oidc-spa 7.2.5 → 7.3.0

package/src/keycloak/keycloak-js/Keycloak.ts

@@ -330,7 +330,7 @@ export class Keycloak {
 
         if (!oidc.isUserLoggedIn) {
             console.warn(
-                "Trying to read keycloak.realAccess when keycloak.realmAccess is false is a logical error in your application"
+                "Trying to read keycloak.realAccess when keycloak.authenticated is false is a logical error in your application"
             );
             return undefined;
         }
@@ -389,7 +389,7 @@ export class Keycloak {
 
         if (!oidc.isUserLoggedIn) {
             console.warn(
-                "Trying to read keycloak.token when keycloak.token is false is a logical error in your application"
+                "Trying to read keycloak.token when keycloak.authenticated is false is a logical error in your application"
             );
             return undefined;
         }
@@ -423,7 +423,7 @@ export class Keycloak {
 
         if (!oidc.isUserLoggedIn) {
             console.warn(
-                "Trying to read keycloak.token when keycloak.tokenParsed is false is a logical error in your application"
+                "Trying to read keycloak.tokenParsed when keycloak.authenticated is false is a logical error in your application"
             );
             return undefined;
         }
@@ -451,7 +451,7 @@ export class Keycloak {
 
         if (!oidc.isUserLoggedIn) {
             console.warn(
-                "Trying to read keycloak.token when keycloak.refreshToken is false is a logical error in your application"
+                "Trying to read keycloak.refreshToken when keycloak.authenticated is false is a logical error in your application"
             );
             return undefined;
         }
@@ -485,7 +485,7 @@ export class Keycloak {
 
         if (!oidc.isUserLoggedIn) {
             console.warn(
-                "Trying to read keycloak.token when keycloak.refreshTokenParsed is false is a logical error in your application"
+                "Trying to read keycloak.refreshTokenParsed when keycloak.authenticated is false is a logical error in your application"
             );
             return undefined;
         }
@@ -517,7 +517,7 @@ export class Keycloak {
 
         if (!oidc.isUserLoggedIn) {
             console.warn(
-                "Trying to read keycloak.token when keycloak.token is false is a logical error in your application"
+                "Trying to read keycloak.idToken when keycloak.authenticated is false is a logical error in your application"
             );
             return undefined;
         }
@@ -551,7 +551,7 @@ export class Keycloak {
 
         if (!oidc.isUserLoggedIn) {
             console.warn(
-                "Trying to read keycloak.token when keycloak.refreshTokenParsed is false is a logical error in your application"
+                "Trying to read keycloak.idTokenParsed when keycloak.authenticated is false is a logical error in your application"
             );
             return undefined;
         }
@@ -566,10 +566,37 @@ export class Keycloak {
      * The estimated time difference between the browser time and the Keycloak
      * server in seconds. This value is just an estimation, but is accurate
      * enough when determining if a token is expired or not.
-     *
-     * NOTE oidc-spa: Not supported.
      */
-    timeSkew = null;
+    get timeSkew(): number | null {
+        const internalState = internalStateByInstance.get(this);
+
+        assert(internalState !== undefined);
+
+        if (!this.didInitialize) {
+            const { timeSkew } = internalState.initOptions ?? {};
+
+            if (timeSkew === undefined) {
+                return null;
+            }
+
+            return timeSkew;
+        }
+
+        const { oidc, tokens } = internalState;
+
+        assert(oidc !== undefined);
+
+        if (!oidc.isUserLoggedIn) {
+            console.warn(
+                "Trying to read keycloak.timeSkew when keycloak.authenticated is false is a logical error in your application"
+            );
+            return null;
+        }
+
+        assert(tokens !== undefined);
+
+        return Math.ceil((tokens.getServerDateNow() - Date.now()) / 1000);
+    }
 
     /**
      * Whether the instance has been initialized by calling `.init()`.

package/src/keycloak/keycloak-js/types.ts

@@ -139,11 +139,8 @@ export interface KeycloakInitOptions {
     /**
      * Set an initial value for skew between local time and Keycloak server in
      * seconds (only together with `token` or `refreshToken`).
-     *
-     * NOTE oidc-spa: Not supported
      */
-    //timeSkew?: number;
-    timeSkew?: undefined;
+    timeSkew?: number;
 
     /**
      * Set to enable/disable monitoring login state.

package/src/mock/oidc.ts

@@ -151,7 +151,8 @@ export async function createMockOidc<
                             "See https://docs.oidc-spa.dev/v/v7/mock"
                         ].join("\n")
                     }),
-                issuedAtTime: Date.now()
+                issuedAtTime: Date.now(),
+                getServerDateNow: () => Date.now()
             };
 
             const tokens: Oidc.Tokens<DecodedIdToken> =

package/src/tools/workerTimers.ts

@@ -29,16 +29,12 @@ export function setTimeout(callback: () => void, delay: number): TimerHandle {
 
     const start = Date.now();
 
-    const onPageshow = (event: { persisted: boolean }) => {
-        if (!event.persisted) {
-            return;
-        }
-
+    const onPageshow = () => {
         workerTimers.clearTimeout(timerHandle_n);
 
         const elapsed = Date.now() - start;
 
-        if (elapsed < delay) {
+        if (0 <= elapsed && elapsed < delay) {
             timerHandle_n = workerTimers.setTimeout(callback_actual, delay - elapsed);
         } else {
             callback_actual();

package/tools/workerTimers.js

@@ -18,13 +18,10 @@ function setTimeout(callback, delay) {
         window.removeEventListener("pageshow", onPageshow);
     });
     const start = Date.now();
-    const onPageshow = (event) => {
-        if (!event.persisted) {
-            return;
-        }
+    const onPageshow = () => {
         worker_timers_1.workerTimers.clearTimeout(timerHandle_n);
         const elapsed = Date.now() - start;
-        if (elapsed < delay) {
+        if (0 <= elapsed && elapsed < delay) {
             timerHandle_n = worker_timers_1.workerTimers.setTimeout(callback_actual, delay - elapsed);
         }
         else {

package/tools/workerTimers.js.map

@@ -1 +1 @@
-{"version":3,"file":"workerTimers.js","sourceRoot":"","sources":["../src/tools/workerTimers.ts"],"names":[],"mappings":";;AAQA,gCA0CC;AAED,oCAQC;AA5DD,oEAAgE;AAMhE,MAAM,kBAAkB,GAAG,IAAI,OAAO,EAA2B,CAAC;AAElE,SAAgB,UAAU,CAAC,QAAoB,EAAE,KAAa;IAC1D,MAAM,eAAe,GAAG,GAAG,EAAE;QACzB,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAEnD,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAEvC,QAAQ,EAAE,CAAC;IACf,CAAC,CAAC;IAEF,IAAI,aAAa,GAAG,4BAAY,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAEpE,MAAM,WAAW,GAAgB,EAAS,CAAC;IAE3C,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE;QACrC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAEvC,4BAAY,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAEzC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,MAAM,UAAU,GAAG,CAAC,KAA6B,EAAE,EAAE;QACjD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YACnB,OAAO;QACX,CAAC;QAED,4BAAY,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAEzC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAEnC,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;YAClB,aAAa,GAAG,4BAAY,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACJ,eAAe,EAAE,CAAC;QACtB,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAEhD,OAAO,WAAW,CAAC;AACvB,CAAC;AAED,SAAgB,YAAY,CAAC,MAAmB;IAC5C,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO;IACX,CAAC;IAED,KAAK,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"workerTimers.js","sourceRoot":"","sources":["../src/tools/workerTimers.ts"],"names":[],"mappings":";;AAQA,gCAsCC;AAED,oCAQC;AAxDD,oEAAgE;AAMhE,MAAM,kBAAkB,GAAG,IAAI,OAAO,EAA2B,CAAC;AAElE,SAAgB,UAAU,CAAC,QAAoB,EAAE,KAAa;IAC1D,MAAM,eAAe,GAAG,GAAG,EAAE;QACzB,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAEnD,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAEvC,QAAQ,EAAE,CAAC;IACf,CAAC,CAAC;IAEF,IAAI,aAAa,GAAG,4BAAY,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IAEpE,MAAM,WAAW,GAAgB,EAAS,CAAC;IAE3C,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,EAAE;QACrC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAEvC,4BAAY,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAEzC,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,MAAM,UAAU,GAAG,GAAG,EAAE;QACpB,4BAAY,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAEzC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QAEnC,IAAI,CAAC,IAAI,OAAO,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;YAClC,aAAa,GAAG,4BAAY,CAAC,UAAU,CAAC,eAAe,EAAE,KAAK,GAAG,OAAO,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACJ,eAAe,EAAE,CAAC;QACtB,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,CAAC,gBAAgB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAEhD,OAAO,WAAW,CAAC;AACvB,CAAC;AAED,SAAgB,YAAY,CAAC,MAAmB;IAC5C,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO;IACX,CAAC;IAED,KAAK,EAAE,CAAC;AACZ,CAAC"}

package/vendor/frontend/oidc-client-ts.js

@@ -1182,6 +1182,7 @@ var UserInfoService = class {
 };
 
 // src/TokenClient.ts
+var localTimeByResponse = /* @__PURE__ */ new WeakMap();
 var TokenClient = class {
   constructor(_settings, _metadataService) {
     this._settings = _settings;
@@ -1240,6 +1241,7 @@ var TokenClient = class {
     }
     const url = await this._metadataService.getTokenEndpoint(false);
     logger2.debug("got token endpoint");
+    const timeBefore = Date.now();
     const response = await this._jsonService.postForm(url, {
       body: params,
       basicAuth,
@@ -1247,6 +1249,8 @@ var TokenClient = class {
       initCredentials: this._settings.fetchRequestCredentials,
       extraHeaders
     });
+    const timeAfter = Date.now();
+    localTimeByResponse.set(response, Math.floor((timeBefore + timeAfter) / 2));
     logger2.debug("got response");
     return response;
   }
@@ -1293,7 +1297,10 @@ var TokenClient = class {
     }
     const url = await this._metadataService.getTokenEndpoint(false);
     logger2.debug("got token endpoint");
+    const timeBefore = Date.now();
     const response = await this._jsonService.postForm(url, { body: params, basicAuth, timeoutInSeconds: this._settings.requestTimeoutInSeconds, initCredentials: this._settings.fetchRequestCredentials });
+    const timeAfter = Date.now();
+    localTimeByResponse.set(response, Math.floor((timeBefore + timeAfter) / 2));
     logger2.debug("got response");
     return response;
   }
@@ -1343,7 +1350,10 @@ var TokenClient = class {
     }
     const url = await this._metadataService.getTokenEndpoint(false);
     logger2.debug("got token endpoint");
+    const timeBefore = Date.now();
     const response = await this._jsonService.postForm(url, { body: params, basicAuth, timeoutInSeconds, initCredentials: this._settings.fetchRequestCredentials, extraHeaders });
+    const timeAfter = Date.now();
+    localTimeByResponse.set(response, Math.floor((timeBefore + timeAfter) / 2));
     logger2.debug("got response");
     return response;
   }
@@ -1498,6 +1508,13 @@ var ResponseValidator = class {
       });
       Object.assign(response, tokenResponse);
       response.__oidc_spa_tokenResponse = tokenResponse;
+      response.__oidc_spa_localTimeWhenTokenIssued = (() => {
+        const time = localTimeByResponse.get(tokenResponse);
+        if (time === void 0) {
+          throw new Error("oidc-spa error in oidc-client-ts");
+        }
+        return time;
+      })();
     } else {
       logger2.debug("No code to process");
     }
@@ -1782,6 +1799,7 @@ var SigninResponse = class {
     this.error_uri = params.get("error_uri");
     this.code = params.get("code");
     this.__oidc_spa_tokenResponse = void 0;
+    this.__oidc_spa_localTimeWhenTokenIssued = void 0;
   }
   get expires_in() {
     if (this.expires_at === void 0) {
@@ -2068,6 +2086,13 @@ var OidcClient = class {
     const signinResponse = new SigninResponse(new URLSearchParams());
     Object.assign(signinResponse, tokenResponse);
     signinResponse.__oidc_spa_tokenResponse = tokenResponse;
+    signinResponse.__oidc_spa_localTimeWhenTokenIssued = (() => {
+      const time = localTimeByResponse.get(tokenResponse);
+      if (time === void 0) {
+        throw new Error("oidc-spa error in oidc-client-ts");
+      }
+      return time;
+    })();
     await this._validator.validateCredentialsResponse(signinResponse, skipUserInfo);
     return signinResponse;
   }
@@ -2125,6 +2150,13 @@ var OidcClient = class {
     const response = new SigninResponse(new URLSearchParams());
     Object.assign(response, result);
     response.__oidc_spa_tokenResponse = result;
+    response.__oidc_spa_localTimeWhenTokenIssued = (() => {
+      const time = localTimeByResponse.get(result);
+      if (time === void 0) {
+        throw new Error("oidc-spa error in oidc-client-ts");
+      }
+      return time;
+    })();
     logger2.debug("validating response", response);
     await this._validator.validateRefreshResponse(response, {
       ...state,
@@ -2356,6 +2388,7 @@ var User = class _User {
     this.state = args.userState;
     this.url_state = args.url_state;
     this.__oidc_spa_tokenResponse = args.__oidc_spa_tokenResponse;
+    this.__oidc_spa_localTimeWhenTokenIssued = args.__oidc_spa_localTimeWhenTokenIssued;
   }
   /** Computed number of seconds the access token has remaining. */
   get expires_in() {
@@ -2393,7 +2426,8 @@ var User = class _User {
       scope: this.scope,
       profile: this.profile,
       expires_at: this.expires_at,
-      __oidc_spa_tokenResponse: this.__oidc_spa_tokenResponse
+      __oidc_spa_tokenResponse: this.__oidc_spa_tokenResponse,
+      __oidc_spa_localTimeWhenTokenIssued: this.__oidc_spa_localTimeWhenTokenIssued
     });
   }
   static fromStorageString(storageString) {
@@ -3150,12 +3184,15 @@ var UserManager = class {
       timeoutInSeconds: this.settings.silentRequestTimeoutInSeconds,
       ...args
     });
-    if (response.__oidc_spa_tokenResponse === void 0) {
-      throw new Error(
-        "Wrong Assertion Encountered: Error in oidc-spa mod of oidc-client-ts"
-      );
+    if (response.__oidc_spa_tokenResponse === void 0 || response.__oidc_spa_localTimeWhenTokenIssued === void 0) {
+      throw new Error("Wrong Assertion Encountered: Error in oidc-spa mod of oidc-client-ts");
     }
-    const user = new User({ ...args.state, ...response, __oidc_spa_tokenResponse: response.__oidc_spa_tokenResponse });
+    const user = new User({
+      ...args.state,
+      ...response,
+      __oidc_spa_tokenResponse: response.__oidc_spa_tokenResponse,
+      __oidc_spa_localTimeWhenTokenIssued: response.__oidc_spa_localTimeWhenTokenIssued
+    });
     await this.storeUser(user);
     await this._events.load(user);
     return user;
@@ -3318,14 +3355,15 @@ var UserManager = class {
   }
   async _buildUser(signinResponse, verifySub) {
     const logger2 = this._logger.create("_buildUser");
-    if (signinResponse.__oidc_spa_tokenResponse === void 0) {
+    if (signinResponse.__oidc_spa_tokenResponse === void 0 || signinResponse.__oidc_spa_localTimeWhenTokenIssued === void 0) {
       throw new Error(
         "Wrong Assertion Encountered: Error in oidc-spa mod of oidc-client-ts"
       );
     }
     const user = new User({
       ...signinResponse,
-      __oidc_spa_tokenResponse: signinResponse.__oidc_spa_tokenResponse
+      __oidc_spa_tokenResponse: signinResponse.__oidc_spa_tokenResponse,
+      __oidc_spa_localTimeWhenTokenIssued: signinResponse.__oidc_spa_localTimeWhenTokenIssued
     });
     if (verifySub) {
       if (verifySub !== user.profile.sub) {