", callback);
-                    if (rest.doesCurrentHrefRequiresAuth) {
-                        if (lastPublicRoute !== undefined) {
-                            window.location.href = lastPublicRoute;
-                        }
-                        else {
-                            window.history.back();
-                        }
-                    }
-                    else {
-                        hasLoginBeenCalled = false;
-                    }
-                }
-            };
-            document.addEventListener("visibilitychange", callback);
+        finally { if (e) throw e.error; }
+    }
+    return ar;
+};
+var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
+    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
+        if (ar || !(i in from)) {
+            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
+            ar[i] = from[i];
         }
-        //NOTE: We know there is a extraQueryParameter option but it doesn't allow
-        // to control the encoding so we have to highjack global URL Class that is
-        // used internally by oidc-client-ts. It's save to do so since this is the
-        // last thing that will be done before the redirect.
-        {
-            const URL = (...args) => {
-                const urlInstance = new URL_real(...args);
-                return new Proxy(urlInstance, {
-                    "get": (target, prop) => {
-                        if (prop === "href") {
-                            let url = urlInstance.href;
-                            [
-                                [getExtraQueryParams === null || getExtraQueryParams === void 0 ? void 0 : getExtraQueryParams(), transformUrlBeforeRedirect],
-                                [
-                                    extraQueryParams_fromLoginFn,
-                                    transformUrlBeforeRedirect_fromLoginFn
-                                ]
-                            ].forEach(([extraQueryParams, transformUrlBeforeRedirect]) => {
-                                add_extra_query_params: {
-                                    if (extraQueryParams === undefined) {
-                                        break add_extra_query_params;
-                                    }
-                                    Object.entries(extraQueryParams).forEach(([name, value]) => (url = (0, urlQueryParams_1.addQueryParamToUrl)({
-                                        url,
-                                        name,
-                                        value
-                                    }).newUrl));
-                                }
-                                url = transformUrlBeforeRedirect(url);
-                            });
-                            Object.defineProperty(window, "URL", { "value": URL_real });
-                            return url;
-                        }
-                        //@ts-expect-error
-                        return target[prop];
-                    }
-                });
-            };
-            Object.defineProperty(window, "URL", { "value": URL });
+    }
+    return to.concat(ar || Array.prototype.slice.call(from));
+};
+var __values = (this && this.__values) || function(o) {
+    var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
+    if (m) return m.call(o);
+    if (o && typeof o.length === "number") return {
+        next: function () {
+            if (o && i >= o.length) o = void 0;
+            return { value: o && o[i++], done: !o };
         }
-        await oidcClientTsUserManager.signinRedirect({
-            redirect_uri,
-            // NOTE: This is for the behavior when the use presses the back button on the login pages.
-            // This is what happens when the user gave up the login process.
-            // We want to that to redirect to the last public page.
-            "redirectMethod": (() => {
-                switch (rest.action) {
-                    case "login":
-                        return rest.doesCurrentHrefRequiresAuth ? "replace" : "assign";
-                    case "go to auth server":
-                        return "assign";
-                }
-            })()
-        });
-        return new Promise(() => { });
     };
-    const resultOfLoginProcess = await (async function getUser() {
-        read_successful_login_query_params: {
-            let url = window.location.href;
-            {
-                const result = (0, urlQueryParams_1.retrieveQueryParamFromUrl)({ "name": CONFIG_HASH_KEY, url });
-                if (!result.wasPresent || result.value !== configHash) {
-                    break read_successful_login_query_params;
-                }
-                url = result.newUrl;
-            }
-            let loginSuccessUrl = "https://dummy.com";
-            let missingMandatoryParams = [];
-            for (const name of PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN) {
-                const result = (0, urlQueryParams_1.retrieveQueryParamFromUrl)({ name, url });
-                if (!result.wasPresent) {
-                    if (name === "iss") {
-                        continue;
-                    }
-                    missingMandatoryParams.push(name);
-                    continue;
-                }
-                loginSuccessUrl = (0, urlQueryParams_1.addQueryParamToUrl)({
-                    "url": loginSuccessUrl,
-                    "name": name,
-                    "value": result.value
-                }).newUrl;
-                url = result.newUrl;
-            }
-            window.history.pushState(null, "", url);
-            {
-                const result = (0, urlQueryParams_1.retrieveQueryParamFromUrl)({ "name": "error", url });
-                if (result.wasPresent) {
-                    throw new Error([
-                        "The OIDC server responded with an error passed as query parameter after the login process",
-                        `this error is: ${result.value}`
-                    ].join(" "));
-                }
-            }
-            if (missingMandatoryParams.length !== 0) {
-                throw new Error([
-                    "After the login process the following mandatory OIDC query parameters where missing:",
-                    missingMandatoryParams.join(", ")
-                ].join(" "));
-            }
-            let oidcClientTsUser = undefined;
-            try {
-                oidcClientTsUser = await oidcClientTsUserManager.signinRedirectCallback(loginSuccessUrl);
-            }
-            catch (error) {
-                (0, tsafe_2.assert)(error instanceof Error);
-                if (error.message === "Failed to fetch") {
-                    // If it's a fetch error here we know that the web server is not down and the login was successful,
-                    // we just where redirected from the login pages.
-                    // This means it's likely a "Web origins" misconfiguration.
-                    throw new OidcInitializationError_1.OidcInitializationError({
-                        "type": "bad configuration",
-                        "likelyCause": {
-                            "type": "not in Web Origins",
-                            clientId
-                        }
-                    });
-                }
-                //NOTE: The user has likely pressed the back button just after logging in.
-                //UPDATE: I don't remember how to reproduce this case and I don't know if it's still relevant.
-                return undefined;
-            }
-            return {
-                "loginScenario": "backFromLoginPages",
-                oidcClientTsUser
-            };
-        }
-        restore_from_session: {
-            const oidcClientTsUser = await oidcClientTsUserManager.getUser();
-            if (oidcClientTsUser === null) {
-                break restore_from_session;
-            }
-            // The server might have restarted and the session might have been lost.
-            try {
-                await oidcClientTsUserManager.signinSilent();
-            }
-            catch (error) {
-                (0, tsafe_2.assert)(error instanceof Error);
-                if (error.message === "Failed to fetch") {
-                    // Here it could be web origins as well but it's less likely because
-                    // it would mean that there was once a valid configuration and it has been
-                    // changed to an invalid one before the token expired.
-                    // but the server is not necessarily down, the issuerUri could be wrong.
-                    // So the error that we return should be either "server down" if fetching the
-                    // well known configuration endpoint failed without returning any status code
-                    // or "bad configuration" if the endpoint returned a 404 or an other status code.
-                    throw new OidcInitializationError_1.OidcInitializationError({
-                        "type": "server down",
-                        issuerUri
-                    });
-                }
-                return undefined;
-            }
-            return {
-                "loginScenario": "sessionStorageRestoration",
-                oidcClientTsUser
-            };
-        }
-        restore_from_http_only_cookie: {
-            const dLoginSuccessUrl = new Deferred_1.Deferred();
-            const timeoutDelayMs = (() => {
-                const downlinkAndRtt = (0, getDownlinkAndRtt_1.getDownlinkAndRtt)();
-                if (downlinkAndRtt === undefined) {
-                    return 5000;
-                }
-                const { downlink, rtt } = downlinkAndRtt;
-                // Base delay is the minimum delay we're willing to tolerate
-                const baseDelay = 3000;
-                // Calculate dynamic delay based on RTT and downlink
-                // Add 1 to downlink to avoid division by zero
-                const dynamicDelay = rtt * 2.5 + 3000 / (downlink + 1);
-                return Math.max(baseDelay, dynamicDelay);
-            })();
-            const timeout = (0, worker_timers_1.setTimeout)(async () => {
-                let dedicatedSilentSsoHtmlFileCsp = undefined;
-                silent_sso_html_unreachable: {
-                    if (!silentSso.hasDedicatedHtmlFile) {
-                        break silent_sso_html_unreachable;
-                    }
-                    const isSilentSsoHtmlReachable = await fetch(silentSso.redirectUri).then(async (response) => {
-                        dedicatedSilentSsoHtmlFileCsp =
-                            response.headers.get("Content-Security-Policy");
-                        const content = await response.text();
-                        return (content.length < 250 &&
-                            content.includes("parent.postMessage(location.href"));
-                    }, () => false);
-                    if (isSilentSsoHtmlReachable) {
-                        break silent_sso_html_unreachable;
-                    }
-                    dLoginSuccessUrl.reject(new OidcInitializationError_1.OidcInitializationError({
-                        "type": "bad configuration",
-                        "likelyCause": {
-                            "type": "silent-sso.html not reachable",
-                            "silentSsoHtmlUrl": silentSso.redirectUri
+    throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createOidc = createOidc;
+var oidc_client_ts_and_jwt_decode_1 = require("./vendor/frontend/oidc-client-ts-and-jwt-decode");
+var tsafe_1 = require("./vendor/frontend/tsafe");
+var readExpirationTimeInJwt_1 = require("./tools/readExpirationTimeInJwt");
+var tsafe_2 = require("./vendor/frontend/tsafe");
+var urlQueryParams_1 = require("./tools/urlQueryParams");
+var fnv1aHashToHex_1 = require("./tools/fnv1aHashToHex");
+var Deferred_1 = require("./tools/Deferred");
+var decodeJwt_1 = require("./tools/decodeJwt");
+var getDownlinkAndRtt_1 = require("./tools/getDownlinkAndRtt");
+var createIsUserActive_1 = require("./tools/createIsUserActive");
+var startCountdown_1 = require("./tools/startCountdown");
+var worker_timers_1 = require("./vendor/frontend/worker-timers");
+var OidcInitializationError_1 = require("./OidcInitializationError");
+var PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN = ["code", "state", "session_state", "iss"];
+var $isUserActive = undefined;
+var prOidcByConfigHash = new Map();
+var URL_real = window.URL;
+/** @see: https://github.com/garronej/oidc-spa#option-1-usage-without-involving-the-ui-framework */
+function createOidc(params) {
+    return __awaiter(this, void 0, void 0, function () {
+        var issuerUri, clientId, clientSecret, _a, scopes, _b, transformUrlBeforeRedirect, extraQueryParamsOrGetter, publicUrl_params, decodedIdTokenSchema, __unsafe_ssoSessionIdleSeconds, _c, autoLogoutParams, _d, isAuthGloballyRequired, postLoginRedirectUrl, getExtraQueryParams, publicUrl, configHash, prOidc, dOidc, silentSso, SILENT_SSO_KEY, CONFIG_HASH_KEY, result, oidcClientTsUserManager, lastPublicRoute, startTrackingLastPublicRoute, hasLoginBeenCalled, loginOrGoToAuthServer, resultOfLoginProcess, common, error, initializationError, oidc_1, oidc_2, currentTokens, autoLogoutCountdownTickCallbacks, onTokenChanges, oidc, getMsBeforeExpiration_1, startCountdown_2, stopCountdown_1;
+        var _this = this;
+        return __generator(this, function (_e) {
+            switch (_e.label) {
+                case 0:
+                    issuerUri = params.issuerUri, clientId = params.clientId, clientSecret = params.clientSecret, _a = params.scopes, scopes = _a === void 0 ? ["profile"] : _a, _b = params.transformUrlBeforeRedirect, transformUrlBeforeRedirect = _b === void 0 ? function (url) { return url; } : _b, extraQueryParamsOrGetter = params.extraQueryParams, publicUrl_params = params.publicUrl, decodedIdTokenSchema = params.decodedIdTokenSchema, __unsafe_ssoSessionIdleSeconds = params.__unsafe_ssoSessionIdleSeconds, _c = params.autoLogoutParams, autoLogoutParams = _c === void 0 ? { "redirectTo": "current page" } : _c, _d = params.isAuthGloballyRequired, isAuthGloballyRequired = _d === void 0 ? false : _d, postLoginRedirectUrl = params.postLoginRedirectUrl;
+                    getExtraQueryParams = (function () {
+                        if (typeof extraQueryParamsOrGetter === "function") {
+                            return extraQueryParamsOrGetter;
                         }
-                    }));
-                    return;
-                }
-                frame_ancestors_none: {
-                    const csp = await (async () => {
-                        if (silentSso.hasDedicatedHtmlFile) {
-                            (0, tsafe_2.assert)(dedicatedSilentSsoHtmlFileCsp !== undefined);
-                            return dedicatedSilentSsoHtmlFileCsp;
+                        if (extraQueryParamsOrGetter !== undefined) {
+                            return function () { return extraQueryParamsOrGetter; };
                         }
-                        const csp = await fetch(silentSso.redirectUri).then(response => response.headers.get("Content-Security-Policy"), error => (0, tsafe_1.id)(error));
-                        if (csp instanceof Error) {
-                            dLoginSuccessUrl.reject(new Error(`Failed to fetch ${silentSso.redirectUri}: ${csp.message}`));
-                            return new Promise(() => { });
+                        return undefined;
+                    })();
+                    publicUrl = (function () {
+                        if (publicUrl_params === undefined) {
+                            return undefined;
                         }
-                        return csp;
+                        return (publicUrl_params.startsWith("http")
+                            ? publicUrl_params
+                            : "".concat(window.location.origin).concat(publicUrl_params)).replace(/\/$/, "");
                     })();
-                    if (csp === null) {
-                        break frame_ancestors_none;
-                    }
-                    const hasFrameAncestorsNone = csp
-                        .replace(/["']/g, "")
-                        .replace(/\s+/g, " ")
-                        .toLowerCase()
-                        .includes("frame-ancestors none");
-                    if (!hasFrameAncestorsNone) {
-                        break frame_ancestors_none;
-                    }
-                    dLoginSuccessUrl.reject(new OidcInitializationError_1.OidcInitializationError({
-                        "type": "bad configuration",
-                        "likelyCause": {
-                            "type": "frame-ancestors none",
-                            silentSso
+                    configHash = (0, fnv1aHashToHex_1.fnv1aHashToHex)("".concat(issuerUri, " ").concat(clientId, " ").concat(clientSecret !== null && clientSecret !== void 0 ? clientSecret : "", " ").concat(scopes.join(" ")));
+                    use_previous_instance: {
+                        prOidc = prOidcByConfigHash.get(configHash);
+                        if (prOidc === undefined) {
+                            break use_previous_instance;
                         }
-                    }));
-                    return;
-                }
-                // Here we know that the server is not down and that the issuer_uri is correct
-                // otherwise we would have had a fetch error when loading the iframe.
-                // So this means that it's very likely a OIDC client misconfiguration.
-                // It could also be a very slow network but this risk is mitigated by the fact that we check
-                // for the network speed to adjust the timeout delay.
-                dLoginSuccessUrl.reject(new OidcInitializationError_1.OidcInitializationError({
-                    "type": "bad configuration",
-                    "likelyCause": {
-                        "type": "misconfigured OIDC client",
-                        clientId,
-                        timeoutDelayMs,
-                        publicUrl
-                    }
-                }));
-            }, timeoutDelayMs);
-            const listener = (event) => {
-                if (typeof event.data !== "string") {
-                    return;
-                }
-                const url = event.data;
-                {
-                    let result;
-                    try {
-                        result = (0, urlQueryParams_1.retrieveQueryParamFromUrl)({ "name": CONFIG_HASH_KEY, url });
-                    }
-                    catch (_a) {
-                        // This could possibly happen if url is not a valid url.
-                        return;
+                        console.warn([
+                            "oidc-spa has been instantiated more than once with the same configuration.",
+                            "If you are in development mode with hot module replacement this is expected you can ignore this warning.",
+                            "In production however this is something that should be addressed."
+                        ].join(" "));
+                        return [2 /*return*/, prOidc];
                     }
-                    if (!result.wasPresent || result.value !== configHash) {
-                        return;
-                    }
-                }
-                (0, worker_timers_1.clearTimeout)(timeout);
-                window.removeEventListener("message", listener);
-                {
-                    const result = (0, urlQueryParams_1.retrieveQueryParamFromUrl)({ "name": "error", url });
-                    if (result.wasPresent) {
-                        dLoginSuccessUrl.resolve(undefined);
-                        return;
-                    }
-                }
-                let loginSuccessUrl = "https://dummy.com";
-                const missingMandatoryParams = [];
-                for (const name of PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN) {
-                    const result = (0, urlQueryParams_1.retrieveQueryParamFromUrl)({ name, url });
-                    if (!result.wasPresent) {
-                        if (name === "iss") {
-                            continue;
+                    dOidc = new Deferred_1.Deferred();
+                    prOidcByConfigHash.set(configHash, dOidc.pr);
+                    silentSso = publicUrl === undefined
+                        ? {
+                            "hasDedicatedHtmlFile": false,
+                            "redirectUri": window.location.href
                         }
-                        missingMandatoryParams.push(name);
-                        continue;
+                        : {
+                            "hasDedicatedHtmlFile": true,
+                            "redirectUri": "".concat(publicUrl, "/silent-sso.html")
+                        };
+                    SILENT_SSO_KEY = "oidcSpaSilentSso";
+                    CONFIG_HASH_KEY = "configHash";
+                    if (!(0, urlQueryParams_1.retrieveQueryParamFromUrl)({
+                        "url": window.location.href,
+                        "name": SILENT_SSO_KEY
+                    }).wasPresent) {
+                        return [3 /*break*/, 4];
                     }
-                    loginSuccessUrl = (0, urlQueryParams_1.addQueryParamToUrl)({
-                        "url": loginSuccessUrl,
-                        "name": name,
-                        "value": result.value
-                    }).newUrl;
-                }
-                if (missingMandatoryParams.length !== 0) {
-                    dLoginSuccessUrl.reject(new Error([
-                        "After the silent signin process the following mandatory OIDC query parameters where missing:",
-                        missingMandatoryParams.join(", ")
-                    ].join(" ")));
-                    return;
-                }
-                dLoginSuccessUrl.resolve(loginSuccessUrl);
-            };
-            window.addEventListener("message", listener, false);
-            oidcClientTsUserManager
-                .signinSilent({ "silentRequestTimeoutInSeconds": timeoutDelayMs / 1000 })
-                .catch((error) => {
-                if (error.message === "Failed to fetch") {
-                    (0, worker_timers_1.clearTimeout)(timeout);
-                    // Here we know it's not web origin because it's not the token we are fetching
-                    // but just the well known configuration endpoint that is not subject to CORS.
-                    dLoginSuccessUrl.reject(new OidcInitializationError_1.OidcInitializationError({
-                        "type": "server down",
-                        issuerUri
-                    }));
-                }
-            });
-            const loginSuccessUrl = await dLoginSuccessUrl.pr;
-            if (loginSuccessUrl === undefined) {
-                break restore_from_http_only_cookie;
-            }
-            let oidcClientTsUser = undefined;
-            try {
-                oidcClientTsUser = await oidcClientTsUserManager.signinRedirectCallback(loginSuccessUrl);
-            }
-            catch (error) {
-                (0, tsafe_2.assert)(error instanceof Error);
-                if (error.message === "Failed to fetch") {
-                    // If we have a fetch error here. We know for sure that the server isn't down,
-                    // the silent sign-in was successful. We also know that the issuer_uri is correct.
-                    // so it's very likely the web origins that are misconfigured.
-                    throw new OidcInitializationError_1.OidcInitializationError({
-                        "type": "bad configuration",
-                        "likelyCause": {
-                            "type": "not in Web Origins",
-                            clientId
+                    {
+                        result = (0, urlQueryParams_1.retrieveQueryParamFromUrl)({
+                            "url": window.location.href,
+                            "name": CONFIG_HASH_KEY
+                        });
+                        if (!result.wasPresent || result.value !== configHash) {
+                            return [3 /*break*/, 4];
                         }
+                    }
+                    if (!silentSso.hasDedicatedHtmlFile) return [3 /*break*/, 2];
+                    // Here the user forget to create the silent-sso.html file or or the web server is not serving it correctly
+                    // we shouldn't fall back to the SPA page.
+                    // In this case we want to let the timeout of the parent expire to provide the correct error message.
+                    return [4 /*yield*/, new Promise(function () { })];
+                case 1:
+                    // Here the user forget to create the silent-sso.html file or or the web server is not serving it correctly
+                    // we shouldn't fall back to the SPA page.
+                    // In this case we want to let the timeout of the parent expire to provide the correct error message.
+                    _e.sent();
+                    _e.label = 2;
+                case 2:
+                    parent.postMessage(location.href, location.origin);
+                    return [4 /*yield*/, new Promise(function () { })];
+                case 3:
+                    _e.sent();
+                    _e.label = 4;
+                case 4:
+                    oidcClientTsUserManager = new oidc_client_ts_and_jwt_decode_1.UserManager({
+                        "authority": issuerUri,
+                        "client_id": clientId,
+                        "client_secret": clientSecret,
+                        "redirect_uri": "" /* provided when calling login */,
+                        "response_type": "code",
+                        "scope": Array.from(new Set(__spreadArray(["openid"], __read(scopes), false))).join(" "),
+                        "automaticSilentRenew": false,
+                        "silent_redirect_uri": (function () {
+                            var redirectUri = silentSso.redirectUri;
+                            redirectUri = (0, urlQueryParams_1.addQueryParamToUrl)({
+                                "url": redirectUri,
+                                "name": CONFIG_HASH_KEY,
+                                "value": configHash
+                            }).newUrl;
+                            redirectUri = (0, urlQueryParams_1.addQueryParamToUrl)({
+                                "url": redirectUri,
+                                "name": SILENT_SSO_KEY,
+                                "value": "true"
+                            }).newUrl;
+                            return redirectUri;
+                        })()
                     });
-                }
-                throw error;
-            }
-            return {
-                "loginScenario": "silentSignin",
-                oidcClientTsUser
-            };
-        }
-        return undefined;
-    })().then(result => {
-        if (result === undefined) {
-            return undefined;
-        }
-        const { oidcClientTsUser, loginScenario } = result;
-        const tokens = oidcClientTsUserToTokens({
-            oidcClientTsUser,
-            decodedIdTokenSchema
-        });
-        if (tokens.refreshTokenExpirationTime < tokens.accessTokenExpirationTime) {
-            console.warn([
-                "The OIDC refresh token shorter than the one of the access token.",
-                "This is very unusual and probably a misconfiguration.",
-                `Check your oidc server configuration for ${clientId} ${issuerUri}`
-            ].join(" "));
-        }
-        return { tokens, loginScenario };
-    }, error => {
-        (0, tsafe_2.assert)(error instanceof Error);
-        return error;
-    });
-    const common = {
-        "params": {
-            issuerUri,
-            clientId
-        }
-    };
-    if (resultOfLoginProcess instanceof Error) {
-        const error = resultOfLoginProcess;
-        const initializationError = error instanceof OidcInitializationError_1.OidcInitializationError
-            ? error
-            : new OidcInitializationError_1.OidcInitializationError({
-                "type": "unknown",
-                "cause": error
-            });
-        if (isAuthGloballyRequired) {
-            throw initializationError;
-        }
-        console.error(`OIDC initialization error of type "${initializationError.type}": ${initializationError.message}`);
-        startTrackingLastPublicRoute();
-        const oidc = (0, tsafe_1.id)({
-            ...common,
-            "isUserLoggedIn": false,
-            "login": async () => {
-                alert("Authentication is currently unavailable. Please try again later.");
-                return new Promise(() => { });
-            },
-            initializationError
-        });
-        dOidc.resolve(oidc);
-        // @ts-expect-error: We know what we are doing.
-        return oidc;
-    }
-    if (resultOfLoginProcess === undefined) {
-        if (isAuthGloballyRequired) {
-            await loginOrGoToAuthServer({
-                "action": "login",
-                "doesCurrentHrefRequiresAuth": true,
-                "redirectUrl": postLoginRedirectUrl
-            });
-        }
-        startTrackingLastPublicRoute();
-        const oidc = (0, tsafe_1.id)({
-            ...common,
-            "isUserLoggedIn": false,
-            "login": params => loginOrGoToAuthServer({ "action": "login", ...params }),
-            "initializationError": undefined
-        });
-        dOidc.resolve(oidc);
-        // @ts-expect-error: We know what we are doing.
-        return oidc;
-    }
-    let currentTokens = resultOfLoginProcess.tokens;
-    const autoLogoutCountdownTickCallbacks = new Set();
-    const onTokenChanges = new Set();
-    const oidc = (0, tsafe_1.id)({
-        ...common,
-        "isUserLoggedIn": true,
-        "getTokens": () => currentTokens,
-        "logout": async (params) => {
-            await oidcClientTsUserManager.signoutRedirect({
-                "id_token_hint": currentTokens.idToken,
-                "post_logout_redirect_uri": (() => {
-                    switch (params.redirectTo) {
-                        case "current page":
-                            return window.location.href;
-                        case "home":
-                            if (publicUrl === undefined) {
-                                throw new Error([
-                                    "Since you've opted out of the `silent-sso.html` file you are probably in a",
-                                    "setup a bit less standard. To avoid any confusion on where the users should be",
-                                    "redirected after logout please explicitly specify the url to redirect to.",
-                                    "With `logout({ redirectTo: 'specific url', url: '/my-home' })` or use",
-                                    "`logout({ redirectTo: 'current page' })` if you want to redirect to the current page."
+                    lastPublicRoute = undefined;
+                    startTrackingLastPublicRoute = function () {
+                        var realPushState = history.pushState.bind(history);
+                        history.pushState = function pushState() {
+                            var args = [];
+                            for (var _i = 0; _i < arguments.length; _i++) {
+                                args[_i] = arguments[_i];
+                            }
+                            lastPublicRoute = window.location.href;
+                            return realPushState.apply(void 0, __spreadArray([], __read(args), false));
+                        };
+                    };
+                    hasLoginBeenCalled = false;
+                    loginOrGoToAuthServer = function (params) { return __awaiter(_this, void 0, void 0, function () {
+                        var extraQueryParams_fromLoginFn, redirectUrl, _a, transformUrlBeforeRedirect_fromLoginFn, rest, redirect_uri, callback_1, URL_1;
+                        return __generator(this, function (_b) {
+                            switch (_b.label) {
+                                case 0:
+                                    extraQueryParams_fromLoginFn = params.extraQueryParams, redirectUrl = params.redirectUrl, _a = params.transformUrlBeforeRedirect, transformUrlBeforeRedirect_fromLoginFn = _a === void 0 ? function (url) { return url; } : _a, rest = __rest(params, ["extraQueryParams", "redirectUrl", "transformUrlBeforeRedirect"]);
+                                    login_only: {
+                                        if (rest.action !== "login") {
+                                            break login_only;
+                                        }
+                                        if (hasLoginBeenCalled) {
+                                            return [2 /*return*/, new Promise(function () { })];
+                                        }
+                                        hasLoginBeenCalled = true;
+                                    }
+                                    redirect_uri = (0, urlQueryParams_1.addQueryParamToUrl)({
+                                        "url": (function () {
+                                            if (redirectUrl === undefined) {
+                                                return window.location.href;
+                                            }
+                                            return redirectUrl.startsWith("/")
+                                                ? "".concat(window.location.origin).concat(redirectUrl)
+                                                : redirectUrl;
+                                        })(),
+                                        "name": CONFIG_HASH_KEY,
+                                        "value": configHash
+                                    }).newUrl;
+                                    // NOTE: This is for handling cases when user press the back button on the login pages.
+                                    // When the app is hosted on https (so not in dev mode) the browser will restore the state of the app
+                                    // instead of reloading the page.
+                                    login_only: {
+                                        if (rest.action !== "login") {
+                                            break login_only;
+                                        }
+                                        callback_1 = function () {
+                                            if (document.visibilityState === "visible") {
+                                                document.removeEventListener("visibilitychange", callback_1);
+                                                if (rest.doesCurrentHrefRequiresAuth) {
+                                                    if (lastPublicRoute !== undefined) {
+                                                        window.location.href = lastPublicRoute;
+                                                    }
+                                                    else {
+                                                        window.history.back();
+                                                    }
+                                                }
+                                                else {
+                                                    hasLoginBeenCalled = false;
+                                                }
+                                            }
+                                        };
+                                        document.addEventListener("visibilitychange", callback_1);
+                                    }
+                                    //NOTE: We know there is a extraQueryParameter option but it doesn't allow
+                                    // to control the encoding so we have to highjack global URL Class that is
+                                    // used internally by oidc-client-ts. It's save to do so since this is the
+                                    // last thing that will be done before the redirect.
+                                    {
+                                        URL_1 = function () {
+                                            var args = [];
+                                            for (var _i = 0; _i < arguments.length; _i++) {
+                                                args[_i] = arguments[_i];
+                                            }
+                                            var urlInstance = new (URL_real.bind.apply(URL_real, __spreadArray([void 0], __read(args), false)))();
+                                            return new Proxy(urlInstance, {
+                                                "get": function (target, prop) {
+                                                    if (prop === "href") {
+                                                        var url_1 = urlInstance.href;
+                                                        [
+                                                            [getExtraQueryParams === null || getExtraQueryParams === void 0 ? void 0 : getExtraQueryParams(), transformUrlBeforeRedirect],
+                                                            [
+                                                                extraQueryParams_fromLoginFn,
+                                                                transformUrlBeforeRedirect_fromLoginFn
+                                                            ]
+                                                        ].forEach(function (_a) {
+                                                            var _b = __read(_a, 2), extraQueryParams = _b[0], transformUrlBeforeRedirect = _b[1];
+                                                            add_extra_query_params: {
+                                                                if (extraQueryParams === undefined) {
+                                                                    break add_extra_query_params;
+                                                                }
+                                                                Object.entries(extraQueryParams).forEach(function (_a) {
+                                                                    var _b = __read(_a, 2), name = _b[0], value = _b[1];
+                                                                    return (url_1 = (0, urlQueryParams_1.addQueryParamToUrl)({
+                                                                        url: url_1,
+                                                                        name: name,
+                                                                        value: value
+                                                                    }).newUrl);
+                                                                });
+                                                            }
+                                                            url_1 = transformUrlBeforeRedirect(url_1);
+                                                        });
+                                                        Object.defineProperty(window, "URL", { "value": URL_real });
+                                                        return url_1;
+                                                    }
+                                                    //@ts-expect-error
+                                                    return target[prop];
+                                                }
+                                            });
+                                        };
+                                        Object.defineProperty(window, "URL", { "value": URL_1 });
+                                    }
+                                    return [4 /*yield*/, oidcClientTsUserManager.signinRedirect({
+                                            redirect_uri: redirect_uri,
+                                            // NOTE: This is for the behavior when the use presses the back button on the login pages.
+                                            // This is what happens when the user gave up the login process.
+                                            // We want to that to redirect to the last public page.
+                                            "redirectMethod": (function () {
+                                                switch (rest.action) {
+                                                    case "login":
+                                                        return rest.doesCurrentHrefRequiresAuth ? "replace" : "assign";
+                                                    case "go to auth server":
+                                                        return "assign";
+                                                }
+                                            })()
+                                        })];
+                                case 1:
+                                    _b.sent();
+                                    return [2 /*return*/, new Promise(function () { })];
+                            }
+                        });
+                    }); };
+                    return [4 /*yield*/, (function getUser() {
+                            return __awaiter(this, void 0, void 0, function () {
+                                var url, result, loginSuccessUrl, missingMandatoryParams, PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_1, PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_1_1, name_1, result, result, oidcClientTsUser, error_1, oidcClientTsUser, error_2, dLoginSuccessUrl_1, timeoutDelayMs_1, timeout_1, listener_1, loginSuccessUrl, oidcClientTsUser, error_3;
+                                var e_1, _a;
+                                var _this = this;
+                                return __generator(this, function (_b) {
+                                    switch (_b.label) {
+                                        case 0:
+                                            url = window.location.href;
+                                            {
+                                                result = (0, urlQueryParams_1.retrieveQueryParamFromUrl)({ "name": CONFIG_HASH_KEY, url: url });
+                                                if (!result.wasPresent || result.value !== configHash) {
+                                                    return [3 /*break*/, 5];
+                                                }
+                                                url = result.newUrl;
+                                            }
+                                            loginSuccessUrl = "https://dummy.com";
+                                            missingMandatoryParams = [];
+                                            try {
+                                                for (PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_1 = __values(PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN), PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_1_1 = PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_1.next(); !PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_1_1.done; PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_1_1 = PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_1.next()) {
+                                                    name_1 = PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_1_1.value;
+                                                    result = (0, urlQueryParams_1.retrieveQueryParamFromUrl)({ name: name_1, url: url });
+                                                    if (!result.wasPresent) {
+                                                        if (name_1 === "iss") {
+                                                            continue;
+                                                        }
+                                                        missingMandatoryParams.push(name_1);
+                                                        continue;
+                                                    }
+                                                    loginSuccessUrl = (0, urlQueryParams_1.addQueryParamToUrl)({
+                                                        "url": loginSuccessUrl,
+                                                        "name": name_1,
+                                                        "value": result.value
+                                                    }).newUrl;
+                                                    url = result.newUrl;
+                                                }
+                                            }
+                                            catch (e_1_1) { e_1 = { error: e_1_1 }; }
+                                            finally {
+                                                try {
+                                                    if (PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_1_1 && !PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_1_1.done && (_a = PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_1.return)) _a.call(PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_1);
+                                                }
+                                                finally { if (e_1) throw e_1.error; }
+                                            }
+                                            window.history.pushState(null, "", url);
+                                            {
+                                                result = (0, urlQueryParams_1.retrieveQueryParamFromUrl)({ "name": "error", url: url });
+                                                if (result.wasPresent) {
+                                                    throw new Error([
+                                                        "The OIDC server responded with an error passed as query parameter after the login process",
+                                                        "this error is: ".concat(result.value)
+                                                    ].join(" "));
+                                                }
+                                            }
+                                            if (missingMandatoryParams.length !== 0) {
+                                                throw new Error([
+                                                    "After the login process the following mandatory OIDC query parameters where missing:",
+                                                    missingMandatoryParams.join(", ")
+                                                ].join(" "));
+                                            }
+                                            oidcClientTsUser = undefined;
+                                            _b.label = 1;
+                                        case 1:
+                                            _b.trys.push([1, 3, , 4]);
+                                            return [4 /*yield*/, oidcClientTsUserManager.signinRedirectCallback(loginSuccessUrl)];
+                                        case 2:
+                                            oidcClientTsUser = _b.sent();
+                                            return [3 /*break*/, 4];
+                                        case 3:
+                                            error_1 = _b.sent();
+                                            (0, tsafe_2.assert)(error_1 instanceof Error);
+                                            if (error_1.message === "Failed to fetch") {
+                                                // If it's a fetch error here we know that the web server is not down and the login was successful,
+                                                // we just where redirected from the login pages.
+                                                // This means it's likely a "Web origins" misconfiguration.
+                                                throw new OidcInitializationError_1.OidcInitializationError({
+                                                    "type": "bad configuration",
+                                                    "likelyCause": {
+                                                        "type": "not in Web Origins",
+                                                        clientId: clientId
+                                                    }
+                                                });
+                                            }
+                                            //NOTE: The user has likely pressed the back button just after logging in.
+                                            //UPDATE: I don't remember how to reproduce this case and I don't know if it's still relevant.
+                                            return [2 /*return*/, undefined];
+                                        case 4: return [2 /*return*/, {
+                                                "loginScenario": "backFromLoginPages",
+                                                oidcClientTsUser: oidcClientTsUser
+                                            }];
+                                        case 5: return [4 /*yield*/, oidcClientTsUserManager.getUser()];
+                                        case 6:
+                                            oidcClientTsUser = _b.sent();
+                                            if (oidcClientTsUser === null) {
+                                                return [3 /*break*/, 11];
+                                            }
+                                            _b.label = 7;
+                                        case 7:
+                                            _b.trys.push([7, 9, , 10]);
+                                            return [4 /*yield*/, oidcClientTsUserManager.signinSilent()];
+                                        case 8:
+                                            _b.sent();
+                                            return [3 /*break*/, 10];
+                                        case 9:
+                                            error_2 = _b.sent();
+                                            (0, tsafe_2.assert)(error_2 instanceof Error);
+                                            if (error_2.message === "Failed to fetch") {
+                                                // Here it could be web origins as well but it's less likely because
+                                                // it would mean that there was once a valid configuration and it has been
+                                                // changed to an invalid one before the token expired.
+                                                // but the server is not necessarily down, the issuerUri could be wrong.
+                                                // So the error that we return should be either "server down" if fetching the
+                                                // well known configuration endpoint failed without returning any status code
+                                                // or "bad configuration" if the endpoint returned a 404 or an other status code.
+                                                throw new OidcInitializationError_1.OidcInitializationError({
+                                                    "type": "server down",
+                                                    issuerUri: issuerUri
+                                                });
+                                            }
+                                            return [2 /*return*/, undefined];
+                                        case 10: return [2 /*return*/, {
+                                                "loginScenario": "sessionStorageRestoration",
+                                                oidcClientTsUser: oidcClientTsUser
+                                            }];
+                                        case 11:
+                                            dLoginSuccessUrl_1 = new Deferred_1.Deferred();
+                                            timeoutDelayMs_1 = (function () {
+                                                var downlinkAndRtt = (0, getDownlinkAndRtt_1.getDownlinkAndRtt)();
+                                                if (downlinkAndRtt === undefined) {
+                                                    return 5000;
+                                                }
+                                                var downlink = downlinkAndRtt.downlink, rtt = downlinkAndRtt.rtt;
+                                                // Base delay is the minimum delay we're willing to tolerate
+                                                var baseDelay = 3000;
+                                                // Calculate dynamic delay based on RTT and downlink
+                                                // Add 1 to downlink to avoid division by zero
+                                                var dynamicDelay = rtt * 2.5 + 3000 / (downlink + 1);
+                                                return Math.max(baseDelay, dynamicDelay);
+                                            })();
+                                            timeout_1 = (0, worker_timers_1.setTimeout)(function () { return __awaiter(_this, void 0, void 0, function () {
+                                                var dedicatedSilentSsoHtmlFileCsp, isSilentSsoHtmlReachable, csp, hasFrameAncestorsNone;
+                                                var _this = this;
+                                                return __generator(this, function (_a) {
+                                                    switch (_a.label) {
+                                                        case 0:
+                                                            dedicatedSilentSsoHtmlFileCsp = undefined;
+                                                            if (!silentSso.hasDedicatedHtmlFile) {
+                                                                return [3 /*break*/, 2];
+                                                            }
+                                                            return [4 /*yield*/, fetch(silentSso.redirectUri).then(function (response) { return __awaiter(_this, void 0, void 0, function () {
+                                                                    var content;
+                                                                    return __generator(this, function (_a) {
+                                                                        switch (_a.label) {
+                                                                            case 0:
+                                                                                dedicatedSilentSsoHtmlFileCsp =
+                                                                                    response.headers.get("Content-Security-Policy");
+                                                                                return [4 /*yield*/, response.text()];
+                                                                            case 1:
+                                                                                content = _a.sent();
+                                                                                return [2 /*return*/, (content.length < 250 &&
+                                                                                        content.includes("parent.postMessage(location.href"))];
+                                                                        }
+                                                                    });
+                                                                }); }, function () { return false; })];
+                                                        case 1:
+                                                            isSilentSsoHtmlReachable = _a.sent();
+                                                            if (isSilentSsoHtmlReachable) {
+                                                                return [3 /*break*/, 2];
+                                                            }
+                                                            dLoginSuccessUrl_1.reject(new OidcInitializationError_1.OidcInitializationError({
+                                                                "type": "bad configuration",
+                                                                "likelyCause": {
+                                                                    "type": "silent-sso.html not reachable",
+                                                                    "silentSsoHtmlUrl": silentSso.redirectUri
+                                                                }
+                                                            }));
+                                                            return [2 /*return*/];
+                                                        case 2: return [4 /*yield*/, (function () { return __awaiter(_this, void 0, void 0, function () {
+                                                                var csp;
+                                                                return __generator(this, function (_a) {
+                                                                    switch (_a.label) {
+                                                                        case 0:
+                                                                            if (silentSso.hasDedicatedHtmlFile) {
+                                                                                (0, tsafe_2.assert)(dedicatedSilentSsoHtmlFileCsp !== undefined);
+                                                                                return [2 /*return*/, dedicatedSilentSsoHtmlFileCsp];
+                                                                            }
+                                                                            return [4 /*yield*/, fetch(silentSso.redirectUri).then(function (response) { return response.headers.get("Content-Security-Policy"); }, function (error) { return (0, tsafe_1.id)(error); })];
+                                                                        case 1:
+                                                                            csp = _a.sent();
+                                                                            if (csp instanceof Error) {
+                                                                                dLoginSuccessUrl_1.reject(new Error("Failed to fetch ".concat(silentSso.redirectUri, ": ").concat(csp.message)));
+                                                                                return [2 /*return*/, new Promise(function () { })];
+                                                                            }
+                                                                            return [2 /*return*/, csp];
+                                                                    }
+                                                                });
+                                                            }); })()];
+                                                        case 3:
+                                                            csp = _a.sent();
+                                                            if (csp === null) {
+                                                                return [3 /*break*/, 4];
+                                                            }
+                                                            hasFrameAncestorsNone = csp
+                                                                .replace(/["']/g, "")
+                                                                .replace(/\s+/g, " ")
+                                                                .toLowerCase()
+                                                                .includes("frame-ancestors none");
+                                                            if (!hasFrameAncestorsNone) {
+                                                                return [3 /*break*/, 4];
+                                                            }
+                                                            dLoginSuccessUrl_1.reject(new OidcInitializationError_1.OidcInitializationError({
+                                                                "type": "bad configuration",
+                                                                "likelyCause": {
+                                                                    "type": "frame-ancestors none",
+                                                                    silentSso: silentSso
+                                                                }
+                                                            }));
+                                                            return [2 /*return*/];
+                                                        case 4:
+                                                            // Here we know that the server is not down and that the issuer_uri is correct
+                                                            // otherwise we would have had a fetch error when loading the iframe.
+                                                            // So this means that it's very likely a OIDC client misconfiguration.
+                                                            // It could also be a very slow network but this risk is mitigated by the fact that we check
+                                                            // for the network speed to adjust the timeout delay.
+                                                            dLoginSuccessUrl_1.reject(new OidcInitializationError_1.OidcInitializationError({
+                                                                "type": "bad configuration",
+                                                                "likelyCause": {
+                                                                    "type": "misconfigured OIDC client",
+                                                                    clientId: clientId,
+                                                                    timeoutDelayMs: timeoutDelayMs_1,
+                                                                    publicUrl: publicUrl
+                                                                }
+                                                            }));
+                                                            return [2 /*return*/];
+                                                    }
+                                                });
+                                            }); }, timeoutDelayMs_1);
+                                            listener_1 = function (event) {
+                                                var e_2, _a;
+                                                if (typeof event.data !== "string") {
+                                                    return;
+                                                }
+                                                var url = event.data;
+                                                {
+                                                    var result = void 0;
+                                                    try {
+                                                        result = (0, urlQueryParams_1.retrieveQueryParamFromUrl)({ "name": CONFIG_HASH_KEY, url: url });
+                                                    }
+                                                    catch (_b) {
+                                                        // This could possibly happen if url is not a valid url.
+                                                        return;
+                                                    }
+                                                    if (!result.wasPresent || result.value !== configHash) {
+                                                        return;
+                                                    }
+                                                }
+                                                (0, worker_timers_1.clearTimeout)(timeout_1);
+                                                window.removeEventListener("message", listener_1);
+                                                {
+                                                    var result = (0, urlQueryParams_1.retrieveQueryParamFromUrl)({ "name": "error", url: url });
+                                                    if (result.wasPresent) {
+                                                        dLoginSuccessUrl_1.resolve(undefined);
+                                                        return;
+                                                    }
+                                                }
+                                                var loginSuccessUrl = "https://dummy.com";
+                                                var missingMandatoryParams = [];
+                                                try {
+                                                    for (var PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_2 = __values(PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN), PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_2_1 = PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_2.next(); !PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_2_1.done; PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_2_1 = PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_2.next()) {
+                                                        var name_2 = PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_2_1.value;
+                                                        var result = (0, urlQueryParams_1.retrieveQueryParamFromUrl)({ name: name_2, url: url });
+                                                        if (!result.wasPresent) {
+                                                            if (name_2 === "iss") {
+                                                                continue;
+                                                            }
+                                                            missingMandatoryParams.push(name_2);
+                                                            continue;
+                                                        }
+                                                        loginSuccessUrl = (0, urlQueryParams_1.addQueryParamToUrl)({
+                                                            "url": loginSuccessUrl,
+                                                            "name": name_2,
+                                                            "value": result.value
+                                                        }).newUrl;
+                                                    }
+                                                }
+                                                catch (e_2_1) { e_2 = { error: e_2_1 }; }
+                                                finally {
+                                                    try {
+                                                        if (PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_2_1 && !PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_2_1.done && (_a = PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_2.return)) _a.call(PARAMS_TO_RETRIEVE_FROM_SUCCESSFUL_LOGIN_2);
+                                                    }
+                                                    finally { if (e_2) throw e_2.error; }
+                                                }
+                                                if (missingMandatoryParams.length !== 0) {
+                                                    dLoginSuccessUrl_1.reject(new Error([
+                                                        "After the silent signin process the following mandatory OIDC query parameters where missing:",
+                                                        missingMandatoryParams.join(", ")
+                                                    ].join(" ")));
+                                                    return;
+                                                }
+                                                dLoginSuccessUrl_1.resolve(loginSuccessUrl);
+                                            };
+                                            window.addEventListener("message", listener_1, false);
+                                            oidcClientTsUserManager
+                                                .signinSilent({ "silentRequestTimeoutInSeconds": timeoutDelayMs_1 / 1000 })
+                                                .catch(function (error) {
+                                                if (error.message === "Failed to fetch") {
+                                                    (0, worker_timers_1.clearTimeout)(timeout_1);
+                                                    // Here we know it's not web origin because it's not the token we are fetching
+                                                    // but just the well known configuration endpoint that is not subject to CORS.
+                                                    dLoginSuccessUrl_1.reject(new OidcInitializationError_1.OidcInitializationError({
+                                                        "type": "server down",
+                                                        issuerUri: issuerUri
+                                                    }));
+                                                }
+                                            });
+                                            return [4 /*yield*/, dLoginSuccessUrl_1.pr];
+                                        case 12:
+                                            loginSuccessUrl = _b.sent();
+                                            if (loginSuccessUrl === undefined) {
+                                                return [3 /*break*/, 17];
+                                            }
+                                            oidcClientTsUser = undefined;
+                                            _b.label = 13;
+                                        case 13:
+                                            _b.trys.push([13, 15, , 16]);
+                                            return [4 /*yield*/, oidcClientTsUserManager.signinRedirectCallback(loginSuccessUrl)];
+                                        case 14:
+                                            oidcClientTsUser = _b.sent();
+                                            return [3 /*break*/, 16];
+                                        case 15:
+                                            error_3 = _b.sent();
+                                            (0, tsafe_2.assert)(error_3 instanceof Error);
+                                            if (error_3.message === "Failed to fetch") {
+                                                // If we have a fetch error here. We know for sure that the server isn't down,
+                                                // the silent sign-in was successful. We also know that the issuer_uri is correct.
+                                                // so it's very likely the web origins that are misconfigured.
+                                                throw new OidcInitializationError_1.OidcInitializationError({
+                                                    "type": "bad configuration",
+                                                    "likelyCause": {
+                                                        "type": "not in Web Origins",
+                                                        clientId: clientId
+                                                    }
+                                                });
+                                            }
+                                            throw error_3;
+                                        case 16: return [2 /*return*/, {
+                                                "loginScenario": "silentSignin",
+                                                oidcClientTsUser: oidcClientTsUser
+                                            }];
+                                        case 17: return [2 /*return*/, undefined];
+                                    }
+                                });
+                            });
+                        })().then(function (result) {
+                            if (result === undefined) {
+                                return undefined;
+                            }
+                            var oidcClientTsUser = result.oidcClientTsUser, loginScenario = result.loginScenario;
+                            var tokens = oidcClientTsUserToTokens({
+                                oidcClientTsUser: oidcClientTsUser,
+                                decodedIdTokenSchema: decodedIdTokenSchema
+                            });
+                            if (tokens.refreshTokenExpirationTime < tokens.accessTokenExpirationTime) {
+                                console.warn([
+                                    "The OIDC refresh token shorter than the one of the access token.",
+                                    "This is very unusual and probably a misconfiguration.",
+                                    "Check your oidc server configuration for ".concat(clientId, " ").concat(issuerUri)
                                 ].join(" "));
                             }
-                            return publicUrl;
-                        case "specific url":
-                            return params.url.startsWith("/")
-                                ? `${window.location.origin}${params.url}`
-                                : params.url;
+                            return { tokens: tokens, loginScenario: loginScenario };
+                        }, function (error) {
+                            (0, tsafe_2.assert)(error instanceof Error);
+                            return error;
+                        })];
+                case 5:
+                    resultOfLoginProcess = _e.sent();
+                    common = {
+                        "params": {
+                            issuerUri: issuerUri,
+                            clientId: clientId
+                        }
+                    };
+                    if (resultOfLoginProcess instanceof Error) {
+                        error = resultOfLoginProcess;
+                        initializationError = error instanceof OidcInitializationError_1.OidcInitializationError
+                            ? error
+                            : new OidcInitializationError_1.OidcInitializationError({
+                                "type": "unknown",
+                                "cause": error
+                            });
+                        if (isAuthGloballyRequired) {
+                            throw initializationError;
+                        }
+                        console.error("OIDC initialization error of type \"".concat(initializationError.type, "\": ").concat(initializationError.message));
+                        startTrackingLastPublicRoute();
+                        oidc_1 = (0, tsafe_1.id)(__assign(__assign({}, common), { "isUserLoggedIn": false, "login": function () { return __awaiter(_this, void 0, void 0, function () {
+                                return __generator(this, function (_a) {
+                                    alert("Authentication is currently unavailable. Please try again later.");
+                                    return [2 /*return*/, new Promise(function () { })];
+                                });
+                            }); }, initializationError: initializationError }));
+                        dOidc.resolve(oidc_1);
+                        // @ts-expect-error: We know what we are doing.
+                        return [2 /*return*/, oidc_1];
+                    }
+                    if (!(resultOfLoginProcess === undefined)) return [3 /*break*/, 8];
+                    if (!isAuthGloballyRequired) return [3 /*break*/, 7];
+                    return [4 /*yield*/, loginOrGoToAuthServer({
+                            "action": "login",
+                            "doesCurrentHrefRequiresAuth": true,
+                            "redirectUrl": postLoginRedirectUrl
+                        })];
+                case 6:
+                    _e.sent();
+                    _e.label = 7;
+                case 7:
+                    startTrackingLastPublicRoute();
+                    oidc_2 = (0, tsafe_1.id)(__assign(__assign({}, common), { "isUserLoggedIn": false, "login": function (params) { return loginOrGoToAuthServer(__assign({ "action": "login" }, params)); }, "initializationError": undefined }));
+                    dOidc.resolve(oidc_2);
+                    // @ts-expect-error: We know what we are doing.
+                    return [2 /*return*/, oidc_2];
+                case 8:
+                    currentTokens = resultOfLoginProcess.tokens;
+                    autoLogoutCountdownTickCallbacks = new Set();
+                    onTokenChanges = new Set();
+                    oidc = (0, tsafe_1.id)(__assign(__assign({}, common), { "isUserLoggedIn": true, "getTokens": function () { return currentTokens; }, "logout": function (params) { return __awaiter(_this, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, oidcClientTsUserManager.signoutRedirect({
+                                            "id_token_hint": currentTokens.idToken,
+                                            "post_logout_redirect_uri": (function () {
+                                                switch (params.redirectTo) {
+                                                    case "current page":
+                                                        return window.location.href;
+                                                    case "home":
+                                                        if (publicUrl === undefined) {
+                                                            throw new Error([
+                                                                "Since you've opted out of the `silent-sso.html` file you are probably in a",
+                                                                "setup a bit less standard. To avoid any confusion on where the users should be",
+                                                                "redirected after logout please explicitly specify the url to redirect to.",
+                                                                "With `logout({ redirectTo: 'specific url', url: '/my-home' })` or use",
+                                                                "`logout({ redirectTo: 'current page' })` if you want to redirect to the current page."
+                                                            ].join(" "));
+                                                        }
+                                                        return publicUrl;
+                                                    case "specific url":
+                                                        return params.url.startsWith("/")
+                                                            ? "".concat(window.location.origin).concat(params.url)
+                                                            : params.url;
+                                                }
+                                                (0, tsafe_2.assert)(false);
+                                            })()
+                                        })];
+                                    case 1:
+                                        _a.sent();
+                                        return [2 /*return*/, new Promise(function () { })];
+                                }
+                            });
+                        }); }, "renewTokens": function () { return __awaiter(_this, void 0, void 0, function () {
+                            var oidcClientTsUser, decodedIdTokenPropertyDescriptor;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, oidcClientTsUserManager.signinSilent()];
+                                    case 1:
+                                        oidcClientTsUser = _a.sent();
+                                        (0, tsafe_2.assert)(oidcClientTsUser !== null);
+                                        decodedIdTokenPropertyDescriptor = Object.getOwnPropertyDescriptor(currentTokens, "decodedIdToken");
+                                        (0, tsafe_2.assert)(decodedIdTokenPropertyDescriptor !== undefined);
+                                        currentTokens = oidcClientTsUserToTokens({
+                                            oidcClientTsUser: oidcClientTsUser,
+                                            decodedIdTokenSchema: decodedIdTokenSchema
+                                        });
+                                        // NOTE: We do that to preserve the cache and the object reference.
+                                        Object.defineProperty(currentTokens, "decodedIdToken", decodedIdTokenPropertyDescriptor);
+                                        Array.from(onTokenChanges).forEach(function (onTokenChange) { return onTokenChange(); });
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); }, "subscribeToTokensChange": function (onTokenChange) {
+                            onTokenChanges.add(onTokenChange);
+                            return {
+                                "unsubscribe": function () {
+                                    onTokenChanges.delete(onTokenChange);
+                                }
+                            };
+                        }, "subscribeToAutoLogoutCountdown": function (tickCallback) {
+                            autoLogoutCountdownTickCallbacks.add(tickCallback);
+                            var unsubscribeFromAutoLogoutCountdown = function () {
+                                autoLogoutCountdownTickCallbacks.delete(tickCallback);
+                            };
+                            return { unsubscribeFromAutoLogoutCountdown: unsubscribeFromAutoLogoutCountdown };
+                        }, "loginScenario": resultOfLoginProcess.loginScenario, "goToAuthServer": function (params) { return loginOrGoToAuthServer(__assign({ "action": "go to auth server" }, params)); } }));
+                    {
+                        getMsBeforeExpiration_1 = function () {
+                            // NOTE: In general the access token is supposed to have a shorter
+                            // lifespan than the refresh token but we don't want to make any
+                            // assumption here.
+                            var tokenExpirationTime = Math.min(currentTokens.accessTokenExpirationTime, currentTokens.refreshTokenExpirationTime);
+                            return Math.min(tokenExpirationTime - Date.now(), 
+                            // NOTE: We want to make sure we do not overflow the setTimeout
+                            // that must be a 32 bit unsigned integer.
+                            // This can happen if the tokenExpirationTime is more than 24.8 days in the future.
+                            Math.pow(2, 31) - 1);
+                        };
+                        (function scheduleRenew() {
+                            var _this = this;
+                            // NOTE: We refresh the token 25 seconds before it expires.
+                            // If the token expiration time is less than 25 seconds we refresh the token when
+                            // only 1/10 of the token time is left.
+                            var renewMsBeforeExpires = Math.min(25000, getMsBeforeExpiration_1() * 0.1);
+                            var timer = (0, worker_timers_1.setTimeout)(function () { return __awaiter(_this, void 0, void 0, function () {
+                                var _a;
+                                return __generator(this, function (_b) {
+                                    switch (_b.label) {
+                                        case 0:
+                                            tokenChangeUnsubscribe();
+                                            _b.label = 1;
+                                        case 1:
+                                            _b.trys.push([1, 3, , 5]);
+                                            return [4 /*yield*/, oidc.renewTokens()];
+                                        case 2:
+                                            _b.sent();
+                                            return [3 /*break*/, 5];
+                                        case 3:
+                                            _a = _b.sent();
+                                            // NOTE: Here semantically `"doesCurrentHrefRequiresAuth": false` is wrong.
+                                            // The user may very well be on a page that require auth.
+                                            // However there's no way to enforce the browser to redirect back to
+                                            // the last public route if the user press back on the login page.
+                                            // This is due to the fact that pushing to history only works if it's
+                                            // triggered by a user interaction.
+                                            return [4 /*yield*/, loginOrGoToAuthServer({
+                                                    "action": "login",
+                                                    "doesCurrentHrefRequiresAuth": false
+                                                })];
+                                        case 4:
+                                            // NOTE: Here semantically `"doesCurrentHrefRequiresAuth": false` is wrong.
+                                            // The user may very well be on a page that require auth.
+                                            // However there's no way to enforce the browser to redirect back to
+                                            // the last public route if the user press back on the login page.
+                                            // This is due to the fact that pushing to history only works if it's
+                                            // triggered by a user interaction.
+                                            _b.sent();
+                                            return [3 /*break*/, 5];
+                                        case 5: return [2 /*return*/];
+                                    }
+                                });
+                            }); }, getMsBeforeExpiration_1() - renewMsBeforeExpires);
+                            var tokenChangeUnsubscribe = oidc.subscribeToTokensChange(function () {
+                                (0, worker_timers_1.clearTimeout)(timer);
+                                tokenChangeUnsubscribe();
+                                scheduleRenew();
+                            }).unsubscribe;
+                        })();
+                    }
+                    {
+                        startCountdown_2 = (0, startCountdown_1.createStartCountdown)({
+                            "getCountdownEndTime": function () {
+                                return __unsafe_ssoSessionIdleSeconds !== undefined
+                                    ? Date.now() + __unsafe_ssoSessionIdleSeconds * 1000
+                                    : currentTokens.refreshTokenExpirationTime;
+                            },
+                            "tickCallback": function (_a) {
+                                var secondsLeft = _a.secondsLeft;
+                                Array.from(autoLogoutCountdownTickCallbacks).forEach(function (tickCallback) {
+                                    return tickCallback({ secondsLeft: secondsLeft });
+                                });
+                                if (secondsLeft === 0) {
+                                    oidc.logout(autoLogoutParams);
+                                }
+                            }
+                        }).startCountdown;
+                        stopCountdown_1 = undefined;
+                        if ($isUserActive === undefined) {
+                            $isUserActive = (0, createIsUserActive_1.createIsUserActive)({
+                                "theUserIsConsideredInactiveAfterMsOfInactivity": 5000
+                            }).$isUserActive;
+                        }
+                        $isUserActive.subscribe(function (isUserActive) {
+                            if (isUserActive) {
+                                if (stopCountdown_1 !== undefined) {
+                                    stopCountdown_1();
+                                    stopCountdown_1 = undefined;
+                                }
+                            }
+                            else {
+                                (0, tsafe_2.assert)(stopCountdown_1 === undefined);
+                                stopCountdown_1 = startCountdown_2().stopCountdown;
+                            }
+                        });
                     }
-                    (0, tsafe_2.assert)(false);
-                })()
-            });
-            return new Promise(() => { });
-        },
-        "renewTokens": async () => {
-            const oidcClientTsUser = await oidcClientTsUserManager.signinSilent();
-            (0, tsafe_2.assert)(oidcClientTsUser !== null);
-            const decodedIdTokenPropertyDescriptor = Object.getOwnPropertyDescriptor(currentTokens, "decodedIdToken");
-            (0, tsafe_2.assert)(decodedIdTokenPropertyDescriptor !== undefined);
-            currentTokens = oidcClientTsUserToTokens({
-                oidcClientTsUser,
-                decodedIdTokenSchema
-            });
-            // NOTE: We do that to preserve the cache and the object reference.
-            Object.defineProperty(currentTokens, "decodedIdToken", decodedIdTokenPropertyDescriptor);
-            Array.from(onTokenChanges).forEach(onTokenChange => onTokenChange());
-        },
-        "subscribeToTokensChange": onTokenChange => {
-            onTokenChanges.add(onTokenChange);
-            return {
-                "unsubscribe": () => {
-                    onTokenChanges.delete(onTokenChange);
-                }
-            };
-        },
-        "subscribeToAutoLogoutCountdown": tickCallback => {
-            autoLogoutCountdownTickCallbacks.add(tickCallback);
-            const unsubscribeFromAutoLogoutCountdown = () => {
-                autoLogoutCountdownTickCallbacks.delete(tickCallback);
-            };
-            return { unsubscribeFromAutoLogoutCountdown };
-        },
-        "loginScenario": resultOfLoginProcess.loginScenario,
-        "goToAuthServer": params => loginOrGoToAuthServer({ "action": "go to auth server", ...params })
-    });
-    {
-        const getMsBeforeExpiration = () => {
-            // NOTE: In general the access token is supposed to have a shorter
-            // lifespan than the refresh token but we don't want to make any
-            // assumption here.
-            const tokenExpirationTime = Math.min(currentTokens.accessTokenExpirationTime, currentTokens.refreshTokenExpirationTime);
-            return Math.min(tokenExpirationTime - Date.now(), 
-            // NOTE: We want to make sure we do not overflow the setTimeout
-            // that must be a 32 bit unsigned integer.
-            // This can happen if the tokenExpirationTime is more than 24.8 days in the future.
-            Math.pow(2, 31) - 1);
-        };
-        (function scheduleRenew() {
-            // NOTE: We refresh the token 25 seconds before it expires.
-            // If the token expiration time is less than 25 seconds we refresh the token when
-            // only 1/10 of the token time is left.
-            const renewMsBeforeExpires = Math.min(25000, getMsBeforeExpiration() * 0.1);
-            const timer = (0, worker_timers_1.setTimeout)(async () => {
-                tokenChangeUnsubscribe();
-                try {
-                    await oidc.renewTokens();
-                }
-                catch (_a) {
-                    // NOTE: Here semantically `"doesCurrentHrefRequiresAuth": false` is wrong.
-                    // The user may very well be on a page that require auth.
-                    // However there's no way to enforce the browser to redirect back to
-                    // the last public route if the user press back on the login page.
-                    // This is due to the fact that pushing to history only works if it's
-                    // triggered by a user interaction.
-                    await loginOrGoToAuthServer({
-                        "action": "login",
-                        "doesCurrentHrefRequiresAuth": false
-                    });
-                }
-            }, getMsBeforeExpiration() - renewMsBeforeExpires);
-            const { unsubscribe: tokenChangeUnsubscribe } = oidc.subscribeToTokensChange(() => {
-                (0, worker_timers_1.clearTimeout)(timer);
-                tokenChangeUnsubscribe();
-                scheduleRenew();
-            });
-        })();
-    }
-    {
-        const { startCountdown } = (0, startCountdown_1.createStartCountdown)({
-            "getCountdownEndTime": () => __unsafe_ssoSessionIdleSeconds !== undefined
-                ? Date.now() + __unsafe_ssoSessionIdleSeconds * 1000
-                : currentTokens.refreshTokenExpirationTime,
-            "tickCallback": ({ secondsLeft }) => {
-                Array.from(autoLogoutCountdownTickCallbacks).forEach(tickCallback => tickCallback({ secondsLeft }));
-                if (secondsLeft === 0) {
-                    oidc.logout(autoLogoutParams);
-                }
+                    return [2 /*return*/, oidc];
             }
         });
-        let stopCountdown = undefined;
-        if ($isUserActive === undefined) {
-            $isUserActive = (0, createIsUserActive_1.createIsUserActive)({
-                "theUserIsConsideredInactiveAfterMsOfInactivity": 5000
-            }).$isUserActive;
-        }
-        $isUserActive.subscribe(isUserActive => {
-            if (isUserActive) {
-                if (stopCountdown !== undefined) {
-                    stopCountdown();
-                    stopCountdown = undefined;
-                }
-            }
-            else {
-                (0, tsafe_2.assert)(stopCountdown === undefined);
-                stopCountdown = startCountdown().stopCountdown;
-            }
-        });
-    }
-    return oidc;
+    });
 }
 function oidcClientTsUserToTokens(params) {
-    const { oidcClientTsUser, decodedIdTokenSchema } = params;
-    const accessToken = oidcClientTsUser.access_token;
-    const accessTokenExpirationTime = (() => {
+    var oidcClientTsUser = params.oidcClientTsUser, decodedIdTokenSchema = params.decodedIdTokenSchema;
+    var accessToken = oidcClientTsUser.access_token;
+    var accessTokenExpirationTime = (function () {
         read_from_metadata: {
-            const { expires_at } = oidcClientTsUser;
+            var expires_at = oidcClientTsUser.expires_at;
             if (expires_at === undefined) {
                 break read_from_metadata;
             }
             return expires_at * 1000;
         }
         read_from_jwt: {
-            const expirationTime = (0, readExpirationTimeInJwt_1.readExpirationTimeInJwt)(accessToken);
+            var expirationTime = (0, readExpirationTimeInJwt_1.readExpirationTimeInJwt)(accessToken);
             if (expirationTime === undefined) {
                 break read_from_jwt;
             }
@@ -746,11 +969,11 @@ function oidcClientTsUserToTokens(params) {
         }
         (0, tsafe_2.assert)(false, "Failed to get access token expiration time");
     })();
-    const refreshToken = oidcClientTsUser.refresh_token;
+    var refreshToken = oidcClientTsUser.refresh_token;
     (0, tsafe_2.assert)(refreshToken !== undefined, "No refresh token provided by the oidc server");
-    const refreshTokenExpirationTime = (() => {
+    var refreshTokenExpirationTime = (function () {
         read_from_jwt: {
-            const expirationTime = (0, readExpirationTimeInJwt_1.readExpirationTimeInJwt)(refreshToken);
+            var expirationTime = (0, readExpirationTimeInJwt_1.readExpirationTimeInJwt)(refreshToken);
             if (expirationTime === undefined) {
                 break read_from_jwt;
             }
@@ -758,29 +981,29 @@ function oidcClientTsUserToTokens(params) {
         }
         (0, tsafe_2.assert)(false, "Failed to get refresh token expiration time");
     })();
-    const idToken = oidcClientTsUser.id_token;
+    var idToken = oidcClientTsUser.id_token;
     (0, tsafe_2.assert)(idToken !== undefined, "No id token provided by the oidc server");
-    const tokens = {
-        accessToken,
-        accessTokenExpirationTime,
-        refreshToken,
-        refreshTokenExpirationTime,
-        idToken,
+    var tokens = {
+        accessToken: accessToken,
+        accessTokenExpirationTime: accessTokenExpirationTime,
+        refreshToken: refreshToken,
+        refreshTokenExpirationTime: refreshTokenExpirationTime,
+        idToken: idToken,
         "decodedIdToken": null
     };
-    let cache = undefined;
+    var cache = undefined;
     Object.defineProperty(tokens, "decodedIdToken", {
         "get": function () {
             if (cache !== undefined && cache.idToken === this.idToken) {
                 return cache.decodedIdToken;
             }
-            let decodedIdToken = (0, decodeJwt_1.decodeJwt)(this.idToken);
+            var decodedIdToken = (0, decodeJwt_1.decodeJwt)(this.idToken);
             if (decodedIdTokenSchema !== undefined) {
                 decodedIdToken = decodedIdTokenSchema.parse(decodedIdToken);
             }
             cache = {
                 "idToken": this.idToken,
-                decodedIdToken
+                decodedIdToken: decodedIdToken
             };
             return decodedIdToken;
         },