oidc-spa 6.15.1 → 7.0.1

package/core/createOidc.js

@@ -100,7 +100,6 @@ var oidc_client_ts_and_jwt_decode_1 = require("../vendor/frontend/oidc-client-ts
 var tsafe_1 = require("../vendor/frontend/tsafe");
 var workerTimers_1 = require("../tools/workerTimers");
 var Deferred_1 = require("../tools/Deferred");
-var decodeJwt_1 = require("../tools/decodeJwt");
 var evtIsUserActive_1 = require("./evtIsUserActive");
 var startCountdown_1 = require("../tools/startCountdown");
 var toHumanReadableDuration_1 = require("../tools/toHumanReadableDuration");
@@ -125,13 +124,12 @@ var isNewBrowserSession_1 = require("./isNewBrowserSession");
 var trustedFetch_1 = require("./trustedFetch");
 (0, handleOidcCallback_1.handleOidcCallback)();
 // NOTE: Replaced at build time
-var VERSION = "6.15.1";
+var VERSION = "7.0.1";
 var globalContext = {
     prOidcByConfigId: new Map(),
     hasLogoutBeenCalled: (0, tsafe_1.id)(false),
     evtRequestToPersistTokens: (0, Evt_1.createEvt)()
 };
-var MIN_RENEW_BEFORE_EXPIRE_MS = 2000;
 /** @see: https://docs.oidc-spa.dev/v/v6/usage */
 function createOidc(params) {
     return __awaiter(this, void 0, void 0, function () {
@@ -217,12 +215,12 @@ function createOidc(params) {
 }
 function createOidc_nonMemoized(params, preProcessedParams) {
     return __awaiter(this, void 0, void 0, function () {
-        var transformUrlBeforeRedirect_next, transformUrlBeforeRedirect, extraQueryParamsOrGetter, extraTokenParamsOrGetter, homeUrl_params, __callbackUri, decodedIdTokenSchema, __unsafe_ssoSessionIdleSeconds, _a, idleSessionLifetimeInSeconds, _b, autoLogoutParams, _c, autoLogin, postLoginRedirectUrl_default, __unsafe_clientSecret, _d, __unsafe_useIdTokenAsAccessToken, __metadata, _e, noIframe, issuerUri, clientId, scopes, configId, log, getExtraQueryParams, getExtraTokenParams, homeUrl, callbackUri, isHandled, stateQueryParamValue_instance, canUseIframe, isUserStoreInMemoryOnly, oidcClientTsUserManager, evtIsUserLoggedIn, loginOrGoToAuthServer, getIsNewBrowserSession, completeLoginOrRefreshProcess, resultOfLoginProcess, oidc_common, oidc_notLoggedIn, prOtherTabLogin, currentTokens, autoLogoutCountdownTickCallbacks, onTokenChanges, _f, sessionId, subjectId, oidc_loggedIn, prOtherTabLogout, startCountdown_2, stopCountdown_1, evtIsUserActive;
+        var transformUrlBeforeRedirect, extraQueryParamsOrGetter, extraTokenParamsOrGetter, homeUrl_params, decodedIdTokenSchema, idleSessionLifetimeInSeconds, _a, autoLogoutParams, _b, autoLogin, postLoginRedirectUrl_default, __unsafe_clientSecret, _c, __unsafe_useIdTokenAsAccessToken, __metadata, _d, noIframe, issuerUri, clientId, scopes, configId, log, getExtraQueryParams, getExtraTokenParams, homeUrl, callbackUri, isHandled, stateQueryParamValue_instance, canUseIframe, isUserStoreInMemoryOnly, oidcClientTsUserManager, evtIsUserLoggedIn, loginOrGoToAuthServer, getIsNewBrowserSession, completeLoginOrRefreshProcess, resultOfLoginProcess, oidc_common, oidc_notLoggedIn, prOtherTabLogin, currentTokens, autoLogoutCountdownTickCallbacks, onTokenChanges, _e, sessionId, subjectId, oidc_loggedIn, prOtherTabLogout, getCurrentRefreshTokenTtlInSeconds_1, startCountdown_2, stopCountdown_1, evtIsUserActive, currentRefreshTokenTtlInSeconds;
         var _this = this;
-        return __generator(this, function (_g) {
-            switch (_g.label) {
+        return __generator(this, function (_f) {
+            switch (_f.label) {
                 case 0:
-                    transformUrlBeforeRedirect_next = params.transformUrlBeforeRedirect_next, transformUrlBeforeRedirect = params.transformUrlBeforeRedirect, extraQueryParamsOrGetter = params.extraQueryParams, extraTokenParamsOrGetter = params.extraTokenParams, homeUrl_params = params.homeUrl, __callbackUri = params.__callbackUri, decodedIdTokenSchema = params.decodedIdTokenSchema, __unsafe_ssoSessionIdleSeconds = params.__unsafe_ssoSessionIdleSeconds, _a = params.idleSessionLifetimeInSeconds, idleSessionLifetimeInSeconds = _a === void 0 ? __unsafe_ssoSessionIdleSeconds : _a, _b = params.autoLogoutParams, autoLogoutParams = _b === void 0 ? { redirectTo: "current page" } : _b, _c = params.autoLogin, autoLogin = _c === void 0 ? false : _c, postLoginRedirectUrl_default = params.postLoginRedirectUrl, __unsafe_clientSecret = params.__unsafe_clientSecret, _d = params.__unsafe_useIdTokenAsAccessToken, __unsafe_useIdTokenAsAccessToken = _d === void 0 ? false : _d, __metadata = params.__metadata, _e = params.noIframe, noIframe = _e === void 0 ? false : _e;
+                    transformUrlBeforeRedirect = params.transformUrlBeforeRedirect, extraQueryParamsOrGetter = params.extraQueryParams, extraTokenParamsOrGetter = params.extraTokenParams, homeUrl_params = params.homeUrl, decodedIdTokenSchema = params.decodedIdTokenSchema, idleSessionLifetimeInSeconds = params.idleSessionLifetimeInSeconds, _a = params.autoLogoutParams, autoLogoutParams = _a === void 0 ? { redirectTo: "current page" } : _a, _b = params.autoLogin, autoLogin = _b === void 0 ? false : _b, postLoginRedirectUrl_default = params.postLoginRedirectUrl, __unsafe_clientSecret = params.__unsafe_clientSecret, _c = params.__unsafe_useIdTokenAsAccessToken, __unsafe_useIdTokenAsAccessToken = _c === void 0 ? false : _c, __metadata = params.__metadata, _d = params.noIframe, noIframe = _d === void 0 ? false : _d;
                     issuerUri = preProcessedParams.issuerUri, clientId = preProcessedParams.clientId, scopes = preProcessedParams.scopes, configId = preProcessedParams.configId, log = preProcessedParams.log;
                     getExtraQueryParams = (function () {
                         if (extraQueryParamsOrGetter === undefined) {
@@ -248,7 +246,7 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                         doOutputWithTrailingSlash: true
                     });
                     callbackUri = (0, toFullyQualifiedUrl_1.toFullyQualifiedUrl)({
-                        urlish: __callbackUri !== null && __callbackUri !== void 0 ? __callbackUri : homeUrl,
+                        urlish: homeUrl,
                         doAssertNoQueryParams: true,
                         doOutputWithTrailingSlash: true
                     });
@@ -264,8 +262,8 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                     if (!isHandled) return [3 /*break*/, 2];
                     return [4 /*yield*/, new Promise(function () { })];
                 case 1:
-                    _g.sent();
-                    _g.label = 2;
+                    _f.sent();
+                    _f.label = 2;
                 case 2:
                     stateQueryParamValue_instance = (0, StateData_1.generateStateQueryParamValue)();
                     canUseIframe = (function () {
@@ -343,7 +341,6 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                         configId: configId,
                         oidcClientTsUserManager: oidcClientTsUserManager,
                         transformUrlBeforeRedirect: transformUrlBeforeRedirect,
-                        transformUrlBeforeRedirect_next: transformUrlBeforeRedirect_next,
                         getExtraQueryParams: getExtraQueryParams,
                         getExtraTokenParams: getExtraTokenParams,
                         homeUrl: homeUrl,
@@ -364,7 +361,7 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                     }).getIsNewBrowserSession;
                     return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.startLoginOrRefreshProcess)()];
                 case 3:
-                    completeLoginOrRefreshProcess = (_g.sent()).completeLoginOrRefreshProcess;
+                    completeLoginOrRefreshProcess = (_f.sent()).completeLoginOrRefreshProcess;
                     return [4 /*yield*/, (function () { return __awaiter(_this, void 0, void 0, function () {
                             var authResponseAndStateData, authResponse, stateData, _a, authResponseUrl, oidcClientTsUser, error_1, authResponse_error, authResponseUrl, _b, oidcClientTsUser, _c, _d, persistedAuthState_2, authResponse_error, oidcClientTsUser, result_loginSilent, authResponse, error_2;
                             return __generator(this, function (_e) {
@@ -514,7 +511,7 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                                 oidcClientTsUserManager: oidcClientTsUserManager,
                                                 stateQueryParamValue_instance: stateQueryParamValue_instance,
                                                 configId: configId,
-                                                transformUrlBeforeRedirect_next: transformUrlBeforeRedirect_next,
+                                                transformUrlBeforeRedirect: transformUrlBeforeRedirect,
                                                 getExtraQueryParams: getExtraQueryParams,
                                                 getExtraTokenParams: getExtraTokenParams,
                                                 autoLogin: autoLogin
@@ -633,13 +630,13 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                             });
                         }); })()];
                 case 4:
-                    resultOfLoginProcess = _g.sent();
+                    resultOfLoginProcess = _f.sent();
                     completeLoginOrRefreshProcess();
                     return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
                             prUnlock: Promise.resolve()
                         })];
                 case 5:
-                    _g.sent();
+                    _f.sent();
                     oidc_common = {
                         params: {
                             issuerUri: issuerUri,
@@ -758,13 +755,26 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                     }
                     autoLogoutCountdownTickCallbacks = new Set();
                     onTokenChanges = new Set();
-                    _f = (0, decodeJwt_1.decodeJwt)(currentTokens.idToken), sessionId = _f.sid, subjectId = _f.sub;
+                    _e = currentTokens.decodedIdToken_original, sessionId = _e.sid, subjectId = _e.sub;
                     (0, tsafe_1.assert)(subjectId !== undefined, "The 'sub' claim is missing from the id token");
-                    oidc_loggedIn = (0, tsafe_1.id)(__assign(__assign({}, oidc_common), { isUserLoggedIn: true, getTokens: function () { return currentTokens; }, getTokens_next: function () { return __awaiter(_this, void 0, void 0, function () {
+                    (0, tsafe_1.assert)(sessionId === undefined || typeof sessionId === "string");
+                    oidc_loggedIn = (0, tsafe_1.id)(__assign(__assign({}, oidc_common), { isUserLoggedIn: true, getTokens: function () { return __awaiter(_this, void 0, void 0, function () {
+                            var msBeforeExpirationOfTheAccessToken, msElapsedSinceCurrentTokenWereIssued;
                             return __generator(this, function (_a) {
                                 switch (_a.label) {
                                     case 0:
-                                        if (!((0, oidcClientTsUserToTokens_1.getMsBeforeExpiration)(currentTokens) <= MIN_RENEW_BEFORE_EXPIRE_MS)) return [3 /*break*/, 2];
+                                        {
+                                            msBeforeExpirationOfTheAccessToken = currentTokens.accessTokenExpirationTime - Date.now();
+                                            if (msBeforeExpirationOfTheAccessToken > 30000) {
+                                                return [3 /*break*/, 2];
+                                            }
+                                        }
+                                        {
+                                            msElapsedSinceCurrentTokenWereIssued = Date.now() - currentTokens.issuedAtTime;
+                                            if (msElapsedSinceCurrentTokenWereIssued < 5000) {
+                                                return [3 /*break*/, 2];
+                                            }
+                                        }
                                         return [4 /*yield*/, oidc_loggedIn.renewTokens()];
                                     case 1:
                                         _a.sent();
@@ -851,106 +861,130 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                         }); }, renewTokens: (function () {
                             function renewTokens_nonMutexed(params) {
                                 return __awaiter(this, void 0, void 0, function () {
-                                    var extraTokenParams, message, completeLoginOrRefreshProcess, result_loginSilent, oidcClientTsUser, _a, authResponse, authResponse_error, oidcClientTsUser_scope, error_4;
+                                    var extraTokenParams, fallbackToFullPageReload, completeLoginOrRefreshProcess, result_loginSilent, oidcClientTsUser, _a, authResponse, authResponse_error, oidcClientTsUser_scope, error_4;
+                                    var _this = this;
                                     return __generator(this, function (_b) {
                                         switch (_b.label) {
                                             case 0:
                                                 extraTokenParams = params.extraTokenParams;
-                                                if (!currentTokens.hasRefreshToken && !canUseIframe) {
-                                                    message = [
-                                                        "Unable to refresh tokens without a full app reload,",
-                                                        "because no refresh token is available",
-                                                        "and your app setup prevents silent sign-in via iframe.",
-                                                        "Your only option to refresh tokens is to call `window.location.reload()`"
-                                                    ].join(" ");
-                                                    log === null || log === void 0 ? void 0 : log(message);
-                                                    throw new Error(message);
-                                                }
+                                                fallbackToFullPageReload = function () { return __awaiter(_this, void 0, void 0, function () {
+                                                    return __generator(this, function (_a) {
+                                                        switch (_a.label) {
+                                                            case 0:
+                                                                (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: undefined });
+                                                                return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
+                                                                        prUnlock: new Promise(function () { })
+                                                                    })];
+                                                            case 1:
+                                                                _a.sent();
+                                                                globalContext.evtRequestToPersistTokens.post({
+                                                                    configIdOfInstancePostingTheRequest: configId
+                                                                });
+                                                                return [4 /*yield*/, loginOrGoToAuthServer({
+                                                                        action: "login",
+                                                                        redirectUrl: window.location.href,
+                                                                        doForceReloadOnBfCache: true,
+                                                                        extraQueryParams_local: undefined,
+                                                                        transformUrlBeforeRedirect_local: undefined,
+                                                                        doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: false,
+                                                                        interaction: "directly redirect if active session show login otherwise"
+                                                                    })];
+                                                            case 2:
+                                                                _a.sent();
+                                                                (0, tsafe_1.assert)(false, "136134");
+                                                                return [2 /*return*/];
+                                                        }
+                                                    });
+                                                }); };
+                                                if (!(!currentTokens.hasRefreshToken && !canUseIframe)) return [3 /*break*/, 2];
+                                                log === null || log === void 0 ? void 0 : log([
+                                                    "Unable to refresh tokens without a full app reload,",
+                                                    "because no refresh token is available",
+                                                    "and your app setup prevents silent sign-in via iframe.",
+                                                    "Your only option to refresh tokens is to call `window.location.reload()`"
+                                                ].join(" "));
+                                                return [4 /*yield*/, fallbackToFullPageReload()];
+                                            case 1:
+                                                _b.sent();
+                                                (0, tsafe_1.assert)(false, "136135");
+                                                _b.label = 2;
+                                            case 2:
                                                 log === null || log === void 0 ? void 0 : log("Renewing tokens");
                                                 return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.startLoginOrRefreshProcess)()];
-                                            case 1:
+                                            case 3:
                                                 completeLoginOrRefreshProcess = (_b.sent()).completeLoginOrRefreshProcess;
                                                 return [4 /*yield*/, (0, loginSilent_1.loginSilent)({
                                                         oidcClientTsUserManager: oidcClientTsUserManager,
                                                         stateQueryParamValue_instance: stateQueryParamValue_instance,
                                                         configId: configId,
-                                                        transformUrlBeforeRedirect_next: transformUrlBeforeRedirect_next,
+                                                        transformUrlBeforeRedirect: transformUrlBeforeRedirect,
                                                         getExtraQueryParams: getExtraQueryParams,
                                                         getExtraTokenParams: function () { return extraTokenParams; },
                                                         autoLogin: autoLogin
                                                     })];
-                                            case 2:
+                                            case 4:
                                                 result_loginSilent = _b.sent();
                                                 if (result_loginSilent.outcome === "failure") {
                                                     completeLoginOrRefreshProcess();
+                                                    // NOTE: This is a configuration or network error, okay to throw,
+                                                    // this exception doesn't have to be handle if it fails it fails.
                                                     throw new Error(result_loginSilent.cause);
                                                 }
                                                 _a = result_loginSilent.outcome;
                                                 switch (_a) {
-                                                    case "token refreshed using refresh token": return [3 /*break*/, 3];
-                                                    case "got auth response from iframe": return [3 /*break*/, 4];
+                                                    case "token refreshed using refresh token": return [3 /*break*/, 5];
+                                                    case "got auth response from iframe": return [3 /*break*/, 6];
                                                 }
-                                                return [3 /*break*/, 12];
-                                            case 3:
+                                                return [3 /*break*/, 13];
+                                            case 5:
                                                 {
                                                     log === null || log === void 0 ? void 0 : log("Refresh token used");
                                                     oidcClientTsUser = result_loginSilent.oidcClientTsUser;
                                                 }
-                                                return [3 /*break*/, 13];
-                                            case 4:
+                                                return [3 /*break*/, 14];
+                                            case 6:
                                                 authResponse = result_loginSilent.authResponse;
                                                 log === null || log === void 0 ? void 0 : log("Tokens refresh using iframe", authResponse);
                                                 authResponse_error = authResponse.error;
                                                 oidcClientTsUser_scope = undefined;
-                                                _b.label = 5;
-                                            case 5:
-                                                _b.trys.push([5, 7, , 8]);
+                                                _b.label = 7;
+                                            case 7:
+                                                _b.trys.push([7, 9, , 10]);
                                                 return [4 /*yield*/, oidcClientTsUserManager.signinRedirectCallback((0, AuthResponse_1.authResponseToUrl)(authResponse))];
-                                            case 6:
+                                            case 8:
                                                 oidcClientTsUser_scope =
                                                     _b.sent();
-                                                return [3 /*break*/, 8];
-                                            case 7:
+                                                return [3 /*break*/, 10];
+                                            case 9:
                                                 error_4 = _b.sent();
                                                 (0, tsafe_1.assert)(error_4 instanceof Error, "321389");
                                                 if (authResponse_error === undefined) {
                                                     completeLoginOrRefreshProcess();
+                                                    // Same here, if it fails it fails.
                                                     throw error_4;
                                                 }
-                                                oidcClientTsUser_scope = undefined;
-                                                return [3 /*break*/, 8];
-                                            case 8:
-                                                if (!(oidcClientTsUser_scope === undefined)) return [3 /*break*/, 11];
-                                                (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: undefined });
-                                                completeLoginOrRefreshProcess();
-                                                return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
-                                                        prUnlock: new Promise(function () { })
-                                                    })];
-                                            case 9:
-                                                _b.sent();
-                                                globalContext.evtRequestToPersistTokens.post({
-                                                    configIdOfInstancePostingTheRequest: configId
-                                                });
-                                                return [4 /*yield*/, loginOrGoToAuthServer({
-                                                        action: "login",
-                                                        redirectUrl: window.location.href,
-                                                        doForceReloadOnBfCache: true,
-                                                        extraQueryParams_local: undefined,
-                                                        transformUrlBeforeRedirect_local: undefined,
-                                                        doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: false,
-                                                        interaction: "ensure no interaction"
-                                                    })];
+                                                return [3 /*break*/, 10];
                                             case 10:
-                                                _b.sent();
-                                                (0, tsafe_1.assert)(false, "136134");
-                                                _b.label = 11;
+                                                if (!(oidcClientTsUser_scope === undefined)) return [3 /*break*/, 12];
+                                                // NOTE: Here we got a response but it's an error, session might have been
+                                                // deleted or other edge case.
+                                                completeLoginOrRefreshProcess();
+                                                log === null || log === void 0 ? void 0 : log([
+                                                    "The user is probably not logged in anymore,",
+                                                    "need to redirect to login pages"
+                                                ].join(" "));
+                                                return [4 /*yield*/, fallbackToFullPageReload()];
                                             case 11:
-                                                oidcClientTsUser = oidcClientTsUser_scope;
-                                                return [3 /*break*/, 13];
+                                                _b.sent();
+                                                (0, tsafe_1.assert)(false, "136135");
+                                                _b.label = 12;
                                             case 12:
-                                                (0, tsafe_1.assert)(false);
-                                                return [3 /*break*/, 13];
+                                                oidcClientTsUser = oidcClientTsUser_scope;
+                                                return [3 /*break*/, 14];
                                             case 13:
+                                                (0, tsafe_1.assert)(false);
+                                                return [3 /*break*/, 14];
+                                            case 14:
                                                 currentTokens = (0, oidcClientTsUserToTokens_1.oidcClientTsUserToTokens)({
                                                     oidcClientTsUser: oidcClientTsUser,
                                                     decodedIdTokenSchema: decodedIdTokenSchema,
@@ -1077,68 +1111,67 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                     }
                     (function scheduleRenew() {
                         var _this = this;
-                        var login_dueToExpiration = function () { return __awaiter(_this, void 0, void 0, function () {
-                            return __generator(this, function (_a) {
-                                switch (_a.label) {
-                                    case 0: return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
-                                            prUnlock: new Promise(function () { })
-                                        })];
-                                    case 1:
-                                        _a.sent();
-                                        (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: undefined });
-                                        return [2 /*return*/, loginOrGoToAuthServer({
-                                                action: "login",
-                                                redirectUrl: window.location.href,
-                                                doForceReloadOnBfCache: true,
-                                                extraQueryParams_local: undefined,
-                                                transformUrlBeforeRedirect_local: undefined,
-                                                // NOTE: Wether or not it's the preferred behavior, pushing to history
-                                                // only works on user interaction so it have to be false
-                                                doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: false,
-                                                interaction: "ensure no interaction"
-                                            })];
-                                }
-                            });
-                        }); };
-                        var msBeforeExpiration = (0, oidcClientTsUserToTokens_1.getMsBeforeExpiration)(currentTokens);
-                        if (msBeforeExpiration <= MIN_RENEW_BEFORE_EXPIRE_MS) {
+                        var _a;
+                        if (!currentTokens.hasRefreshToken && !canUseIframe) {
+                            log === null || log === void 0 ? void 0 : log([
+                                "Disabling token auto refresh mechanism because we",
+                                "have no way to renew the tokens without a full page reload"
+                            ].join(" "));
+                            return;
+                        }
+                        var typeOfTheTokenWeGotTheTtlFrom = currentTokens.hasRefreshToken ? "refresh" : "access";
+                        var msBeforeExpiration = ((_a = currentTokens.refreshTokenExpirationTime) !== null && _a !== void 0 ? _a : currentTokens.accessTokenExpirationTime) -
+                            Date.now();
+                        var RENEW_MS_BEFORE_EXPIRES = 30000;
+                        if (msBeforeExpiration <= RENEW_MS_BEFORE_EXPIRES) {
                             // NOTE: We just got a new token that is about to expire. This means that
                             // the refresh token has reached it's max SSO time.
-                            login_dueToExpiration();
+                            // ...or that the refresh token have a very short lifespan...
+                            // anyway, no need to keep alive, it will probably redirect on the next getTokens() or refreshTokens() call
+                            log === null || log === void 0 ? void 0 : log([
+                                "Disabling auto renew mechanism. We just got fresh tokens",
+                                (function () {
+                                    switch (typeOfTheTokenWeGotTheTtlFrom) {
+                                        case "refresh":
+                                            return [
+                                                " and the refresh token is already about to expires.",
+                                                "This means that we have reached the max session lifespan, we can't keep",
+                                                "the session alive any longer.",
+                                                "(This can also mean that the refresh token was configured with a TTL,",
+                                                "aka the idle session lifespan, too low to make sense)"
+                                            ].join(" ");
+                                        case "access":
+                                            return [
+                                                ", we have no refresh token and the access token is already about to expire",
+                                                "we would spam the auth server by constantly renewing the access token in the background",
+                                                "avoiding to do so."
+                                            ].join(" ");
+                                    }
+                                })()
+                            ].join(" "));
                             return;
                         }
-                        // NOTE: We refresh the token 25 seconds before it expires.
-                        // If the token expiration time is less than 25 seconds we refresh the token when
-                        // only 1/10 of the token time is left.
-                        var renewMsBeforeExpires = Math.max(Math.min(25000, msBeforeExpiration * 0.1), MIN_RENEW_BEFORE_EXPIRE_MS);
                         log === null || log === void 0 ? void 0 : log([
                             (0, toHumanReadableDuration_1.toHumanReadableDuration)(msBeforeExpiration),
-                            "before expiration of the access token.",
-                            "Scheduling renewal ".concat((0, toHumanReadableDuration_1.toHumanReadableDuration)(renewMsBeforeExpires), " before expiration")
+                            "before expiration of the ".concat(typeOfTheTokenWeGotTheTtlFrom, " token."),
+                            "Scheduling renewal ".concat((0, toHumanReadableDuration_1.toHumanReadableDuration)(RENEW_MS_BEFORE_EXPIRES), " before expiration to keep the session alive on the OIDC server.")
                         ].join(" "));
                         var timer = (0, workerTimers_1.setTimeout)(function () { return __awaiter(_this, void 0, void 0, function () {
-                            var _a;
-                            return __generator(this, function (_b) {
-                                switch (_b.label) {
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
                                     case 0:
-                                        log === null || log === void 0 ? void 0 : log("Renewing the access token now as it will expires in ".concat((0, toHumanReadableDuration_1.toHumanReadableDuration)(renewMsBeforeExpires)));
-                                        _b.label = 1;
-                                    case 1:
-                                        _b.trys.push([1, 3, , 5]);
+                                        log === null || log === void 0 ? void 0 : log("Renewing the ".concat(typeOfTheTokenWeGotTheTtlFrom, " token now as it will expires in ").concat((0, toHumanReadableDuration_1.toHumanReadableDuration)(RENEW_MS_BEFORE_EXPIRES)));
                                         return [4 /*yield*/, oidc_loggedIn.renewTokens()];
-                                    case 2:
-                                        _b.sent();
-                                        return [3 /*break*/, 5];
-                                    case 3:
-                                        _a = _b.sent();
-                                        return [4 /*yield*/, login_dueToExpiration()];
-                                    case 4:
-                                        _b.sent();
-                                        return [3 /*break*/, 5];
-                                    case 5: return [2 /*return*/];
+                                    case 1:
+                                        _a.sent();
+                                        return [2 /*return*/];
                                 }
                             });
-                        }); }, msBeforeExpiration - renewMsBeforeExpires);
+                        }); }, Math.min(msBeforeExpiration - RENEW_MS_BEFORE_EXPIRES, 
+                        // NOTE: We want to make sure we do not overflow the setTimeout
+                        // that must be a 32 bit unsigned integer.
+                        // This can happen if the tokenExpirationTime is more than 24.8 days in the future.
+                        Math.pow(2, 31) - 1));
                         var tokenChangeUnsubscribe = oidc_loggedIn.subscribeToTokensChange(function () {
                             (0, workerTimers_1.clearTimeout)(timer);
                             tokenChangeUnsubscribe();
@@ -1146,33 +1179,22 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                         }).unsubscribe;
                     })();
                     auto_logout: {
-                        if ((!currentTokens.hasRefreshToken || currentTokens.refreshTokenExpirationTime === undefined) &&
-                            idleSessionLifetimeInSeconds === undefined) {
+                        getCurrentRefreshTokenTtlInSeconds_1 = function () {
+                            if (idleSessionLifetimeInSeconds !== undefined) {
+                                return idleSessionLifetimeInSeconds;
+                            }
+                            if (currentTokens.refreshTokenExpirationTime === undefined) {
+                                return undefined;
+                            }
+                            return (currentTokens.refreshTokenExpirationTime - currentTokens.issuedAtTime) / 1000;
+                        };
+                        if (getCurrentRefreshTokenTtlInSeconds_1() === undefined) {
                             log === null || log === void 0 ? void 0 : log("".concat(currentTokens.hasRefreshToken
                                 ? "The refresh token is opaque, we can't read it's expiration time"
                                 : "No refresh token", ", and idleSessionLifetimeInSeconds was not set, can't implement auto logout mechanism"));
                             break auto_logout;
                         }
                         startCountdown_2 = (0, startCountdown_1.createStartCountdown)({
-                            getCountdownEndTime: (function () {
-                                var getCountdownEndTime = function () {
-                                    return idleSessionLifetimeInSeconds !== undefined
-                                        ? Date.now() + idleSessionLifetimeInSeconds * 1000
-                                        : ((0, tsafe_1.assert)(currentTokens.hasRefreshToken, "230198"),
-                                            (0, tsafe_1.assert)(currentTokens.refreshTokenExpirationTime !== undefined, "435490"),
-                                            currentTokens.refreshTokenExpirationTime);
-                                };
-                                var durationBeforeAutoLogout = (0, toHumanReadableDuration_1.toHumanReadableDuration)(getCountdownEndTime() - Date.now());
-                                log === null || log === void 0 ? void 0 : log([
-                                    "The user will be automatically logged out after ".concat(durationBeforeAutoLogout, " of inactivity."),
-                                    idleSessionLifetimeInSeconds === undefined
-                                        ? undefined
-                                        : "It was artificially defined by using the idleSessionLifetimeInSeconds param."
-                                ]
-                                    .filter(function (x) { return x !== undefined; })
-                                    .join("\n"));
-                                return getCountdownEndTime;
-                            })(),
                             tickCallback: function (_a) {
                                 var secondsLeft = _a.secondsLeft;
                                 Array.from(autoLogoutCountdownTickCallbacks).forEach(function (tickCallback) {
@@ -1197,9 +1219,25 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                             }
                             else {
                                 (0, tsafe_1.assert)(stopCountdown_1 === undefined, "902992");
-                                stopCountdown_1 = startCountdown_2().stopCountdown;
+                                var currentRefreshTokenTtlInSeconds = getCurrentRefreshTokenTtlInSeconds_1();
+                                (0, tsafe_1.assert)(currentRefreshTokenTtlInSeconds !== undefined, "902992326");
+                                stopCountdown_1 = startCountdown_2({
+                                    countDownFromSeconds: currentRefreshTokenTtlInSeconds
+                                }).stopCountdown;
                             }
                         });
+                        {
+                            currentRefreshTokenTtlInSeconds = getCurrentRefreshTokenTtlInSeconds_1();
+                            (0, tsafe_1.assert)(currentRefreshTokenTtlInSeconds !== undefined, "9029923253");
+                            log === null || log === void 0 ? void 0 : log([
+                                "The user will be automatically logged out after ".concat((0, toHumanReadableDuration_1.toHumanReadableDuration)(currentRefreshTokenTtlInSeconds * 1000), " of inactivity."),
+                                idleSessionLifetimeInSeconds === undefined
+                                    ? undefined
+                                    : "It was artificially defined by using the idleSessionLifetimeInSeconds param."
+                            ]
+                                .filter(function (x) { return x !== undefined; })
+                                .join("\n"));
+                        }
                     }
                     return [2 /*return*/, oidc_loggedIn];
             }