oidc-spa 6.6.0 → 6.7.0

package/src/oidc/createOidc.ts

@@ -57,11 +57,22 @@ export type ParamsOfCreateOidc<
      **/
     scopes?: string[];
     /**
-     * Transform the url before redirecting to the login pages.
+     * Transform the url of the authorization endpoint before redirecting to the login pages.
      */
     transformUrlBeforeRedirect?: (url: string) => string;
+
     /**
-     * Extra query params to be added on the login url.
+     * NOTE: Will replace transformUrlBeforeRedirect in the next major version.
+     *
+     * Transform the url (authorization endpoint) before redirecting to the login pages.
+     *
+     * The isSilent parameter is true when the redirect is initiated in the background iframe for silent signin.
+     * This can be used to omit ui related query parameters (like `ui_locales`).
+     */
+    transformUrlBeforeRedirect_next?: (params: { isSilent: boolean; url: string }) => string;
+
+    /**
+     * Extra query params to be added to the authorization endpoint url before redirecting or silent signing in.
      * You can provide a function that returns those extra query params, it will be called
      * when login() is called.
      *
@@ -69,7 +80,9 @@ export type ParamsOfCreateOidc<
      *
      * This parameter can also be passed to login() directly.
      */
-    extraQueryParams?: Record<string, string> | (() => Record<string, string>);
+    extraQueryParams?:
+        | Record<string, string | undefined>
+        | ((params: { isSilent: boolean; url: string }) => Record<string, string | undefined>);
     /**
      * Extra body params to be added to the /token POST request.
      *
@@ -81,7 +94,7 @@ export type ParamsOfCreateOidc<
      * Example: extraTokenParams: ()=> ({ selectedCustomer: "xxx" })
      *          extraTokenParams: { selectedCustomer: "xxx" }
      */
-    extraTokenParams?: Record<string, string> | (() => Record<string, string>);
+    extraTokenParams?: Record<string, string | undefined> | (() => Record<string, string | undefined>);
     /**
      * Where to redirect after successful login.
      * Default: window.location.href (here)
@@ -246,6 +259,7 @@ export async function createOidc_nonMemoized<
     }
 ): Promise<AutoLogin extends true ? Oidc.LoggedIn<DecodedIdToken> : Oidc<DecodedIdToken>> {
     const {
+        transformUrlBeforeRedirect_next,
         transformUrlBeforeRedirect,
         extraQueryParams: extraQueryParamsOrGetter,
         extraTokenParams: extraTokenParamsOrGetter,
@@ -261,19 +275,29 @@ export async function createOidc_nonMemoized<
 
     const { issuerUri, clientId, scopes, configId, log } = preProcessedParams;
 
-    const [getExtraQueryParams, getExtraTokenParams] = (
-        [extraQueryParamsOrGetter, extraTokenParamsOrGetter] as const
-    ).map(valueOrGetter => {
-        if (typeof valueOrGetter === "function") {
-            return valueOrGetter;
+    const getExtraQueryParams = (() => {
+        if (extraQueryParamsOrGetter === undefined) {
+            return undefined;
         }
 
-        if (valueOrGetter !== undefined) {
-            return () => valueOrGetter;
+        if (typeof extraQueryParamsOrGetter !== "function") {
+            return () => extraQueryParamsOrGetter;
         }
 
-        return undefined;
-    });
+        return extraQueryParamsOrGetter;
+    })();
+
+    const getExtraTokenParams = (() => {
+        if (extraTokenParamsOrGetter === undefined) {
+            return undefined;
+        }
+
+        if (typeof extraTokenParamsOrGetter !== "function") {
+            return () => extraTokenParamsOrGetter;
+        }
+
+        return extraTokenParamsOrGetter;
+    })();
 
     const homeAndCallbackUrl = toFullyQualifiedUrl({
         urlish: homeUrl_params,
@@ -369,8 +393,10 @@ export async function createOidc_nonMemoized<
     const { loginOrGoToAuthServer } = createLoginOrGoToAuthServer({
         configId,
         oidcClientTsUserManager,
-        getExtraQueryParams,
         transformUrlBeforeRedirect,
+        transformUrlBeforeRedirect_next,
+        getExtraQueryParams,
+        getExtraTokenParams,
         homeAndCallbackUrl,
         evtIsUserLoggedIn,
         log
@@ -518,67 +544,79 @@ export async function createOidc_nonMemoized<
             };
         }
 
-        restore_from_http_only_cookie: {
+        silent_login_if_possible_and_auto_login: {
             log?.("Trying to restore the auth from the http only cookie (silent signin with iframe)");
 
             const persistedAuthState = getPersistedAuthState({ configId });
 
-            if (persistedAuthState === "explicitly logged out") {
+            if (persistedAuthState === "explicitly logged out" && !autoLogin) {
                 log?.("Skipping silent signin with iframe, the user has logged out");
-                break restore_from_http_only_cookie;
+                break silent_login_if_possible_and_auto_login;
             }
 
-            const result_loginSilent = await loginSilent({
-                oidcClientTsUserManager,
-                stateQueryParamValue_instance,
-                configId,
-                getExtraTokenParams
-            });
-
-            assert(result_loginSilent.outcome !== "token refreshed using refresh token");
+            let authResponse_error: string | undefined = undefined;
+            let oidcClientTsUser: OidcClientTsUser | undefined = undefined;
 
-            if (result_loginSilent.outcome === "failure") {
-                switch (result_loginSilent.cause) {
-                    case "can't reach well-known oidc endpoint":
-                        return createWellKnownOidcConfigurationEndpointUnreachableInitializationError({
-                            issuerUri
-                        });
-                    case "timeout":
-                        return createIframeTimeoutInitializationError({
-                            homeAndCallbackUrl,
-                            clientId,
-                            issuerUri
-                        });
+            actual_silent_signin: {
+                if (persistedAuthState === "explicitly logged out") {
+                    break actual_silent_signin;
                 }
 
-                assert<Equals<typeof result_loginSilent.cause, never>>(false);
-            }
+                const result_loginSilent = await loginSilent({
+                    oidcClientTsUserManager,
+                    stateQueryParamValue_instance,
+                    configId,
+                    transformUrlBeforeRedirect_next,
+                    getExtraQueryParams,
+                    getExtraTokenParams
+                });
 
-            assert<Equals<typeof result_loginSilent.outcome, "got auth response from iframe">>();
+                assert(result_loginSilent.outcome !== "token refreshed using refresh token");
 
-            const { authResponse } = result_loginSilent;
+                if (result_loginSilent.outcome === "failure") {
+                    switch (result_loginSilent.cause) {
+                        case "can't reach well-known oidc endpoint":
+                            return createWellKnownOidcConfigurationEndpointUnreachableInitializationError(
+                                {
+                                    issuerUri
+                                }
+                            );
+                        case "timeout":
+                            return createIframeTimeoutInitializationError({
+                                homeAndCallbackUrl,
+                                clientId,
+                                issuerUri
+                            });
+                    }
 
-            log?.("Silent signin auth response", authResponse);
+                    assert<Equals<typeof result_loginSilent.cause, never>>(false);
+                }
 
-            const authResponse_error = authResponse.error;
-            let oidcClientTsUser: OidcClientTsUser | undefined = undefined;
+                assert<Equals<typeof result_loginSilent.outcome, "got auth response from iframe">>();
 
-            try {
-                oidcClientTsUser = await oidcClientTsUserManager.signinRedirectCallback(
-                    authResponseToUrl(authResponse)
-                );
-            } catch (error) {
-                assert(error instanceof Error);
+                const { authResponse } = result_loginSilent;
 
-                if (error.message === "Failed to fetch") {
-                    return createFailedToFetchTokenEndpointInitializationError({
-                        clientId,
-                        issuerUri
-                    });
-                }
+                log?.("Silent signin auth response", authResponse);
+
+                authResponse_error = authResponse.error;
 
-                if (authResponse_error === undefined) {
-                    return error;
+                try {
+                    oidcClientTsUser = await oidcClientTsUserManager.signinRedirectCallback(
+                        authResponseToUrl(authResponse)
+                    );
+                } catch (error) {
+                    assert(error instanceof Error);
+
+                    if (error.message === "Failed to fetch") {
+                        return createFailedToFetchTokenEndpointInitializationError({
+                            clientId,
+                            issuerUri
+                        });
+                    }
+
+                    if (authResponse_error === undefined) {
+                        return error;
+                    }
                 }
             }
 
@@ -612,7 +650,7 @@ export async function createOidc_nonMemoized<
                         doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: autoLogin,
                         extraQueryParams_local: undefined,
                         transformUrlBeforeRedirect_local: undefined,
-                        doForceInteraction: false
+                        doForceInteraction: persistedAuthState === "explicitly logged out"
                     });
                     assert(false);
                 }
@@ -626,7 +664,7 @@ export async function createOidc_nonMemoized<
                     ].join("")
                 );
 
-                break restore_from_http_only_cookie;
+                break silent_login_if_possible_and_auto_login;
             }
 
             log?.("Successful silent signed in");
@@ -876,7 +914,9 @@ export async function createOidc_nonMemoized<
             return new Promise<never>(() => {});
         },
         renewTokens: (() => {
-            async function renewTokens_nonMutexed(params: { extraTokenParams: Record<string, string> }) {
+            async function renewTokens_nonMutexed(params: {
+                extraTokenParams: Record<string, string | undefined>;
+            }) {
                 const { extraTokenParams } = params;
 
                 log?.("Renewing tokens");
@@ -887,6 +927,8 @@ export async function createOidc_nonMemoized<
                     oidcClientTsUserManager,
                     stateQueryParamValue_instance,
                     configId,
+                    transformUrlBeforeRedirect_next,
+                    getExtraQueryParams,
                     getExtraTokenParams: () => extraTokenParams
                 });
 
@@ -989,7 +1031,7 @@ export async function createOidc_nonMemoized<
             let ongoingCall:
                 | {
                       pr: Promise<void>;
-                      extraTokenParams: Record<string, string>;
+                      extraTokenParams: Record<string, string | undefined>;
                   }
                 | undefined = undefined;
 

package/src/oidc/loginOrGoToAuthServer.ts

@@ -1,7 +1,7 @@
 import type { UserManager as OidcClientTsUserManager } from "../vendor/frontend/oidc-client-ts-and-jwt-decode";
 import { toFullyQualifiedUrl } from "../tools/toFullyQualifiedUrl";
-import { id, assert, type Equals } from "../vendor/frontend/tsafe";
-import type { StateData } from "./StateData";
+import { assert, type Equals, noUndefined } from "../vendor/frontend/tsafe";
+import { StateData } from "./StateData";
 import type { NonPostableEvt } from "../tools/Evt";
 import { type StatefulEvt, createStatefulEvt } from "../tools/StatefulEvt";
 import { Deferred } from "../tools/Deferred";
@@ -27,7 +27,7 @@ type Params = Params.Login | Params.GoToAuthServer;
 namespace Params {
     type Common = {
         redirectUrl: string;
-        extraQueryParams_local: Record<string, string> | undefined;
+        extraQueryParams_local: Record<string, string | undefined> | undefined;
         transformUrlBeforeRedirect_local: ((url: string) => string) | undefined;
     };
 
@@ -59,8 +59,15 @@ export function getPrSafelyRestoredFromBfCacheAfterLoginBackNavigation() {
 export function createLoginOrGoToAuthServer(params: {
     configId: string;
     oidcClientTsUserManager: OidcClientTsUserManager;
-    getExtraQueryParams: (() => Record<string, string>) | undefined;
     transformUrlBeforeRedirect: ((url: string) => string) | undefined;
+    transformUrlBeforeRedirect_next: ((params: { isSilent: false; url: string }) => string) | undefined;
+
+    getExtraQueryParams:
+        | ((params: { isSilent: false; url: string }) => Record<string, string | undefined>)
+        | undefined;
+
+    getExtraTokenParams: (() => Record<string, string | undefined>) | undefined;
+
     homeAndCallbackUrl: string;
     evtIsUserLoggedIn: NonPostableEvt<boolean>;
     log: typeof console.log | undefined;
@@ -68,8 +75,13 @@ export function createLoginOrGoToAuthServer(params: {
     const {
         configId,
         oidcClientTsUserManager,
-        getExtraQueryParams,
+
         transformUrlBeforeRedirect,
+        transformUrlBeforeRedirect_next,
+        getExtraQueryParams,
+
+        getExtraTokenParams,
+
         homeAndCallbackUrl,
         evtIsUserLoggedIn,
         log
@@ -83,7 +95,7 @@ export function createLoginOrGoToAuthServer(params: {
         const {
             redirectUrl: redirectUrl_params,
             extraQueryParams_local,
-            transformUrlBeforeRedirect_local,
+            transformUrlBeforeRedirect_local: transformUrl,
             ...rest
         } = params;
 
@@ -152,33 +164,82 @@ export function createLoginOrGoToAuthServer(params: {
 
         log?.(`redirectUrl: ${redirectUrl}`);
 
+        const stateData: StateData = {
+            context: "redirect",
+            redirectUrl,
+            extraQueryParams: {},
+            hasBeenProcessedByCallback: false,
+            configId,
+            action: "login",
+            redirectUrl_consentRequiredCase: (() => {
+                switch (rest.action) {
+                    case "login":
+                        return lastPublicUrl ?? homeAndCallbackUrl;
+                    case "go to auth server":
+                        return redirectUrl;
+                }
+            })()
+        };
+
         const transformUrl_oidcClientTs = (url: string) => {
             (
                 [
-                    [getExtraQueryParams?.(), transformUrlBeforeRedirect],
-                    [extraQueryParams_local, transformUrlBeforeRedirect_local]
+                    [
+                        undefined,
+                        transformUrlBeforeRedirect_next === undefined
+                            ? undefined
+                            : (url: string) => transformUrlBeforeRedirect_next({ url, isSilent: false })
+                    ],
+                    [getExtraQueryParams, transformUrlBeforeRedirect],
+                    [extraQueryParams_local, transformUrl]
                 ] as const
-            ).forEach(([extraQueryParams, transformUrlBeforeRedirect]) => {
+            ).forEach(([extraQueryParamsMaybeGetter, transformUrlBeforeRedirect], i) => {
+                const urlObj_before = i !== 2 ? undefined : new URL(url);
+
                 add_extra_query_params: {
-                    if (extraQueryParams === undefined) {
+                    if (extraQueryParamsMaybeGetter === undefined) {
                         break add_extra_query_params;
                     }
 
+                    const extraQueryParams =
+                        typeof extraQueryParamsMaybeGetter === "function"
+                            ? extraQueryParamsMaybeGetter({ isSilent: false, url })
+                            : extraQueryParamsMaybeGetter;
+
                     const url_obj = new URL(url);
 
                     for (const [name, value] of Object.entries(extraQueryParams)) {
+                        if (value === undefined) {
+                            continue;
+                        }
                         url_obj.searchParams.set(name, value);
                     }
 
                     url = url_obj.href;
                 }
 
-                apply_transform_before_redirect: {
+                apply_transform_url: {
                     if (transformUrlBeforeRedirect === undefined) {
-                        break apply_transform_before_redirect;
+                        break apply_transform_url;
                     }
                     url = transformUrlBeforeRedirect(url);
                 }
+
+                update_state: {
+                    if (urlObj_before === undefined) {
+                        break update_state;
+                    }
+
+                    for (const [name, value] of new URL(url).searchParams.entries()) {
+                        const value_before = urlObj_before.searchParams.get(name);
+
+                        if (value_before === value) {
+                            continue;
+                        }
+
+                        stateData.extraQueryParams[name] = value;
+                    }
+                }
             });
 
             return url;
@@ -197,48 +258,9 @@ export function createLoginOrGoToAuthServer(params: {
 
         log?.(`redirectMethod: ${redirectMethod}`);
 
-        const { extraQueryParams } = (() => {
-            const extraQueryParams: Record<string, string> = extraQueryParams_local ?? {};
-
-            read_query_params_added_by_transform_before_redirect: {
-                if (transformUrlBeforeRedirect_local === undefined) {
-                    break read_query_params_added_by_transform_before_redirect;
-                }
-
-                let url_afterTransform;
-
-                try {
-                    url_afterTransform = transformUrlBeforeRedirect_local("https://dummy.com");
-                } catch {
-                    break read_query_params_added_by_transform_before_redirect;
-                }
-
-                for (const [name, value] of new URL(url_afterTransform).searchParams) {
-                    extraQueryParams[name] = value;
-                }
-            }
-
-            return { extraQueryParams };
-        })();
-
         return oidcClientTsUserManager
             .signinRedirect({
-                state: id<StateData>({
-                    context: "redirect",
-                    redirectUrl,
-                    extraQueryParams,
-                    hasBeenProcessedByCallback: false,
-                    configId,
-                    action: "login",
-                    redirectUrl_consentRequiredCase: (() => {
-                        switch (rest.action) {
-                            case "login":
-                                return lastPublicUrl ?? homeAndCallbackUrl;
-                            case "go to auth server":
-                                return redirectUrl;
-                        }
-                    })()
-                }),
+                state: stateData,
                 redirectMethod,
                 prompt: (() => {
                     switch (rest.action) {
@@ -249,7 +271,9 @@ export function createLoginOrGoToAuthServer(params: {
                     }
                     assert<Equals<typeof rest, never>>;
                 })(),
-                transformUrl: transformUrl_oidcClientTs
+                transformUrl: transformUrl_oidcClientTs,
+                extraTokenParams:
+                    getExtraTokenParams === undefined ? undefined : noUndefined(getExtraTokenParams())
             })
             .then(() => new Promise<never>(() => {}));
     }

package/src/oidc/loginSilent.ts

@@ -1,6 +1,6 @@
 import type { UserManager as OidcClientTsUserManager } from "../vendor/frontend/oidc-client-ts-and-jwt-decode";
 import { Deferred } from "../tools/Deferred";
-import { id, assert } from "../vendor/frontend/tsafe";
+import { id, assert, noUndefined } from "../vendor/frontend/tsafe";
 import { getStateData, clearStateStore, type StateData } from "./StateData";
 import { getDownlinkAndRtt } from "../tools/getDownlinkAndRtt";
 import { getIsDev } from "../tools/isDev";
@@ -25,10 +25,23 @@ export async function loginSilent(params: {
     oidcClientTsUserManager: OidcClientTsUserManager;
     stateQueryParamValue_instance: string;
     configId: string;
-    getExtraTokenParams: (() => Record<string, string>) | undefined;
+
+    transformUrlBeforeRedirect_next: ((params: { isSilent: true; url: string }) => string) | undefined;
+
+    getExtraQueryParams:
+        | ((params: { isSilent: true; url: string }) => Record<string, string | undefined>)
+        | undefined;
+
+    getExtraTokenParams: (() => Record<string, string | undefined>) | undefined;
 }): Promise<ResultOfLoginSilent> {
-    const { oidcClientTsUserManager, stateQueryParamValue_instance, configId, getExtraTokenParams } =
-        params;
+    const {
+        oidcClientTsUserManager,
+        stateQueryParamValue_instance,
+        configId,
+        transformUrlBeforeRedirect_next,
+        getExtraQueryParams,
+        getExtraTokenParams
+    } = params;
 
     const dResult = new Deferred<ResultOfLoginSilent>();
 
@@ -88,6 +101,36 @@ export async function loginSilent(params: {
 
     window.addEventListener("message", listener, false);
 
+    const transformUrl_oidcClientTs = (url: string) => {
+        add_extra_query_params: {
+            if (getExtraQueryParams === undefined) {
+                break add_extra_query_params;
+            }
+
+            const extraQueryParams = getExtraQueryParams({ isSilent: true, url });
+
+            const url_obj = new URL(url);
+
+            for (const [name, value] of Object.entries(extraQueryParams)) {
+                if (value === undefined) {
+                    continue;
+                }
+                url_obj.searchParams.set(name, value);
+            }
+
+            url = url_obj.href;
+        }
+
+        apply_transform_url: {
+            if (transformUrlBeforeRedirect_next === undefined) {
+                break apply_transform_url;
+            }
+            url = transformUrlBeforeRedirect_next({ url, isSilent: true });
+        }
+
+        return url;
+    };
+
     oidcClientTsUserManager
         .signinSilent({
             state: id<StateData.IFrame>({
@@ -95,7 +138,9 @@ export async function loginSilent(params: {
                 configId
             }),
             silentRequestTimeoutInSeconds: timeoutDelayMs / 1000,
-            extraTokenParams: getExtraTokenParams?.()
+            extraTokenParams:
+                getExtraTokenParams === undefined ? undefined : noUndefined(getExtraTokenParams()),
+            transformUrl: transformUrl_oidcClientTs
         })
         .then(
             oidcClientTsUser => {

package/src/vendor/frontend/tsafe.ts

@@ -2,4 +2,5 @@ export { id } from "tsafe/id";
 export { assert, is, type Equals } from "tsafe/assert";
 export { typeGuard } from "tsafe/typeGuard";
 export { overwriteReadonlyProp } from "tsafe/lab/overwriteReadonlyProp";
+export { noUndefined } from "tsafe/noUndefined";
 export type { Param0 } from "tsafe";