oidc-spa 6.4.0 → 6.5.1

package/oidc/createOidc.js

@@ -102,7 +102,7 @@ var tsafe_1 = require("../vendor/frontend/tsafe");
 var workerTimers_1 = require("../tools/workerTimers");
 var Deferred_1 = require("../tools/Deferred");
 var decodeJwt_1 = require("../tools/decodeJwt");
-var createIsUserActive_1 = require("./createIsUserActive");
+var isUserActive_1 = require("./isUserActive");
 var startCountdown_1 = require("../tools/startCountdown");
 var toHumanReadableDuration_1 = require("../tools/toHumanReadableDuration");
 var toFullyQualifiedUrl_1 = require("../tools/toFullyQualifiedUrl");
@@ -113,21 +113,23 @@ var configId_1 = require("./configId");
 var oidcClientTsUserToTokens_1 = require("./oidcClientTsUserToTokens");
 var loginSilent_1 = require("./loginSilent");
 var handleOidcCallback_1 = require("./handleOidcCallback");
-var persistedLogoutState_1 = require("./persistedLogoutState");
+var persistedAuthState_1 = require("./persistedAuthState");
 var AwaitableEventEmitter_1 = require("../tools/AwaitableEventEmitter");
+var haveSharedParentDomain_1 = require("../tools/haveSharedParentDomain");
+var loginOrGoToAuthServer_1 = require("./loginOrGoToAuthServer");
+var ephemeralSessionStorage_1 = require("../tools/ephemeralSessionStorage");
 // NOTE: Replaced at build time
-var VERSION = "6.4.0";
+var VERSION = "6.5.1";
 (0, handleOidcCallback_1.handleOidcCallback)();
 var GLOBAL_CONTEXT_KEY = "__oidc-spa.createOidc.globalContext";
 (_a = window[GLOBAL_CONTEXT_KEY]) !== null && _a !== void 0 ? _a : (window[GLOBAL_CONTEXT_KEY] = {
     prOidcByConfigId: new Map(),
     evtAuthResponseHandled: (0, AwaitableEventEmitter_1.createAwaitableEventEmitter)(),
-    URL_real: window.URL,
     $isUserActive: undefined,
-    hasLoginBeenCalled: false,
     hasLogoutBeenCalled: false
 });
 var globalContext = window[GLOBAL_CONTEXT_KEY];
+var MIN_RENEW_BEFORE_EXPIRE_MS = 2000;
 /** @see: https://docs.oidc-spa.dev/v/v6/usage */
 function createOidc(params) {
     return __awaiter(this, void 0, void 0, function () {
@@ -213,28 +215,12 @@ function createOidc(params) {
 }
 function createOidc_nonMemoized(params, preProcessedParams) {
     return __awaiter(this, void 0, void 0, function () {
-        function getMsBeforeExpiration() {
-            // NOTE: In general the access token is supposed to have a shorter
-            // lifespan than the refresh token but we don't want to make any
-            // assumption here.
-            var tokenExpirationTime = Math.min(currentTokens.accessTokenExpirationTime, currentTokens.refreshTokenExpirationTime);
-            var msBeforeExpiration = Math.min(tokenExpirationTime - Date.now(), 
-            // NOTE: We want to make sure we do not overflow the setTimeout
-            // that must be a 32 bit unsigned integer.
-            // This can happen if the tokenExpirationTime is more than 24.8 days in the future.
-            Math.pow(2, 31) - 1);
-            if (msBeforeExpiration < 0) {
-                log === null || log === void 0 ? void 0 : log("Token has already expired");
-                return 0;
-            }
-            return msBeforeExpiration;
-        }
-        var transformUrlBeforeRedirect, extraQueryParamsOrGetter, extraTokenParamsOrGetter, homeUrl_params, decodedIdTokenSchema, __unsafe_ssoSessionIdleSeconds, _a, autoLogoutParams, _b, autoLogin, postLoginRedirectUrl, __unsafe_clientSecret, _c, __unsafe_useIdTokenAsAccessToken, issuerUri, clientId, scopes, configId, log, _d, getExtraQueryParams, getExtraTokenParams, homeAndCallbackUrl, isHandled, USER_LOGGED_IN_KEY, stateQueryParamValue_instance, oidcClientTsUserManager, lastPublicUrl, startTrackingLastPublicUrl, loginOrGoToAuthServer, BROWSER_SESSION_NOT_FIRST_INIT_KEY, resultOfLoginProcess, common, error, initializationError, oidc_1, oidc_2, currentTokens, autoLogoutCountdownTickCallbacks, onTokenChanges, oidc, sessionId, prOtherTabLogout, startCountdown_2, stopCountdown_1;
+        var transformUrlBeforeRedirect, extraQueryParamsOrGetter, extraTokenParamsOrGetter, homeUrl_params, decodedIdTokenSchema, __unsafe_ssoSessionIdleSeconds, _a, autoLogoutParams, _b, autoLogin, postLoginRedirectUrl_default, __unsafe_clientSecret, _c, __unsafe_useIdTokenAsAccessToken, issuerUri, clientId, scopes, configId, log, _d, getExtraQueryParams, getExtraTokenParams, homeAndCallbackUrl, isHandled, stateQueryParamValue_instance, areThirdPartyCookiesAllowed, url1, url2, isUserStorePersistent, oidcClientTsUserManager, _e, loginOrGoToAuthServer, toCallBeforeReturningOidcLoggedIn, toCallBeforeReturningOidcNotLoggedIn, BROWSER_SESSION_NOT_FIRST_INIT_KEY, resultOfLoginProcess, common, oidc_notLoggedIn, currentTokens, autoLogoutCountdownTickCallbacks, onTokenChanges, oidc_loggedIn, sessionId, prOtherTabLogout, startCountdown_2, stopCountdown_1;
         var _this = this;
-        return __generator(this, function (_e) {
-            switch (_e.label) {
+        return __generator(this, function (_f) {
+            switch (_f.label) {
                 case 0:
-                    transformUrlBeforeRedirect = params.transformUrlBeforeRedirect, extraQueryParamsOrGetter = params.extraQueryParams, extraTokenParamsOrGetter = params.extraTokenParams, homeUrl_params = params.homeUrl, decodedIdTokenSchema = params.decodedIdTokenSchema, __unsafe_ssoSessionIdleSeconds = params.__unsafe_ssoSessionIdleSeconds, _a = params.autoLogoutParams, autoLogoutParams = _a === void 0 ? { redirectTo: "current page" } : _a, _b = params.autoLogin, autoLogin = _b === void 0 ? false : _b, postLoginRedirectUrl = params.postLoginRedirectUrl, __unsafe_clientSecret = params.__unsafe_clientSecret, _c = params.__unsafe_useIdTokenAsAccessToken, __unsafe_useIdTokenAsAccessToken = _c === void 0 ? false : _c;
+                    transformUrlBeforeRedirect = params.transformUrlBeforeRedirect, extraQueryParamsOrGetter = params.extraQueryParams, extraTokenParamsOrGetter = params.extraTokenParams, homeUrl_params = params.homeUrl, decodedIdTokenSchema = params.decodedIdTokenSchema, __unsafe_ssoSessionIdleSeconds = params.__unsafe_ssoSessionIdleSeconds, _a = params.autoLogoutParams, autoLogoutParams = _a === void 0 ? { redirectTo: "current page" } : _a, _b = params.autoLogin, autoLogin = _b === void 0 ? false : _b, postLoginRedirectUrl_default = params.postLoginRedirectUrl, __unsafe_clientSecret = params.__unsafe_clientSecret, _c = params.__unsafe_useIdTokenAsAccessToken, __unsafe_useIdTokenAsAccessToken = _c === void 0 ? false : _c;
                     issuerUri = preProcessedParams.issuerUri, clientId = preProcessedParams.clientId, scopes = preProcessedParams.scopes, configId = preProcessedParams.configId, log = preProcessedParams.log;
                     _d = __read([extraQueryParamsOrGetter, extraTokenParamsOrGetter].map(function (valueOrGetter) {
                         if (typeof valueOrGetter === "function") {
@@ -261,12 +247,29 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                     if (!isHandled) return [3 /*break*/, 2];
                     return [4 /*yield*/, new Promise(function () { })];
                 case 1:
-                    _e.sent();
-                    _e.label = 2;
+                    _f.sent();
+                    _f.label = 2;
                 case 2:
-                    USER_LOGGED_IN_KEY = "oidc-spa.user-logged-in:".concat(configId);
-                    localStorage.removeItem(USER_LOGGED_IN_KEY);
                     stateQueryParamValue_instance = (0, StateData_1.generateStateQueryParamValue)();
+                    {
+                        url1 = window.location.origin;
+                        url2 = issuerUri;
+                        areThirdPartyCookiesAllowed = (0, haveSharedParentDomain_1.getHaveSharedParentDomain)({
+                            url1: url1,
+                            url2: url2
+                        });
+                        if (areThirdPartyCookiesAllowed) {
+                            log === null || log === void 0 ? void 0 : log("".concat(url1, " and ").concat(url2, " have shared parent domain, third party cookies are allowed"));
+                        }
+                        else {
+                            log === null || log === void 0 ? void 0 : log([
+                                "".concat(url1, " and ").concat(url2, " don't have shared parent domain, setting third party cookies"),
+                                "on the auth server domain might not work. Making sure that everything works smoothly regardless",
+                                "by allowing oidc-spa to store the auth state in the session storage for a limited period of time."
+                            ].join(" "));
+                        }
+                    }
+                    isUserStorePersistent = !areThirdPartyCookiesAllowed;
                     oidcClientTsUserManager = new oidc_client_ts_and_jwt_decode_1.UserManager({
                         stateQueryParamValue: stateQueryParamValue_instance,
                         authority: issuerUri,
@@ -277,207 +280,29 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                         response_type: "code",
                         scope: Array.from(new Set(__spreadArray(["openid"], __read(scopes), false))).join(" "),
                         automaticSilentRenew: false,
-                        userStore: new oidc_client_ts_and_jwt_decode_1.WebStorageStateStore({ store: new oidc_client_ts_and_jwt_decode_1.InMemoryWebStorage() }),
+                        userStore: new oidc_client_ts_and_jwt_decode_1.WebStorageStateStore({
+                            store: areThirdPartyCookiesAllowed
+                                ? new oidc_client_ts_and_jwt_decode_1.InMemoryWebStorage()
+                                : (0, ephemeralSessionStorage_1.createEphemeralSessionStorage)({
+                                    sessionStorageTtlMs: 3 * 601000
+                                })
+                        }),
                         stateStore: new oidc_client_ts_and_jwt_decode_1.WebStorageStateStore({ store: localStorage, prefix: StateData_1.STATE_STORE_KEY_PREFIX }),
                         client_secret: __unsafe_clientSecret
                     });
-                    lastPublicUrl = undefined;
-                    startTrackingLastPublicUrl = function () {
-                        var realPushState = history.pushState.bind(history);
-                        history.pushState = function pushState() {
-                            var args = [];
-                            for (var _i = 0; _i < arguments.length; _i++) {
-                                args[_i] = arguments[_i];
-                            }
-                            lastPublicUrl = window.location.href;
-                            return realPushState.apply(void 0, __spreadArray([], __read(args), false));
-                        };
-                    };
-                    loginOrGoToAuthServer = function (params) { return __awaiter(_this, void 0, void 0, function () {
-                        var extraQueryParams_fromLoginFn, redirectUrl_params, transformUrlBeforeRedirect_fromLoginFn, rest, callback_1, redirectUrl, URL_real_1, URL_1, redirectMethod, extraQueryParams;
-                        return __generator(this, function (_a) {
-                            switch (_a.label) {
-                                case 0:
-                                    extraQueryParams_fromLoginFn = params.extraQueryParams, redirectUrl_params = params.redirectUrl, transformUrlBeforeRedirect_fromLoginFn = params.transformUrlBeforeRedirect, rest = __rest(params, ["extraQueryParams", "redirectUrl", "transformUrlBeforeRedirect"]);
-                                    log === null || log === void 0 ? void 0 : log("Calling loginOrGoToAuthServer", { params: params });
-                                    // NOTE: This is for handling cases when user press the back button on the login pages.
-                                    // When the app is hosted on https (so not in dev mode) the browser will restore the state of the app
-                                    // instead of reloading the page.
-                                    if (rest.action === "login") {
-                                        if (globalContext.hasLoginBeenCalled) {
-                                            log === null || log === void 0 ? void 0 : log("login() has already been called, ignoring the call");
-                                            return [2 /*return*/, new Promise(function () { })];
-                                        }
-                                        globalContext.hasLoginBeenCalled = true;
-                                        callback_1 = function () {
-                                            if (document.visibilityState === "visible") {
-                                                document.removeEventListener("visibilitychange", callback_1);
-                                                log === null || log === void 0 ? void 0 : log("We came back from the login pages and the state of the app has been restored");
-                                                if (rest.doesCurrentHrefRequiresAuth) {
-                                                    if (lastPublicUrl !== undefined) {
-                                                        log === null || log === void 0 ? void 0 : log("Loading last public route: ".concat(lastPublicUrl));
-                                                        window.location.href = lastPublicUrl;
-                                                    }
-                                                    else {
-                                                        log === null || log === void 0 ? void 0 : log("We don't know the last public route, navigating back in history");
-                                                        window.history.back();
-                                                    }
-                                                }
-                                                else {
-                                                    log === null || log === void 0 ? void 0 : log("The current page doesn't require auth...");
-                                                    if (localStorage.getItem(USER_LOGGED_IN_KEY)) {
-                                                        log === null || log === void 0 ? void 0 : log("but the user is now authenticated, reloading the page");
-                                                        location.reload();
-                                                    }
-                                                    else {
-                                                        log === null || log === void 0 ? void 0 : log("and the user doesn't seem to be authenticated, avoiding a reload");
-                                                        globalContext.hasLoginBeenCalled = false;
-                                                    }
-                                                }
-                                            }
-                                        };
-                                        log === null || log === void 0 ? void 0 : log("Start listening to visibility change event");
-                                        document.addEventListener("visibilitychange", callback_1);
-                                    }
-                                    redirectUrl = redirectUrl_params === undefined
-                                        ? window.location.href
-                                        : (0, toFullyQualifiedUrl_1.toFullyQualifiedUrl)({
-                                            urlish: redirectUrl_params,
-                                            doAssertNoQueryParams: false
-                                        });
-                                    log === null || log === void 0 ? void 0 : log("redirectUrl: ".concat(redirectUrl));
-                                    //NOTE: We know there is a extraQueryParameter option but it doesn't allow
-                                    // to control the encoding so we have to highjack global URL Class that is
-                                    // used internally by oidc-client-ts. It's save to do so since this is the
-                                    // last thing that will be done before the redirect.
-                                    {
-                                        URL_real_1 = globalContext.URL_real;
-                                        URL_1 = function () {
-                                            var args = [];
-                                            for (var _i = 0; _i < arguments.length; _i++) {
-                                                args[_i] = arguments[_i];
-                                            }
-                                            var urlInstance = new (URL_real_1.bind.apply(URL_real_1, __spreadArray([void 0], __read(args), false)))();
-                                            return new Proxy(urlInstance, {
-                                                get: function (target, prop) {
-                                                    if (prop === "href") {
-                                                        Object.defineProperty(window, "URL", { value: URL_real_1 });
-                                                        var url_1 = urlInstance.href;
-                                                        [
-                                                            [getExtraQueryParams === null || getExtraQueryParams === void 0 ? void 0 : getExtraQueryParams(), transformUrlBeforeRedirect],
-                                                            [
-                                                                extraQueryParams_fromLoginFn,
-                                                                transformUrlBeforeRedirect_fromLoginFn
-                                                            ]
-                                                        ].forEach(function (_a) {
-                                                            var e_2, _b;
-                                                            var _c = __read(_a, 2), extraQueryParams = _c[0], transformUrlBeforeRedirect = _c[1];
-                                                            add_extra_query_params: {
-                                                                if (extraQueryParams === undefined) {
-                                                                    break add_extra_query_params;
-                                                                }
-                                                                var url_obj = new URL_real_1(url_1);
-                                                                try {
-                                                                    for (var _d = __values(Object.entries(extraQueryParams)), _e = _d.next(); !_e.done; _e = _d.next()) {
-                                                                        var _f = __read(_e.value, 2), name_2 = _f[0], value = _f[1];
-                                                                        url_obj.searchParams.set(name_2, value);
-                                                                    }
-                                                                }
-                                                                catch (e_2_1) { e_2 = { error: e_2_1 }; }
-                                                                finally {
-                                                                    try {
-                                                                        if (_e && !_e.done && (_b = _d.return)) _b.call(_d);
-                                                                    }
-                                                                    finally { if (e_2) throw e_2.error; }
-                                                                }
-                                                                url_1 = url_obj.href;
-                                                            }
-                                                            apply_transform_before_redirect: {
-                                                                if (transformUrlBeforeRedirect === undefined) {
-                                                                    break apply_transform_before_redirect;
-                                                                }
-                                                                url_1 = transformUrlBeforeRedirect(url_1);
-                                                            }
-                                                        });
-                                                        return url_1;
-                                                    }
-                                                    //@ts-expect-error
-                                                    return target[prop];
-                                                }
-                                            });
-                                        };
-                                        Object.defineProperty(window, "URL", { value: URL_1 });
-                                    }
-                                    redirectMethod = (function () {
-                                        switch (rest.action) {
-                                            case "login":
-                                                return rest.doesCurrentHrefRequiresAuth ? "replace" : "assign";
-                                            case "go to auth server":
-                                                return "assign";
-                                        }
-                                    })();
-                                    log === null || log === void 0 ? void 0 : log("redirectMethod: ".concat(redirectMethod));
-                                    extraQueryParams = (function () {
-                                        var e_3, _a;
-                                        var extraQueryParams = extraQueryParams_fromLoginFn !== null && extraQueryParams_fromLoginFn !== void 0 ? extraQueryParams_fromLoginFn : {};
-                                        read_query_params_added_by_transform_before_redirect: {
-                                            if (transformUrlBeforeRedirect_fromLoginFn === undefined) {
-                                                break read_query_params_added_by_transform_before_redirect;
-                                            }
-                                            var url_afterTransform = void 0;
-                                            try {
-                                                url_afterTransform = transformUrlBeforeRedirect_fromLoginFn("https://dummy.com");
-                                            }
-                                            catch (_b) {
-                                                break read_query_params_added_by_transform_before_redirect;
-                                            }
-                                            try {
-                                                for (var _c = __values(new URL(url_afterTransform).searchParams), _d = _c.next(); !_d.done; _d = _c.next()) {
-                                                    var _e = __read(_d.value, 2), name_3 = _e[0], value = _e[1];
-                                                    extraQueryParams[name_3] = value;
-                                                }
-                                            }
-                                            catch (e_3_1) { e_3 = { error: e_3_1 }; }
-                                            finally {
-                                                try {
-                                                    if (_d && !_d.done && (_a = _c.return)) _a.call(_c);
-                                                }
-                                                finally { if (e_3) throw e_3.error; }
-                                            }
-                                        }
-                                        return { extraQueryParams: extraQueryParams };
-                                    })().extraQueryParams;
-                                    return [4 /*yield*/, oidcClientTsUserManager.signinRedirect({
-                                            state: (0, tsafe_1.id)({
-                                                context: "redirect",
-                                                redirectUrl: redirectUrl,
-                                                extraQueryParams: extraQueryParams,
-                                                hasBeenProcessedByCallback: false,
-                                                configId: configId,
-                                                action: "login",
-                                                redirectUrl_consentRequiredCase: (function () {
-                                                    switch (rest.action) {
-                                                        case "login":
-                                                            return lastPublicUrl !== null && lastPublicUrl !== void 0 ? lastPublicUrl : homeAndCallbackUrl;
-                                                        case "go to auth server":
-                                                            return redirectUrl;
-                                                    }
-                                                })()
-                                            }),
-                                            redirectMethod: redirectMethod,
-                                            prompt: (0, persistedLogoutState_1.getIsPersistedLogoutState)({ configId: configId }) ? "consent" : undefined
-                                        })];
-                                case 1:
-                                    _a.sent();
-                                    return [2 /*return*/, new Promise(function () { })];
-                            }
-                        });
-                    }); };
+                    _e = (0, loginOrGoToAuthServer_1.createLoginOrGoToAuthServer)({
+                        configId: configId,
+                        oidcClientTsUserManager: oidcClientTsUserManager,
+                        getExtraQueryParams: getExtraQueryParams,
+                        transformUrlBeforeRedirect: transformUrlBeforeRedirect,
+                        homeAndCallbackUrl: homeAndCallbackUrl,
+                        log: log
+                    }), loginOrGoToAuthServer = _e.loginOrGoToAuthServer, toCallBeforeReturningOidcLoggedIn = _e.toCallBeforeReturningOidcLoggedIn, toCallBeforeReturningOidcNotLoggedIn = _e.toCallBeforeReturningOidcNotLoggedIn;
                     BROWSER_SESSION_NOT_FIRST_INIT_KEY = "oidc-spa.browser-session-not-first-init:".concat(configId);
                     return [4 /*yield*/, (function () { return __awaiter(_this, void 0, void 0, function () {
-                            var authResponse, stateData, evtAuthResponseHandled_1, prHandled, _a, authResponseUrl, oidcClientTsUser, error_1, error_3, authResponseUrl, _b, result_loginSilent, authResponse, oidcClientTsUser, error_2, error_4;
-                            return __generator(this, function (_c) {
-                                switch (_c.label) {
+                            var authResponse, stateData, evtAuthResponseHandled_1, prHandled, _a, authResponseUrl, oidcClientTsUser, error_1, error_3, authResponseUrl, _b, oidcClientTsUser, _c, _d, persistedAuthState, result_loginSilent, authResponse, authResponse_error, oidcClientTsUser, error_2;
+                            return __generator(this, function (_e) {
+                                switch (_e.label) {
                                     case 0:
                                         authResponse = (function () {
                                             var value = sessionStorage.getItem(handleOidcCallback_1.AUTH_RESPONSE_KEY);
@@ -507,12 +332,12 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                         prHandled = evtAuthResponseHandled_1.waitFor();
                                         return [4 /*yield*/, Promise.resolve()];
                                     case 1:
-                                        _c.sent();
+                                        _e.sent();
                                         if (!(sessionStorage.getItem(handleOidcCallback_1.AUTH_RESPONSE_KEY) === null)) return [3 /*break*/, 3];
                                         return [4 /*yield*/, prHandled];
                                     case 2:
-                                        _c.sent();
-                                        _c.label = 3;
+                                        _e.sent();
+                                        _e.label = 3;
                                     case 3: return [3 /*break*/, 15];
                                     case 4:
                                         sessionStorage.removeItem(handleOidcCallback_1.AUTH_RESPONSE_KEY);
@@ -526,19 +351,19 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                         log === null || log === void 0 ? void 0 : log("Handling login redirect auth response", authResponse);
                                         authResponseUrl = (0, loginSilent_1.authResponseToUrl)(authResponse);
                                         oidcClientTsUser = undefined;
-                                        _c.label = 6;
+                                        _e.label = 6;
                                     case 6:
-                                        _c.trys.push([6, 8, , 9]);
+                                        _e.trys.push([6, 8, , 9]);
                                         return [4 /*yield*/, oidcClientTsUserManager
                                                 .signinRedirectCallback(authResponseUrl)
                                                 .finally(function () {
                                                 evtAuthResponseHandled_1.post();
                                             })];
                                     case 7:
-                                        oidcClientTsUser = _c.sent();
+                                        oidcClientTsUser = _e.sent();
                                         return [3 /*break*/, 9];
                                     case 8:
-                                        error_1 = _c.sent();
+                                        error_1 = _e.sent();
                                         (0, tsafe_1.assert)(error_1 instanceof Error);
                                         if (error_1.message === "Failed to fetch") {
                                             return [2 /*return*/, (0, OidcInitializationError_1.createFailedToFetchTokenEndpointInitializationError)({
@@ -556,7 +381,6 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                         return [2 /*return*/, error_1];
                                     case 9:
                                         sessionStorage.removeItem(BROWSER_SESSION_NOT_FIRST_INIT_KEY);
-                                        (0, persistedLogoutState_1.clearPersistedLogoutState)({ configId: configId });
                                         return [2 /*return*/, {
                                                 oidcClientTsUser: oidcClientTsUser,
                                                 backFromAuthServer: {
@@ -573,15 +397,15 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                     case 10:
                                         log === null || log === void 0 ? void 0 : log("Handling logout redirect auth response", authResponse);
                                         authResponseUrl = (0, loginSilent_1.authResponseToUrl)(authResponse);
-                                        _c.label = 11;
+                                        _e.label = 11;
                                     case 11:
-                                        _c.trys.push([11, 13, , 14]);
+                                        _e.trys.push([11, 13, , 14]);
                                         return [4 /*yield*/, oidcClientTsUserManager.signoutRedirectCallback(authResponseUrl)];
                                     case 12:
-                                        _c.sent();
+                                        _e.sent();
                                         return [3 /*break*/, 14];
                                     case 13:
-                                        _b = _c.sent();
+                                        _b = _e.sent();
                                         return [3 /*break*/, 14];
                                     case 14:
                                         evtAuthResponseHandled_1.post();
@@ -593,10 +417,47 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                         // NOTE: The user is no longer logged in.
                                         return [2 /*return*/, undefined];
                                     case 15:
+                                        if (!isUserStorePersistent) {
+                                            return [3 /*break*/, 24];
+                                        }
+                                        oidcClientTsUser = void 0;
+                                        _e.label = 16;
+                                    case 16:
+                                        _e.trys.push([16, 18, , 23]);
+                                        return [4 /*yield*/, oidcClientTsUserManager.getUser()];
+                                    case 17:
+                                        oidcClientTsUser = _e.sent();
+                                        return [3 /*break*/, 23];
+                                    case 18:
+                                        _c = _e.sent();
+                                        // NOTE: Not sure if it can throw, but let's be safe.
+                                        oidcClientTsUser = null;
+                                        _e.label = 19;
+                                    case 19:
+                                        _e.trys.push([19, 21, , 22]);
+                                        return [4 /*yield*/, oidcClientTsUserManager.removeUser()];
+                                    case 20:
+                                        _e.sent();
+                                        return [3 /*break*/, 22];
+                                    case 21:
+                                        _d = _e.sent();
+                                        return [3 /*break*/, 22];
+                                    case 22: return [3 /*break*/, 23];
+                                    case 23:
+                                        if (oidcClientTsUser === null) {
+                                            return [3 /*break*/, 24];
+                                        }
+                                        log === null || log === void 0 ? void 0 : log("Restored the auth from ephemeral session storage");
+                                        return [2 /*return*/, {
+                                                oidcClientTsUser: oidcClientTsUser,
+                                                backFromAuthServer: undefined
+                                            }];
+                                    case 24:
                                         log === null || log === void 0 ? void 0 : log("Trying to restore the auth from the http only cookie (silent signin with iframe)");
-                                        if ((0, persistedLogoutState_1.getIsPersistedLogoutState)({ configId: configId })) {
+                                        persistedAuthState = (0, persistedAuthState_1.getPersistedAuthState)({ configId: configId });
+                                        if (persistedAuthState === "explicitly logged out") {
                                             log === null || log === void 0 ? void 0 : log("Skipping silent signin with iframe, the user has logged out");
-                                            return [3 /*break*/, 21];
+                                            return [3 /*break*/, 33];
                                         }
                                         return [4 /*yield*/, (0, loginSilent_1.loginSilent)({
                                                 oidcClientTsUserManager: oidcClientTsUserManager,
@@ -604,9 +465,9 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                                 configId: configId,
                                                 getExtraTokenParams: getExtraTokenParams
                                             })];
-                                    case 16:
-                                        result_loginSilent = _c.sent();
-                                        (0, tsafe_1.assert)(result_loginSilent.outcome !== "refresh token used");
+                                    case 25:
+                                        result_loginSilent = _e.sent();
+                                        (0, tsafe_1.assert)(result_loginSilent.outcome !== "token refreshed using refresh token");
                                         if (result_loginSilent.outcome === "failure") {
                                             switch (result_loginSilent.cause) {
                                                 case "can't reach well-known oidc endpoint":
@@ -625,16 +486,17 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                         (0, tsafe_1.assert)();
                                         authResponse = result_loginSilent.authResponse;
                                         log === null || log === void 0 ? void 0 : log("Silent signin auth response", authResponse);
+                                        authResponse_error = authResponse["error"];
                                         oidcClientTsUser = undefined;
-                                        _c.label = 17;
-                                    case 17:
-                                        _c.trys.push([17, 19, , 20]);
+                                        _e.label = 26;
+                                    case 26:
+                                        _e.trys.push([26, 28, , 29]);
                                         return [4 /*yield*/, oidcClientTsUserManager.signinRedirectCallback((0, loginSilent_1.authResponseToUrl)(authResponse))];
-                                    case 18:
-                                        oidcClientTsUser = _c.sent();
-                                        return [3 /*break*/, 20];
-                                    case 19:
-                                        error_2 = _c.sent();
+                                    case 27:
+                                        oidcClientTsUser = _e.sent();
+                                        return [3 /*break*/, 29];
+                                    case 28:
+                                        error_2 = _e.sent();
                                         (0, tsafe_1.assert)(error_2 instanceof Error);
                                         if (error_2.message === "Failed to fetch") {
                                             return [2 /*return*/, (0, OidcInitializationError_1.createFailedToFetchTokenEndpointInitializationError)({
@@ -642,27 +504,46 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                                     issuerUri: issuerUri
                                                 })];
                                         }
-                                        {
-                                            error_4 = authResponse["error"];
-                                            if (error_4 !== undefined) {
-                                                // NOTE: This is a very expected case, it happens each time there's no active session.
-                                                log === null || log === void 0 ? void 0 : log([
-                                                    "The auth server responded with: ".concat(error_4, " "),
-                                                    "login_required" === error_4
-                                                        ? "(authentication_required just means that there's no active session for the user)"
-                                                        : ""
-                                                ].join(""));
-                                                return [3 /*break*/, 21];
-                                            }
+                                        if (authResponse_error === undefined) {
+                                            return [2 /*return*/, error_2];
                                         }
-                                        return [2 /*return*/, error_2];
-                                    case 20:
+                                        return [3 /*break*/, 29];
+                                    case 29:
+                                        if (!(oidcClientTsUser === undefined)) return [3 /*break*/, 32];
+                                        if (!(autoLogin ||
+                                            (persistedAuthState === "logged in" &&
+                                                (authResponse_error === "interaction_required" ||
+                                                    authResponse_error === "login_required" ||
+                                                    authResponse_error === "consent_required" ||
+                                                    authResponse_error === "account_selection_required")))) return [3 /*break*/, 31];
+                                        (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: undefined });
+                                        return [4 /*yield*/, loginOrGoToAuthServer({
+                                                action: "login",
+                                                doForceReloadOnBfCache: true,
+                                                redirectUrl: window.location.href,
+                                                doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: autoLogin,
+                                                extraQueryParams_local: undefined,
+                                                transformUrlBeforeRedirect_local: undefined,
+                                                doForceInteraction: false
+                                            })];
+                                    case 30:
+                                        _e.sent();
+                                        _e.label = 31;
+                                    case 31:
+                                        log === null || log === void 0 ? void 0 : log([
+                                            "The auth server responded with: ".concat(authResponse_error, " "),
+                                            "login_required" === authResponse_error
+                                                ? "(login_required just means that there's no active session for the user)"
+                                                : ""
+                                        ].join(""));
+                                        return [3 /*break*/, 33];
+                                    case 32:
                                         log === null || log === void 0 ? void 0 : log("Successful silent signed in");
                                         return [2 /*return*/, {
                                                 oidcClientTsUser: oidcClientTsUser,
                                                 backFromAuthServer: undefined
                                             }];
-                                    case 21: 
+                                    case 33: 
                                     // NOTE: The user is not logged in.
                                     return [2 /*return*/, undefined];
                                 }
@@ -714,70 +595,78 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                             return { tokens: tokens, backFromAuthServer: backFromAuthServer };
                         })];
                 case 3:
-                    resultOfLoginProcess = _e.sent();
+                    resultOfLoginProcess = _f.sent();
                     common = {
                         params: {
                             issuerUri: issuerUri,
                             clientId: clientId
                         }
                     };
-                    if (resultOfLoginProcess instanceof Error) {
-                        log === null || log === void 0 ? void 0 : log("User not logged in and there was an initialization error");
-                        error = resultOfLoginProcess;
-                        initializationError = error instanceof OidcInitializationError_1.OidcInitializationError
-                            ? error
-                            : new OidcInitializationError_1.OidcInitializationError({
-                                isAuthServerLikelyDown: false,
-                                messageOrCause: error
-                            });
-                        if (autoLogin) {
-                            throw initializationError;
+                    not_loggedIn_case: {
+                        if (!(resultOfLoginProcess instanceof Error) && resultOfLoginProcess !== undefined) {
+                            break not_loggedIn_case;
                         }
-                        console.error([
-                            "oidc-spa Initialization Error: ",
-                            "isAuthServerLikelyDown: ".concat(initializationError.isAuthServerLikelyDown),
-                            "",
-                            initializationError.message
-                        ].join("\n"));
-                        startTrackingLastPublicUrl();
-                        oidc_1 = (0, tsafe_1.id)(__assign(__assign({}, common), { isUserLoggedIn: false, login: function () { return __awaiter(_this, void 0, void 0, function () {
-                                return __generator(this, function (_a) {
-                                    alert("Authentication is currently unavailable. Please try again later.");
-                                    return [2 /*return*/, new Promise(function () { })];
-                                });
-                            }); }, initializationError: initializationError }));
-                        // @ts-expect-error: We know what we are doing.
-                        return [2 /*return*/, oidc_1];
+                        oidc_notLoggedIn = (function () {
+                            if (resultOfLoginProcess instanceof Error) {
+                                log === null || log === void 0 ? void 0 : log("User not logged in and there was an initialization error");
+                                var error = resultOfLoginProcess;
+                                var initializationError = error instanceof OidcInitializationError_1.OidcInitializationError
+                                    ? error
+                                    : new OidcInitializationError_1.OidcInitializationError({
+                                        isAuthServerLikelyDown: false,
+                                        messageOrCause: error
+                                    });
+                                if (autoLogin) {
+                                    throw initializationError;
+                                }
+                                console.error([
+                                    "oidc-spa Initialization Error: ",
+                                    "isAuthServerLikelyDown: ".concat(initializationError.isAuthServerLikelyDown),
+                                    "",
+                                    initializationError.message
+                                ].join("\n"));
+                                return (0, tsafe_1.id)(__assign(__assign({}, common), { isUserLoggedIn: false, login: function () { return __awaiter(_this, void 0, void 0, function () {
+                                        return __generator(this, function (_a) {
+                                            alert("Authentication is currently unavailable. Please try again later.");
+                                            return [2 /*return*/, new Promise(function () { })];
+                                        });
+                                    }); }, initializationError: initializationError }));
+                            }
+                            if (resultOfLoginProcess === undefined) {
+                                log === null || log === void 0 ? void 0 : log("User not logged in");
+                                return (0, tsafe_1.id)(__assign(__assign({}, common), { isUserLoggedIn: false, login: function (_a) {
+                                        var _b;
+                                        var doesCurrentHrefRequiresAuth = _a.doesCurrentHrefRequiresAuth, extraQueryParams = _a.extraQueryParams, redirectUrl = _a.redirectUrl, transformUrlBeforeRedirect = _a.transformUrlBeforeRedirect;
+                                        return loginOrGoToAuthServer({
+                                            action: "login",
+                                            doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: doesCurrentHrefRequiresAuth,
+                                            doForceReloadOnBfCache: false,
+                                            redirectUrl: (_b = redirectUrl !== null && redirectUrl !== void 0 ? redirectUrl : postLoginRedirectUrl_default) !== null && _b !== void 0 ? _b : window.location.href,
+                                            extraQueryParams_local: extraQueryParams,
+                                            transformUrlBeforeRedirect_local: transformUrlBeforeRedirect,
+                                            doForceInteraction: (0, persistedAuthState_1.getPersistedAuthState)({ configId: configId }) === "explicitly logged out"
+                                        });
+                                    }, initializationError: undefined }));
+                            }
+                            (0, tsafe_1.assert)(false);
+                        })();
+                        if ((0, persistedAuthState_1.getPersistedAuthState)({ configId: configId }) !== "explicitly logged out") {
+                            (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: undefined });
+                        }
+                        toCallBeforeReturningOidcNotLoggedIn();
+                        // @ts-expect-error: We know what we're doing
+                        return [2 /*return*/, oidc_notLoggedIn];
                     }
-                    if (!(resultOfLoginProcess === undefined)) return [3 /*break*/, 6];
-                    log === null || log === void 0 ? void 0 : log("User not logged in");
-                    if (!autoLogin) return [3 /*break*/, 5];
-                    log === null || log === void 0 ? void 0 : log("Authentication is required everywhere on this app, redirecting to the login page");
-                    return [4 /*yield*/, loginOrGoToAuthServer({
-                            action: "login",
-                            doesCurrentHrefRequiresAuth: true,
-                            redirectUrl: postLoginRedirectUrl
-                        })];
-                case 4:
-                    _e.sent();
-                    _e.label = 5;
-                case 5:
-                    startTrackingLastPublicUrl();
-                    oidc_2 = (0, tsafe_1.id)(__assign(__assign({}, common), { isUserLoggedIn: false, login: function (params) { return loginOrGoToAuthServer(__assign({ action: "login" }, params)); }, initializationError: undefined }));
-                    // @ts-expect-error: We know what we are doing.
-                    return [2 /*return*/, oidc_2];
-                case 6:
                     log === null || log === void 0 ? void 0 : log("User is logged in");
-                    localStorage.setItem(USER_LOGGED_IN_KEY, "true");
                     currentTokens = resultOfLoginProcess.tokens;
                     autoLogoutCountdownTickCallbacks = new Set();
                     onTokenChanges = new Set();
-                    oidc = (0, tsafe_1.id)(__assign(__assign({}, common), { isUserLoggedIn: true, getTokens: function () { return currentTokens; }, getTokens_next: function () { return __awaiter(_this, void 0, void 0, function () {
+                    oidc_loggedIn = (0, tsafe_1.id)(__assign(__assign({}, common), { isUserLoggedIn: true, getTokens: function () { return currentTokens; }, getTokens_next: function () { return __awaiter(_this, void 0, void 0, function () {
                             return __generator(this, function (_a) {
                                 switch (_a.label) {
                                     case 0:
-                                        if (!(getMsBeforeExpiration() <= 5000)) return [3 /*break*/, 2];
-                                        return [4 /*yield*/, oidc.renewTokens()];
+                                        if (!((0, oidcClientTsUserToTokens_1.getMsBeforeExpiration)(currentTokens) <= MIN_RENEW_BEFORE_EXPIRE_MS)) return [3 /*break*/, 2];
+                                        return [4 /*yield*/, oidc_loggedIn.renewTokens()];
                                     case 1:
                                         _a.sent();
                                         _a.label = 2;
@@ -785,9 +674,9 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                 }
                             });
                         }); }, getDecodedIdToken: function () { return currentTokens.decodedIdToken; }, logout: function (params) { return __awaiter(_this, void 0, void 0, function () {
-                            var postLogoutRedirectUrl, error_5;
-                            return __generator(this, function (_a) {
-                                switch (_a.label) {
+                            var postLogoutRedirectUrl, error_4, _a;
+                            return __generator(this, function (_b) {
+                                switch (_b.label) {
                                     case 0:
                                         if (globalContext.hasLogoutBeenCalled) {
                                             log === null || log === void 0 ? void 0 : log("logout() has already been called, ignoring the call");
@@ -812,9 +701,9 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                                     });
                                             }
                                         })();
-                                        _a.label = 1;
+                                        _b.label = 1;
                                     case 1:
-                                        _a.trys.push([1, 3, , 4]);
+                                        _b.trys.push([1, 3, , 10]);
                                         return [4 /*yield*/, oidcClientTsUserManager.signoutRedirect({
                                                 state: (0, tsafe_1.id)({
                                                     configId: configId,
@@ -827,25 +716,36 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                                 redirectMethod: "assign"
                                             })];
                                     case 2:
-                                        _a.sent();
-                                        return [3 /*break*/, 4];
+                                        _b.sent();
+                                        return [3 /*break*/, 10];
                                     case 3:
-                                        error_5 = _a.sent();
-                                        (0, tsafe_1.assert)((0, tsafe_1.is)(error_5));
-                                        if (error_5.message !== "No end session endpoint") {
-                                            throw error_5;
-                                        }
+                                        error_4 = _b.sent();
+                                        (0, tsafe_1.assert)((0, tsafe_1.is)(error_4));
+                                        if (!(error_4.message === "No end session endpoint")) return [3 /*break*/, 8];
                                         log === null || log === void 0 ? void 0 : log("No end session endpoint, managing logging state locally");
-                                        (0, persistedLogoutState_1.persistLogoutState)({ configId: configId });
+                                        (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: "explicitly logged out" });
+                                        _b.label = 4;
+                                    case 4:
+                                        _b.trys.push([4, 6, , 7]);
+                                        return [4 /*yield*/, oidcClientTsUserManager.removeUser()];
+                                    case 5:
+                                        _b.sent();
+                                        return [3 /*break*/, 7];
+                                    case 6:
+                                        _a = _b.sent();
+                                        return [3 /*break*/, 7];
+                                    case 7:
                                         window.location.href = postLogoutRedirectUrl;
-                                        return [3 /*break*/, 4];
-                                    case 4: return [2 /*return*/, new Promise(function () { })];
+                                        return [3 /*break*/, 9];
+                                    case 8: throw error_4;
+                                    case 9: return [3 /*break*/, 10];
+                                    case 10: return [2 /*return*/, new Promise(function () { })];
                                 }
                             });
                         }); }, renewTokens: (function () {
                             function renewTokens_nonMutexed(params) {
                                 return __awaiter(this, void 0, void 0, function () {
-                                    var extraTokenParams, result_loginSilent, oidcClientTsUser, _a, authResponse;
+                                    var extraTokenParams, result_loginSilent, oidcClientTsUser, _a, authResponse, authResponse_error, oidcClientTsUser_scope, error_5;
                                     return __generator(this, function (_b) {
                                         switch (_b.label) {
                                             case 0:
@@ -864,27 +764,60 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                                 }
                                                 _a = result_loginSilent.outcome;
                                                 switch (_a) {
-                                                    case "refresh token used": return [3 /*break*/, 2];
-                                                    case "success iframe": return [3 /*break*/, 3];
+                                                    case "token refreshed using refresh token": return [3 /*break*/, 2];
+                                                    case "got auth response from iframe": return [3 /*break*/, 3];
                                                 }
-                                                return [3 /*break*/, 5];
+                                                return [3 /*break*/, 10];
                                             case 2:
                                                 {
                                                     log === null || log === void 0 ? void 0 : log("Refresh token used");
                                                     oidcClientTsUser = result_loginSilent.oidcClientTsUser;
                                                 }
-                                                return [3 /*break*/, 6];
+                                                return [3 /*break*/, 11];
                                             case 3:
                                                 authResponse = result_loginSilent.authResponse;
                                                 log === null || log === void 0 ? void 0 : log("Tokens refresh using iframe", authResponse);
-                                                return [4 /*yield*/, oidcClientTsUserManager.signinRedirectCallback((0, loginSilent_1.authResponseToUrl)(authResponse))];
+                                                authResponse_error = authResponse["error"];
+                                                oidcClientTsUser_scope = undefined;
+                                                _b.label = 4;
                                             case 4:
-                                                oidcClientTsUser = _b.sent();
-                                                return [3 /*break*/, 6];
+                                                _b.trys.push([4, 6, , 7]);
+                                                return [4 /*yield*/, oidcClientTsUserManager.signinRedirectCallback((0, loginSilent_1.authResponseToUrl)(authResponse))];
                                             case 5:
-                                                (0, tsafe_1.assert)(false);
-                                                return [3 /*break*/, 6];
+                                                oidcClientTsUser_scope =
+                                                    _b.sent();
+                                                return [3 /*break*/, 7];
                                             case 6:
+                                                error_5 = _b.sent();
+                                                (0, tsafe_1.assert)(error_5 instanceof Error);
+                                                if (authResponse_error === undefined) {
+                                                    throw error_5;
+                                                }
+                                                oidcClientTsUser_scope = undefined;
+                                                return [3 /*break*/, 7];
+                                            case 7:
+                                                if (!(oidcClientTsUser_scope === undefined)) return [3 /*break*/, 9];
+                                                (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: undefined });
+                                                return [4 /*yield*/, loginOrGoToAuthServer({
+                                                        action: "login",
+                                                        redirectUrl: window.location.href,
+                                                        doForceReloadOnBfCache: true,
+                                                        extraQueryParams_local: undefined,
+                                                        transformUrlBeforeRedirect_local: undefined,
+                                                        doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: false,
+                                                        doForceInteraction: false
+                                                    })];
+                                            case 8:
+                                                _b.sent();
+                                                (0, tsafe_1.assert)(false);
+                                                _b.label = 9;
+                                            case 9:
+                                                oidcClientTsUser = oidcClientTsUser_scope;
+                                                return [3 /*break*/, 11];
+                                            case 10:
+                                                (0, tsafe_1.assert)(false);
+                                                return [3 /*break*/, 11];
+                                            case 11:
                                                 currentTokens = (0, oidcClientTsUserToTokens_1.oidcClientTsUserToTokens)({
                                                     oidcClientTsUser: oidcClientTsUser,
                                                     decodedIdTokenSchema: decodedIdTokenSchema,
@@ -964,7 +897,15 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                 autoLogoutCountdownTickCallbacks.delete(tickCallback);
                             };
                             return { unsubscribeFromAutoLogoutCountdown: unsubscribeFromAutoLogoutCountdown };
-                        }, goToAuthServer: function (params) { return loginOrGoToAuthServer(__assign({ action: "go to auth server" }, params)); }, backFromAuthServer: resultOfLoginProcess.backFromAuthServer, isNewBrowserSession: (function () {
+                        }, goToAuthServer: function (_a) {
+                            var extraQueryParams = _a.extraQueryParams, redirectUrl = _a.redirectUrl, transformUrlBeforeRedirect = _a.transformUrlBeforeRedirect;
+                            return loginOrGoToAuthServer({
+                                action: "go to auth server",
+                                redirectUrl: redirectUrl !== null && redirectUrl !== void 0 ? redirectUrl : window.location.href,
+                                extraQueryParams_local: extraQueryParams,
+                                transformUrlBeforeRedirect_local: transformUrlBeforeRedirect
+                            });
+                        }, backFromAuthServer: resultOfLoginProcess.backFromAuthServer, isNewBrowserSession: (function () {
                             if (sessionStorage.getItem(BROWSER_SESSION_NOT_FIRST_INIT_KEY) === null) {
                                 sessionStorage.setItem(BROWSER_SESSION_NOT_FIRST_INIT_KEY, "true");
                                 log === null || log === void 0 ? void 0 : log("This is a new browser session");
@@ -988,20 +929,22 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                     }
                     (function scheduleRenew() {
                         var _this = this;
-                        var msBeforeExpiration = getMsBeforeExpiration();
-                        // NOTE: Here semantically `"doesCurrentHrefRequiresAuth": false` is wrong.
-                        // The user may very well be on a page that require auth.
-                        // However there's no way to enforce the browser to redirect back to
-                        // the last public route if the user press back on the login page.
-                        // This is due to the fact that pushing to history only works if it's
-                        // triggered by a user interaction.
                         var login_dueToExpiration = function () {
+                            (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: undefined });
                             return loginOrGoToAuthServer({
                                 action: "login",
-                                doesCurrentHrefRequiresAuth: false
+                                redirectUrl: window.location.href,
+                                doForceReloadOnBfCache: true,
+                                extraQueryParams_local: undefined,
+                                transformUrlBeforeRedirect_local: undefined,
+                                // NOTE: Wether or not it's the preferred behavior, pushing to history
+                                // only works on user interaction so it have to be false
+                                doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: false,
+                                doForceInteraction: true
                             });
                         };
-                        if (msBeforeExpiration <= 2000) {
+                        var msBeforeExpiration = (0, oidcClientTsUserToTokens_1.getMsBeforeExpiration)(currentTokens);
+                        if (msBeforeExpiration <= MIN_RENEW_BEFORE_EXPIRE_MS) {
                             // NOTE: We just got a new token that is about to expire. This means that
                             // the refresh token has reached it's max SSO time.
                             login_dueToExpiration();
@@ -1010,7 +953,7 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                         // NOTE: We refresh the token 25 seconds before it expires.
                         // If the token expiration time is less than 25 seconds we refresh the token when
                         // only 1/10 of the token time is left.
-                        var renewMsBeforeExpires = Math.min(25000, msBeforeExpiration * 0.1);
+                        var renewMsBeforeExpires = Math.max(Math.min(25000, msBeforeExpiration * 0.1), MIN_RENEW_BEFORE_EXPIRE_MS);
                         log === null || log === void 0 ? void 0 : log([
                             (0, toHumanReadableDuration_1.toHumanReadableDuration)(msBeforeExpiration),
                             "before expiration of the access token.",
@@ -1025,7 +968,7 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                         _b.label = 1;
                                     case 1:
                                         _b.trys.push([1, 3, , 5]);
-                                        return [4 /*yield*/, oidc.renewTokens()];
+                                        return [4 /*yield*/, oidc_loggedIn.renewTokens()];
                                     case 2:
                                         _b.sent();
                                         return [3 /*break*/, 5];
@@ -1039,7 +982,7 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                 }
                             });
                         }); }, msBeforeExpiration - renewMsBeforeExpires);
-                        var tokenChangeUnsubscribe = oidc.subscribeToTokensChange(function () {
+                        var tokenChangeUnsubscribe = oidc_loggedIn.subscribeToTokensChange(function () {
                             (0, workerTimers_1.clearTimeout)(timer);
                             tokenChangeUnsubscribe();
                             scheduleRenew();
@@ -1074,13 +1017,13 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                     return tickCallback({ secondsLeft: secondsLeft });
                                 });
                                 if (secondsLeft === 0) {
-                                    oidc.logout(autoLogoutParams);
+                                    oidc_loggedIn.logout(autoLogoutParams);
                                 }
                             }
                         }).startCountdown;
                         stopCountdown_1 = undefined;
                         if (globalContext.$isUserActive === undefined) {
-                            globalContext.$isUserActive = (0, createIsUserActive_1.create$isUserActive)({
+                            globalContext.$isUserActive = (0, isUserActive_1.create$isUserActive)({
                                 configId: configId,
                                 sessionId: sessionId
                             });
@@ -1098,7 +1041,16 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                             }
                         });
                     }
-                    return [2 /*return*/, oidc];
+                    {
+                        if ((0, persistedAuthState_1.getPersistedAuthState)({ configId: configId }) !== undefined) {
+                            (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: undefined });
+                        }
+                        if (!areThirdPartyCookiesAllowed) {
+                            (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: "logged in" });
+                        }
+                    }
+                    toCallBeforeReturningOidcLoggedIn();
+                    return [2 /*return*/, oidc_loggedIn];
             }
         });
     });