oidc-spa 6.5.2 → 6.6.0

package/oidc/createOidc.js

@@ -102,31 +102,33 @@ var tsafe_1 = require("../vendor/frontend/tsafe");
 var workerTimers_1 = require("../tools/workerTimers");
 var Deferred_1 = require("../tools/Deferred");
 var decodeJwt_1 = require("../tools/decodeJwt");
-var isUserActive_1 = require("./isUserActive");
+var evtIsUserActive_1 = require("./evtIsUserActive");
 var startCountdown_1 = require("../tools/startCountdown");
 var toHumanReadableDuration_1 = require("../tools/toHumanReadableDuration");
 var toFullyQualifiedUrl_1 = require("../tools/toFullyQualifiedUrl");
 var OidcInitializationError_1 = require("./OidcInitializationError");
 var StateData_1 = require("./StateData");
 var logoutPropagationToOtherTabs_1 = require("./logoutPropagationToOtherTabs");
+var loginPropagationToOtherTabs_1 = require("./loginPropagationToOtherTabs");
 var configId_1 = require("./configId");
 var oidcClientTsUserToTokens_1 = require("./oidcClientTsUserToTokens");
 var loginSilent_1 = require("./loginSilent");
+var AuthResponse_1 = require("./AuthResponse");
 var handleOidcCallback_1 = require("./handleOidcCallback");
 var persistedAuthState_1 = require("./persistedAuthState");
-var AwaitableEventEmitter_1 = require("../tools/AwaitableEventEmitter");
+var Evt_1 = require("../tools/Evt");
 var haveSharedParentDomain_1 = require("../tools/haveSharedParentDomain");
 var loginOrGoToAuthServer_1 = require("./loginOrGoToAuthServer");
-var ephemeralSessionStorage_1 = require("../tools/ephemeralSessionStorage");
-// NOTE: Replaced at build time
-var VERSION = "6.5.2";
+var EphemeralSessionStorage_1 = require("../tools/EphemeralSessionStorage");
+var ongoingLoginOrRefreshProcesses_1 = require("./ongoingLoginOrRefreshProcesses");
 (0, handleOidcCallback_1.handleOidcCallback)();
+// NOTE: Replaced at build time
+var VERSION = "6.6.0";
 var GLOBAL_CONTEXT_KEY = "__oidc-spa.createOidc.globalContext";
 (_a = window[GLOBAL_CONTEXT_KEY]) !== null && _a !== void 0 ? _a : (window[GLOBAL_CONTEXT_KEY] = {
     prOidcByConfigId: new Map(),
-    evtAuthResponseHandled: (0, AwaitableEventEmitter_1.createAwaitableEventEmitter)(),
-    $isUserActive: undefined,
-    hasLogoutBeenCalled: false
+    hasLogoutBeenCalled: false,
+    evtRequestToPersistTokens: (0, Evt_1.createEvt)()
 });
 var globalContext = window[GLOBAL_CONTEXT_KEY];
 var MIN_RENEW_BEFORE_EXPIRE_MS = 2000;
@@ -215,10 +217,10 @@ function createOidc(params) {
 }
 function createOidc_nonMemoized(params, preProcessedParams) {
     return __awaiter(this, void 0, void 0, function () {
-        var transformUrlBeforeRedirect, extraQueryParamsOrGetter, extraTokenParamsOrGetter, homeUrl_params, decodedIdTokenSchema, __unsafe_ssoSessionIdleSeconds, _a, autoLogoutParams, _b, autoLogin, postLoginRedirectUrl_default, __unsafe_clientSecret, _c, __unsafe_useIdTokenAsAccessToken, issuerUri, clientId, scopes, configId, log, _d, getExtraQueryParams, getExtraTokenParams, homeAndCallbackUrl, isHandled, stateQueryParamValue_instance, areThirdPartyCookiesAllowed, url1, url2, isUserStorePersistent, oidcClientTsUserManager, _e, loginOrGoToAuthServer, toCallBeforeReturningOidcLoggedIn, toCallBeforeReturningOidcNotLoggedIn, BROWSER_SESSION_NOT_FIRST_INIT_KEY, resultOfLoginProcess, common, oidc_notLoggedIn, currentTokens, autoLogoutCountdownTickCallbacks, onTokenChanges, oidc_loggedIn, sessionId, prOtherTabLogout, startCountdown_2, stopCountdown_1;
+        var transformUrlBeforeRedirect, extraQueryParamsOrGetter, extraTokenParamsOrGetter, homeUrl_params, decodedIdTokenSchema, __unsafe_ssoSessionIdleSeconds, _a, autoLogoutParams, _b, autoLogin, postLoginRedirectUrl_default, __unsafe_clientSecret, _c, __unsafe_useIdTokenAsAccessToken, issuerUri, clientId, scopes, configId, log, _d, getExtraQueryParams, getExtraTokenParams, homeAndCallbackUrl, isHandled, stateQueryParamValue_instance, areThirdPartyCookiesAllowed, url1, url2, isUserStoreInMemoryOnly, oidcClientTsUserManager, evtIsUserLoggedIn, loginOrGoToAuthServer, BROWSER_SESSION_NOT_FIRST_INIT_KEY, completeLoginOrRefreshProcess, resultOfLoginProcess, oidc_common, oidc_notLoggedIn, prOtherTabLogin, currentTokens, autoLogoutCountdownTickCallbacks, onTokenChanges, oidc_loggedIn, sessionId, prOtherTabLogout, startCountdown_2, stopCountdown_1, evtIsUserActive;
         var _this = this;
-        return __generator(this, function (_f) {
-            switch (_f.label) {
+        return __generator(this, function (_e) {
+            switch (_e.label) {
                 case 0:
                     transformUrlBeforeRedirect = params.transformUrlBeforeRedirect, extraQueryParamsOrGetter = params.extraQueryParams, extraTokenParamsOrGetter = params.extraTokenParams, homeUrl_params = params.homeUrl, decodedIdTokenSchema = params.decodedIdTokenSchema, __unsafe_ssoSessionIdleSeconds = params.__unsafe_ssoSessionIdleSeconds, _a = params.autoLogoutParams, autoLogoutParams = _a === void 0 ? { redirectTo: "current page" } : _a, _b = params.autoLogin, autoLogin = _b === void 0 ? false : _b, postLoginRedirectUrl_default = params.postLoginRedirectUrl, __unsafe_clientSecret = params.__unsafe_clientSecret, _c = params.__unsafe_useIdTokenAsAccessToken, __unsafe_useIdTokenAsAccessToken = _c === void 0 ? false : _c;
                     issuerUri = preProcessedParams.issuerUri, clientId = preProcessedParams.clientId, scopes = preProcessedParams.scopes, configId = preProcessedParams.configId, log = preProcessedParams.log;
@@ -247,8 +249,8 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                     if (!isHandled) return [3 /*break*/, 2];
                     return [4 /*yield*/, new Promise(function () { })];
                 case 1:
-                    _f.sent();
-                    _f.label = 2;
+                    _e.sent();
+                    _e.label = 2;
                 case 2:
                     stateQueryParamValue_instance = (0, StateData_1.generateStateQueryParamValue)();
                     {
@@ -269,7 +271,6 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                             ].join(" "));
                         }
                     }
-                    isUserStorePersistent = !areThirdPartyCookiesAllowed;
                     oidcClientTsUserManager = new oidc_client_ts_and_jwt_decode_1.UserManager({
                         stateQueryParamValue: stateQueryParamValue_instance,
                         authority: issuerUri,
@@ -281,88 +282,71 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                         scope: Array.from(new Set(__spreadArray(["openid"], __read(scopes), false))).join(" "),
                         automaticSilentRenew: false,
                         userStore: new oidc_client_ts_and_jwt_decode_1.WebStorageStateStore({
-                            store: areThirdPartyCookiesAllowed
-                                ? new oidc_client_ts_and_jwt_decode_1.InMemoryWebStorage()
-                                : (0, ephemeralSessionStorage_1.createEphemeralSessionStorage)({
-                                    sessionStorageTtlMs: 3 * 601000
-                                })
+                            store: (function () {
+                                if (areThirdPartyCookiesAllowed) {
+                                    isUserStoreInMemoryOnly = true;
+                                    return new oidc_client_ts_and_jwt_decode_1.InMemoryWebStorage();
+                                }
+                                isUserStoreInMemoryOnly = false;
+                                var storage = (0, EphemeralSessionStorage_1.createEphemeralSessionStorage)({
+                                    sessionStorageTtlMs: 3 * 60000
+                                });
+                                var evtRequestToPersistTokens = globalContext.evtRequestToPersistTokens;
+                                evtRequestToPersistTokens.subscribe(function (_a) {
+                                    var configIdOfInstancePostingTheRequest = _a.configIdOfInstancePostingTheRequest;
+                                    if (configIdOfInstancePostingTheRequest === configId) {
+                                        return;
+                                    }
+                                    storage.persistCurrentStateAndSubsequentChanges();
+                                });
+                                return storage;
+                            })()
                         }),
                         stateStore: new oidc_client_ts_and_jwt_decode_1.WebStorageStateStore({ store: localStorage, prefix: StateData_1.STATE_STORE_KEY_PREFIX }),
                         client_secret: __unsafe_clientSecret
                     });
-                    _e = (0, loginOrGoToAuthServer_1.createLoginOrGoToAuthServer)({
+                    evtIsUserLoggedIn = (0, Evt_1.createEvt)();
+                    loginOrGoToAuthServer = (0, loginOrGoToAuthServer_1.createLoginOrGoToAuthServer)({
                         configId: configId,
                         oidcClientTsUserManager: oidcClientTsUserManager,
                         getExtraQueryParams: getExtraQueryParams,
                         transformUrlBeforeRedirect: transformUrlBeforeRedirect,
                         homeAndCallbackUrl: homeAndCallbackUrl,
+                        evtIsUserLoggedIn: evtIsUserLoggedIn,
                         log: log
-                    }), loginOrGoToAuthServer = _e.loginOrGoToAuthServer, toCallBeforeReturningOidcLoggedIn = _e.toCallBeforeReturningOidcLoggedIn, toCallBeforeReturningOidcNotLoggedIn = _e.toCallBeforeReturningOidcNotLoggedIn;
+                    }).loginOrGoToAuthServer;
                     BROWSER_SESSION_NOT_FIRST_INIT_KEY = "oidc-spa.browser-session-not-first-init:".concat(configId);
+                    return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.startLoginOrRefreshProcess)()];
+                case 3:
+                    completeLoginOrRefreshProcess = (_e.sent()).completeLoginOrRefreshProcess;
                     return [4 /*yield*/, (function () { return __awaiter(_this, void 0, void 0, function () {
-                            var authResponse, stateData, evtAuthResponseHandled_1, prHandled, _a, authResponseUrl, oidcClientTsUser, error_1, error_3, authResponseUrl, _b, oidcClientTsUser, _c, _d, persistedAuthState, result_loginSilent, authResponse, authResponse_error, oidcClientTsUser, error_2;
+                            var authResponseAndStateData, authResponse, stateData, _a, authResponseUrl, oidcClientTsUser, error_1, authResponse_error, authResponseUrl, _b, oidcClientTsUser, _c, _d, persistedAuthState, result_loginSilent, authResponse, authResponse_error, oidcClientTsUser, error_2;
                             return __generator(this, function (_e) {
                                 switch (_e.label) {
                                     case 0:
-                                        authResponse = (function () {
-                                            var value = sessionStorage.getItem(handleOidcCallback_1.AUTH_RESPONSE_KEY);
-                                            if (value === null) {
-                                                return undefined;
-                                            }
-                                            var authResponse;
-                                            try {
-                                                authResponse = JSON.parse(value);
-                                                (0, tsafe_1.assert)((0, tsafe_1.typeGuard)(authResponse, authResponse instanceof Object &&
-                                                    Object.values(authResponse).every(function (value) { return typeof value === "string"; })), "Valid json but not expected shape");
-                                            }
-                                            catch (error) {
-                                                console.error("Failed to parse auth response from callback URL ".concat(String(error)));
-                                                return undefined;
-                                            }
-                                            return authResponse;
-                                        })();
-                                        if (authResponse === undefined) {
-                                            return [3 /*break*/, 15];
+                                        authResponseAndStateData = (0, handleOidcCallback_1.retrieveRedirectAuthResponseAndStateData)({ configId: configId });
+                                        if (authResponseAndStateData === undefined) {
+                                            return [3 /*break*/, 11];
                                         }
-                                        stateData = (0, StateData_1.getStateData)({ stateQueryParamValue: authResponse["state"] });
-                                        (0, tsafe_1.assert)(stateData !== undefined);
-                                        (0, tsafe_1.assert)(stateData.context === "redirect");
-                                        evtAuthResponseHandled_1 = globalContext.evtAuthResponseHandled;
-                                        if (!(stateData.configId !== configId)) return [3 /*break*/, 4];
-                                        prHandled = evtAuthResponseHandled_1.waitFor();
-                                        return [4 /*yield*/, Promise.resolve()];
-                                    case 1:
-                                        _e.sent();
-                                        if (!(sessionStorage.getItem(handleOidcCallback_1.AUTH_RESPONSE_KEY) === null)) return [3 /*break*/, 3];
-                                        return [4 /*yield*/, prHandled];
-                                    case 2:
-                                        _e.sent();
-                                        _e.label = 3;
-                                    case 3: return [3 /*break*/, 15];
-                                    case 4:
-                                        sessionStorage.removeItem(handleOidcCallback_1.AUTH_RESPONSE_KEY);
+                                        authResponse = authResponseAndStateData.authResponse, stateData = authResponseAndStateData.stateData;
                                         _a = stateData.action;
                                         switch (_a) {
-                                            case "login": return [3 /*break*/, 5];
-                                            case "logout": return [3 /*break*/, 10];
+                                            case "login": return [3 /*break*/, 1];
+                                            case "logout": return [3 /*break*/, 6];
                                         }
-                                        return [3 /*break*/, 15];
-                                    case 5:
+                                        return [3 /*break*/, 11];
+                                    case 1:
                                         log === null || log === void 0 ? void 0 : log("Handling login redirect auth response", authResponse);
-                                        authResponseUrl = (0, loginSilent_1.authResponseToUrl)(authResponse);
+                                        authResponseUrl = (0, AuthResponse_1.authResponseToUrl)(authResponse);
                                         oidcClientTsUser = undefined;
-                                        _e.label = 6;
-                                    case 6:
-                                        _e.trys.push([6, 8, , 9]);
-                                        return [4 /*yield*/, oidcClientTsUserManager
-                                                .signinRedirectCallback(authResponseUrl)
-                                                .finally(function () {
-                                                evtAuthResponseHandled_1.post();
-                                            })];
-                                    case 7:
+                                        _e.label = 2;
+                                    case 2:
+                                        _e.trys.push([2, 4, , 5]);
+                                        return [4 /*yield*/, oidcClientTsUserManager.signinRedirectCallback(authResponseUrl)];
+                                    case 3:
                                         oidcClientTsUser = _e.sent();
-                                        return [3 /*break*/, 9];
-                                    case 8:
+                                        return [3 /*break*/, 5];
+                                    case 4:
                                         error_1 = _e.sent();
                                         (0, tsafe_1.assert)(error_1 instanceof Error);
                                         if (error_1.message === "Failed to fetch") {
@@ -372,43 +356,51 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                                 })];
                                         }
                                         {
-                                            error_3 = authResponse["error"];
-                                            if (error_3 !== undefined) {
-                                                log === null || log === void 0 ? void 0 : log("The auth server responded with: ".concat(error_3, ", trying to restore from the http only cookie"));
-                                                return [3 /*break*/, 15];
+                                            authResponse_error = authResponse.error;
+                                            if (authResponse_error !== undefined) {
+                                                log === null || log === void 0 ? void 0 : log("The auth server responded with: ".concat(authResponse_error, ", trying to restore from the http only cookie"));
+                                                return [3 /*break*/, 11];
                                             }
                                         }
                                         return [2 /*return*/, error_1];
-                                    case 9:
+                                    case 5:
                                         sessionStorage.removeItem(BROWSER_SESSION_NOT_FIRST_INIT_KEY);
+                                        (0, loginPropagationToOtherTabs_1.notifyOtherTabsOfLogin)({ configId: configId });
                                         return [2 /*return*/, {
                                                 oidcClientTsUser: oidcClientTsUser,
                                                 backFromAuthServer: {
                                                     extraQueryParams: stateData.extraQueryParams,
-                                                    result: Object.fromEntries(Object.entries(authResponse).filter(function (_a) {
-                                                        var _b = __read(_a, 1), name = _b[0];
-                                                        return name !== "state" &&
-                                                            name !== "session_state" &&
-                                                            name !== "iss" &&
-                                                            name !== "code";
-                                                    }))
+                                                    result: Object.fromEntries(Object.entries(authResponse)
+                                                        .map(function (_a) {
+                                                        var _b = __read(_a, 2), name = _b[0], value = _b[1];
+                                                        if (name === "state" ||
+                                                            name === "session_state" ||
+                                                            name === "iss" ||
+                                                            name === "code") {
+                                                            return undefined;
+                                                        }
+                                                        if (value === undefined) {
+                                                            return undefined;
+                                                        }
+                                                        return [name, value];
+                                                    })
+                                                        .filter(function (entry) { return entry !== undefined; }))
                                                 }
                                             }];
-                                    case 10:
+                                    case 6:
                                         log === null || log === void 0 ? void 0 : log("Handling logout redirect auth response", authResponse);
-                                        authResponseUrl = (0, loginSilent_1.authResponseToUrl)(authResponse);
-                                        _e.label = 11;
-                                    case 11:
-                                        _e.trys.push([11, 13, , 14]);
+                                        authResponseUrl = (0, AuthResponse_1.authResponseToUrl)(authResponse);
+                                        _e.label = 7;
+                                    case 7:
+                                        _e.trys.push([7, 9, , 10]);
                                         return [4 /*yield*/, oidcClientTsUserManager.signoutRedirectCallback(authResponseUrl)];
-                                    case 12:
+                                    case 8:
                                         _e.sent();
-                                        return [3 /*break*/, 14];
-                                    case 13:
+                                        return [3 /*break*/, 10];
+                                    case 9:
                                         _b = _e.sent();
-                                        return [3 /*break*/, 14];
-                                    case 14:
-                                        evtAuthResponseHandled_1.post();
+                                        return [3 /*break*/, 10];
+                                    case 10:
                                         (0, logoutPropagationToOtherTabs_1.notifyOtherTabsOfLogout)({
                                             configId: configId,
                                             redirectUrl: stateData.redirectUrl,
@@ -416,48 +408,48 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                         });
                                         // NOTE: The user is no longer logged in.
                                         return [2 /*return*/, undefined];
-                                    case 15:
-                                        if (!isUserStorePersistent) {
-                                            return [3 /*break*/, 24];
+                                    case 11:
+                                        if (isUserStoreInMemoryOnly) {
+                                            return [3 /*break*/, 20];
                                         }
                                         oidcClientTsUser = void 0;
-                                        _e.label = 16;
-                                    case 16:
-                                        _e.trys.push([16, 18, , 23]);
+                                        _e.label = 12;
+                                    case 12:
+                                        _e.trys.push([12, 14, , 19]);
                                         return [4 /*yield*/, oidcClientTsUserManager.getUser()];
-                                    case 17:
+                                    case 13:
                                         oidcClientTsUser = _e.sent();
-                                        return [3 /*break*/, 23];
-                                    case 18:
+                                        return [3 /*break*/, 19];
+                                    case 14:
                                         _c = _e.sent();
                                         // NOTE: Not sure if it can throw, but let's be safe.
                                         oidcClientTsUser = null;
-                                        _e.label = 19;
-                                    case 19:
-                                        _e.trys.push([19, 21, , 22]);
+                                        _e.label = 15;
+                                    case 15:
+                                        _e.trys.push([15, 17, , 18]);
                                         return [4 /*yield*/, oidcClientTsUserManager.removeUser()];
-                                    case 20:
+                                    case 16:
                                         _e.sent();
-                                        return [3 /*break*/, 22];
-                                    case 21:
+                                        return [3 /*break*/, 18];
+                                    case 17:
                                         _d = _e.sent();
-                                        return [3 /*break*/, 22];
-                                    case 22: return [3 /*break*/, 23];
-                                    case 23:
+                                        return [3 /*break*/, 18];
+                                    case 18: return [3 /*break*/, 19];
+                                    case 19:
                                         if (oidcClientTsUser === null) {
-                                            return [3 /*break*/, 24];
+                                            return [3 /*break*/, 20];
                                         }
                                         log === null || log === void 0 ? void 0 : log("Restored the auth from ephemeral session storage");
                                         return [2 /*return*/, {
                                                 oidcClientTsUser: oidcClientTsUser,
                                                 backFromAuthServer: undefined
                                             }];
-                                    case 24:
+                                    case 20:
                                         log === null || log === void 0 ? void 0 : log("Trying to restore the auth from the http only cookie (silent signin with iframe)");
                                         persistedAuthState = (0, persistedAuthState_1.getPersistedAuthState)({ configId: configId });
                                         if (persistedAuthState === "explicitly logged out") {
                                             log === null || log === void 0 ? void 0 : log("Skipping silent signin with iframe, the user has logged out");
-                                            return [3 /*break*/, 33];
+                                            return [3 /*break*/, 30];
                                         }
                                         return [4 /*yield*/, (0, loginSilent_1.loginSilent)({
                                                 oidcClientTsUserManager: oidcClientTsUserManager,
@@ -465,7 +457,7 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                                 configId: configId,
                                                 getExtraTokenParams: getExtraTokenParams
                                             })];
-                                    case 25:
+                                    case 21:
                                         result_loginSilent = _e.sent();
                                         (0, tsafe_1.assert)(result_loginSilent.outcome !== "token refreshed using refresh token");
                                         if (result_loginSilent.outcome === "failure") {
@@ -486,16 +478,16 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                         (0, tsafe_1.assert)();
                                         authResponse = result_loginSilent.authResponse;
                                         log === null || log === void 0 ? void 0 : log("Silent signin auth response", authResponse);
-                                        authResponse_error = authResponse["error"];
+                                        authResponse_error = authResponse.error;
                                         oidcClientTsUser = undefined;
-                                        _e.label = 26;
-                                    case 26:
-                                        _e.trys.push([26, 28, , 29]);
-                                        return [4 /*yield*/, oidcClientTsUserManager.signinRedirectCallback((0, loginSilent_1.authResponseToUrl)(authResponse))];
-                                    case 27:
+                                        _e.label = 22;
+                                    case 22:
+                                        _e.trys.push([22, 24, , 25]);
+                                        return [4 /*yield*/, oidcClientTsUserManager.signinRedirectCallback((0, AuthResponse_1.authResponseToUrl)(authResponse))];
+                                    case 23:
                                         oidcClientTsUser = _e.sent();
-                                        return [3 /*break*/, 29];
-                                    case 28:
+                                        return [3 /*break*/, 25];
+                                    case 24:
                                         error_2 = _e.sent();
                                         (0, tsafe_1.assert)(error_2 instanceof Error);
                                         if (error_2.message === "Failed to fetch") {
@@ -507,16 +499,27 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                         if (authResponse_error === undefined) {
                                             return [2 /*return*/, error_2];
                                         }
-                                        return [3 /*break*/, 29];
-                                    case 29:
-                                        if (!(oidcClientTsUser === undefined)) return [3 /*break*/, 32];
+                                        return [3 /*break*/, 25];
+                                    case 25:
+                                        if (!(oidcClientTsUser === undefined)) return [3 /*break*/, 29];
                                         if (!(autoLogin ||
                                             (persistedAuthState === "logged in" &&
                                                 (authResponse_error === "interaction_required" ||
                                                     authResponse_error === "login_required" ||
                                                     authResponse_error === "consent_required" ||
-                                                    authResponse_error === "account_selection_required")))) return [3 /*break*/, 31];
+                                                    authResponse_error === "account_selection_required")))) return [3 /*break*/, 28];
                                         (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: undefined });
+                                        completeLoginOrRefreshProcess();
+                                        return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
+                                                prUnlock: new Promise(function () { })
+                                            })];
+                                    case 26:
+                                        _e.sent();
+                                        if (persistedAuthState === "logged in") {
+                                            globalContext.evtRequestToPersistTokens.post({
+                                                configIdOfInstancePostingTheRequest: configId
+                                            });
+                                        }
                                         return [4 /*yield*/, loginOrGoToAuthServer({
                                                 action: "login",
                                                 doForceReloadOnBfCache: true,
@@ -526,77 +529,39 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                                 transformUrlBeforeRedirect_local: undefined,
                                                 doForceInteraction: false
                                             })];
-                                    case 30:
+                                    case 27:
                                         _e.sent();
-                                        _e.label = 31;
-                                    case 31:
+                                        (0, tsafe_1.assert)(false);
+                                        _e.label = 28;
+                                    case 28:
                                         log === null || log === void 0 ? void 0 : log([
                                             "The auth server responded with: ".concat(authResponse_error, " "),
                                             "login_required" === authResponse_error
                                                 ? "(login_required just means that there's no active session for the user)"
                                                 : ""
                                         ].join(""));
-                                        return [3 /*break*/, 33];
-                                    case 32:
+                                        return [3 /*break*/, 30];
+                                    case 29:
                                         log === null || log === void 0 ? void 0 : log("Successful silent signed in");
                                         return [2 /*return*/, {
                                                 oidcClientTsUser: oidcClientTsUser,
                                                 backFromAuthServer: undefined
                                             }];
-                                    case 33: 
+                                    case 30: 
                                     // NOTE: The user is not logged in.
                                     return [2 /*return*/, undefined];
                                 }
                             });
-                        }); })().then(function (result) {
-                            if (result === undefined) {
-                                return undefined;
-                            }
-                            if (result instanceof Error) {
-                                return result;
-                            }
-                            var oidcClientTsUser = result.oidcClientTsUser, backFromAuthServer = result.backFromAuthServer;
-                            log_real_decoded_id_token: {
-                                if (log === undefined) {
-                                    break log_real_decoded_id_token;
-                                }
-                                var idToken = oidcClientTsUser.id_token;
-                                if (idToken === undefined) {
-                                    break log_real_decoded_id_token;
-                                }
-                                var decodedIdToken = (0, decodeJwt_1.decodeJwt)(idToken);
-                                log([
-                                    "Decoded ID token",
-                                    decodedIdTokenSchema === undefined ? "" : " before `decodedIdTokenSchema.parse()`\n",
-                                    JSON.stringify(decodedIdToken, null, 2)
-                                ].join(""));
-                                if (decodedIdTokenSchema === undefined) {
-                                    break log_real_decoded_id_token;
-                                }
-                                log([
-                                    "Decoded ID token after `decodedIdTokenSchema.parse()`\n",
-                                    JSON.stringify(decodedIdTokenSchema.parse(decodedIdToken), null, 2)
-                                ].join(""));
-                            }
-                            var tokens = (0, oidcClientTsUserToTokens_1.oidcClientTsUserToTokens)({
-                                oidcClientTsUser: oidcClientTsUser,
-                                decodedIdTokenSchema: decodedIdTokenSchema,
-                                __unsafe_useIdTokenAsAccessToken: __unsafe_useIdTokenAsAccessToken,
-                                decodedIdToken_previous: undefined,
-                                log: log
-                            });
-                            if (tokens.refreshTokenExpirationTime < tokens.accessTokenExpirationTime) {
-                                console.warn([
-                                    "The OIDC refresh token shorter than the one of the access token.",
-                                    "This is very unusual and probably a misconfiguration.",
-                                    "Check your oidc server configuration for ".concat(clientId, " ").concat(issuerUri)
-                                ].join(" "));
-                            }
-                            return { tokens: tokens, backFromAuthServer: backFromAuthServer };
+                        }); })()];
+                case 4:
+                    resultOfLoginProcess = _e.sent();
+                    completeLoginOrRefreshProcess();
+                    return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
+                            prUnlock: Promise.resolve()
                         })];
-                case 3:
-                    resultOfLoginProcess = _f.sent();
-                    common = {
+                case 5:
+                    _e.sent();
+                    oidc_common = {
                         params: {
                             issuerUri: issuerUri,
                             clientId: clientId
@@ -606,6 +571,10 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                         if (!(resultOfLoginProcess instanceof Error) && resultOfLoginProcess !== undefined) {
                             break not_loggedIn_case;
                         }
+                        evtIsUserLoggedIn.post(false);
+                        if ((0, persistedAuthState_1.getPersistedAuthState)({ configId: configId }) !== "explicitly logged out") {
+                            (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: undefined });
+                        }
                         oidc_notLoggedIn = (function () {
                             if (resultOfLoginProcess instanceof Error) {
                                 log === null || log === void 0 ? void 0 : log("User not logged in and there was an initialization error");
@@ -625,7 +594,7 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                     "",
                                     initializationError.message
                                 ].join("\n"));
-                                return (0, tsafe_1.id)(__assign(__assign({}, common), { isUserLoggedIn: false, login: function () { return __awaiter(_this, void 0, void 0, function () {
+                                return (0, tsafe_1.id)(__assign(__assign({}, oidc_common), { isUserLoggedIn: false, login: function () { return __awaiter(_this, void 0, void 0, function () {
                                         return __generator(this, function (_a) {
                                             alert("Authentication is currently unavailable. Please try again later.");
                                             return [2 /*return*/, new Promise(function () { })];
@@ -634,34 +603,80 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                             }
                             if (resultOfLoginProcess === undefined) {
                                 log === null || log === void 0 ? void 0 : log("User not logged in");
-                                return (0, tsafe_1.id)(__assign(__assign({}, common), { isUserLoggedIn: false, login: function (_a) {
-                                        var _b;
-                                        var doesCurrentHrefRequiresAuth = _a.doesCurrentHrefRequiresAuth, extraQueryParams = _a.extraQueryParams, redirectUrl = _a.redirectUrl, transformUrlBeforeRedirect = _a.transformUrlBeforeRedirect;
-                                        return loginOrGoToAuthServer({
-                                            action: "login",
-                                            doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: doesCurrentHrefRequiresAuth,
-                                            doForceReloadOnBfCache: false,
-                                            redirectUrl: (_b = redirectUrl !== null && redirectUrl !== void 0 ? redirectUrl : postLoginRedirectUrl_default) !== null && _b !== void 0 ? _b : window.location.href,
-                                            extraQueryParams_local: extraQueryParams,
-                                            transformUrlBeforeRedirect_local: transformUrlBeforeRedirect,
-                                            doForceInteraction: (0, persistedAuthState_1.getPersistedAuthState)({ configId: configId }) === "explicitly logged out"
+                                return (0, tsafe_1.id)(__assign(__assign({}, oidc_common), { isUserLoggedIn: false, login: function (_a) { return __awaiter(_this, [_a], void 0, function (_b) {
+                                        var _c;
+                                        var doesCurrentHrefRequiresAuth = _b.doesCurrentHrefRequiresAuth, extraQueryParams = _b.extraQueryParams, redirectUrl = _b.redirectUrl, transformUrlBeforeRedirect = _b.transformUrlBeforeRedirect;
+                                        return __generator(this, function (_d) {
+                                            switch (_d.label) {
+                                                case 0: return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
+                                                        prUnlock: (0, loginOrGoToAuthServer_1.getPrSafelyRestoredFromBfCacheAfterLoginBackNavigation)()
+                                                    })];
+                                                case 1:
+                                                    _d.sent();
+                                                    return [2 /*return*/, loginOrGoToAuthServer({
+                                                            action: "login",
+                                                            doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: doesCurrentHrefRequiresAuth,
+                                                            doForceReloadOnBfCache: false,
+                                                            redirectUrl: (_c = redirectUrl !== null && redirectUrl !== void 0 ? redirectUrl : postLoginRedirectUrl_default) !== null && _c !== void 0 ? _c : window.location.href,
+                                                            extraQueryParams_local: extraQueryParams,
+                                                            transformUrlBeforeRedirect_local: transformUrlBeforeRedirect,
+                                                            doForceInteraction: (0, persistedAuthState_1.getPersistedAuthState)({ configId: configId }) === "explicitly logged out"
+                                                        })];
+                                            }
                                         });
-                                    }, initializationError: undefined }));
+                                    }); }, initializationError: undefined }));
                             }
                             (0, tsafe_1.assert)(false);
                         })();
-                        if ((0, persistedAuthState_1.getPersistedAuthState)({ configId: configId }) !== "explicitly logged out") {
-                            (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: undefined });
+                        {
+                            prOtherTabLogin = (0, loginPropagationToOtherTabs_1.getPrOtherTabLogin)({
+                                configId: configId
+                            }).prOtherTabLogin;
+                            prOtherTabLogin.then(function () { return __awaiter(_this, void 0, void 0, function () {
+                                return __generator(this, function (_a) {
+                                    switch (_a.label) {
+                                        case 0:
+                                            log === null || log === void 0 ? void 0 : log("Other tab has logged in, reloading this tab");
+                                            return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
+                                                    prUnlock: new Promise(function () { })
+                                                })];
+                                        case 1:
+                                            _a.sent();
+                                            window.location.reload();
+                                            return [2 /*return*/];
+                                    }
+                                });
+                            }); });
                         }
-                        toCallBeforeReturningOidcNotLoggedIn();
                         // @ts-expect-error: We know what we're doing
                         return [2 /*return*/, oidc_notLoggedIn];
                     }
                     log === null || log === void 0 ? void 0 : log("User is logged in");
-                    currentTokens = resultOfLoginProcess.tokens;
+                    evtIsUserLoggedIn.post(true);
+                    currentTokens = (0, oidcClientTsUserToTokens_1.oidcClientTsUserToTokens)({
+                        oidcClientTsUser: resultOfLoginProcess.oidcClientTsUser,
+                        decodedIdTokenSchema: decodedIdTokenSchema,
+                        __unsafe_useIdTokenAsAccessToken: __unsafe_useIdTokenAsAccessToken,
+                        decodedIdToken_previous: undefined,
+                        log: log
+                    });
+                    {
+                        if ((0, persistedAuthState_1.getPersistedAuthState)({ configId: configId }) !== undefined) {
+                            (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: undefined });
+                        }
+                        if (!areThirdPartyCookiesAllowed) {
+                            (0, persistedAuthState_1.persistAuthState)({
+                                configId: configId,
+                                state: {
+                                    stateDescription: "logged in",
+                                    untilTime: currentTokens.refreshTokenExpirationTime
+                                }
+                            });
+                        }
+                    }
                     autoLogoutCountdownTickCallbacks = new Set();
                     onTokenChanges = new Set();
-                    oidc_loggedIn = (0, tsafe_1.id)(__assign(__assign({}, common), { isUserLoggedIn: true, getTokens: function () { return currentTokens; }, getTokens_next: function () { return __awaiter(_this, void 0, void 0, function () {
+                    oidc_loggedIn = (0, tsafe_1.id)(__assign(__assign({}, oidc_common), { isUserLoggedIn: true, getTokens: function () { return currentTokens; }, getTokens_next: function () { return __awaiter(_this, void 0, void 0, function () {
                             return __generator(this, function (_a) {
                                 switch (_a.label) {
                                     case 0:
@@ -674,7 +689,7 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                 }
                             });
                         }); }, getDecodedIdToken: function () { return currentTokens.decodedIdToken; }, logout: function (params) { return __awaiter(_this, void 0, void 0, function () {
-                            var postLogoutRedirectUrl, error_4, _a;
+                            var postLogoutRedirectUrl, error_3, _a;
                             return __generator(this, function (_b) {
                                 switch (_b.label) {
                                     case 0:
@@ -683,11 +698,6 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                             return [2 /*return*/, new Promise(function () { })];
                                         }
                                         globalContext.hasLogoutBeenCalled = true;
-                                        document.addEventListener("visibilitychange", function () {
-                                            if (document.visibilityState === "visible") {
-                                                location.reload();
-                                            }
-                                        });
                                         postLogoutRedirectUrl = (function () {
                                             switch (params.redirectTo) {
                                                 case "current page":
@@ -701,9 +711,17 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                                     });
                                             }
                                         })();
-                                        _b.label = 1;
+                                        return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
+                                                prUnlock: new Promise(function () { })
+                                            })];
                                     case 1:
-                                        _b.trys.push([1, 3, , 10]);
+                                        _b.sent();
+                                        window.addEventListener("pageshow", function () {
+                                            location.reload();
+                                        });
+                                        _b.label = 2;
+                                    case 2:
+                                        _b.trys.push([2, 4, , 11]);
                                         return [4 /*yield*/, oidcClientTsUserManager.signoutRedirect({
                                                 state: (0, tsafe_1.id)({
                                                     configId: configId,
@@ -715,89 +733,108 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                                 }),
                                                 redirectMethod: "assign"
                                             })];
-                                    case 2:
-                                        _b.sent();
-                                        return [3 /*break*/, 10];
                                     case 3:
-                                        error_4 = _b.sent();
-                                        (0, tsafe_1.assert)((0, tsafe_1.is)(error_4));
-                                        if (!(error_4.message === "No end session endpoint")) return [3 /*break*/, 8];
-                                        log === null || log === void 0 ? void 0 : log("No end session endpoint, managing logging state locally");
-                                        (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: "explicitly logged out" });
-                                        _b.label = 4;
+                                        _b.sent();
+                                        return [3 /*break*/, 11];
                                     case 4:
-                                        _b.trys.push([4, 6, , 7]);
-                                        return [4 /*yield*/, oidcClientTsUserManager.removeUser()];
+                                        error_3 = _b.sent();
+                                        (0, tsafe_1.assert)((0, tsafe_1.is)(error_3));
+                                        if (!(error_3.message === "No end session endpoint")) return [3 /*break*/, 9];
+                                        log === null || log === void 0 ? void 0 : log("No end session endpoint, managing logging state locally");
+                                        (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: { stateDescription: "explicitly logged out" } });
+                                        _b.label = 5;
                                     case 5:
-                                        _b.sent();
-                                        return [3 /*break*/, 7];
+                                        _b.trys.push([5, 7, , 8]);
+                                        return [4 /*yield*/, oidcClientTsUserManager.removeUser()];
                                     case 6:
-                                        _a = _b.sent();
-                                        return [3 /*break*/, 7];
+                                        _b.sent();
+                                        return [3 /*break*/, 8];
                                     case 7:
+                                        _a = _b.sent();
+                                        return [3 /*break*/, 8];
+                                    case 8:
+                                        (0, logoutPropagationToOtherTabs_1.notifyOtherTabsOfLogout)({
+                                            configId: configId,
+                                            redirectUrl: postLogoutRedirectUrl,
+                                            sessionId: sessionId
+                                        });
                                         window.location.href = postLogoutRedirectUrl;
-                                        return [3 /*break*/, 9];
-                                    case 8: throw error_4;
-                                    case 9: return [3 /*break*/, 10];
-                                    case 10: return [2 /*return*/, new Promise(function () { })];
+                                        return [3 /*break*/, 10];
+                                    case 9: throw error_3;
+                                    case 10: return [3 /*break*/, 11];
+                                    case 11: return [2 /*return*/, new Promise(function () { })];
                                 }
                             });
                         }); }, renewTokens: (function () {
                             function renewTokens_nonMutexed(params) {
                                 return __awaiter(this, void 0, void 0, function () {
-                                    var extraTokenParams, result_loginSilent, oidcClientTsUser, _a, authResponse, authResponse_error, oidcClientTsUser_scope, error_5;
+                                    var extraTokenParams, completeLoginOrRefreshProcess, result_loginSilent, oidcClientTsUser, _a, authResponse, authResponse_error, oidcClientTsUser_scope, error_4;
                                     return __generator(this, function (_b) {
                                         switch (_b.label) {
                                             case 0:
                                                 extraTokenParams = params.extraTokenParams;
                                                 log === null || log === void 0 ? void 0 : log("Renewing tokens");
+                                                return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.startLoginOrRefreshProcess)()];
+                                            case 1:
+                                                completeLoginOrRefreshProcess = (_b.sent()).completeLoginOrRefreshProcess;
                                                 return [4 /*yield*/, (0, loginSilent_1.loginSilent)({
                                                         oidcClientTsUserManager: oidcClientTsUserManager,
                                                         stateQueryParamValue_instance: stateQueryParamValue_instance,
                                                         configId: configId,
                                                         getExtraTokenParams: function () { return extraTokenParams; }
                                                     })];
-                                            case 1:
+                                            case 2:
                                                 result_loginSilent = _b.sent();
                                                 if (result_loginSilent.outcome === "failure") {
+                                                    completeLoginOrRefreshProcess();
                                                     throw new Error(result_loginSilent.cause);
                                                 }
                                                 _a = result_loginSilent.outcome;
                                                 switch (_a) {
-                                                    case "token refreshed using refresh token": return [3 /*break*/, 2];
-                                                    case "got auth response from iframe": return [3 /*break*/, 3];
+                                                    case "token refreshed using refresh token": return [3 /*break*/, 3];
+                                                    case "got auth response from iframe": return [3 /*break*/, 4];
                                                 }
-                                                return [3 /*break*/, 10];
-                                            case 2:
+                                                return [3 /*break*/, 12];
+                                            case 3:
                                                 {
                                                     log === null || log === void 0 ? void 0 : log("Refresh token used");
                                                     oidcClientTsUser = result_loginSilent.oidcClientTsUser;
                                                 }
-                                                return [3 /*break*/, 11];
-                                            case 3:
+                                                return [3 /*break*/, 13];
+                                            case 4:
                                                 authResponse = result_loginSilent.authResponse;
                                                 log === null || log === void 0 ? void 0 : log("Tokens refresh using iframe", authResponse);
-                                                authResponse_error = authResponse["error"];
+                                                authResponse_error = authResponse.error;
                                                 oidcClientTsUser_scope = undefined;
-                                                _b.label = 4;
-                                            case 4:
-                                                _b.trys.push([4, 6, , 7]);
-                                                return [4 /*yield*/, oidcClientTsUserManager.signinRedirectCallback((0, loginSilent_1.authResponseToUrl)(authResponse))];
+                                                _b.label = 5;
                                             case 5:
+                                                _b.trys.push([5, 7, , 8]);
+                                                return [4 /*yield*/, oidcClientTsUserManager.signinRedirectCallback((0, AuthResponse_1.authResponseToUrl)(authResponse))];
+                                            case 6:
                                                 oidcClientTsUser_scope =
                                                     _b.sent();
-                                                return [3 /*break*/, 7];
-                                            case 6:
-                                                error_5 = _b.sent();
-                                                (0, tsafe_1.assert)(error_5 instanceof Error);
+                                                return [3 /*break*/, 8];
+                                            case 7:
+                                                error_4 = _b.sent();
+                                                (0, tsafe_1.assert)(error_4 instanceof Error);
                                                 if (authResponse_error === undefined) {
-                                                    throw error_5;
+                                                    completeLoginOrRefreshProcess();
+                                                    throw error_4;
                                                 }
                                                 oidcClientTsUser_scope = undefined;
-                                                return [3 /*break*/, 7];
-                                            case 7:
-                                                if (!(oidcClientTsUser_scope === undefined)) return [3 /*break*/, 9];
+                                                return [3 /*break*/, 8];
+                                            case 8:
+                                                if (!(oidcClientTsUser_scope === undefined)) return [3 /*break*/, 11];
                                                 (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: undefined });
+                                                completeLoginOrRefreshProcess();
+                                                return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
+                                                        prUnlock: new Promise(function () { })
+                                                    })];
+                                            case 9:
+                                                _b.sent();
+                                                globalContext.evtRequestToPersistTokens.post({
+                                                    configIdOfInstancePostingTheRequest: configId
+                                                });
                                                 return [4 /*yield*/, loginOrGoToAuthServer({
                                                         action: "login",
                                                         redirectUrl: window.location.href,
@@ -807,17 +844,17 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                                         doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: false,
                                                         doForceInteraction: false
                                                     })];
-                                            case 8:
+                                            case 10:
                                                 _b.sent();
                                                 (0, tsafe_1.assert)(false);
-                                                _b.label = 9;
-                                            case 9:
+                                                _b.label = 11;
+                                            case 11:
                                                 oidcClientTsUser = oidcClientTsUser_scope;
-                                                return [3 /*break*/, 11];
-                                            case 10:
+                                                return [3 /*break*/, 13];
+                                            case 12:
                                                 (0, tsafe_1.assert)(false);
-                                                return [3 /*break*/, 11];
-                                            case 11:
+                                                return [3 /*break*/, 13];
+                                            case 13:
                                                 currentTokens = (0, oidcClientTsUserToTokens_1.oidcClientTsUserToTokens)({
                                                     oidcClientTsUser: oidcClientTsUser,
                                                     decodedIdTokenSchema: decodedIdTokenSchema,
@@ -825,7 +862,17 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                                     decodedIdToken_previous: currentTokens.decodedIdToken,
                                                     log: log
                                                 });
+                                                if ((0, persistedAuthState_1.getPersistedAuthState)({ configId: configId }) !== undefined) {
+                                                    (0, persistedAuthState_1.persistAuthState)({
+                                                        configId: configId,
+                                                        state: {
+                                                            stateDescription: "logged in",
+                                                            untilTime: currentTokens.refreshTokenExpirationTime
+                                                        }
+                                                    });
+                                                }
                                                 Array.from(onTokenChanges).forEach(function (onTokenChange) { return onTokenChange(currentTokens); });
+                                                completeLoginOrRefreshProcess();
                                                 return [2 /*return*/];
                                         }
                                     });
@@ -921,28 +968,51 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                             homeUrl: homeAndCallbackUrl,
                             sessionId: sessionId
                         }).prOtherTabLogout;
-                        prOtherTabLogout.then(function (_a) {
-                            var redirectUrl = _a.redirectUrl;
-                            log === null || log === void 0 ? void 0 : log("Other tab has logged out, redirecting to ".concat(redirectUrl));
-                            window.location.href = redirectUrl;
-                        });
+                        prOtherTabLogout.then(function (_a) { return __awaiter(_this, [_a], void 0, function (_b) {
+                            var redirectUrl = _b.redirectUrl;
+                            return __generator(this, function (_c) {
+                                switch (_c.label) {
+                                    case 0:
+                                        log === null || log === void 0 ? void 0 : log("Other tab has logged out, redirecting to ".concat(redirectUrl));
+                                        return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
+                                                prUnlock: new Promise(function () { })
+                                            })];
+                                    case 1:
+                                        _c.sent();
+                                        window.addEventListener("pageshow", function () {
+                                            location.reload();
+                                        });
+                                        window.location.href = redirectUrl;
+                                        return [2 /*return*/];
+                                }
+                            });
+                        }); });
                     }
                     (function scheduleRenew() {
                         var _this = this;
-                        var login_dueToExpiration = function () {
-                            (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: undefined });
-                            return loginOrGoToAuthServer({
-                                action: "login",
-                                redirectUrl: window.location.href,
-                                doForceReloadOnBfCache: true,
-                                extraQueryParams_local: undefined,
-                                transformUrlBeforeRedirect_local: undefined,
-                                // NOTE: Wether or not it's the preferred behavior, pushing to history
-                                // only works on user interaction so it have to be false
-                                doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: false,
-                                doForceInteraction: true
+                        var login_dueToExpiration = function () { return __awaiter(_this, void 0, void 0, function () {
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0: return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
+                                            prUnlock: new Promise(function () { })
+                                        })];
+                                    case 1:
+                                        _a.sent();
+                                        (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: undefined });
+                                        return [2 /*return*/, loginOrGoToAuthServer({
+                                                action: "login",
+                                                redirectUrl: window.location.href,
+                                                doForceReloadOnBfCache: true,
+                                                extraQueryParams_local: undefined,
+                                                transformUrlBeforeRedirect_local: undefined,
+                                                // NOTE: Wether or not it's the preferred behavior, pushing to history
+                                                // only works on user interaction so it have to be false
+                                                doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: false,
+                                                doForceInteraction: true
+                                            })];
+                                }
                             });
-                        };
+                        }); };
                         var msBeforeExpiration = (0, oidcClientTsUserToTokens_1.getMsBeforeExpiration)(currentTokens);
                         if (msBeforeExpiration <= MIN_RENEW_BEFORE_EXPIRE_MS) {
                             // NOTE: We just got a new token that is about to expire. This means that
@@ -989,8 +1059,11 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                         }).unsubscribe;
                     })();
                     auto_logout: {
-                        if (currentTokens.refreshToken === "" && __unsafe_ssoSessionIdleSeconds === undefined) {
-                            log === null || log === void 0 ? void 0 : log("No refresh token, and ____unsafe_ssoSessionIdleSeconds was not set, auto logout non applicable");
+                        if ((!currentTokens.hasRefreshToken || currentTokens.refreshTokenExpirationTime === undefined) &&
+                            __unsafe_ssoSessionIdleSeconds === undefined) {
+                            log === null || log === void 0 ? void 0 : log("".concat(currentTokens.hasRefreshToken
+                                ? "The refresh token is opaque, we can't read it's expiration time"
+                                : "No refresh token", ", and __unsafe_ssoSessionIdleSeconds was not set, can't implement auto logout mechanism"));
                             break auto_logout;
                         }
                         startCountdown_2 = (0, startCountdown_1.createStartCountdown)({
@@ -998,7 +1071,9 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                                 var getCountdownEndTime = function () {
                                     return __unsafe_ssoSessionIdleSeconds !== undefined
                                         ? Date.now() + __unsafe_ssoSessionIdleSeconds * 1000
-                                        : currentTokens.refreshTokenExpirationTime;
+                                        : ((0, tsafe_1.assert)(currentTokens.hasRefreshToken),
+                                            (0, tsafe_1.assert)(currentTokens.refreshTokenExpirationTime !== undefined),
+                                            currentTokens.refreshTokenExpirationTime);
                                 };
                                 var durationBeforeAutoLogout = (0, toHumanReadableDuration_1.toHumanReadableDuration)(getCountdownEndTime() - Date.now());
                                 log === null || log === void 0 ? void 0 : log([
@@ -1022,13 +1097,11 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                             }
                         }).startCountdown;
                         stopCountdown_1 = undefined;
-                        if (globalContext.$isUserActive === undefined) {
-                            globalContext.$isUserActive = (0, isUserActive_1.create$isUserActive)({
-                                configId: configId,
-                                sessionId: sessionId
-                            });
-                        }
-                        globalContext.$isUserActive.subscribe(function (isUserActive) {
+                        evtIsUserActive = (0, evtIsUserActive_1.createEvtIsUserActive)({
+                            configId: configId,
+                            sessionId: sessionId
+                        });
+                        evtIsUserActive.subscribe(function (isUserActive) {
                             if (isUserActive) {
                                 if (stopCountdown_1 !== undefined) {
                                     stopCountdown_1();
@@ -1041,15 +1114,6 @@ function createOidc_nonMemoized(params, preProcessedParams) {
                             }
                         });
                     }
-                    {
-                        if ((0, persistedAuthState_1.getPersistedAuthState)({ configId: configId }) !== undefined) {
-                            (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: undefined });
-                        }
-                        if (!areThirdPartyCookiesAllowed) {
-                            (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: "logged in" });
-                        }
-                    }
-                    toCallBeforeReturningOidcLoggedIn();
                     return [2 /*return*/, oidc_loggedIn];
             }
         });