oidc-spa 7.1.9 → 7.2.0-rc.1

package/core/createOidc.js

@@ -1,1337 +1,1042 @@
 "use strict";
-var __assign = (this && this.__assign) || function () {
-    __assign = Object.assign || function(t) {
-        for (var s, i = 1, n = arguments.length; i < n; i++) {
-            s = arguments[i];
-            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
-                t[p] = s[p];
-        }
-        return t;
-    };
-    return __assign.apply(this, arguments);
-};
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-var __generator = (this && this.__generator) || function (thisArg, body) {
-    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
-    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
-    function verb(n) { return function (v) { return step([n, v]); }; }
-    function step(op) {
-        if (f) throw new TypeError("Generator is already executing.");
-        while (g && (g = 0, op[0] && (_ = 0)), _) try {
-            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
-            if (y = 0, t) op = [op[0] & 2, t.value];
-            switch (op[0]) {
-                case 0: case 1: t = op; break;
-                case 4: _.label++; return { value: op[1], done: false };
-                case 5: _.label++; y = op[1]; op = [0]; continue;
-                case 7: op = _.ops.pop(); _.trys.pop(); continue;
-                default:
-                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
-                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
-                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
-                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
-                    if (t[2]) _.ops.pop();
-                    _.trys.pop(); continue;
-            }
-            op = body.call(thisArg, _);
-        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
-        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
-    }
-};
-var __rest = (this && this.__rest) || function (s, e) {
-    var t = {};
-    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
-        t[p] = s[p];
-    if (s != null && typeof Object.getOwnPropertySymbols === "function")
-        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
-            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
-                t[p[i]] = s[p[i]];
-        }
-    return t;
-};
-var __values = (this && this.__values) || function(o) {
-    var s = typeof Symbol === "function" && Symbol.iterator, m = s && o[s], i = 0;
-    if (m) return m.call(o);
-    if (o && typeof o.length === "number") return {
-        next: function () {
-            if (o && i >= o.length) o = void 0;
-            return { value: o && o[i++], done: !o };
-        }
-    };
-    throw new TypeError(s ? "Object is not iterable." : "Symbol.iterator is not defined.");
-};
-var __read = (this && this.__read) || function (o, n) {
-    var m = typeof Symbol === "function" && o[Symbol.iterator];
-    if (!m) return o;
-    var i = m.call(o), r, ar = [], e;
-    try {
-        while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
-    }
-    catch (error) { e = { error: error }; }
-    finally {
-        try {
-            if (r && !r.done && (m = i["return"])) m.call(i);
-        }
-        finally { if (e) throw e.error; }
-    }
-    return ar;
-};
-var __spreadArray = (this && this.__spreadArray) || function (to, from, pack) {
-    if (pack || arguments.length === 2) for (var i = 0, l = from.length, ar; i < l; i++) {
-        if (ar || !(i in from)) {
-            if (!ar) ar = Array.prototype.slice.call(from, 0, i);
-            ar[i] = from[i];
-        }
-    }
-    return to.concat(ar || Array.prototype.slice.call(from));
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createOidc = createOidc;
 exports.createOidc_nonMemoized = createOidc_nonMemoized;
-var oidc_client_ts_and_jwt_decode_1 = require("../vendor/frontend/oidc-client-ts-and-jwt-decode");
-var tsafe_1 = require("../vendor/frontend/tsafe");
-var workerTimers_1 = require("../tools/workerTimers");
-var Deferred_1 = require("../tools/Deferred");
-var evtIsUserActive_1 = require("./evtIsUserActive");
-var startCountdown_1 = require("../tools/startCountdown");
-var toHumanReadableDuration_1 = require("../tools/toHumanReadableDuration");
-var toFullyQualifiedUrl_1 = require("../tools/toFullyQualifiedUrl");
-var OidcInitializationError_1 = require("./OidcInitializationError");
-var StateData_1 = require("./StateData");
-var logoutPropagationToOtherTabs_1 = require("./logoutPropagationToOtherTabs");
-var loginPropagationToOtherTabs_1 = require("./loginPropagationToOtherTabs");
-var configId_1 = require("./configId");
-var oidcClientTsUserToTokens_1 = require("./oidcClientTsUserToTokens");
-var loginSilent_1 = require("./loginSilent");
-var AuthResponse_1 = require("./AuthResponse");
-var handleOidcCallback_1 = require("./handleOidcCallback");
-var persistedAuthState_1 = require("./persistedAuthState");
-var Evt_1 = require("../tools/Evt");
-var haveSharedParentDomain_1 = require("../tools/haveSharedParentDomain");
-var loginOrGoToAuthServer_1 = require("./loginOrGoToAuthServer");
-var EphemeralSessionStorage_1 = require("../tools/EphemeralSessionStorage");
-var ongoingLoginOrRefreshProcesses_1 = require("./ongoingLoginOrRefreshProcesses");
-var initialLocationHref_1 = require("./initialLocationHref");
-var isNewBrowserSession_1 = require("./isNewBrowserSession");
-var trustedFetch_1 = require("./trustedFetch");
-var getIsOnline_1 = require("../tools/getIsOnline");
-(0, handleOidcCallback_1.handleOidcCallback)();
+const oidc_client_ts_1 = require("../vendor/frontend/oidc-client-ts");
+const tsafe_1 = require("../vendor/frontend/tsafe");
+const workerTimers_1 = require("../tools/workerTimers");
+const Deferred_1 = require("../tools/Deferred");
+const evtIsUserActive_1 = require("./evtIsUserActive");
+const startCountdown_1 = require("../tools/startCountdown");
+const toHumanReadableDuration_1 = require("../tools/toHumanReadableDuration");
+const toFullyQualifiedUrl_1 = require("../tools/toFullyQualifiedUrl");
+const OidcInitializationError_1 = require("./OidcInitializationError");
+const StateData_1 = require("./StateData");
+const logoutPropagationToOtherTabs_1 = require("./logoutPropagationToOtherTabs");
+const loginPropagationToOtherTabs_1 = require("./loginPropagationToOtherTabs");
+const configId_1 = require("./configId");
+const oidcClientTsUserToTokens_1 = require("./oidcClientTsUserToTokens");
+const loginSilent_1 = require("./loginSilent");
+const AuthResponse_1 = require("./AuthResponse");
+const handleOidcCallback_1 = require("./handleOidcCallback");
+const persistedAuthState_1 = require("./persistedAuthState");
+const Evt_1 = require("../tools/Evt");
+const haveSharedParentDomain_1 = require("../tools/haveSharedParentDomain");
+const loginOrGoToAuthServer_1 = require("./loginOrGoToAuthServer");
+const EphemeralSessionStorage_1 = require("../tools/EphemeralSessionStorage");
+const ongoingLoginOrRefreshProcesses_1 = require("./ongoingLoginOrRefreshProcesses");
+const initialLocationHref_1 = require("./initialLocationHref");
+const isNewBrowserSession_1 = require("./isNewBrowserSession");
+const getIsOnline_1 = require("../tools/getIsOnline");
+const isKeycloak_1 = require("../keycloak/isKeycloak");
 // NOTE: Replaced at build time
-var VERSION = "7.1.9";
-var globalContext = {
+const VERSION = "7.2.0-rc.1";
+const globalContext = {
     prOidcByConfigId: new Map(),
     hasLogoutBeenCalled: (0, tsafe_1.id)(false),
     evtRequestToPersistTokens: (0, Evt_1.createEvt)()
 };
 /** @see: https://docs.oidc-spa.dev/v/v7/usage */
-function createOidc(params) {
-    return __awaiter(this, void 0, void 0, function () {
-        var _a, _b, name_1, value, issuerUri_params, clientId, _c, scopes, debugLogs, rest, issuerUri, log, configId, prOidcByConfigId, prOidc, dOidc, oidc;
-        var e_1, _d;
-        return __generator(this, function (_e) {
-            switch (_e.label) {
-                case 0:
-                    try {
-                        for (_a = __values(["issuerUri", "clientId"]), _b = _a.next(); !_b.done; _b = _a.next()) {
-                            name_1 = _b.value;
-                            value = params[name_1];
-                            if (!value) {
-                                throw new Error("The parameter \"".concat(name_1, "\" is required, you provided: ").concat(value, ". (Forgot a .env variable?)"));
-                            }
-                        }
+async function createOidc(params) {
+    for (const name of ["issuerUri", "clientId"]) {
+        const value = params[name];
+        if (!value) {
+            throw new Error(`The parameter "${name}" is required, you provided: ${value}. (Forgot a .env variable?)`);
+        }
+    }
+    const { issuerUri: issuerUri_params, clientId, scopes = ["profile"], debugLogs, ...rest } = params;
+    const issuerUri = (0, toFullyQualifiedUrl_1.toFullyQualifiedUrl)({
+        urlish: issuerUri_params,
+        doAssertNoQueryParams: true,
+        doOutputWithTrailingSlash: false
+    });
+    const log = (() => {
+        if (!debugLogs) {
+            return undefined;
+        }
+        return (0, tsafe_1.id)((...[first, ...rest]) => {
+            const label = "oidc-spa";
+            if (typeof first === "string") {
+                console.log(...[`${label}: ${first}`, ...rest]);
+            }
+            else {
+                console.log(...[`${label}:`, first, ...rest]);
+            }
+        });
+    })();
+    const configId = (0, configId_1.getConfigId)({ issuerUri, clientId });
+    const { prOidcByConfigId } = globalContext;
+    use_previous_instance: {
+        const prOidc = prOidcByConfigId.get(configId);
+        if (prOidc === undefined) {
+            break use_previous_instance;
+        }
+        log?.([
+            `createOidc was called again with the same config (${JSON.stringify({
+                issuerUri,
+                clientId
+            })})`,
+            `Returning the previous instance. All potential different parameters are ignored.`
+        ].join(" "));
+        // @ts-expect-error: We know what we're doing
+        return prOidc;
+    }
+    const dOidc = new Deferred_1.Deferred();
+    prOidcByConfigId.set(configId, dOidc.pr);
+    const oidc = await createOidc_nonMemoized(rest, {
+        issuerUri,
+        clientId,
+        scopes,
+        configId,
+        log
+    });
+    dOidc.resolve(oidc);
+    return oidc;
+}
+async function createOidc_nonMemoized(params, preProcessedParams) {
+    const { transformUrlBeforeRedirect, extraQueryParams: extraQueryParamsOrGetter, extraTokenParams: extraTokenParamsOrGetter, homeUrl: homeUrl_params, decodedIdTokenSchema, idleSessionLifetimeInSeconds, autoLogoutParams = { redirectTo: "current page" }, autoLogin = false, postLoginRedirectUrl: postLoginRedirectUrl_default, __unsafe_clientSecret, __unsafe_useIdTokenAsAccessToken = false, __metadata, noIframe = false } = params;
+    const { issuerUri, clientId, scopes, configId, log } = preProcessedParams;
+    const getExtraQueryParams = (() => {
+        if (extraQueryParamsOrGetter === undefined) {
+            return undefined;
+        }
+        if (typeof extraQueryParamsOrGetter !== "function") {
+            return () => extraQueryParamsOrGetter;
+        }
+        return extraQueryParamsOrGetter;
+    })();
+    const getExtraTokenParams = (() => {
+        if (extraTokenParamsOrGetter === undefined) {
+            return undefined;
+        }
+        if (typeof extraTokenParamsOrGetter !== "function") {
+            return () => extraTokenParamsOrGetter;
+        }
+        return extraTokenParamsOrGetter;
+    })();
+    const homeUrlAndRedirectUri = (0, toFullyQualifiedUrl_1.toFullyQualifiedUrl)({
+        urlish: homeUrl_params,
+        doAssertNoQueryParams: true,
+        doOutputWithTrailingSlash: true
+    });
+    log?.(`Calling createOidc v${VERSION} ${JSON.stringify({
+        issuerUri,
+        clientId,
+        scopes,
+        configId,
+        homeUrlAndRedirectUri
+    }, null, 2)}`);
+    {
+        const { isHandled } = (0, handleOidcCallback_1.handleOidcCallback)();
+        if (isHandled) {
+            await new Promise(() => { });
+        }
+    }
+    const stateUrlParamValue_instance = (0, StateData_1.generateStateUrlParamValue)();
+    const canUseIframe = (() => {
+        if (noIframe) {
+            return false;
+        }
+        third_party_cookies: {
+            const isOidcServerThirdPartyRelativeToApp = (0, haveSharedParentDomain_1.getHaveSharedParentDomain)({
+                url1: window.location.origin,
+                url2: issuerUri
+            }) === false;
+            if (!isOidcServerThirdPartyRelativeToApp) {
+                break third_party_cookies;
+            }
+            const isGoogleChrome = (() => {
+                const ua = navigator.userAgent;
+                const vendor = navigator.vendor;
+                return (/Chrome/.test(ua) && /Google Inc/.test(vendor) && !/Edg/.test(ua) && !/OPR/.test(ua));
+            })();
+            if (window.location.origin.startsWith("http://localhost") && isGoogleChrome) {
+                break third_party_cookies;
+            }
+            log?.([
+                "Can't use iframe because your auth server is on a third party domain relative",
+                "to the domain of your app and third party cookies are blocked by navigators."
+            ].join(" "));
+            return false;
+        }
+        // NOTE: Maybe not, it depend if the app can iframe itself.
+        return true;
+    })();
+    let isUserStoreInMemoryOnly;
+    const oidcClientTsUserManager = new oidc_client_ts_1.UserManager({
+        stateUrlParamValue: stateUrlParamValue_instance,
+        authority: issuerUri,
+        client_id: clientId,
+        redirect_uri: homeUrlAndRedirectUri,
+        silent_redirect_uri: homeUrlAndRedirectUri,
+        post_logout_redirect_uri: homeUrlAndRedirectUri,
+        response_mode: (0, isKeycloak_1.isKeycloak)({ issuerUri }) ? "fragment" : "query",
+        response_type: "code",
+        scope: Array.from(new Set(["openid", ...scopes])).join(" "),
+        automaticSilentRenew: false,
+        userStore: new oidc_client_ts_1.WebStorageStateStore({
+            store: (() => {
+                if (canUseIframe) {
+                    isUserStoreInMemoryOnly = true;
+                    return new oidc_client_ts_1.InMemoryWebStorage();
+                }
+                isUserStoreInMemoryOnly = false;
+                const storage = (0, EphemeralSessionStorage_1.createEphemeralSessionStorage)({
+                    sessionStorageTtlMs: 3 * 60000
+                });
+                const { evtRequestToPersistTokens } = globalContext;
+                evtRequestToPersistTokens.subscribe(({ configIdOfInstancePostingTheRequest }) => {
+                    if (configIdOfInstancePostingTheRequest === configId) {
+                        return;
                     }
-                    catch (e_1_1) { e_1 = { error: e_1_1 }; }
-                    finally {
+                    storage.persistCurrentStateAndSubsequentChanges();
+                });
+                return storage;
+            })()
+        }),
+        stateStore: new oidc_client_ts_1.WebStorageStateStore({ store: localStorage, prefix: StateData_1.STATE_STORE_KEY_PREFIX }),
+        client_secret: __unsafe_clientSecret,
+        metadata: __metadata
+    });
+    const evtIsUserLoggedIn = (0, Evt_1.createEvt)();
+    const { loginOrGoToAuthServer } = (0, loginOrGoToAuthServer_1.createLoginOrGoToAuthServer)({
+        configId,
+        oidcClientTsUserManager,
+        transformUrlBeforeRedirect,
+        getExtraQueryParams,
+        getExtraTokenParams,
+        homeUrl: homeUrlAndRedirectUri,
+        evtIsUserLoggedIn,
+        log
+    });
+    const { getIsNewBrowserSession } = (0, isNewBrowserSession_1.createGetIsNewBrowserSession)({
+        configId,
+        evtUserNotLoggedIn: (() => {
+            const evt = (0, Evt_1.createEvt)();
+            evtIsUserLoggedIn.subscribe(isUserLoggedIn => {
+                if (!isUserLoggedIn) {
+                    evt.post();
+                }
+            });
+            return evt;
+        })()
+    });
+    const { completeLoginOrRefreshProcess } = await (0, ongoingLoginOrRefreshProcesses_1.startLoginOrRefreshProcess)();
+    const resultOfLoginProcess = await (async () => {
+        handle_redirect_auth_response: {
+            const authResponseAndStateData = (0, handleOidcCallback_1.retrieveRedirectAuthResponseAndStateData)({ configId });
+            if (authResponseAndStateData === undefined) {
+                break handle_redirect_auth_response;
+            }
+            const { authResponse, stateData } = authResponseAndStateData;
+            switch (stateData.action) {
+                case "login":
+                    {
+                        log?.(`Handling login redirect auth response ${JSON.stringify(authResponse, null, 2)}`);
+                        const authResponseUrl = (0, AuthResponse_1.authResponseToUrl)(authResponse);
+                        let oidcClientTsUser = undefined;
                         try {
-                            if (_b && !_b.done && (_d = _a.return)) _d.call(_a);
-                        }
-                        finally { if (e_1) throw e_1.error; }
-                    }
-                    issuerUri_params = params.issuerUri, clientId = params.clientId, _c = params.scopes, scopes = _c === void 0 ? ["profile"] : _c, debugLogs = params.debugLogs, rest = __rest(params, ["issuerUri", "clientId", "scopes", "debugLogs"]);
-                    issuerUri = (0, toFullyQualifiedUrl_1.toFullyQualifiedUrl)({
-                        urlish: issuerUri_params,
-                        doAssertNoQueryParams: true,
-                        doOutputWithTrailingSlash: false
-                    });
-                    log = (function () {
-                        if (!debugLogs) {
-                            return undefined;
+                            oidcClientTsUser = await oidcClientTsUserManager.signinRedirectCallback(authResponseUrl);
                         }
-                        return (0, tsafe_1.id)(function () {
-                            var _a = [];
-                            for (var _i = 0; _i < arguments.length; _i++) {
-                                _a[_i] = arguments[_i];
+                        catch (error) {
+                            (0, tsafe_1.assert)(error instanceof Error, "741947");
+                            if (error.message === "Failed to fetch") {
+                                return (0, OidcInitializationError_1.createFailedToFetchTokenEndpointInitializationError)({
+                                    clientId,
+                                    issuerUri
+                                });
                             }
-                            var _b = __read(_a), first = _b[0], rest = _b.slice(1);
-                            var label = "oidc-spa";
-                            if (typeof first === "string") {
-                                console.log.apply(console, __spreadArray([], __read(__spreadArray(["".concat(label, ": ").concat(first)], __read(rest), false)), false));
+                            {
+                                const authResponse_error = authResponse.error;
+                                if (authResponse_error !== undefined) {
+                                    log?.(`The auth server responded with: ${authResponse_error}, trying to restore from the http only cookie`);
+                                    break handle_redirect_auth_response;
+                                }
                             }
-                            else {
-                                console.log.apply(console, __spreadArray([], __read(__spreadArray(["".concat(label, ":"), first], __read(rest), false)), false));
+                            return error;
+                        }
+                        (0, loginPropagationToOtherTabs_1.notifyOtherTabsOfLogin)({ configId });
+                        return {
+                            oidcClientTsUser,
+                            backFromAuthServer: {
+                                extraQueryParams: stateData.extraQueryParams,
+                                result: Object.fromEntries(Object.entries(authResponse)
+                                    .map(([name, value]) => {
+                                    if (name === "state" ||
+                                        name === "session_state" ||
+                                        name === "iss" ||
+                                        name === "code") {
+                                        return undefined;
+                                    }
+                                    if (value === undefined) {
+                                        return undefined;
+                                    }
+                                    return [name, value];
+                                })
+                                    .filter(entry => entry !== undefined))
                             }
+                        };
+                    }
+                    break;
+                case "logout":
+                    {
+                        log?.("Handling logout redirect auth response", authResponse);
+                        const authResponseUrl = (0, AuthResponse_1.authResponseToUrl)(authResponse);
+                        try {
+                            await oidcClientTsUserManager.signoutRedirectCallback(authResponseUrl);
+                        }
+                        catch { }
+                        (0, logoutPropagationToOtherTabs_1.notifyOtherTabsOfLogout)({
+                            configId,
+                            sessionId: stateData.sessionId
                         });
-                    })();
-                    configId = (0, configId_1.getConfigId)({ issuerUri: issuerUri, clientId: clientId });
-                    prOidcByConfigId = globalContext.prOidcByConfigId;
-                    use_previous_instance: {
-                        prOidc = prOidcByConfigId.get(configId);
-                        if (prOidc === undefined) {
-                            break use_previous_instance;
+                        if (autoLogin) {
+                            location.reload();
+                            await new Promise(() => { });
                         }
-                        log === null || log === void 0 ? void 0 : log([
-                            "createOidc was called again with the same config (".concat(JSON.stringify({
-                                issuerUri: issuerUri,
-                                clientId: clientId
-                            }), ")"),
-                            "Returning the previous instance. All potential different parameters are ignored."
+                        // NOTE: The user is no longer logged in.
+                        return undefined;
+                    }
+                    break;
+            }
+        }
+        restore_from_session_storage: {
+            if (isUserStoreInMemoryOnly) {
+                break restore_from_session_storage;
+            }
+            let oidcClientTsUser;
+            try {
+                oidcClientTsUser = await oidcClientTsUserManager.getUser();
+            }
+            catch {
+                // NOTE: Not sure if it can throw, but let's be safe.
+                oidcClientTsUser = null;
+                try {
+                    await oidcClientTsUserManager.removeUser();
+                }
+                catch { }
+            }
+            if (oidcClientTsUser === null) {
+                break restore_from_session_storage;
+            }
+            log?.("Restored the auth from ephemeral session storage");
+            return {
+                oidcClientTsUser,
+                backFromAuthServer: undefined
+            };
+        }
+        silent_login_if_possible_and_auto_login: {
+            const persistedAuthState = (0, persistedAuthState_1.getPersistedAuthState)({ configId });
+            if (persistedAuthState === "explicitly logged out" && !autoLogin) {
+                log?.("Skipping silent signin with iframe, the user has logged out");
+                break silent_login_if_possible_and_auto_login;
+            }
+            {
+                const { isOnline, prOnline } = (0, getIsOnline_1.getIsOnline)();
+                if (!isOnline) {
+                    if (autoLogin) {
+                        log?.([
+                            "The browser is currently offline",
+                            "Since autoLogin is enabled we wait until it comes back online",
+                            "to continue with authentication"
+                        ].join(" "));
+                        await prOnline;
+                    }
+                    else {
+                        log?.([
+                            "The browser is not currently online so we proceed with initialization",
+                            "assuming the user isn't authenticated"
                         ].join(" "));
-                        // @ts-expect-error: We know what we're doing
-                        return [2 /*return*/, prOidc];
+                        break silent_login_if_possible_and_auto_login;
                     }
-                    dOidc = new Deferred_1.Deferred();
-                    prOidcByConfigId.set(configId, dOidc.pr);
-                    return [4 /*yield*/, createOidc_nonMemoized(rest, {
-                            issuerUri: issuerUri,
-                            clientId: clientId,
-                            scopes: scopes,
-                            configId: configId,
-                            log: log
-                        })];
-                case 1:
-                    oidc = _e.sent();
-                    dOidc.resolve(oidc);
-                    return [2 /*return*/, oidc];
+                }
             }
-        });
-    });
-}
-function createOidc_nonMemoized(params, preProcessedParams) {
-    return __awaiter(this, void 0, void 0, function () {
-        var transformUrlBeforeRedirect, extraQueryParamsOrGetter, extraTokenParamsOrGetter, homeUrl_params, decodedIdTokenSchema, idleSessionLifetimeInSeconds, _a, autoLogoutParams, _b, autoLogin, postLoginRedirectUrl_default, __unsafe_clientSecret, _c, __unsafe_useIdTokenAsAccessToken, __metadata, _d, noIframe, issuerUri, clientId, scopes, configId, log, getExtraQueryParams, getExtraTokenParams, homeUrl, callbackUri, isHandled, stateQueryParamValue_instance, canUseIframe, isUserStoreInMemoryOnly, oidcClientTsUserManager, evtIsUserLoggedIn, loginOrGoToAuthServer, getIsNewBrowserSession, completeLoginOrRefreshProcess, resultOfLoginProcess, oidc_common, oidc_notLoggedIn, prOtherTabLogin, currentTokens, autoLogoutCountdownTickCallbacks, onTokenChanges, _e, sessionId, subjectId, wouldHaveAutoLoggedOutIfBrowserWasOnline, oidc_loggedIn, prOtherTabLogout, getCurrentRefreshTokenTtlInSeconds_1, startCountdown_2, stopCountdown_1, evtIsUserActive, unsubscribeFromIsUserActive_1, currentRefreshTokenTtlInSeconds;
-        var _this = this;
-        return __generator(this, function (_f) {
-            switch (_f.label) {
-                case 0:
-                    transformUrlBeforeRedirect = params.transformUrlBeforeRedirect, extraQueryParamsOrGetter = params.extraQueryParams, extraTokenParamsOrGetter = params.extraTokenParams, homeUrl_params = params.homeUrl, decodedIdTokenSchema = params.decodedIdTokenSchema, idleSessionLifetimeInSeconds = params.idleSessionLifetimeInSeconds, _a = params.autoLogoutParams, autoLogoutParams = _a === void 0 ? { redirectTo: "current page" } : _a, _b = params.autoLogin, autoLogin = _b === void 0 ? false : _b, postLoginRedirectUrl_default = params.postLoginRedirectUrl, __unsafe_clientSecret = params.__unsafe_clientSecret, _c = params.__unsafe_useIdTokenAsAccessToken, __unsafe_useIdTokenAsAccessToken = _c === void 0 ? false : _c, __metadata = params.__metadata, _d = params.noIframe, noIframe = _d === void 0 ? false : _d;
-                    issuerUri = preProcessedParams.issuerUri, clientId = preProcessedParams.clientId, scopes = preProcessedParams.scopes, configId = preProcessedParams.configId, log = preProcessedParams.log;
-                    getExtraQueryParams = (function () {
-                        if (extraQueryParamsOrGetter === undefined) {
-                            return undefined;
-                        }
-                        if (typeof extraQueryParamsOrGetter !== "function") {
-                            return function () { return extraQueryParamsOrGetter; };
-                        }
-                        return extraQueryParamsOrGetter;
-                    })();
-                    getExtraTokenParams = (function () {
-                        if (extraTokenParamsOrGetter === undefined) {
-                            return undefined;
-                        }
-                        if (typeof extraTokenParamsOrGetter !== "function") {
-                            return function () { return extraTokenParamsOrGetter; };
-                        }
-                        return extraTokenParamsOrGetter;
-                    })();
-                    homeUrl = (0, toFullyQualifiedUrl_1.toFullyQualifiedUrl)({
-                        urlish: homeUrl_params,
-                        doAssertNoQueryParams: true,
-                        doOutputWithTrailingSlash: true
-                    });
-                    callbackUri = (0, toFullyQualifiedUrl_1.toFullyQualifiedUrl)({
-                        urlish: homeUrl,
-                        doAssertNoQueryParams: true,
-                        doOutputWithTrailingSlash: true
-                    });
-                    log === null || log === void 0 ? void 0 : log("Calling createOidc v".concat(VERSION, " ").concat(JSON.stringify({
-                        issuerUri: issuerUri,
-                        clientId: clientId,
-                        scopes: scopes,
-                        configId: configId,
-                        homeUrl: homeUrl,
-                        callbackUri: callbackUri
-                    }, null, 2)));
-                    isHandled = (0, handleOidcCallback_1.handleOidcCallback)().isHandled;
-                    if (!isHandled) return [3 /*break*/, 2];
-                    return [4 /*yield*/, new Promise(function () { })];
-                case 1:
-                    _f.sent();
-                    _f.label = 2;
-                case 2:
-                    stateQueryParamValue_instance = (0, StateData_1.generateStateQueryParamValue)();
-                    canUseIframe = (function () {
-                        if (noIframe) {
-                            return false;
-                        }
-                        // NOTE: Electron
-                        if (!/https?:\/\//.test(callbackUri)) {
-                            log === null || log === void 0 ? void 0 : log("We won't use iframe, callbackUri uses a custom protocol.");
-                            return false;
-                        }
-                        third_party_cookies: {
-                            var isOidcServerThirdPartyRelativeToApp = (0, haveSharedParentDomain_1.getHaveSharedParentDomain)({
-                                url1: window.location.origin,
-                                url2: issuerUri
-                            }) === false;
-                            if (!isOidcServerThirdPartyRelativeToApp) {
-                                break third_party_cookies;
-                            }
-                            var isGoogleChrome = (function () {
-                                var ua = navigator.userAgent;
-                                var vendor = navigator.vendor;
-                                return (/Chrome/.test(ua) && /Google Inc/.test(vendor) && !/Edg/.test(ua) && !/OPR/.test(ua));
-                            })();
-                            if (window.location.origin.startsWith("http://localhost") && isGoogleChrome) {
-                                break third_party_cookies;
-                            }
-                            log === null || log === void 0 ? void 0 : log([
-                                "Can't use iframe because your auth server is on a third party domain relative",
-                                "to the domain of your app and third party cookies are blocked by navigators."
-                            ].join(" "));
-                            return false;
-                        }
-                        // NOTE: Maybe not, it depend if the app can iframe itself.
-                        return true;
-                    })();
-                    oidcClientTsUserManager = new oidc_client_ts_and_jwt_decode_1.UserManager({
-                        stateQueryParamValue: stateQueryParamValue_instance,
-                        authority: issuerUri,
-                        client_id: clientId,
-                        redirect_uri: callbackUri,
-                        silent_redirect_uri: callbackUri,
-                        post_logout_redirect_uri: callbackUri,
-                        response_type: "code",
-                        scope: Array.from(new Set(__spreadArray(["openid"], __read(scopes), false))).join(" "),
-                        automaticSilentRenew: false,
-                        userStore: new oidc_client_ts_and_jwt_decode_1.WebStorageStateStore({
-                            store: (function () {
-                                if (canUseIframe) {
-                                    isUserStoreInMemoryOnly = true;
-                                    return new oidc_client_ts_and_jwt_decode_1.InMemoryWebStorage();
-                                }
-                                isUserStoreInMemoryOnly = false;
-                                var storage = (0, EphemeralSessionStorage_1.createEphemeralSessionStorage)({
-                                    sessionStorageTtlMs: 3 * 60000
-                                });
-                                var evtRequestToPersistTokens = globalContext.evtRequestToPersistTokens;
-                                evtRequestToPersistTokens.subscribe(function (_a) {
-                                    var configIdOfInstancePostingTheRequest = _a.configIdOfInstancePostingTheRequest;
-                                    if (configIdOfInstancePostingTheRequest === configId) {
-                                        return;
-                                    }
-                                    storage.persistCurrentStateAndSubsequentChanges();
-                                });
-                                return storage;
-                            })()
-                        }),
-                        stateStore: new oidc_client_ts_and_jwt_decode_1.WebStorageStateStore({ store: localStorage, prefix: StateData_1.STATE_STORE_KEY_PREFIX }),
-                        client_secret: __unsafe_clientSecret,
-                        fetch: trustedFetch_1.trustedFetch,
-                        metadata: __metadata
-                    });
-                    evtIsUserLoggedIn = (0, Evt_1.createEvt)();
-                    loginOrGoToAuthServer = (0, loginOrGoToAuthServer_1.createLoginOrGoToAuthServer)({
-                        configId: configId,
-                        oidcClientTsUserManager: oidcClientTsUserManager,
-                        transformUrlBeforeRedirect: transformUrlBeforeRedirect,
-                        getExtraQueryParams: getExtraQueryParams,
-                        getExtraTokenParams: getExtraTokenParams,
-                        homeUrl: homeUrl,
-                        evtIsUserLoggedIn: evtIsUserLoggedIn,
-                        log: log
-                    }).loginOrGoToAuthServer;
-                    getIsNewBrowserSession = (0, isNewBrowserSession_1.createGetIsNewBrowserSession)({
-                        configId: configId,
-                        evtUserNotLoggedIn: (function () {
-                            var evt = (0, Evt_1.createEvt)();
-                            evtIsUserLoggedIn.subscribe(function (isUserLoggedIn) {
-                                if (!isUserLoggedIn) {
-                                    evt.post();
-                                }
+            let authResponse_error = undefined;
+            let oidcClientTsUser = undefined;
+            actual_silent_signin: {
+                if (persistedAuthState === "explicitly logged out") {
+                    break actual_silent_signin;
+                }
+                if (!canUseIframe) {
+                    break actual_silent_signin;
+                }
+                log?.("Trying to restore the auth from the http only cookie (silent signin with iframe)");
+                const result_loginSilent = await (0, loginSilent_1.loginSilent)({
+                    oidcClientTsUserManager,
+                    stateUrlParamValue_instance,
+                    configId,
+                    transformUrlBeforeRedirect,
+                    getExtraQueryParams,
+                    getExtraTokenParams,
+                    autoLogin
+                });
+                (0, tsafe_1.assert)(result_loginSilent.outcome !== "token refreshed using refresh token", "876995");
+                if (result_loginSilent.outcome === "failure") {
+                    switch (result_loginSilent.cause) {
+                        case "can't reach well-known oidc endpoint":
+                            return (0, OidcInitializationError_1.createWellKnownOidcConfigurationEndpointUnreachableInitializationError)({
+                                issuerUri
                             });
-                            return evt;
-                        })()
-                    }).getIsNewBrowserSession;
-                    return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.startLoginOrRefreshProcess)()];
-                case 3:
-                    completeLoginOrRefreshProcess = (_f.sent()).completeLoginOrRefreshProcess;
-                    return [4 /*yield*/, (function () { return __awaiter(_this, void 0, void 0, function () {
-                            var authResponseAndStateData, authResponse, stateData, _a, authResponseUrl, oidcClientTsUser, error_1, authResponse_error, authResponseUrl, _b, oidcClientTsUser, _c, _d, persistedAuthState_2, _e, isOnline, prOnline, authResponse_error, oidcClientTsUser, result_loginSilent, authResponse, error_2;
-                            return __generator(this, function (_f) {
-                                switch (_f.label) {
-                                    case 0:
-                                        authResponseAndStateData = (0, handleOidcCallback_1.retrieveRedirectAuthResponseAndStateData)({ configId: configId });
-                                        if (authResponseAndStateData === undefined) {
-                                            return [3 /*break*/, 13];
-                                        }
-                                        authResponse = authResponseAndStateData.authResponse, stateData = authResponseAndStateData.stateData;
-                                        _a = stateData.action;
-                                        switch (_a) {
-                                            case "login": return [3 /*break*/, 1];
-                                            case "logout": return [3 /*break*/, 6];
-                                        }
-                                        return [3 /*break*/, 13];
-                                    case 1:
-                                        log === null || log === void 0 ? void 0 : log("Handling login redirect auth response ".concat(JSON.stringify(authResponse, null, 2)));
-                                        authResponseUrl = (0, AuthResponse_1.authResponseToUrl)(authResponse);
-                                        oidcClientTsUser = undefined;
-                                        _f.label = 2;
-                                    case 2:
-                                        _f.trys.push([2, 4, , 5]);
-                                        return [4 /*yield*/, oidcClientTsUserManager.signinRedirectCallback(authResponseUrl)];
-                                    case 3:
-                                        oidcClientTsUser = _f.sent();
-                                        return [3 /*break*/, 5];
-                                    case 4:
-                                        error_1 = _f.sent();
-                                        (0, tsafe_1.assert)(error_1 instanceof Error, "741947");
-                                        if (error_1.message === "Failed to fetch") {
-                                            return [2 /*return*/, (0, OidcInitializationError_1.createFailedToFetchTokenEndpointInitializationError)({
-                                                    clientId: clientId,
-                                                    issuerUri: issuerUri
-                                                })];
-                                        }
-                                        {
-                                            authResponse_error = authResponse.error;
-                                            if (authResponse_error !== undefined) {
-                                                log === null || log === void 0 ? void 0 : log("The auth server responded with: ".concat(authResponse_error, ", trying to restore from the http only cookie"));
-                                                return [3 /*break*/, 13];
-                                            }
-                                        }
-                                        return [2 /*return*/, error_1];
-                                    case 5:
-                                        (0, loginPropagationToOtherTabs_1.notifyOtherTabsOfLogin)({ configId: configId });
-                                        return [2 /*return*/, {
-                                                oidcClientTsUser: oidcClientTsUser,
-                                                backFromAuthServer: {
-                                                    extraQueryParams: stateData.extraQueryParams,
-                                                    result: Object.fromEntries(Object.entries(authResponse)
-                                                        .map(function (_a) {
-                                                        var _b = __read(_a, 2), name = _b[0], value = _b[1];
-                                                        if (name === "state" ||
-                                                            name === "session_state" ||
-                                                            name === "iss" ||
-                                                            name === "code") {
-                                                            return undefined;
-                                                        }
-                                                        if (value === undefined) {
-                                                            return undefined;
-                                                        }
-                                                        return [name, value];
-                                                    })
-                                                        .filter(function (entry) { return entry !== undefined; }))
-                                                }
-                                            }];
-                                    case 6:
-                                        log === null || log === void 0 ? void 0 : log("Handling logout redirect auth response", authResponse);
-                                        authResponseUrl = (0, AuthResponse_1.authResponseToUrl)(authResponse);
-                                        _f.label = 7;
-                                    case 7:
-                                        _f.trys.push([7, 9, , 10]);
-                                        return [4 /*yield*/, oidcClientTsUserManager.signoutRedirectCallback(authResponseUrl)];
-                                    case 8:
-                                        _f.sent();
-                                        return [3 /*break*/, 10];
-                                    case 9:
-                                        _b = _f.sent();
-                                        return [3 /*break*/, 10];
-                                    case 10:
-                                        (0, logoutPropagationToOtherTabs_1.notifyOtherTabsOfLogout)({
-                                            configId: configId,
-                                            sessionId: stateData.sessionId
-                                        });
-                                        if (!autoLogin) return [3 /*break*/, 12];
-                                        location.reload();
-                                        return [4 /*yield*/, new Promise(function () { })];
-                                    case 11:
-                                        _f.sent();
-                                        _f.label = 12;
-                                    case 12: 
-                                    // NOTE: The user is no longer logged in.
-                                    return [2 /*return*/, undefined];
-                                    case 13:
-                                        if (isUserStoreInMemoryOnly) {
-                                            return [3 /*break*/, 22];
-                                        }
-                                        oidcClientTsUser = void 0;
-                                        _f.label = 14;
-                                    case 14:
-                                        _f.trys.push([14, 16, , 21]);
-                                        return [4 /*yield*/, oidcClientTsUserManager.getUser()];
-                                    case 15:
-                                        oidcClientTsUser = _f.sent();
-                                        return [3 /*break*/, 21];
-                                    case 16:
-                                        _c = _f.sent();
-                                        // NOTE: Not sure if it can throw, but let's be safe.
-                                        oidcClientTsUser = null;
-                                        _f.label = 17;
-                                    case 17:
-                                        _f.trys.push([17, 19, , 20]);
-                                        return [4 /*yield*/, oidcClientTsUserManager.removeUser()];
-                                    case 18:
-                                        _f.sent();
-                                        return [3 /*break*/, 20];
-                                    case 19:
-                                        _d = _f.sent();
-                                        return [3 /*break*/, 20];
-                                    case 20: return [3 /*break*/, 21];
-                                    case 21:
-                                        if (oidcClientTsUser === null) {
-                                            return [3 /*break*/, 22];
-                                        }
-                                        log === null || log === void 0 ? void 0 : log("Restored the auth from ephemeral session storage");
-                                        return [2 /*return*/, {
-                                                oidcClientTsUser: oidcClientTsUser,
-                                                backFromAuthServer: undefined
-                                            }];
-                                    case 22:
-                                        persistedAuthState_2 = (0, persistedAuthState_1.getPersistedAuthState)({ configId: configId });
-                                        if (persistedAuthState_2 === "explicitly logged out" && !autoLogin) {
-                                            log === null || log === void 0 ? void 0 : log("Skipping silent signin with iframe, the user has logged out");
-                                            return [3 /*break*/, 35];
-                                        }
-                                        _e = (0, getIsOnline_1.getIsOnline)(), isOnline = _e.isOnline, prOnline = _e.prOnline;
-                                        if (!!isOnline) return [3 /*break*/, 25];
-                                        if (!autoLogin) return [3 /*break*/, 24];
-                                        log === null || log === void 0 ? void 0 : log([
-                                            "The browser is currently offline",
-                                            "Since autoLogin is enabled we wait until it comes back online",
-                                            "to continue with authentication"
-                                        ].join(" "));
-                                        return [4 /*yield*/, prOnline];
-                                    case 23:
-                                        _f.sent();
-                                        return [3 /*break*/, 25];
-                                    case 24:
-                                        log === null || log === void 0 ? void 0 : log([
-                                            "The browser is not currently online so we proceed with initialization",
-                                            "assuming the user isn't authenticated"
-                                        ].join(" "));
-                                        return [3 /*break*/, 35];
-                                    case 25:
-                                        authResponse_error = undefined;
-                                        oidcClientTsUser = undefined;
-                                        if (persistedAuthState_2 === "explicitly logged out") {
-                                            return [3 /*break*/, 30];
-                                        }
-                                        if (!canUseIframe) {
-                                            return [3 /*break*/, 30];
-                                        }
-                                        log === null || log === void 0 ? void 0 : log("Trying to restore the auth from the http only cookie (silent signin with iframe)");
-                                        return [4 /*yield*/, (0, loginSilent_1.loginSilent)({
-                                                oidcClientTsUserManager: oidcClientTsUserManager,
-                                                stateQueryParamValue_instance: stateQueryParamValue_instance,
-                                                configId: configId,
-                                                transformUrlBeforeRedirect: transformUrlBeforeRedirect,
-                                                getExtraQueryParams: getExtraQueryParams,
-                                                getExtraTokenParams: getExtraTokenParams,
-                                                autoLogin: autoLogin
-                                            })];
-                                    case 26:
-                                        result_loginSilent = _f.sent();
-                                        (0, tsafe_1.assert)(result_loginSilent.outcome !== "token refreshed using refresh token", "876995");
-                                        if (result_loginSilent.outcome === "failure") {
-                                            switch (result_loginSilent.cause) {
-                                                case "can't reach well-known oidc endpoint":
-                                                    return [2 /*return*/, (0, OidcInitializationError_1.createWellKnownOidcConfigurationEndpointUnreachableInitializationError)({
-                                                            issuerUri: issuerUri
-                                                        })];
-                                                case "timeout":
-                                                    return [2 /*return*/, (0, OidcInitializationError_1.createIframeTimeoutInitializationError)({
-                                                            callbackUri: callbackUri,
-                                                            clientId: clientId,
-                                                            issuerUri: issuerUri,
-                                                            noIframe: noIframe
-                                                        })];
-                                            }
-                                            (0, tsafe_1.assert)(false);
-                                        }
-                                        (0, tsafe_1.assert)();
-                                        authResponse = result_loginSilent.authResponse;
-                                        log === null || log === void 0 ? void 0 : log("Silent signin auth response ".concat(JSON.stringify(authResponse, null, 2)));
-                                        authResponse_error = authResponse.error;
-                                        _f.label = 27;
-                                    case 27:
-                                        _f.trys.push([27, 29, , 30]);
-                                        return [4 /*yield*/, oidcClientTsUserManager.signinRedirectCallback((0, AuthResponse_1.authResponseToUrl)(authResponse))];
-                                    case 28:
-                                        oidcClientTsUser = _f.sent();
-                                        return [3 /*break*/, 30];
-                                    case 29:
-                                        error_2 = _f.sent();
-                                        (0, tsafe_1.assert)(error_2 instanceof Error, "433344");
-                                        if (error_2.message === "Failed to fetch") {
-                                            return [2 /*return*/, (0, OidcInitializationError_1.createFailedToFetchTokenEndpointInitializationError)({
-                                                    clientId: clientId,
-                                                    issuerUri: issuerUri
-                                                })];
-                                        }
-                                        if (authResponse_error === undefined) {
-                                            return [2 /*return*/, error_2];
-                                        }
-                                        return [3 /*break*/, 30];
-                                    case 30:
-                                        if (!(oidcClientTsUser === undefined)) return [3 /*break*/, 34];
-                                        if (!(autoLogin ||
-                                            (persistedAuthState_2 === "logged in" &&
-                                                (authResponse_error === undefined ||
-                                                    authResponse_error === "interaction_required" ||
-                                                    authResponse_error === "login_required" ||
-                                                    authResponse_error === "consent_required" ||
-                                                    authResponse_error === "account_selection_required")))) return [3 /*break*/, 33];
-                                        log === null || log === void 0 ? void 0 : log("Performing auto login with redirect");
-                                        (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: undefined });
-                                        completeLoginOrRefreshProcess();
-                                        if (autoLogin && persistedAuthState_2 !== "logged in") {
-                                            evtIsUserLoggedIn.post(false);
-                                        }
-                                        return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
-                                                prUnlock: new Promise(function () { })
-                                            })];
-                                    case 31:
-                                        _f.sent();
-                                        if (persistedAuthState_2 === "logged in") {
-                                            globalContext.evtRequestToPersistTokens.post({
-                                                configIdOfInstancePostingTheRequest: configId
-                                            });
-                                        }
-                                        return [4 /*yield*/, loginOrGoToAuthServer({
-                                                action: "login",
-                                                doForceReloadOnBfCache: true,
-                                                redirectUrl: initialLocationHref_1.initialLocationHref,
-                                                // NOTE: Wether or not it's the preferred behavior, pushing to history
-                                                // only works on user interaction so it have to be false
-                                                doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: false,
-                                                extraQueryParams_local: undefined,
-                                                transformUrlBeforeRedirect_local: undefined,
-                                                interaction: (function () {
-                                                    if (persistedAuthState_2 === "explicitly logged out") {
-                                                        return "ensure interaction";
-                                                    }
-                                                    if (autoLogin) {
-                                                        return "directly redirect if active session show login otherwise";
-                                                    }
-                                                    return "ensure no interaction";
-                                                })()
-                                            })];
-                                    case 32:
-                                        _f.sent();
-                                        (0, tsafe_1.assert)(false, "321389");
-                                        _f.label = 33;
-                                    case 33:
-                                        if (authResponse_error !== undefined) {
-                                            log === null || log === void 0 ? void 0 : log([
-                                                "The auth server responded with: ".concat(authResponse_error, " "),
-                                                "login_required" === authResponse_error
-                                                    ? "(login_required just means that there's no active session for the user)"
-                                                    : ""
-                                            ].join(""));
-                                        }
-                                        return [3 /*break*/, 35];
-                                    case 34:
-                                        log === null || log === void 0 ? void 0 : log("Successful silent signed in");
-                                        return [2 /*return*/, {
-                                                oidcClientTsUser: oidcClientTsUser,
-                                                backFromAuthServer: undefined
-                                            }];
-                                    case 35: 
-                                    // NOTE: The user is not logged in.
-                                    return [2 /*return*/, undefined];
-                                }
+                        case "timeout":
+                            return (0, OidcInitializationError_1.createIframeTimeoutInitializationError)({
+                                redirectUri: homeUrlAndRedirectUri,
+                                clientId,
+                                issuerUri,
+                                noIframe
                             });
-                        }); })()];
-                case 4:
-                    resultOfLoginProcess = _f.sent();
+                    }
+                    (0, tsafe_1.assert)(false);
+                }
+                (0, tsafe_1.assert)();
+                const { authResponse } = result_loginSilent;
+                log?.(`Silent signin auth response ${JSON.stringify(authResponse, null, 2)}`);
+                authResponse_error = authResponse.error;
+                try {
+                    oidcClientTsUser = await oidcClientTsUserManager.signinRedirectCallback((0, AuthResponse_1.authResponseToUrl)(authResponse));
+                }
+                catch (error) {
+                    (0, tsafe_1.assert)(error instanceof Error, "433344");
+                    if (error.message === "Failed to fetch") {
+                        return (0, OidcInitializationError_1.createFailedToFetchTokenEndpointInitializationError)({
+                            clientId,
+                            issuerUri
+                        });
+                    }
+                    if (authResponse_error === undefined) {
+                        return error;
+                    }
+                }
+            }
+            if (oidcClientTsUser === undefined) {
+                if (autoLogin ||
+                    (persistedAuthState === "logged in" &&
+                        (authResponse_error === undefined ||
+                            authResponse_error === "interaction_required" ||
+                            authResponse_error === "login_required" ||
+                            authResponse_error === "consent_required" ||
+                            authResponse_error === "account_selection_required"))) {
+                    log?.("Performing auto login with redirect");
+                    (0, persistedAuthState_1.persistAuthState)({ configId, state: undefined });
                     completeLoginOrRefreshProcess();
-                    return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
-                            prUnlock: Promise.resolve()
-                        })];
-                case 5:
-                    _f.sent();
-                    oidc_common = {
-                        params: {
-                            issuerUri: issuerUri,
-                            clientId: clientId
-                        }
-                    };
-                    not_loggedIn_case: {
-                        if (!(resultOfLoginProcess instanceof Error) && resultOfLoginProcess !== undefined) {
-                            break not_loggedIn_case;
-                        }
+                    if (autoLogin && persistedAuthState !== "logged in") {
                         evtIsUserLoggedIn.post(false);
-                        if ((0, persistedAuthState_1.getPersistedAuthState)({ configId: configId }) !== "explicitly logged out") {
-                            (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: undefined });
-                        }
-                        oidc_notLoggedIn = (function () {
-                            if (resultOfLoginProcess instanceof Error) {
-                                log === null || log === void 0 ? void 0 : log("User not logged in and there was an initialization error");
-                                var error = resultOfLoginProcess;
-                                var initializationError = error instanceof OidcInitializationError_1.OidcInitializationError
-                                    ? error
-                                    : new OidcInitializationError_1.OidcInitializationError({
-                                        isAuthServerLikelyDown: false,
-                                        messageOrCause: error
-                                    });
-                                if (autoLogin) {
-                                    throw initializationError;
-                                }
-                                console.error([
-                                    "oidc-spa Initialization Error: ",
-                                    "isAuthServerLikelyDown: ".concat(initializationError.isAuthServerLikelyDown),
-                                    "",
-                                    initializationError.message
-                                ].join("\n"));
-                                return (0, tsafe_1.id)(__assign(__assign({}, oidc_common), { isUserLoggedIn: false, login: function () { return __awaiter(_this, void 0, void 0, function () {
-                                        return __generator(this, function (_a) {
-                                            alert("Authentication is currently unavailable. Please try again later.");
-                                            return [2 /*return*/, new Promise(function () { })];
-                                        });
-                                    }); }, initializationError: initializationError }));
+                    }
+                    await (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
+                        prUnlock: new Promise(() => { })
+                    });
+                    if (persistedAuthState === "logged in") {
+                        globalContext.evtRequestToPersistTokens.post({
+                            configIdOfInstancePostingTheRequest: configId
+                        });
+                    }
+                    await loginOrGoToAuthServer({
+                        action: "login",
+                        doForceReloadOnBfCache: true,
+                        redirectUrl: initialLocationHref_1.initialLocationHref,
+                        // NOTE: Wether or not it's the preferred behavior, pushing to history
+                        // only works on user interaction so it have to be false
+                        doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: false,
+                        extraQueryParams_local: undefined,
+                        transformUrlBeforeRedirect_local: undefined,
+                        interaction: (() => {
+                            if (persistedAuthState === "explicitly logged out") {
+                                return "ensure interaction";
                             }
-                            if (resultOfLoginProcess === undefined) {
-                                log === null || log === void 0 ? void 0 : log("User not logged in");
-                                return (0, tsafe_1.id)(__assign(__assign({}, oidc_common), { isUserLoggedIn: false, login: function (_a) { return __awaiter(_this, [_a], void 0, function (_b) {
-                                        var _c;
-                                        var doesCurrentHrefRequiresAuth = _b.doesCurrentHrefRequiresAuth, extraQueryParams = _b.extraQueryParams, redirectUrl = _b.redirectUrl, transformUrlBeforeRedirect = _b.transformUrlBeforeRedirect;
-                                        return __generator(this, function (_d) {
-                                            switch (_d.label) {
-                                                case 0: return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
-                                                        prUnlock: (0, loginOrGoToAuthServer_1.getPrSafelyRestoredFromBfCacheAfterLoginBackNavigation)()
-                                                    })];
-                                                case 1:
-                                                    _d.sent();
-                                                    return [2 /*return*/, loginOrGoToAuthServer({
-                                                            action: "login",
-                                                            doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: doesCurrentHrefRequiresAuth,
-                                                            doForceReloadOnBfCache: false,
-                                                            redirectUrl: (_c = redirectUrl !== null && redirectUrl !== void 0 ? redirectUrl : postLoginRedirectUrl_default) !== null && _c !== void 0 ? _c : window.location.href,
-                                                            extraQueryParams_local: extraQueryParams,
-                                                            transformUrlBeforeRedirect_local: transformUrlBeforeRedirect,
-                                                            interaction: (0, persistedAuthState_1.getPersistedAuthState)({ configId: configId }) === "explicitly logged out"
-                                                                ? "ensure interaction"
-                                                                : "directly redirect if active session show login otherwise"
-                                                        })];
-                                            }
-                                        });
-                                    }); }, initializationError: undefined }));
+                            if (autoLogin) {
+                                return "directly redirect if active session show login otherwise";
                             }
-                            (0, tsafe_1.assert)(false);
-                        })();
-                        {
-                            prOtherTabLogin = (0, loginPropagationToOtherTabs_1.getPrOtherTabLogin)({
-                                configId: configId
-                            }).prOtherTabLogin;
-                            prOtherTabLogin.then(function () { return __awaiter(_this, void 0, void 0, function () {
-                                return __generator(this, function (_a) {
-                                    switch (_a.label) {
-                                        case 0:
-                                            log === null || log === void 0 ? void 0 : log("Other tab has logged in, reloading this tab");
-                                            return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
-                                                    prUnlock: new Promise(function () { })
-                                                })];
-                                        case 1:
-                                            _a.sent();
-                                            window.location.reload();
-                                            return [2 /*return*/];
-                                    }
-                                });
-                            }); });
-                        }
-                        // @ts-expect-error: We know what we're doing
-                        return [2 /*return*/, oidc_notLoggedIn];
+                            return "ensure no interaction";
+                        })()
+                    });
+                    (0, tsafe_1.assert)(false, "321389");
+                }
+                if (authResponse_error !== undefined) {
+                    log?.([
+                        `The auth server responded with: ${authResponse_error} `,
+                        "login_required" === authResponse_error
+                            ? `(login_required just means that there's no active session for the user)`
+                            : ""
+                    ].join(""));
+                }
+                break silent_login_if_possible_and_auto_login;
+            }
+            log?.("Successful silent signed in");
+            return {
+                oidcClientTsUser,
+                backFromAuthServer: undefined
+            };
+        }
+        // NOTE: The user is not logged in.
+        return undefined;
+    })();
+    completeLoginOrRefreshProcess();
+    await (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
+        prUnlock: Promise.resolve()
+    });
+    const oidc_common = {
+        params: {
+            issuerUri,
+            clientId
+        }
+    };
+    not_loggedIn_case: {
+        if (!(resultOfLoginProcess instanceof Error) && resultOfLoginProcess !== undefined) {
+            break not_loggedIn_case;
+        }
+        evtIsUserLoggedIn.post(false);
+        if ((0, persistedAuthState_1.getPersistedAuthState)({ configId }) !== "explicitly logged out") {
+            (0, persistedAuthState_1.persistAuthState)({ configId, state: undefined });
+        }
+        const oidc_notLoggedIn = (() => {
+            if (resultOfLoginProcess instanceof Error) {
+                log?.("User not logged in and there was an initialization error");
+                const error = resultOfLoginProcess;
+                const initializationError = error instanceof OidcInitializationError_1.OidcInitializationError
+                    ? error
+                    : new OidcInitializationError_1.OidcInitializationError({
+                        isAuthServerLikelyDown: false,
+                        messageOrCause: error
+                    });
+                if (autoLogin) {
+                    throw initializationError;
+                }
+                console.error([
+                    `oidc-spa Initialization Error: `,
+                    `isAuthServerLikelyDown: ${initializationError.isAuthServerLikelyDown}`,
+                    ``,
+                    initializationError.message
+                ].join("\n"));
+                return (0, tsafe_1.id)({
+                    ...oidc_common,
+                    isUserLoggedIn: false,
+                    login: async () => {
+                        alert("Authentication is currently unavailable. Please try again later.");
+                        return new Promise(() => { });
+                    },
+                    initializationError
+                });
+            }
+            if (resultOfLoginProcess === undefined) {
+                log?.("User not logged in");
+                return (0, tsafe_1.id)({
+                    ...oidc_common,
+                    isUserLoggedIn: false,
+                    login: async ({ doesCurrentHrefRequiresAuth, extraQueryParams, redirectUrl, transformUrlBeforeRedirect }) => {
+                        await (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
+                            prUnlock: (0, loginOrGoToAuthServer_1.getPrSafelyRestoredFromBfCacheAfterLoginBackNavigation)()
+                        });
+                        return loginOrGoToAuthServer({
+                            action: "login",
+                            doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: doesCurrentHrefRequiresAuth,
+                            doForceReloadOnBfCache: false,
+                            redirectUrl: redirectUrl ?? postLoginRedirectUrl_default ?? window.location.href,
+                            extraQueryParams_local: extraQueryParams,
+                            transformUrlBeforeRedirect_local: transformUrlBeforeRedirect,
+                            interaction: (0, persistedAuthState_1.getPersistedAuthState)({ configId }) === "explicitly logged out"
+                                ? "ensure interaction"
+                                : "directly redirect if active session show login otherwise"
+                        });
+                    },
+                    initializationError: undefined
+                });
+            }
+            (0, tsafe_1.assert)(false);
+        })();
+        {
+            const { prOtherTabLogin } = (0, loginPropagationToOtherTabs_1.getPrOtherTabLogin)({
+                configId
+            });
+            prOtherTabLogin.then(async () => {
+                log?.(`Other tab has logged in, reloading this tab`);
+                await (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
+                    prUnlock: new Promise(() => { })
+                });
+                window.location.reload();
+            });
+        }
+        // @ts-expect-error: We know what we're doing
+        return oidc_notLoggedIn;
+    }
+    log?.("User is logged in");
+    evtIsUserLoggedIn.post(true);
+    let currentTokens = (0, oidcClientTsUserToTokens_1.oidcClientTsUserToTokens)({
+        oidcClientTsUser: resultOfLoginProcess.oidcClientTsUser,
+        decodedIdTokenSchema,
+        __unsafe_useIdTokenAsAccessToken,
+        decodedIdToken_previous: undefined,
+        log
+    });
+    {
+        if ((0, persistedAuthState_1.getPersistedAuthState)({ configId }) !== undefined) {
+            (0, persistedAuthState_1.persistAuthState)({ configId, state: undefined });
+        }
+        if (!canUseIframe) {
+            (0, persistedAuthState_1.persistAuthState)({
+                configId,
+                state: {
+                    stateDescription: "logged in",
+                    refreshTokenExpirationTime: currentTokens.refreshTokenExpirationTime,
+                    idleSessionLifetimeInSeconds
+                }
+            });
+        }
+    }
+    const autoLogoutCountdownTickCallbacks = new Set();
+    const onTokenChanges = new Set();
+    const { sid: sessionId, sub: subjectId } = currentTokens.decodedIdToken_original;
+    (0, tsafe_1.assert)(subjectId !== undefined, "The 'sub' claim is missing from the id token");
+    (0, tsafe_1.assert)(sessionId === undefined || typeof sessionId === "string");
+    let wouldHaveAutoLoggedOutIfBrowserWasOnline = false;
+    const oidc_loggedIn = (0, tsafe_1.id)({
+        ...oidc_common,
+        isUserLoggedIn: true,
+        getTokens: async () => {
+            if (wouldHaveAutoLoggedOutIfBrowserWasOnline) {
+                await oidc_loggedIn.logout(autoLogoutParams);
+                (0, tsafe_1.assert)(false);
+            }
+            renew_tokens: {
+                {
+                    const msBeforeExpirationOfTheAccessToken = currentTokens.accessTokenExpirationTime - Date.now();
+                    if (msBeforeExpirationOfTheAccessToken > 30000) {
+                        break renew_tokens;
                     }
-                    log === null || log === void 0 ? void 0 : log("User is logged in");
-                    evtIsUserLoggedIn.post(true);
-                    currentTokens = (0, oidcClientTsUserToTokens_1.oidcClientTsUserToTokens)({
-                        oidcClientTsUser: resultOfLoginProcess.oidcClientTsUser,
-                        decodedIdTokenSchema: decodedIdTokenSchema,
-                        __unsafe_useIdTokenAsAccessToken: __unsafe_useIdTokenAsAccessToken,
-                        decodedIdToken_previous: undefined,
-                        log: log
+                }
+                {
+                    const msElapsedSinceCurrentTokenWereIssued = Date.now() - currentTokens.issuedAtTime;
+                    if (msElapsedSinceCurrentTokenWereIssued < 5000) {
+                        break renew_tokens;
+                    }
+                }
+                await oidc_loggedIn.renewTokens();
+            }
+            return currentTokens;
+        },
+        getDecodedIdToken: () => currentTokens.decodedIdToken,
+        logout: async (params) => {
+            if (globalContext.hasLogoutBeenCalled) {
+                log?.("logout() has already been called, ignoring the call");
+                return new Promise(() => { });
+            }
+            globalContext.hasLogoutBeenCalled = true;
+            const postLogoutRedirectUrl = (() => {
+                switch (params.redirectTo) {
+                    case "current page":
+                        return window.location.href;
+                    case "home":
+                        return homeUrlAndRedirectUri;
+                    case "specific url":
+                        return (0, toFullyQualifiedUrl_1.toFullyQualifiedUrl)({
+                            urlish: params.url,
+                            doAssertNoQueryParams: false
+                        });
+                }
+            })();
+            await (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
+                prUnlock: new Promise(() => { })
+            });
+            window.addEventListener("pageshow", () => {
+                location.reload();
+            });
+            try {
+                await oidcClientTsUserManager.signoutRedirect({
+                    state: (0, tsafe_1.id)({
+                        configId,
+                        context: "redirect",
+                        redirectUrl: postLogoutRedirectUrl,
+                        hasBeenProcessedByCallback: false,
+                        action: "logout",
+                        sessionId
+                    }),
+                    redirectMethod: "assign"
+                });
+            }
+            catch (error) {
+                (0, tsafe_1.assert)((0, tsafe_1.is)(error));
+                if (error.message === "No end session endpoint") {
+                    log?.("No end session endpoint, managing logging state locally");
+                    (0, persistedAuthState_1.persistAuthState)({ configId, state: { stateDescription: "explicitly logged out" } });
+                    try {
+                        await oidcClientTsUserManager.removeUser();
+                    }
+                    catch {
+                        // NOTE: Not sure if it can throw
+                    }
+                    (0, logoutPropagationToOtherTabs_1.notifyOtherTabsOfLogout)({
+                        configId,
+                        sessionId
                     });
-                    {
-                        if ((0, persistedAuthState_1.getPersistedAuthState)({ configId: configId }) !== undefined) {
-                            (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: undefined });
-                        }
-                        if (!canUseIframe) {
-                            (0, persistedAuthState_1.persistAuthState)({
-                                configId: configId,
-                                state: {
-                                    stateDescription: "logged in",
-                                    refreshTokenExpirationTime: currentTokens.refreshTokenExpirationTime,
-                                    idleSessionLifetimeInSeconds: idleSessionLifetimeInSeconds
-                                }
-                            });
+                    window.location.href = postLogoutRedirectUrl;
+                }
+                else {
+                    throw error;
+                }
+            }
+            return new Promise(() => { });
+        },
+        renewTokens: (() => {
+            async function renewTokens_nonMutexed(params) {
+                const { extraTokenParams } = params;
+                const fallbackToFullPageReload = async () => {
+                    (0, persistedAuthState_1.persistAuthState)({ configId, state: undefined });
+                    await (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
+                        prUnlock: new Promise(() => { })
+                    });
+                    globalContext.evtRequestToPersistTokens.post({
+                        configIdOfInstancePostingTheRequest: configId
+                    });
+                    await loginOrGoToAuthServer({
+                        action: "login",
+                        redirectUrl: window.location.href,
+                        doForceReloadOnBfCache: true,
+                        extraQueryParams_local: undefined,
+                        transformUrlBeforeRedirect_local: undefined,
+                        doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: false,
+                        interaction: "directly redirect if active session show login otherwise"
+                    });
+                    (0, tsafe_1.assert)(false, "136134");
+                };
+                if (!currentTokens.hasRefreshToken && !canUseIframe) {
+                    log?.([
+                        "Unable to refresh tokens without a full app reload,",
+                        "because no refresh token is available",
+                        "and your app setup prevents silent sign-in via iframe.",
+                        "Your only option to refresh tokens is to call `window.location.reload()`"
+                    ].join(" "));
+                    await fallbackToFullPageReload();
+                    (0, tsafe_1.assert)(false, "136135");
+                }
+                log?.("Renewing tokens");
+                const { completeLoginOrRefreshProcess } = await (0, ongoingLoginOrRefreshProcesses_1.startLoginOrRefreshProcess)();
+                const result_loginSilent = await (0, loginSilent_1.loginSilent)({
+                    oidcClientTsUserManager,
+                    stateUrlParamValue_instance,
+                    configId,
+                    transformUrlBeforeRedirect,
+                    getExtraQueryParams,
+                    getExtraTokenParams: () => extraTokenParams,
+                    autoLogin
+                });
+                if (result_loginSilent.outcome === "failure") {
+                    completeLoginOrRefreshProcess();
+                    // NOTE: This is a configuration or network error, okay to throw,
+                    // this exception doesn't have to be handle if it fails it fails.
+                    throw new Error(result_loginSilent.cause);
+                }
+                let oidcClientTsUser;
+                switch (result_loginSilent.outcome) {
+                    case "token refreshed using refresh token":
+                        {
+                            log?.("Refresh token used");
+                            oidcClientTsUser = result_loginSilent.oidcClientTsUser;
                         }
-                    }
-                    autoLogoutCountdownTickCallbacks = new Set();
-                    onTokenChanges = new Set();
-                    _e = currentTokens.decodedIdToken_original, sessionId = _e.sid, subjectId = _e.sub;
-                    (0, tsafe_1.assert)(subjectId !== undefined, "The 'sub' claim is missing from the id token");
-                    (0, tsafe_1.assert)(sessionId === undefined || typeof sessionId === "string");
-                    wouldHaveAutoLoggedOutIfBrowserWasOnline = false;
-                    oidc_loggedIn = (0, tsafe_1.id)(__assign(__assign({}, oidc_common), { isUserLoggedIn: true, getTokens: function () { return __awaiter(_this, void 0, void 0, function () {
-                            var msBeforeExpirationOfTheAccessToken, msElapsedSinceCurrentTokenWereIssued;
-                            return __generator(this, function (_a) {
-                                switch (_a.label) {
-                                    case 0:
-                                        if (!wouldHaveAutoLoggedOutIfBrowserWasOnline) return [3 /*break*/, 2];
-                                        return [4 /*yield*/, oidc_loggedIn.logout(autoLogoutParams)];
-                                    case 1:
-                                        _a.sent();
-                                        (0, tsafe_1.assert)(false);
-                                        _a.label = 2;
-                                    case 2:
-                                        {
-                                            msBeforeExpirationOfTheAccessToken = currentTokens.accessTokenExpirationTime - Date.now();
-                                            if (msBeforeExpirationOfTheAccessToken > 30000) {
-                                                return [3 /*break*/, 4];
-                                            }
-                                        }
-                                        {
-                                            msElapsedSinceCurrentTokenWereIssued = Date.now() - currentTokens.issuedAtTime;
-                                            if (msElapsedSinceCurrentTokenWereIssued < 5000) {
-                                                return [3 /*break*/, 4];
-                                            }
-                                        }
-                                        return [4 /*yield*/, oidc_loggedIn.renewTokens()];
-                                    case 3:
-                                        _a.sent();
-                                        _a.label = 4;
-                                    case 4: return [2 /*return*/, currentTokens];
-                                }
-                            });
-                        }); }, getDecodedIdToken: function () { return currentTokens.decodedIdToken; }, logout: function (params) { return __awaiter(_this, void 0, void 0, function () {
-                            var postLogoutRedirectUrl, error_3, _a;
-                            return __generator(this, function (_b) {
-                                switch (_b.label) {
-                                    case 0:
-                                        if (globalContext.hasLogoutBeenCalled) {
-                                            log === null || log === void 0 ? void 0 : log("logout() has already been called, ignoring the call");
-                                            return [2 /*return*/, new Promise(function () { })];
-                                        }
-                                        globalContext.hasLogoutBeenCalled = true;
-                                        postLogoutRedirectUrl = (function () {
-                                            switch (params.redirectTo) {
-                                                case "current page":
-                                                    return window.location.href;
-                                                case "home":
-                                                    return homeUrl;
-                                                case "specific url":
-                                                    return (0, toFullyQualifiedUrl_1.toFullyQualifiedUrl)({
-                                                        urlish: params.url,
-                                                        doAssertNoQueryParams: false
-                                                    });
-                                            }
-                                        })();
-                                        return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
-                                                prUnlock: new Promise(function () { })
-                                            })];
-                                    case 1:
-                                        _b.sent();
-                                        window.addEventListener("pageshow", function () {
-                                            location.reload();
-                                        });
-                                        _b.label = 2;
-                                    case 2:
-                                        _b.trys.push([2, 4, , 11]);
-                                        return [4 /*yield*/, oidcClientTsUserManager.signoutRedirect({
-                                                state: (0, tsafe_1.id)({
-                                                    configId: configId,
-                                                    context: "redirect",
-                                                    redirectUrl: postLogoutRedirectUrl,
-                                                    hasBeenProcessedByCallback: false,
-                                                    action: "logout",
-                                                    sessionId: sessionId
-                                                }),
-                                                redirectMethod: "assign"
-                                            })];
-                                    case 3:
-                                        _b.sent();
-                                        return [3 /*break*/, 11];
-                                    case 4:
-                                        error_3 = _b.sent();
-                                        (0, tsafe_1.assert)((0, tsafe_1.is)(error_3));
-                                        if (!(error_3.message === "No end session endpoint")) return [3 /*break*/, 9];
-                                        log === null || log === void 0 ? void 0 : log("No end session endpoint, managing logging state locally");
-                                        (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: { stateDescription: "explicitly logged out" } });
-                                        _b.label = 5;
-                                    case 5:
-                                        _b.trys.push([5, 7, , 8]);
-                                        return [4 /*yield*/, oidcClientTsUserManager.removeUser()];
-                                    case 6:
-                                        _b.sent();
-                                        return [3 /*break*/, 8];
-                                    case 7:
-                                        _a = _b.sent();
-                                        return [3 /*break*/, 8];
-                                    case 8:
-                                        (0, logoutPropagationToOtherTabs_1.notifyOtherTabsOfLogout)({
-                                            configId: configId,
-                                            sessionId: sessionId
-                                        });
-                                        window.location.href = postLogoutRedirectUrl;
-                                        return [3 /*break*/, 10];
-                                    case 9: throw error_3;
-                                    case 10: return [3 /*break*/, 11];
-                                    case 11: return [2 /*return*/, new Promise(function () { })];
+                        break;
+                    case "got auth response from iframe":
+                        {
+                            const { authResponse } = result_loginSilent;
+                            log?.("Tokens refresh using iframe", authResponse);
+                            const authResponse_error = authResponse.error;
+                            let oidcClientTsUser_scope = undefined;
+                            try {
+                                oidcClientTsUser_scope =
+                                    await oidcClientTsUserManager.signinRedirectCallback((0, AuthResponse_1.authResponseToUrl)(authResponse));
+                            }
+                            catch (error) {
+                                (0, tsafe_1.assert)(error instanceof Error, "321389");
+                                if (authResponse_error === undefined) {
+                                    completeLoginOrRefreshProcess();
+                                    // Same here, if it fails it fails.
+                                    throw error;
                                 }
-                            });
-                        }); }, renewTokens: (function () {
-                            function renewTokens_nonMutexed(params) {
-                                return __awaiter(this, void 0, void 0, function () {
-                                    var extraTokenParams, fallbackToFullPageReload, completeLoginOrRefreshProcess, result_loginSilent, oidcClientTsUser, _a, authResponse, authResponse_error, oidcClientTsUser_scope, error_4;
-                                    var _this = this;
-                                    return __generator(this, function (_b) {
-                                        switch (_b.label) {
-                                            case 0:
-                                                extraTokenParams = params.extraTokenParams;
-                                                fallbackToFullPageReload = function () { return __awaiter(_this, void 0, void 0, function () {
-                                                    return __generator(this, function (_a) {
-                                                        switch (_a.label) {
-                                                            case 0:
-                                                                (0, persistedAuthState_1.persistAuthState)({ configId: configId, state: undefined });
-                                                                return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
-                                                                        prUnlock: new Promise(function () { })
-                                                                    })];
-                                                            case 1:
-                                                                _a.sent();
-                                                                globalContext.evtRequestToPersistTokens.post({
-                                                                    configIdOfInstancePostingTheRequest: configId
-                                                                });
-                                                                return [4 /*yield*/, loginOrGoToAuthServer({
-                                                                        action: "login",
-                                                                        redirectUrl: window.location.href,
-                                                                        doForceReloadOnBfCache: true,
-                                                                        extraQueryParams_local: undefined,
-                                                                        transformUrlBeforeRedirect_local: undefined,
-                                                                        doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: false,
-                                                                        interaction: "directly redirect if active session show login otherwise"
-                                                                    })];
-                                                            case 2:
-                                                                _a.sent();
-                                                                (0, tsafe_1.assert)(false, "136134");
-                                                                return [2 /*return*/];
-                                                        }
-                                                    });
-                                                }); };
-                                                if (!(!currentTokens.hasRefreshToken && !canUseIframe)) return [3 /*break*/, 2];
-                                                log === null || log === void 0 ? void 0 : log([
-                                                    "Unable to refresh tokens without a full app reload,",
-                                                    "because no refresh token is available",
-                                                    "and your app setup prevents silent sign-in via iframe.",
-                                                    "Your only option to refresh tokens is to call `window.location.reload()`"
-                                                ].join(" "));
-                                                return [4 /*yield*/, fallbackToFullPageReload()];
-                                            case 1:
-                                                _b.sent();
-                                                (0, tsafe_1.assert)(false, "136135");
-                                                _b.label = 2;
-                                            case 2:
-                                                log === null || log === void 0 ? void 0 : log("Renewing tokens");
-                                                return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.startLoginOrRefreshProcess)()];
-                                            case 3:
-                                                completeLoginOrRefreshProcess = (_b.sent()).completeLoginOrRefreshProcess;
-                                                return [4 /*yield*/, (0, loginSilent_1.loginSilent)({
-                                                        oidcClientTsUserManager: oidcClientTsUserManager,
-                                                        stateQueryParamValue_instance: stateQueryParamValue_instance,
-                                                        configId: configId,
-                                                        transformUrlBeforeRedirect: transformUrlBeforeRedirect,
-                                                        getExtraQueryParams: getExtraQueryParams,
-                                                        getExtraTokenParams: function () { return extraTokenParams; },
-                                                        autoLogin: autoLogin
-                                                    })];
-                                            case 4:
-                                                result_loginSilent = _b.sent();
-                                                if (result_loginSilent.outcome === "failure") {
-                                                    completeLoginOrRefreshProcess();
-                                                    // NOTE: This is a configuration or network error, okay to throw,
-                                                    // this exception doesn't have to be handle if it fails it fails.
-                                                    throw new Error(result_loginSilent.cause);
-                                                }
-                                                _a = result_loginSilent.outcome;
-                                                switch (_a) {
-                                                    case "token refreshed using refresh token": return [3 /*break*/, 5];
-                                                    case "got auth response from iframe": return [3 /*break*/, 6];
-                                                }
-                                                return [3 /*break*/, 13];
-                                            case 5:
-                                                {
-                                                    log === null || log === void 0 ? void 0 : log("Refresh token used");
-                                                    oidcClientTsUser = result_loginSilent.oidcClientTsUser;
-                                                }
-                                                return [3 /*break*/, 14];
-                                            case 6:
-                                                authResponse = result_loginSilent.authResponse;
-                                                log === null || log === void 0 ? void 0 : log("Tokens refresh using iframe", authResponse);
-                                                authResponse_error = authResponse.error;
-                                                oidcClientTsUser_scope = undefined;
-                                                _b.label = 7;
-                                            case 7:
-                                                _b.trys.push([7, 9, , 10]);
-                                                return [4 /*yield*/, oidcClientTsUserManager.signinRedirectCallback((0, AuthResponse_1.authResponseToUrl)(authResponse))];
-                                            case 8:
-                                                oidcClientTsUser_scope =
-                                                    _b.sent();
-                                                return [3 /*break*/, 10];
-                                            case 9:
-                                                error_4 = _b.sent();
-                                                (0, tsafe_1.assert)(error_4 instanceof Error, "321389");
-                                                if (authResponse_error === undefined) {
-                                                    completeLoginOrRefreshProcess();
-                                                    // Same here, if it fails it fails.
-                                                    throw error_4;
-                                                }
-                                                return [3 /*break*/, 10];
-                                            case 10:
-                                                if (!(oidcClientTsUser_scope === undefined)) return [3 /*break*/, 12];
-                                                // NOTE: Here we got a response but it's an error, session might have been
-                                                // deleted or other edge case.
-                                                completeLoginOrRefreshProcess();
-                                                log === null || log === void 0 ? void 0 : log([
-                                                    "The user is probably not logged in anymore,",
-                                                    "need to redirect to login pages"
-                                                ].join(" "));
-                                                return [4 /*yield*/, fallbackToFullPageReload()];
-                                            case 11:
-                                                _b.sent();
-                                                (0, tsafe_1.assert)(false, "136135");
-                                                _b.label = 12;
-                                            case 12:
-                                                oidcClientTsUser = oidcClientTsUser_scope;
-                                                return [3 /*break*/, 14];
-                                            case 13:
-                                                (0, tsafe_1.assert)(false);
-                                                return [3 /*break*/, 14];
-                                            case 14:
-                                                currentTokens = (0, oidcClientTsUserToTokens_1.oidcClientTsUserToTokens)({
-                                                    oidcClientTsUser: oidcClientTsUser,
-                                                    decodedIdTokenSchema: decodedIdTokenSchema,
-                                                    __unsafe_useIdTokenAsAccessToken: __unsafe_useIdTokenAsAccessToken,
-                                                    decodedIdToken_previous: currentTokens.decodedIdToken,
-                                                    log: log
-                                                });
-                                                if ((0, persistedAuthState_1.getPersistedAuthState)({ configId: configId }) !== undefined) {
-                                                    (0, persistedAuthState_1.persistAuthState)({
-                                                        configId: configId,
-                                                        state: {
-                                                            stateDescription: "logged in",
-                                                            refreshTokenExpirationTime: currentTokens.refreshTokenExpirationTime,
-                                                            idleSessionLifetimeInSeconds: idleSessionLifetimeInSeconds
-                                                        }
-                                                    });
-                                                }
-                                                Array.from(onTokenChanges).forEach(function (onTokenChange) { return onTokenChange(currentTokens); });
-                                                completeLoginOrRefreshProcess();
-                                                return [2 /*return*/];
-                                        }
-                                    });
-                                });
                             }
-                            var ongoingCall = undefined;
-                            function handleFinally() {
-                                (0, tsafe_1.assert)(ongoingCall !== undefined, "131276");
-                                var pr = ongoingCall.pr;
-                                pr.finally(function () {
-                                    (0, tsafe_1.assert)(ongoingCall !== undefined, "549462");
-                                    if (ongoingCall.pr !== pr) {
-                                        return;
-                                    }
-                                    ongoingCall = undefined;
-                                });
+                            if (oidcClientTsUser_scope === undefined) {
+                                // NOTE: Here we got a response but it's an error, session might have been
+                                // deleted or other edge case.
+                                completeLoginOrRefreshProcess();
+                                log?.([
+                                    "The user is probably not logged in anymore,",
+                                    "need to redirect to login pages"
+                                ].join(" "));
+                                await fallbackToFullPageReload();
+                                (0, tsafe_1.assert)(false, "136135");
                             }
-                            return function (params) { return __awaiter(_this, void 0, void 0, function () {
-                                var extraTokenParams_local, extraTokenParams;
-                                var _this = this;
-                                return __generator(this, function (_a) {
-                                    extraTokenParams_local = (params !== null && params !== void 0 ? params : {}).extraTokenParams;
-                                    extraTokenParams = __assign(__assign({}, getExtraTokenParams === null || getExtraTokenParams === void 0 ? void 0 : getExtraTokenParams()), extraTokenParams_local);
-                                    if (ongoingCall === undefined) {
-                                        ongoingCall = {
-                                            pr: renewTokens_nonMutexed({ extraTokenParams: extraTokenParams }),
-                                            extraTokenParams: extraTokenParams
-                                        };
-                                        handleFinally();
-                                        return [2 /*return*/, ongoingCall.pr];
-                                    }
-                                    if (JSON.stringify(extraTokenParams) === JSON.stringify(ongoingCall.extraTokenParams)) {
-                                        return [2 /*return*/, ongoingCall.pr];
-                                    }
-                                    ongoingCall = {
-                                        pr: (function () { return __awaiter(_this, void 0, void 0, function () {
-                                            var _a;
-                                            return __generator(this, function (_b) {
-                                                switch (_b.label) {
-                                                    case 0:
-                                                        _b.trys.push([0, 2, , 3]);
-                                                        return [4 /*yield*/, ongoingCall.pr];
-                                                    case 1:
-                                                        _b.sent();
-                                                        return [3 /*break*/, 3];
-                                                    case 2:
-                                                        _a = _b.sent();
-                                                        return [3 /*break*/, 3];
-                                                    case 3: return [2 /*return*/, renewTokens_nonMutexed({ extraTokenParams: extraTokenParams })];
-                                                }
-                                            });
-                                        }); })(),
-                                        extraTokenParams: extraTokenParams
-                                    };
-                                    handleFinally();
-                                    return [2 /*return*/, ongoingCall.pr];
-                                });
-                            }); };
-                        })(), subscribeToTokensChange: function (onTokenChange) {
-                            onTokenChanges.add(onTokenChange);
-                            return {
-                                unsubscribe: function () {
-                                    onTokenChanges.delete(onTokenChange);
-                                }
-                            };
-                        }, subscribeToAutoLogoutCountdown: function (tickCallback) {
-                            autoLogoutCountdownTickCallbacks.add(tickCallback);
-                            var unsubscribeFromAutoLogoutCountdown = function () {
-                                autoLogoutCountdownTickCallbacks.delete(tickCallback);
-                            };
-                            return { unsubscribeFromAutoLogoutCountdown: unsubscribeFromAutoLogoutCountdown };
-                        }, goToAuthServer: function (_a) {
-                            var extraQueryParams = _a.extraQueryParams, redirectUrl = _a.redirectUrl, transformUrlBeforeRedirect = _a.transformUrlBeforeRedirect;
-                            return loginOrGoToAuthServer({
-                                action: "go to auth server",
-                                redirectUrl: redirectUrl !== null && redirectUrl !== void 0 ? redirectUrl : window.location.href,
-                                extraQueryParams_local: extraQueryParams,
-                                transformUrlBeforeRedirect_local: transformUrlBeforeRedirect
-                            });
-                        }, backFromAuthServer: resultOfLoginProcess.backFromAuthServer, isNewBrowserSession: (function () {
-                            var value = getIsNewBrowserSession({ subjectId: subjectId });
-                            log === null || log === void 0 ? void 0 : log("isNewBrowserSession: ".concat(value));
-                            return value;
-                        })() }));
-                    {
-                        prOtherTabLogout = (0, logoutPropagationToOtherTabs_1.getPrOtherTabLogout)({
-                            configId: configId,
-                            sessionId: sessionId
-                        }).prOtherTabLogout;
-                        prOtherTabLogout.then(function () { return __awaiter(_this, void 0, void 0, function () {
-                            return __generator(this, function (_a) {
-                                switch (_a.label) {
-                                    case 0:
-                                        log === null || log === void 0 ? void 0 : log("Other tab has logged out, refreshing current tab");
-                                        return [4 /*yield*/, (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
-                                                prUnlock: new Promise(function () { })
-                                            })];
-                                    case 1:
-                                        _a.sent();
-                                        location.reload();
-                                        return [2 /*return*/];
-                                }
-                            });
-                        }); });
-                    }
-                    (function scheduleRenew() {
-                        var _this = this;
-                        var _a;
-                        if (!currentTokens.hasRefreshToken && !canUseIframe) {
-                            log === null || log === void 0 ? void 0 : log([
-                                "Disabling token auto refresh mechanism because we",
-                                "have no way to renew the tokens without a full page reload"
-                            ].join(" "));
-                            return;
+                            oidcClientTsUser = oidcClientTsUser_scope;
                         }
-                        var msBeforeExpiration = ((_a = currentTokens.refreshTokenExpirationTime) !== null && _a !== void 0 ? _a : currentTokens.accessTokenExpirationTime) -
-                            Date.now();
-                        var typeOfTheTokenWeGotTheTtlFrom = currentTokens.refreshTokenExpirationTime !== undefined ? "refresh" : "access";
-                        var RENEW_MS_BEFORE_EXPIRES = 30000;
-                        if (msBeforeExpiration <= RENEW_MS_BEFORE_EXPIRES) {
-                            // NOTE: We just got a new token that is about to expire. This means that
-                            // the refresh token has reached it's max SSO time.
-                            // ...or that the refresh token have a very short lifespan...
-                            // anyway, no need to keep alive, it will probably redirect on the next getTokens() or refreshTokens() call
-                            log === null || log === void 0 ? void 0 : log([
-                                "Disabling auto renew mechanism. We just got fresh tokens",
-                                (function () {
-                                    switch (typeOfTheTokenWeGotTheTtlFrom) {
-                                        case "refresh":
-                                            return [
-                                                " and the refresh token is already about to expires.",
-                                                "This means that we have reached the max session lifespan, we can't keep",
-                                                "the session alive any longer.",
-                                                "(This can also mean that the refresh token was configured with a TTL,",
-                                                "aka the idle session lifespan, too low to make sense)"
-                                            ].join(" ");
-                                        case "access":
-                                            return [
-                                                currentTokens.hasRefreshToken
-                                                    ? ", we can't read the expiration time of the refresh token"
-                                                    : ", we don't have a refresh token",
-                                                " and the access token is already about to expire",
-                                                "we would spam the auth server by constantly renewing the access token in the background",
-                                                "avoiding to do so."
-                                            ].join(" ");
-                                    }
-                                })()
-                            ].join(" "));
-                            return;
+                        break;
+                    default:
+                        (0, tsafe_1.assert)(false);
+                        break;
+                }
+                currentTokens = (0, oidcClientTsUserToTokens_1.oidcClientTsUserToTokens)({
+                    oidcClientTsUser,
+                    decodedIdTokenSchema,
+                    __unsafe_useIdTokenAsAccessToken,
+                    decodedIdToken_previous: currentTokens.decodedIdToken,
+                    log
+                });
+                if ((0, persistedAuthState_1.getPersistedAuthState)({ configId }) !== undefined) {
+                    (0, persistedAuthState_1.persistAuthState)({
+                        configId,
+                        state: {
+                            stateDescription: "logged in",
+                            refreshTokenExpirationTime: currentTokens.refreshTokenExpirationTime,
+                            idleSessionLifetimeInSeconds
                         }
-                        log === null || log === void 0 ? void 0 : log([
-                            (0, toHumanReadableDuration_1.toHumanReadableDuration)(msBeforeExpiration),
-                            "before expiration of the ".concat(typeOfTheTokenWeGotTheTtlFrom, " token."),
-                            "Scheduling renewal ".concat((0, toHumanReadableDuration_1.toHumanReadableDuration)(RENEW_MS_BEFORE_EXPIRES), " before expiration to keep the session alive on the OIDC server.")
+                    });
+                }
+                Array.from(onTokenChanges).forEach(onTokenChange => onTokenChange(currentTokens));
+                completeLoginOrRefreshProcess();
+            }
+            let ongoingCall = undefined;
+            function handleFinally() {
+                (0, tsafe_1.assert)(ongoingCall !== undefined, "131276");
+                const { pr } = ongoingCall;
+                pr.finally(() => {
+                    (0, tsafe_1.assert)(ongoingCall !== undefined, "549462");
+                    if (ongoingCall.pr !== pr) {
+                        return;
+                    }
+                    ongoingCall = undefined;
+                });
+            }
+            return async (params) => {
+                const { extraTokenParams: extraTokenParams_local } = params ?? {};
+                const extraTokenParams = {
+                    ...getExtraTokenParams?.(),
+                    ...extraTokenParams_local
+                };
+                if (ongoingCall === undefined) {
+                    ongoingCall = {
+                        pr: renewTokens_nonMutexed({ extraTokenParams }),
+                        extraTokenParams
+                    };
+                    handleFinally();
+                    return ongoingCall.pr;
+                }
+                if (JSON.stringify(extraTokenParams) === JSON.stringify(ongoingCall.extraTokenParams)) {
+                    return ongoingCall.pr;
+                }
+                ongoingCall = {
+                    pr: (async () => {
+                        try {
+                            await ongoingCall.pr;
+                        }
+                        catch { }
+                        return renewTokens_nonMutexed({ extraTokenParams });
+                    })(),
+                    extraTokenParams
+                };
+                handleFinally();
+                return ongoingCall.pr;
+            };
+        })(),
+        subscribeToTokensChange: onTokenChange => {
+            onTokenChanges.add(onTokenChange);
+            return {
+                unsubscribe: () => {
+                    onTokenChanges.delete(onTokenChange);
+                }
+            };
+        },
+        subscribeToAutoLogoutCountdown: tickCallback => {
+            autoLogoutCountdownTickCallbacks.add(tickCallback);
+            const unsubscribeFromAutoLogoutCountdown = () => {
+                autoLogoutCountdownTickCallbacks.delete(tickCallback);
+            };
+            return { unsubscribeFromAutoLogoutCountdown };
+        },
+        goToAuthServer: ({ extraQueryParams, redirectUrl, transformUrlBeforeRedirect }) => loginOrGoToAuthServer({
+            action: "go to auth server",
+            redirectUrl: redirectUrl ?? window.location.href,
+            extraQueryParams_local: extraQueryParams,
+            transformUrlBeforeRedirect_local: transformUrlBeforeRedirect
+        }),
+        backFromAuthServer: resultOfLoginProcess.backFromAuthServer,
+        isNewBrowserSession: (() => {
+            const value = getIsNewBrowserSession({ subjectId });
+            log?.(`isNewBrowserSession: ${value}`);
+            return value;
+        })()
+    });
+    {
+        const { prOtherTabLogout } = (0, logoutPropagationToOtherTabs_1.getPrOtherTabLogout)({
+            configId,
+            sessionId
+        });
+        prOtherTabLogout.then(async () => {
+            log?.(`Other tab has logged out, refreshing current tab`);
+            await (0, ongoingLoginOrRefreshProcesses_1.waitForAllOtherOngoingLoginOrRefreshProcessesToComplete)({
+                prUnlock: new Promise(() => { })
+            });
+            location.reload();
+        });
+    }
+    (function scheduleRenew() {
+        if (!currentTokens.hasRefreshToken && !canUseIframe) {
+            log?.([
+                "Disabling token auto refresh mechanism because we",
+                "have no way to renew the tokens without a full page reload"
+            ].join(" "));
+            return;
+        }
+        const msBeforeExpiration = (currentTokens.refreshTokenExpirationTime ?? currentTokens.accessTokenExpirationTime) -
+            Date.now();
+        const typeOfTheTokenWeGotTheTtlFrom = currentTokens.refreshTokenExpirationTime !== undefined ? "refresh" : "access";
+        const RENEW_MS_BEFORE_EXPIRES = 30000;
+        if (msBeforeExpiration <= RENEW_MS_BEFORE_EXPIRES) {
+            // NOTE: We just got a new token that is about to expire. This means that
+            // the refresh token has reached it's max SSO time.
+            // ...or that the refresh token have a very short lifespan...
+            // anyway, no need to keep alive, it will probably redirect on the next getTokens() or refreshTokens() call
+            log?.([
+                "Disabling auto renew mechanism. We just got fresh tokens",
+                (() => {
+                    switch (typeOfTheTokenWeGotTheTtlFrom) {
+                        case "refresh":
+                            return [
+                                " and the refresh token is already about to expires.",
+                                "This means that we have reached the max session lifespan, we can't keep",
+                                "the session alive any longer.",
+                                "(This can also mean that the refresh token was configured with a TTL,",
+                                "aka the idle session lifespan, too low to make sense)"
+                            ].join(" ");
+                        case "access":
+                            return [
+                                currentTokens.hasRefreshToken
+                                    ? ", we can't read the expiration time of the refresh token"
+                                    : ", we don't have a refresh token",
+                                ` and the access token is already about to expire`,
+                                "we would spam the auth server by constantly renewing the access token in the background",
+                                "avoiding to do so."
+                            ].join(" ");
+                    }
+                })()
+            ].join(" "));
+            return;
+        }
+        log?.([
+            (0, toHumanReadableDuration_1.toHumanReadableDuration)(msBeforeExpiration),
+            `before expiration of the ${typeOfTheTokenWeGotTheTtlFrom} token.`,
+            `Scheduling renewal ${(0, toHumanReadableDuration_1.toHumanReadableDuration)(RENEW_MS_BEFORE_EXPIRES)} before expiration to keep the session alive on the OIDC server.`
+        ].join(" "));
+        const timer = (0, workerTimers_1.setTimeout)(async () => {
+            {
+                const { isOnline, prOnline } = (0, getIsOnline_1.getIsOnline)();
+                if (!isOnline) {
+                    const didCameBackOnlineInTime = await Promise.race([
+                        new Promise(resolve => (0, workerTimers_1.setTimeout)(() => resolve(false), RENEW_MS_BEFORE_EXPIRES - 1000)),
+                        prOnline.then(() => true)
+                    ]);
+                    if (!didCameBackOnlineInTime) {
+                        log?.([
+                            "The session expired on the OIDC server.",
+                            "We couldn't keep it alive because the browser was offline.",
+                            "We are not redirecting to the login page to support PWAs with offline features.",
+                            "However, the next getTokens() call will trigger a redirect to the Auth server login page."
                         ].join(" "));
-                        var timer = (0, workerTimers_1.setTimeout)(function () { return __awaiter(_this, void 0, void 0, function () {
-                            var _a, isOnline, prOnline, didCameBackOnlineInTime;
-                            return __generator(this, function (_b) {
-                                switch (_b.label) {
-                                    case 0:
-                                        _a = (0, getIsOnline_1.getIsOnline)(), isOnline = _a.isOnline, prOnline = _a.prOnline;
-                                        if (!!isOnline) return [3 /*break*/, 2];
-                                        return [4 /*yield*/, Promise.race([
-                                                new Promise(function (resolve) {
-                                                    return (0, workerTimers_1.setTimeout)(function () { return resolve(false); }, RENEW_MS_BEFORE_EXPIRES - 1000);
-                                                }),
-                                                prOnline.then(function () { return true; })
-                                            ])];
-                                    case 1:
-                                        didCameBackOnlineInTime = _b.sent();
-                                        if (!didCameBackOnlineInTime) {
-                                            log === null || log === void 0 ? void 0 : log([
-                                                "The session expired on the OIDC server.",
-                                                "We couldn't keep it alive because the browser was offline.",
-                                                "We are not redirecting to the login page to support PWAs with offline features.",
-                                                "However, the next getTokens() call will trigger a redirect to the Auth server login page."
-                                            ].join(" "));
-                                            return [2 /*return*/];
-                                        }
-                                        _b.label = 2;
-                                    case 2:
-                                        log === null || log === void 0 ? void 0 : log("Renewing the tokens now as the ".concat(typeOfTheTokenWeGotTheTtlFrom, " token will expire in ").concat((0, toHumanReadableDuration_1.toHumanReadableDuration)(RENEW_MS_BEFORE_EXPIRES)));
-                                        return [4 /*yield*/, oidc_loggedIn.renewTokens()];
-                                    case 3:
-                                        _b.sent();
-                                        return [2 /*return*/];
-                                }
-                            });
-                        }); }, Math.min(msBeforeExpiration - RENEW_MS_BEFORE_EXPIRES, 
-                        // NOTE: We want to make sure we do not overflow the setTimeout
-                        // that must be a 32 bit unsigned integer.
-                        // This can happen if the tokenExpirationTime is more than 24.8 days in the future.
-                        Math.pow(2, 31) - 1));
-                        var tokenChangeUnsubscribe = oidc_loggedIn.subscribeToTokensChange(function () {
-                            (0, workerTimers_1.clearTimeout)(timer);
-                            tokenChangeUnsubscribe();
-                            scheduleRenew();
-                        }).unsubscribe;
-                    })();
-                    auto_logout: {
-                        getCurrentRefreshTokenTtlInSeconds_1 = function () {
-                            if (idleSessionLifetimeInSeconds !== undefined) {
-                                return idleSessionLifetimeInSeconds;
-                            }
-                            if (currentTokens.refreshTokenExpirationTime === undefined) {
-                                return undefined;
-                            }
-                            return (currentTokens.refreshTokenExpirationTime - currentTokens.issuedAtTime) / 1000;
-                        };
-                        if (getCurrentRefreshTokenTtlInSeconds_1() === undefined) {
-                            log === null || log === void 0 ? void 0 : log("".concat(currentTokens.hasRefreshToken
-                                ? "The refresh token is opaque, we can't read it's expiration time"
-                                : "No refresh token", ", and idleSessionLifetimeInSeconds was not set, can't implement auto logout mechanism"));
-                            break auto_logout;
+                        return;
+                    }
+                }
+            }
+            log?.(`Renewing the tokens now as the ${typeOfTheTokenWeGotTheTtlFrom} token will expire in ${(0, toHumanReadableDuration_1.toHumanReadableDuration)(RENEW_MS_BEFORE_EXPIRES)}`);
+            await oidc_loggedIn.renewTokens();
+        }, Math.min(msBeforeExpiration - RENEW_MS_BEFORE_EXPIRES, 
+        // NOTE: We want to make sure we do not overflow the setTimeout
+        // that must be a 32 bit unsigned integer.
+        // This can happen if the tokenExpirationTime is more than 24.8 days in the future.
+        Math.pow(2, 31) - 1));
+        const { unsubscribe: tokenChangeUnsubscribe } = oidc_loggedIn.subscribeToTokensChange(() => {
+            (0, workerTimers_1.clearTimeout)(timer);
+            tokenChangeUnsubscribe();
+            scheduleRenew();
+        });
+    })();
+    auto_logout: {
+        const getCurrentRefreshTokenTtlInSeconds = () => {
+            if (idleSessionLifetimeInSeconds !== undefined) {
+                return idleSessionLifetimeInSeconds;
+            }
+            if (currentTokens.refreshTokenExpirationTime === undefined) {
+                return undefined;
+            }
+            return (currentTokens.refreshTokenExpirationTime - currentTokens.issuedAtTime) / 1000;
+        };
+        if (getCurrentRefreshTokenTtlInSeconds() === undefined) {
+            log?.(`${currentTokens.hasRefreshToken
+                ? "The refresh token is opaque, we can't read it's expiration time"
+                : "No refresh token"}, and idleSessionLifetimeInSeconds was not set, can't implement auto logout mechanism`);
+            break auto_logout;
+        }
+        const { startCountdown } = (0, startCountdown_1.createStartCountdown)({
+            tickCallback: async ({ secondsLeft }) => {
+                const invokeAllCallbacks = (params) => {
+                    const { secondsLeft } = params;
+                    Array.from(autoLogoutCountdownTickCallbacks).forEach(tickCallback => tickCallback({ secondsLeft }));
+                };
+                invokeAllCallbacks({ secondsLeft });
+                if (secondsLeft === 0) {
+                    cancel_if_offline: {
+                        const { isOnline, prOnline } = (0, getIsOnline_1.getIsOnline)();
+                        if (isOnline) {
+                            break cancel_if_offline;
                         }
-                        startCountdown_2 = (0, startCountdown_1.createStartCountdown)({
-                            tickCallback: function (_a) { return __awaiter(_this, [_a], void 0, function (_b) {
-                                var invokeAllCallbacks, _c, isOnline, prOnline, didCameBackOnline;
-                                var secondsLeft = _b.secondsLeft;
-                                return __generator(this, function (_d) {
-                                    switch (_d.label) {
-                                        case 0:
-                                            invokeAllCallbacks = function (params) {
-                                                var secondsLeft = params.secondsLeft;
-                                                Array.from(autoLogoutCountdownTickCallbacks).forEach(function (tickCallback) {
-                                                    return tickCallback({ secondsLeft: secondsLeft });
-                                                });
-                                            };
-                                            invokeAllCallbacks({ secondsLeft: secondsLeft });
-                                            if (!(secondsLeft === 0)) return [3 /*break*/, 4];
-                                            _c = (0, getIsOnline_1.getIsOnline)(), isOnline = _c.isOnline, prOnline = _c.prOnline;
-                                            if (isOnline) {
-                                                return [3 /*break*/, 2];
-                                            }
-                                            return [4 /*yield*/, Promise.race([
-                                                    new Promise(function (resolve) { return (0, workerTimers_1.setTimeout)(function () { return resolve(false); }, 10000); }),
-                                                    prOnline.then(function () { return true; })
-                                                ])];
-                                        case 1:
-                                            didCameBackOnline = _d.sent();
-                                            if (didCameBackOnline) {
-                                                return [3 /*break*/, 2];
-                                            }
-                                            log === null || log === void 0 ? void 0 : log([
-                                                "Normally now we should auto logout.",
-                                                "However since the browser is currently offline",
-                                                "we avoid calling logout() now to play nice in case",
-                                                "this app is a PWA.",
-                                                "Next getTokens() is called logout will be called"
-                                            ].join(" "));
-                                            unsubscribeFromIsUserActive_1();
-                                            invokeAllCallbacks({ secondsLeft: undefined });
-                                            wouldHaveAutoLoggedOutIfBrowserWasOnline = true;
-                                            return [2 /*return*/];
-                                        case 2: return [4 /*yield*/, oidc_loggedIn.logout(autoLogoutParams)];
-                                        case 3:
-                                            _d.sent();
-                                            _d.label = 4;
-                                        case 4: return [2 /*return*/];
-                                    }
-                                });
-                            }); }
-                        }).startCountdown;
-                        stopCountdown_1 = undefined;
-                        evtIsUserActive = (0, evtIsUserActive_1.createEvtIsUserActive)({
-                            configId: configId,
-                            sessionId: sessionId
-                        });
-                        unsubscribeFromIsUserActive_1 = evtIsUserActive.subscribe(function (isUserActive) {
-                            if (isUserActive) {
-                                if (stopCountdown_1 !== undefined) {
-                                    stopCountdown_1();
-                                    stopCountdown_1 = undefined;
-                                }
-                            }
-                            else {
-                                (0, tsafe_1.assert)(stopCountdown_1 === undefined, "902992");
-                                var currentRefreshTokenTtlInSeconds = getCurrentRefreshTokenTtlInSeconds_1();
-                                (0, tsafe_1.assert)(currentRefreshTokenTtlInSeconds !== undefined, "902992326");
-                                stopCountdown_1 = startCountdown_2({
-                                    countDownFromSeconds: currentRefreshTokenTtlInSeconds
-                                }).stopCountdown;
-                            }
-                        }).unsubscribe;
-                        {
-                            currentRefreshTokenTtlInSeconds = getCurrentRefreshTokenTtlInSeconds_1();
-                            (0, tsafe_1.assert)(currentRefreshTokenTtlInSeconds !== undefined, "9029923253");
-                            log === null || log === void 0 ? void 0 : log([
-                                "The user will be automatically logged out after ".concat((0, toHumanReadableDuration_1.toHumanReadableDuration)(currentRefreshTokenTtlInSeconds * 1000), " of inactivity."),
-                                idleSessionLifetimeInSeconds === undefined
-                                    ? undefined
-                                    : "It was artificially defined by using the idleSessionLifetimeInSeconds param."
-                            ]
-                                .filter(function (x) { return x !== undefined; })
-                                .join("\n"));
+                        const didCameBackOnline = await Promise.race([
+                            new Promise(resolve => (0, workerTimers_1.setTimeout)(() => resolve(false), 10000)),
+                            prOnline.then(() => true)
+                        ]);
+                        if (didCameBackOnline) {
+                            break cancel_if_offline;
                         }
+                        log?.([
+                            "Normally now we should auto logout.",
+                            "However since the browser is currently offline",
+                            "we avoid calling logout() now to play nice in case",
+                            "this app is a PWA.",
+                            "Next getTokens() is called logout will be called"
+                        ].join(" "));
+                        unsubscribeFromIsUserActive();
+                        invokeAllCallbacks({ secondsLeft: undefined });
+                        wouldHaveAutoLoggedOutIfBrowserWasOnline = true;
+                        return;
                     }
-                    return [2 /*return*/, oidc_loggedIn];
+                    await oidc_loggedIn.logout(autoLogoutParams);
+                }
             }
         });
-    });
+        let stopCountdown = undefined;
+        const evtIsUserActive = (0, evtIsUserActive_1.createEvtIsUserActive)({
+            configId,
+            sessionId
+        });
+        const { unsubscribe: unsubscribeFromIsUserActive } = evtIsUserActive.subscribe(isUserActive => {
+            if (isUserActive) {
+                if (stopCountdown !== undefined) {
+                    stopCountdown();
+                    stopCountdown = undefined;
+                }
+            }
+            else {
+                (0, tsafe_1.assert)(stopCountdown === undefined, "902992");
+                const currentRefreshTokenTtlInSeconds = getCurrentRefreshTokenTtlInSeconds();
+                (0, tsafe_1.assert)(currentRefreshTokenTtlInSeconds !== undefined, "902992326");
+                stopCountdown = startCountdown({
+                    countDownFromSeconds: currentRefreshTokenTtlInSeconds
+                }).stopCountdown;
+            }
+        });
+        {
+            const currentRefreshTokenTtlInSeconds = getCurrentRefreshTokenTtlInSeconds();
+            (0, tsafe_1.assert)(currentRefreshTokenTtlInSeconds !== undefined, "9029923253");
+            log?.([
+                `The user will be automatically logged out after ${(0, toHumanReadableDuration_1.toHumanReadableDuration)(currentRefreshTokenTtlInSeconds * 1000)} of inactivity.`,
+                idleSessionLifetimeInSeconds === undefined
+                    ? undefined
+                    : `It was artificially defined by using the idleSessionLifetimeInSeconds param.`
+            ]
+                .filter(x => x !== undefined)
+                .join("\n"));
+        }
+    }
+    return oidc_loggedIn;
 }
 //# sourceMappingURL=createOidc.js.map