oidc-spa 6.5.2 → 6.6.1

package/src/oidc/createOidc.ts

@@ -4,13 +4,12 @@ import {
     type User as OidcClientTsUser,
     InMemoryWebStorage
 } from "../vendor/frontend/oidc-client-ts-and-jwt-decode";
-import { id, assert, is, type Equals, typeGuard } from "../vendor/frontend/tsafe";
+import { id, assert, is, type Equals } from "../vendor/frontend/tsafe";
 import { setTimeout, clearTimeout } from "../tools/workerTimers";
 import { Deferred } from "../tools/Deferred";
 import { decodeJwt } from "../tools/decodeJwt";
-import { create$isUserActive } from "./isUserActive";
+import { createEvtIsUserActive } from "./evtIsUserActive";
 import { createStartCountdown } from "../tools/startCountdown";
-import type { StatefulObservable } from "../tools/StatefulObservable";
 import { toHumanReadableDuration } from "../tools/toHumanReadableDuration";
 import { toFullyQualifiedUrl } from "../tools/toFullyQualifiedUrl";
 import {
@@ -19,23 +18,29 @@ import {
     createIframeTimeoutInitializationError,
     createWellKnownOidcConfigurationEndpointUnreachableInitializationError
 } from "./OidcInitializationError";
-import {
-    getStateData,
-    type StateData,
-    generateStateQueryParamValue,
-    STATE_STORE_KEY_PREFIX
-} from "./StateData";
+import { type StateData, generateStateQueryParamValue, STATE_STORE_KEY_PREFIX } from "./StateData";
 import { notifyOtherTabsOfLogout, getPrOtherTabLogout } from "./logoutPropagationToOtherTabs";
+import { notifyOtherTabsOfLogin, getPrOtherTabLogin } from "./loginPropagationToOtherTabs";
 import { getConfigId } from "./configId";
 import { oidcClientTsUserToTokens, getMsBeforeExpiration } from "./oidcClientTsUserToTokens";
-import { loginSilent, authResponseToUrl } from "./loginSilent";
-import { handleOidcCallback, AUTH_RESPONSE_KEY } from "./handleOidcCallback";
+import { loginSilent } from "./loginSilent";
+import { authResponseToUrl } from "./AuthResponse";
+import { handleOidcCallback, retrieveRedirectAuthResponseAndStateData } from "./handleOidcCallback";
 import { getPersistedAuthState, persistAuthState } from "./persistedAuthState";
 import type { Oidc } from "./Oidc";
-import { type AwaitableEventEmitter, createAwaitableEventEmitter } from "../tools/AwaitableEventEmitter";
+import { createEvt, type Evt } from "../tools/Evt";
 import { getHaveSharedParentDomain } from "../tools/haveSharedParentDomain";
-import { createLoginOrGoToAuthServer } from "./loginOrGoToAuthServer";
-import { createEphemeralSessionStorage } from "../tools/ephemeralSessionStorage";
+import {
+    createLoginOrGoToAuthServer,
+    getPrSafelyRestoredFromBfCacheAfterLoginBackNavigation
+} from "./loginOrGoToAuthServer";
+import { createEphemeralSessionStorage } from "../tools/EphemeralSessionStorage";
+import {
+    startLoginOrRefreshProcess,
+    waitForAllOtherOngoingLoginOrRefreshProcessesToComplete
+} from "./ongoingLoginOrRefreshProcesses";
+
+handleOidcCallback();
 
 // NOTE: Replaced at build time
 const VERSION = "{{OIDC_SPA_VERSION}}";
@@ -120,26 +125,22 @@ export type ParamsOfCreateOidc<
     __unsafe_useIdTokenAsAccessToken?: boolean;
 };
 
-handleOidcCallback();
-
 const GLOBAL_CONTEXT_KEY = "__oidc-spa.createOidc.globalContext";
 
 declare global {
     interface Window {
         [GLOBAL_CONTEXT_KEY]: {
             prOidcByConfigId: Map<string, Promise<Oidc<any>>>;
-            evtAuthResponseHandled: AwaitableEventEmitter<void>;
-            $isUserActive: StatefulObservable<boolean> | undefined;
             hasLogoutBeenCalled: boolean;
+            evtRequestToPersistTokens: Evt<{ configIdOfInstancePostingTheRequest: string }>;
         };
     }
 }
 
 window[GLOBAL_CONTEXT_KEY] ??= {
     prOidcByConfigId: new Map(),
-    evtAuthResponseHandled: createAwaitableEventEmitter<void>(),
-    $isUserActive: undefined,
-    hasLogoutBeenCalled: false
+    hasLogoutBeenCalled: false,
+    evtRequestToPersistTokens: createEvt()
 };
 
 const globalContext = window[GLOBAL_CONTEXT_KEY];
@@ -321,7 +322,7 @@ export async function createOidc_nonMemoized<
         }
     }
 
-    const isUserStorePersistent = !areThirdPartyCookiesAllowed;
+    let isUserStoreInMemoryOnly: boolean;
 
     const oidcClientTsUserManager = new OidcClientTsUserManager({
         stateQueryParamValue: stateQueryParamValue_instance,
@@ -334,31 +335,51 @@ export async function createOidc_nonMemoized<
         scope: Array.from(new Set(["openid", ...scopes])).join(" "),
         automaticSilentRenew: false,
         userStore: new WebStorageStateStore({
-            store: areThirdPartyCookiesAllowed
-                ? new InMemoryWebStorage()
-                : createEphemeralSessionStorage({
-                      sessionStorageTtlMs: 3 * 60_1000
-                  })
+            store: (() => {
+                if (areThirdPartyCookiesAllowed) {
+                    isUserStoreInMemoryOnly = true;
+                    return new InMemoryWebStorage();
+                }
+
+                isUserStoreInMemoryOnly = false;
+
+                const storage = createEphemeralSessionStorage({
+                    sessionStorageTtlMs: 3 * 60_000
+                });
+
+                const { evtRequestToPersistTokens } = globalContext;
+
+                evtRequestToPersistTokens.subscribe(({ configIdOfInstancePostingTheRequest }) => {
+                    if (configIdOfInstancePostingTheRequest === configId) {
+                        return;
+                    }
+
+                    storage.persistCurrentStateAndSubsequentChanges();
+                });
+
+                return storage;
+            })()
         }),
         stateStore: new WebStorageStateStore({ store: localStorage, prefix: STATE_STORE_KEY_PREFIX }),
         client_secret: __unsafe_clientSecret
     });
 
-    const {
-        loginOrGoToAuthServer,
-        toCallBeforeReturningOidcLoggedIn,
-        toCallBeforeReturningOidcNotLoggedIn
-    } = createLoginOrGoToAuthServer({
+    const evtIsUserLoggedIn = createEvt<boolean>();
+
+    const { loginOrGoToAuthServer } = createLoginOrGoToAuthServer({
         configId,
         oidcClientTsUserManager,
         getExtraQueryParams,
         transformUrlBeforeRedirect,
         homeAndCallbackUrl,
+        evtIsUserLoggedIn,
         log
     });
 
     const BROWSER_SESSION_NOT_FIRST_INIT_KEY = `oidc-spa.browser-session-not-first-init:${configId}`;
 
+    const { completeLoginOrRefreshProcess } = await startLoginOrRefreshProcess();
+
     const resultOfLoginProcess = await (async (): Promise<
         | undefined // User is currently not logged in
         | Error // Initialization error
@@ -368,58 +389,13 @@ export async function createOidc_nonMemoized<
           }
     > => {
         handle_redirect_auth_response: {
-            const authResponse = (() => {
-                const value = sessionStorage.getItem(AUTH_RESPONSE_KEY);
-
-                if (value === null) {
-                    return undefined;
-                }
-
-                let authResponse: unknown;
+            const authResponseAndStateData = retrieveRedirectAuthResponseAndStateData({ configId });
 
-                try {
-                    authResponse = JSON.parse(value);
-
-                    assert(
-                        typeGuard<{ state: string; [key: string]: string }>(
-                            authResponse,
-                            authResponse instanceof Object &&
-                                Object.values(authResponse).every(value => typeof value === "string")
-                        ),
-                        "Valid json but not expected shape"
-                    );
-                } catch (error) {
-                    console.error(`Failed to parse auth response from callback URL ${String(error)}`);
-                    return undefined;
-                }
-
-                return authResponse;
-            })();
-
-            if (authResponse === undefined) {
-                break handle_redirect_auth_response;
-            }
-
-            const stateData = getStateData({ stateQueryParamValue: authResponse["state"] });
-
-            assert(stateData !== undefined);
-            assert(stateData.context === "redirect");
-
-            const { evtAuthResponseHandled } = globalContext;
-
-            if (stateData.configId !== configId) {
-                // NOTE: Best attempt at letting the other client handle the request synchronously
-                // but we won't wait for it because the initialization of the other client might
-                // be contingent on the initialization of this client.
-                const prHandled = evtAuthResponseHandled.waitFor();
-                await Promise.resolve();
-                if (sessionStorage.getItem(AUTH_RESPONSE_KEY) === null) {
-                    await prHandled;
-                }
+            if (authResponseAndStateData === undefined) {
                 break handle_redirect_auth_response;
             }
 
-            sessionStorage.removeItem(AUTH_RESPONSE_KEY);
+            const { authResponse, stateData } = authResponseAndStateData;
 
             switch (stateData.action) {
                 case "login":
@@ -431,11 +407,9 @@ export async function createOidc_nonMemoized<
                         let oidcClientTsUser: OidcClientTsUser | undefined = undefined;
 
                         try {
-                            oidcClientTsUser = await oidcClientTsUserManager
-                                .signinRedirectCallback(authResponseUrl)
-                                .finally(() => {
-                                    evtAuthResponseHandled.post();
-                                });
+                            oidcClientTsUser = await oidcClientTsUserManager.signinRedirectCallback(
+                                authResponseUrl
+                            );
                         } catch (error) {
                             assert(error instanceof Error);
 
@@ -447,11 +421,11 @@ export async function createOidc_nonMemoized<
                             }
 
                             {
-                                const error: string | undefined = authResponse["error"];
+                                const authResponse_error = authResponse.error;
 
-                                if (error !== undefined) {
+                                if (authResponse_error !== undefined) {
                                     log?.(
-                                        `The auth server responded with: ${error}, trying to restore from the http only cookie`
+                                        `The auth server responded with: ${authResponse_error}, trying to restore from the http only cookie`
                                     );
                                     break handle_redirect_auth_response;
                                 }
@@ -462,18 +436,31 @@ export async function createOidc_nonMemoized<
 
                         sessionStorage.removeItem(BROWSER_SESSION_NOT_FIRST_INIT_KEY);
 
+                        notifyOtherTabsOfLogin({ configId });
+
                         return {
                             oidcClientTsUser,
                             backFromAuthServer: {
                                 extraQueryParams: stateData.extraQueryParams,
                                 result: Object.fromEntries(
-                                    Object.entries(authResponse).filter(
-                                        ([name]) =>
-                                            name !== "state" &&
-                                            name !== "session_state" &&
-                                            name !== "iss" &&
-                                            name !== "code"
-                                    )
+                                    Object.entries(authResponse)
+                                        .map(([name, value]) => {
+                                            if (
+                                                name === "state" ||
+                                                name === "session_state" ||
+                                                name === "iss" ||
+                                                name === "code"
+                                            ) {
+                                                return undefined;
+                                            }
+
+                                            if (value === undefined) {
+                                                return undefined;
+                                            }
+
+                                            return [name, value];
+                                        })
+                                        .filter(entry => entry !== undefined)
                                 )
                             }
                         };
@@ -489,8 +476,6 @@ export async function createOidc_nonMemoized<
                             await oidcClientTsUserManager.signoutRedirectCallback(authResponseUrl);
                         } catch {}
 
-                        evtAuthResponseHandled.post();
-
                         notifyOtherTabsOfLogout({
                             configId,
                             redirectUrl: stateData.redirectUrl,
@@ -505,7 +490,7 @@ export async function createOidc_nonMemoized<
         }
 
         restore_from_session_storage: {
-            if (!isUserStorePersistent) {
+            if (isUserStoreInMemoryOnly) {
                 break restore_from_session_storage;
             }
 
@@ -533,67 +518,77 @@ export async function createOidc_nonMemoized<
             };
         }
 
-        restore_from_http_only_cookie: {
+        silent_login_if_possible_and_auto_login: {
             log?.("Trying to restore the auth from the http only cookie (silent signin with iframe)");
 
             const persistedAuthState = getPersistedAuthState({ configId });
 
-            if (persistedAuthState === "explicitly logged out") {
+            if (persistedAuthState === "explicitly logged out" && !autoLogin) {
                 log?.("Skipping silent signin with iframe, the user has logged out");
-                break restore_from_http_only_cookie;
+                break silent_login_if_possible_and_auto_login;
             }
 
-            const result_loginSilent = await loginSilent({
-                oidcClientTsUserManager,
-                stateQueryParamValue_instance,
-                configId,
-                getExtraTokenParams
-            });
-
-            assert(result_loginSilent.outcome !== "token refreshed using refresh token");
+            let authResponse_error: string | undefined = undefined;
+            let oidcClientTsUser: OidcClientTsUser | undefined = undefined;
 
-            if (result_loginSilent.outcome === "failure") {
-                switch (result_loginSilent.cause) {
-                    case "can't reach well-known oidc endpoint":
-                        return createWellKnownOidcConfigurationEndpointUnreachableInitializationError({
-                            issuerUri
-                        });
-                    case "timeout":
-                        return createIframeTimeoutInitializationError({
-                            homeAndCallbackUrl,
-                            clientId,
-                            issuerUri
-                        });
+            actual_silent_signin: {
+                if (persistedAuthState === "explicitly logged out") {
+                    break actual_silent_signin;
                 }
 
-                assert<Equals<typeof result_loginSilent.cause, never>>(false);
-            }
+                const result_loginSilent = await loginSilent({
+                    oidcClientTsUserManager,
+                    stateQueryParamValue_instance,
+                    configId,
+                    getExtraTokenParams
+                });
+
+                assert(result_loginSilent.outcome !== "token refreshed using refresh token");
+
+                if (result_loginSilent.outcome === "failure") {
+                    switch (result_loginSilent.cause) {
+                        case "can't reach well-known oidc endpoint":
+                            return createWellKnownOidcConfigurationEndpointUnreachableInitializationError(
+                                {
+                                    issuerUri
+                                }
+                            );
+                        case "timeout":
+                            return createIframeTimeoutInitializationError({
+                                homeAndCallbackUrl,
+                                clientId,
+                                issuerUri
+                            });
+                    }
 
-            assert<Equals<typeof result_loginSilent.outcome, "got auth response from iframe">>();
+                    assert<Equals<typeof result_loginSilent.cause, never>>(false);
+                }
 
-            const { authResponse } = result_loginSilent;
+                assert<Equals<typeof result_loginSilent.outcome, "got auth response from iframe">>();
 
-            log?.("Silent signin auth response", authResponse);
+                const { authResponse } = result_loginSilent;
 
-            const authResponse_error: string | undefined = authResponse["error"];
-            let oidcClientTsUser: OidcClientTsUser | undefined = undefined;
+                log?.("Silent signin auth response", authResponse);
 
-            try {
-                oidcClientTsUser = await oidcClientTsUserManager.signinRedirectCallback(
-                    authResponseToUrl(authResponse)
-                );
-            } catch (error) {
-                assert(error instanceof Error);
+                authResponse_error = authResponse.error;
 
-                if (error.message === "Failed to fetch") {
-                    return createFailedToFetchTokenEndpointInitializationError({
-                        clientId,
-                        issuerUri
-                    });
-                }
+                try {
+                    oidcClientTsUser = await oidcClientTsUserManager.signinRedirectCallback(
+                        authResponseToUrl(authResponse)
+                    );
+                } catch (error) {
+                    assert(error instanceof Error);
 
-                if (authResponse_error === undefined) {
-                    return error;
+                    if (error.message === "Failed to fetch") {
+                        return createFailedToFetchTokenEndpointInitializationError({
+                            clientId,
+                            issuerUri
+                        });
+                    }
+
+                    if (authResponse_error === undefined) {
+                        return error;
+                    }
                 }
             }
 
@@ -608,6 +603,18 @@ export async function createOidc_nonMemoized<
                 ) {
                     persistAuthState({ configId, state: undefined });
 
+                    completeLoginOrRefreshProcess();
+
+                    await waitForAllOtherOngoingLoginOrRefreshProcessesToComplete({
+                        prUnlock: new Promise<never>(() => {})
+                    });
+
+                    if (persistedAuthState === "logged in") {
+                        globalContext.evtRequestToPersistTokens.post({
+                            configIdOfInstancePostingTheRequest: configId
+                        });
+                    }
+
                     await loginOrGoToAuthServer({
                         action: "login",
                         doForceReloadOnBfCache: true,
@@ -615,10 +622,9 @@ export async function createOidc_nonMemoized<
                         doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: autoLogin,
                         extraQueryParams_local: undefined,
                         transformUrlBeforeRedirect_local: undefined,
-                        doForceInteraction: false
+                        doForceInteraction: persistedAuthState === "explicitly logged out"
                     });
-
-                    // NOTE: Never here
+                    assert(false);
                 }
 
                 log?.(
@@ -630,7 +636,7 @@ export async function createOidc_nonMemoized<
                     ].join("")
                 );
 
-                break restore_from_http_only_cookie;
+                break silent_login_if_possible_and_auto_login;
             }
 
             log?.("Successful silent signed in");
@@ -643,71 +649,15 @@ export async function createOidc_nonMemoized<
 
         // NOTE: The user is not logged in.
         return undefined;
-    })().then(result => {
-        if (result === undefined) {
-            return undefined;
-        }
-
-        if (result instanceof Error) {
-            return result;
-        }
-
-        const { oidcClientTsUser, backFromAuthServer } = result;
-
-        log_real_decoded_id_token: {
-            if (log === undefined) {
-                break log_real_decoded_id_token;
-            }
-            const idToken = oidcClientTsUser.id_token;
-
-            if (idToken === undefined) {
-                break log_real_decoded_id_token;
-            }
-
-            const decodedIdToken = decodeJwt(idToken);
-
-            log(
-                [
-                    `Decoded ID token`,
-                    decodedIdTokenSchema === undefined ? "" : " before `decodedIdTokenSchema.parse()`\n",
-                    JSON.stringify(decodedIdToken, null, 2)
-                ].join("")
-            );
-
-            if (decodedIdTokenSchema === undefined) {
-                break log_real_decoded_id_token;
-            }
-
-            log(
-                [
-                    "Decoded ID token after `decodedIdTokenSchema.parse()`\n",
-                    JSON.stringify(decodedIdTokenSchema.parse(decodedIdToken), null, 2)
-                ].join("")
-            );
-        }
-
-        const tokens = oidcClientTsUserToTokens({
-            oidcClientTsUser,
-            decodedIdTokenSchema,
-            __unsafe_useIdTokenAsAccessToken,
-            decodedIdToken_previous: undefined,
-            log
-        });
+    })();
 
-        if (tokens.refreshTokenExpirationTime < tokens.accessTokenExpirationTime) {
-            console.warn(
-                [
-                    "The OIDC refresh token shorter than the one of the access token.",
-                    "This is very unusual and probably a misconfiguration.",
-                    `Check your oidc server configuration for ${clientId} ${issuerUri}`
-                ].join(" ")
-            );
-        }
+    completeLoginOrRefreshProcess();
 
-        return { tokens, backFromAuthServer };
+    await waitForAllOtherOngoingLoginOrRefreshProcessesToComplete({
+        prUnlock: Promise.resolve()
     });
 
-    const common: Oidc.Common = {
+    const oidc_common: Oidc.Common = {
         params: {
             issuerUri,
             clientId
@@ -719,6 +669,12 @@ export async function createOidc_nonMemoized<
             break not_loggedIn_case;
         }
 
+        evtIsUserLoggedIn.post(false);
+
+        if (getPersistedAuthState({ configId }) !== "explicitly logged out") {
+            persistAuthState({ configId, state: undefined });
+        }
+
         const oidc_notLoggedIn: Oidc.NotLoggedIn = (() => {
             if (resultOfLoginProcess instanceof Error) {
                 log?.("User not logged in and there was an initialization error");
@@ -747,7 +703,7 @@ export async function createOidc_nonMemoized<
                 );
 
                 return id<Oidc.NotLoggedIn>({
-                    ...common,
+                    ...oidc_common,
                     isUserLoggedIn: false,
                     login: async () => {
                         alert("Authentication is currently unavailable. Please try again later.");
@@ -761,15 +717,19 @@ export async function createOidc_nonMemoized<
                 log?.("User not logged in");
 
                 return id<Oidc.NotLoggedIn>({
-                    ...common,
+                    ...oidc_common,
                     isUserLoggedIn: false,
-                    login: ({
+                    login: async ({
                         doesCurrentHrefRequiresAuth,
                         extraQueryParams,
                         redirectUrl,
                         transformUrlBeforeRedirect
-                    }) =>
-                        loginOrGoToAuthServer({
+                    }) => {
+                        await waitForAllOtherOngoingLoginOrRefreshProcessesToComplete({
+                            prUnlock: getPrSafelyRestoredFromBfCacheAfterLoginBackNavigation()
+                        });
+
+                        return loginOrGoToAuthServer({
                             action: "login",
                             doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack:
                                 doesCurrentHrefRequiresAuth,
@@ -780,7 +740,8 @@ export async function createOidc_nonMemoized<
                             transformUrlBeforeRedirect_local: transformUrlBeforeRedirect,
                             doForceInteraction:
                                 getPersistedAuthState({ configId }) === "explicitly logged out"
-                        }),
+                        });
+                    },
                     initializationError: undefined
                 });
             }
@@ -788,11 +749,21 @@ export async function createOidc_nonMemoized<
             assert<Equals<typeof resultOfLoginProcess, never>>(false);
         })();
 
-        if (getPersistedAuthState({ configId }) !== "explicitly logged out") {
-            persistAuthState({ configId, state: undefined });
-        }
+        {
+            const { prOtherTabLogin } = getPrOtherTabLogin({
+                configId
+            });
+
+            prOtherTabLogin.then(async () => {
+                log?.(`Other tab has logged in, reloading this tab`);
+
+                await waitForAllOtherOngoingLoginOrRefreshProcessesToComplete({
+                    prUnlock: new Promise<never>(() => {})
+                });
 
-        toCallBeforeReturningOidcNotLoggedIn();
+                window.location.reload();
+            });
+        }
 
         // @ts-expect-error: We know what we're doing
         return oidc_notLoggedIn;
@@ -800,7 +771,31 @@ export async function createOidc_nonMemoized<
 
     log?.("User is logged in");
 
-    let currentTokens = resultOfLoginProcess.tokens;
+    evtIsUserLoggedIn.post(true);
+
+    let currentTokens = oidcClientTsUserToTokens({
+        oidcClientTsUser: resultOfLoginProcess.oidcClientTsUser,
+        decodedIdTokenSchema,
+        __unsafe_useIdTokenAsAccessToken,
+        decodedIdToken_previous: undefined,
+        log
+    });
+
+    {
+        if (getPersistedAuthState({ configId }) !== undefined) {
+            persistAuthState({ configId, state: undefined });
+        }
+
+        if (!areThirdPartyCookiesAllowed) {
+            persistAuthState({
+                configId,
+                state: {
+                    stateDescription: "logged in",
+                    untilTime: currentTokens.refreshTokenExpirationTime
+                }
+            });
+        }
+    }
 
     const autoLogoutCountdownTickCallbacks = new Set<
         (params: { secondsLeft: number | undefined }) => void
@@ -809,7 +804,7 @@ export async function createOidc_nonMemoized<
     const onTokenChanges = new Set<(tokens: Oidc.Tokens<DecodedIdToken>) => void>();
 
     const oidc_loggedIn = id<Oidc.LoggedIn<DecodedIdToken>>({
-        ...common,
+        ...oidc_common,
         isUserLoggedIn: true,
         getTokens: () => currentTokens,
         getTokens_next: async () => {
@@ -828,12 +823,6 @@ export async function createOidc_nonMemoized<
 
             globalContext.hasLogoutBeenCalled = true;
 
-            document.addEventListener("visibilitychange", () => {
-                if (document.visibilityState === "visible") {
-                    location.reload();
-                }
-            });
-
             const postLogoutRedirectUrl: string = (() => {
                 switch (params.redirectTo) {
                     case "current page":
@@ -848,6 +837,14 @@ export async function createOidc_nonMemoized<
                 }
             })();
 
+            await waitForAllOtherOngoingLoginOrRefreshProcessesToComplete({
+                prUnlock: new Promise<never>(() => {})
+            });
+
+            window.addEventListener("pageshow", () => {
+                location.reload();
+            });
+
             try {
                 await oidcClientTsUserManager.signoutRedirect({
                     state: id<StateData>({
@@ -866,7 +863,7 @@ export async function createOidc_nonMemoized<
                 if (error.message === "No end session endpoint") {
                     log?.("No end session endpoint, managing logging state locally");
 
-                    persistAuthState({ configId, state: "explicitly logged out" });
+                    persistAuthState({ configId, state: { stateDescription: "explicitly logged out" } });
 
                     try {
                         await oidcClientTsUserManager.removeUser();
@@ -874,6 +871,12 @@ export async function createOidc_nonMemoized<
                         // NOTE: Not sure if it can throw
                     }
 
+                    notifyOtherTabsOfLogout({
+                        configId,
+                        redirectUrl: postLogoutRedirectUrl,
+                        sessionId
+                    });
+
                     window.location.href = postLogoutRedirectUrl;
                 } else {
                     throw error;
@@ -888,6 +891,8 @@ export async function createOidc_nonMemoized<
 
                 log?.("Renewing tokens");
 
+                const { completeLoginOrRefreshProcess } = await startLoginOrRefreshProcess();
+
                 const result_loginSilent = await loginSilent({
                     oidcClientTsUserManager,
                     stateQueryParamValue_instance,
@@ -896,6 +901,7 @@ export async function createOidc_nonMemoized<
                 });
 
                 if (result_loginSilent.outcome === "failure") {
+                    completeLoginOrRefreshProcess();
                     throw new Error(result_loginSilent.cause);
                 }
 
@@ -914,7 +920,7 @@ export async function createOidc_nonMemoized<
 
                             log?.("Tokens refresh using iframe", authResponse);
 
-                            const authResponse_error: string | undefined = authResponse["error"];
+                            const authResponse_error = authResponse.error;
 
                             let oidcClientTsUser_scope: OidcClientTsUser | undefined = undefined;
 
@@ -927,6 +933,7 @@ export async function createOidc_nonMemoized<
                                 assert(error instanceof Error);
 
                                 if (authResponse_error === undefined) {
+                                    completeLoginOrRefreshProcess();
                                     throw error;
                                 }
 
@@ -936,6 +943,16 @@ export async function createOidc_nonMemoized<
                             if (oidcClientTsUser_scope === undefined) {
                                 persistAuthState({ configId, state: undefined });
 
+                                completeLoginOrRefreshProcess();
+
+                                await waitForAllOtherOngoingLoginOrRefreshProcessesToComplete({
+                                    prUnlock: new Promise<never>(() => {})
+                                });
+
+                                globalContext.evtRequestToPersistTokens.post({
+                                    configIdOfInstancePostingTheRequest: configId
+                                });
+
                                 await loginOrGoToAuthServer({
                                     action: "login",
                                     redirectUrl: window.location.href,
@@ -964,7 +981,19 @@ export async function createOidc_nonMemoized<
                     log
                 });
 
+                if (getPersistedAuthState({ configId }) !== undefined) {
+                    persistAuthState({
+                        configId,
+                        state: {
+                            stateDescription: "logged in",
+                            untilTime: currentTokens.refreshTokenExpirationTime
+                        }
+                    });
+                }
+
                 Array.from(onTokenChanges).forEach(onTokenChange => onTokenChange(currentTokens));
+
+                completeLoginOrRefreshProcess();
             }
 
             let ongoingCall:
@@ -1079,14 +1108,27 @@ export async function createOidc_nonMemoized<
             sessionId
         });
 
-        prOtherTabLogout.then(({ redirectUrl }) => {
+        prOtherTabLogout.then(async ({ redirectUrl }) => {
             log?.(`Other tab has logged out, redirecting to ${redirectUrl}`);
+
+            await waitForAllOtherOngoingLoginOrRefreshProcessesToComplete({
+                prUnlock: new Promise<never>(() => {})
+            });
+
+            window.addEventListener("pageshow", () => {
+                location.reload();
+            });
+
             window.location.href = redirectUrl;
         });
     }
 
     (function scheduleRenew() {
-        const login_dueToExpiration = () => {
+        const login_dueToExpiration = async () => {
+            await waitForAllOtherOngoingLoginOrRefreshProcessesToComplete({
+                prUnlock: new Promise<never>(() => {})
+            });
+
             persistAuthState({ configId, state: undefined });
 
             return loginOrGoToAuthServer({
@@ -1149,9 +1191,16 @@ export async function createOidc_nonMemoized<
     })();
 
     auto_logout: {
-        if (currentTokens.refreshToken === "" && __unsafe_ssoSessionIdleSeconds === undefined) {
+        if (
+            (!currentTokens.hasRefreshToken || currentTokens.refreshTokenExpirationTime === undefined) &&
+            __unsafe_ssoSessionIdleSeconds === undefined
+        ) {
             log?.(
-                "No refresh token, and ____unsafe_ssoSessionIdleSeconds was not set, auto logout non applicable"
+                `${
+                    currentTokens.hasRefreshToken
+                        ? "The refresh token is opaque, we can't read it's expiration time"
+                        : "No refresh token"
+                }, and __unsafe_ssoSessionIdleSeconds was not set, can't implement auto logout mechanism`
             );
             break auto_logout;
         }
@@ -1161,7 +1210,9 @@ export async function createOidc_nonMemoized<
                 const getCountdownEndTime = () =>
                     __unsafe_ssoSessionIdleSeconds !== undefined
                         ? Date.now() + __unsafe_ssoSessionIdleSeconds * 1000
-                        : currentTokens.refreshTokenExpirationTime;
+                        : (assert(currentTokens.hasRefreshToken),
+                          assert(currentTokens.refreshTokenExpirationTime !== undefined),
+                          currentTokens.refreshTokenExpirationTime);
 
                 const durationBeforeAutoLogout = toHumanReadableDuration(
                     getCountdownEndTime() - Date.now()
@@ -1193,14 +1244,12 @@ export async function createOidc_nonMemoized<
 
         let stopCountdown: (() => void) | undefined = undefined;
 
-        if (globalContext.$isUserActive === undefined) {
-            globalContext.$isUserActive = create$isUserActive({
-                configId,
-                sessionId
-            });
-        }
+        const evtIsUserActive = createEvtIsUserActive({
+            configId,
+            sessionId
+        });
 
-        globalContext.$isUserActive.subscribe(isUserActive => {
+        evtIsUserActive.subscribe(isUserActive => {
             if (isUserActive) {
                 if (stopCountdown !== undefined) {
                     stopCountdown();
@@ -1213,17 +1262,5 @@ export async function createOidc_nonMemoized<
         });
     }
 
-    {
-        if (getPersistedAuthState({ configId }) !== undefined) {
-            persistAuthState({ configId, state: undefined });
-        }
-
-        if (!areThirdPartyCookiesAllowed) {
-            persistAuthState({ configId, state: "logged in" });
-        }
-    }
-
-    toCallBeforeReturningOidcLoggedIn();
-
     return oidc_loggedIn;
 }