oidc-spa 8.2.1 → 8.2.2

package/src/core/createOidc.ts

@@ -25,12 +25,7 @@ import { notifyOtherTabsOfLogin, getPrOtherTabLogin } from "./loginPropagationTo
 import { getConfigId } from "./configId";
 import { oidcClientTsUserToTokens } from "./oidcClientTsUserToTokens";
 import { loginSilent } from "./loginSilent";
-import {
-    authResponseToUrl,
-    getPersistedRedirectAuthResponses,
-    setPersistedRedirectAuthResponses,
-    type AuthResponse
-} from "./AuthResponse";
+import { authResponseToUrl, type AuthResponse } from "./AuthResponse";
 import { getRootRelativeOriginalLocationHref, getRedirectAuthResponse } from "./earlyInit";
 import { getPersistedAuthState, persistAuthState } from "./persistedAuthState";
 import type { Oidc } from "./Oidc";
@@ -40,7 +35,7 @@ import {
     createLoginOrGoToAuthServer,
     getPrSafelyRestoredFromBfCacheAfterLoginBackNavigationOrInitializationError
 } from "./loginOrGoToAuthServer";
-import { createEphemeralSessionStorage } from "../tools/EphemeralSessionStorage";
+import { createLazySessionStorage } from "../tools/lazySessionStorage";
 import {
     startLoginOrRefreshProcess,
     waitForAllOtherOngoingLoginOrRefreshProcessesToComplete
@@ -53,6 +48,10 @@ import { prShouldLoadApp } from "./prShouldLoadApp";
 import { getBASE_URL } from "./BASE_URL";
 import { getIsLikelyDevServer } from "../tools/isLikelyDevServer";
 import { createObjectThatThrowsIfAccessed } from "../tools/createObjectThatThrowsIfAccessed";
+import {
+    evtIsThereMoreThanOneInstanceThatCantUserIframes,
+    notifyNewInstanceThatCantUseIframes
+} from "./instancesThatCantUseIframes";
 
 // NOTE: Replaced at build time
 const VERSION = "{{OIDC_SPA_VERSION}}";
@@ -108,6 +107,8 @@ export type ParamsOfCreateOidc<
      */
     extraTokenParams?: Record<string, string | undefined> | (() => Record<string, string | undefined>);
     /**
+     * @deprecated: Use login({ redirectUrl: "..." }) instead.
+     *
      * Usage discouraged, it's here because we don't want to assume too much on your
      * usecase but I can't think of a scenario where you would want anything
      * other than the current page.
@@ -208,24 +209,9 @@ export type ParamsOfCreateOidc<
 
 const globalContext = {
     prOidcByConfigId: new Map<string, Promise<Oidc<any>>>(),
-    hasLogoutBeenCalled: id<boolean>(false),
-    evtRequestToPersistTokens: createEvt<{ configIdOfInstancePostingTheRequest: string }>()
+    hasLogoutBeenCalled: id<boolean>(false)
 };
 
-globalContext.evtRequestToPersistTokens.subscribe(() => {
-    const { authResponse } = getRedirectAuthResponse();
-
-    if (authResponse === undefined) {
-        return;
-    }
-
-    const { authResponses } = getPersistedRedirectAuthResponses();
-
-    setPersistedRedirectAuthResponses({
-        authResponses: [...authResponses, authResponse]
-    });
-});
-
 /** @see: https://docs.oidc-spa.dev/v/v8/usage */
 export async function createOidc<
     DecodedIdToken extends Record<string, unknown> = Oidc.Tokens.DecodedIdToken_OidcCoreSpec,
@@ -242,7 +228,7 @@ export async function createOidc<
         }
     }
 
-    const { issuerUri: issuerUri_params, clientId, scopes = ["profile"], debugLogs, ...rest } = params;
+    const { issuerUri: issuerUri_params, clientId, debugLogs, ...rest } = params;
 
     const issuerUri = toFullyQualifiedUrl({
         urlish: issuerUri_params,
@@ -298,7 +284,6 @@ export async function createOidc<
     const oidc = await createOidc_nonMemoized(rest, {
         issuerUri,
         clientId,
-        scopes,
         configId,
         log
     });
@@ -312,14 +297,10 @@ export async function createOidc_nonMemoized<
     DecodedIdToken extends Record<string, unknown>,
     AutoLogin extends boolean
 >(
-    params: Omit<
-        ParamsOfCreateOidc<DecodedIdToken, AutoLogin>,
-        "issuerUri" | "clientId" | "scopes" | "debugLogs"
-    >,
+    params: Omit<ParamsOfCreateOidc<DecodedIdToken, AutoLogin>, "issuerUri" | "clientId" | "debugLogs">,
     preProcessedParams: {
         issuerUri: string;
         clientId: string;
-        scopes: string[];
         configId: string;
         log: typeof console.log | undefined;
     }
@@ -357,12 +338,13 @@ export async function createOidc_nonMemoized<
         __unsafe_clientSecret,
         __unsafe_useIdTokenAsAccessToken = false,
         __metadata,
-        noIframe = false
+        noIframe = false,
+        scopes = ["openid", "profile"]
     } = params;
 
     const BASE_URL_params = params.BASE_URL ?? params.homeUrl;
 
-    const { issuerUri, clientId, scopes, configId, log } = preProcessedParams;
+    const { issuerUri, clientId, configId, log } = preProcessedParams;
 
     const getExtraQueryParams = (() => {
         if (extraQueryParamsOrGetter === undefined) {
@@ -422,8 +404,7 @@ export async function createOidc_nonMemoized<
                 issuerUri,
                 clientId,
                 scopes,
-                configId,
-                homeUrlAndRedirectUri
+                oidcRedirectUri: homeUrlAndRedirectUri
             },
             null,
             2
@@ -515,7 +496,7 @@ export async function createOidc_nonMemoized<
                 log?.(
                     [
                         "Detected localhost environment.",
-                        "\nWhen reloading while logged in, you may briefly see",
+                        "\nWhen reloading while logged in, you will briefly see",
                         "some URL params appear in the address bar.",
                         "\nThis happens because session restore via iframe is disabled,",
                         "the browser treats your auth server as a third party.",
@@ -585,7 +566,16 @@ export async function createOidc_nonMemoized<
         return true;
     })();
 
-    let isUserStoreInMemoryOnly: boolean | undefined = undefined;
+    notifyNewInstanceThatCantUseIframes();
+
+    if (evtIsThereMoreThanOneInstanceThatCantUserIframes.current) {
+        log?.(
+            [
+                "More than one oidc instance can't use iframe",
+                "falling back to persisting tokens in session storage"
+            ].join(" ")
+        );
+    }
 
     const oidcClientTsUserManager =
         oidcMetadata === undefined
@@ -606,27 +596,18 @@ export async function createOidc_nonMemoized<
                   userStore: new WebStorageStateStore({
                       store: (() => {
                           if (canUseIframe) {
-                              isUserStoreInMemoryOnly = true;
                               return new InMemoryWebStorage();
                           }
 
-                          isUserStoreInMemoryOnly = false;
-
-                          const storage = createEphemeralSessionStorage({
-                              sessionStorageTtlMs: 3 * 60_000
-                          });
-
-                          const { evtRequestToPersistTokens } = globalContext;
-
-                          evtRequestToPersistTokens.subscribe(
-                              ({ configIdOfInstancePostingTheRequest }) => {
-                                  if (configIdOfInstancePostingTheRequest === configId) {
-                                      return;
-                                  }
+                          const storage = createLazySessionStorage();
 
+                          if (evtIsThereMoreThanOneInstanceThatCantUserIframes.current) {
+                              storage.persistCurrentStateAndSubsequentChanges();
+                          } else {
+                              evtIsThereMoreThanOneInstanceThatCantUserIframes.subscribe(() => {
                                   storage.persistCurrentStateAndSubsequentChanges();
-                              }
-                          );
+                              });
+                          }
 
                           return storage;
                       })()
@@ -675,75 +656,67 @@ export async function createOidc_nonMemoized<
             });
         }
 
-        handle_redirect_auth_response: {
-            let stateDataAndAuthResponse:
-                | { stateData: StateData.Redirect; authResponse: AuthResponse }
-                | undefined = undefined;
+        restore_from_session_storage: {
+            if (canUseIframe) {
+                break restore_from_session_storage;
+            }
 
-            get_stateData_and_authResponse: {
-                from_memory: {
-                    const { authResponse, clearAuthResponse } = getRedirectAuthResponse();
+            if (!evtIsThereMoreThanOneInstanceThatCantUserIframes.current) {
+                break restore_from_session_storage;
+            }
 
-                    if (authResponse === undefined) {
-                        break from_memory;
-                    }
+            let oidcClientTsUser: OidcClientTsUser | null;
 
-                    const stateData = getStateData({ stateUrlParamValue: authResponse.state });
+            try {
+                oidcClientTsUser = await oidcClientTsUserManager.getUser();
+            } catch {
+                // NOTE: Not sure if it can throw, but let's be safe.
+                oidcClientTsUser = null;
+                try {
+                    await oidcClientTsUserManager.removeUser();
+                } catch {}
+            }
 
-                    if (stateData === undefined) {
-                        clearAuthResponse();
-                        break from_memory;
-                    }
+            if (oidcClientTsUser === null) {
+                break restore_from_session_storage;
+            }
 
-                    if (stateData.configId !== configId) {
-                        break from_memory;
-                    }
+            log?.("Session was restored from session storage");
 
-                    assert(stateData.context === "redirect", "3229492");
+            return {
+                oidcClientTsUser,
+                backFromAuthServer: undefined
+            };
+        }
 
-                    clearAuthResponse();
+        handle_redirect_auth_response: {
+            let stateDataAndAuthResponse:
+                | { stateData: StateData.Redirect; authResponse: AuthResponse }
+                | undefined = undefined;
 
-                    stateDataAndAuthResponse = { stateData, authResponse };
+            {
+                const { authResponse, clearAuthResponse } = getRedirectAuthResponse();
 
-                    break get_stateData_and_authResponse;
+                if (authResponse === undefined) {
+                    break handle_redirect_auth_response;
                 }
 
-                // from storage, this is for race condition in multiple instance
-                // setup where one instance would need to redirect before
-                // the authResponse in memory had the chance to be processed.
-                // This can only happen if:
-                // 1) There are multiple oidc instances in the App.
-                // 2) They are instantiated in a non deterministic order.
-                // 3) We can't use iframe
-                // We practically never persist the auth response and do it only in session
-                // an ephemeral session storage, when we know it's gonna be required.
-                {
-                    const { authResponses } = getPersistedRedirectAuthResponses();
-
-                    for (const authResponse of authResponses) {
-                        const stateData = getStateData({ stateUrlParamValue: authResponse.state });
-
-                        if (stateData === undefined) {
-                            continue;
-                        }
+                const stateData = getStateData({ stateUrlParamValue: authResponse.state });
 
-                        if (stateData.configId !== configId) {
-                            continue;
-                        }
+                if (stateData === undefined) {
+                    clearAuthResponse();
+                    break handle_redirect_auth_response;
+                }
 
-                        assert(stateData.context === "redirect", "35935591");
+                if (stateData.configId !== configId) {
+                    break handle_redirect_auth_response;
+                }
 
-                        setPersistedRedirectAuthResponses({
-                            authResponses: authResponses.filter(
-                                authResponse_i => authResponse_i !== authResponse
-                            )
-                        });
+                assert(stateData.context === "redirect", "3229492");
 
-                        stateDataAndAuthResponse = { stateData, authResponse };
+                clearAuthResponse();
 
-                        break get_stateData_and_authResponse;
-                    }
-                }
+                stateDataAndAuthResponse = { stateData, authResponse };
             }
 
             if (stateDataAndAuthResponse === undefined) {
@@ -856,39 +829,6 @@ export async function createOidc_nonMemoized<
             }
         }
 
-        // NOTE: We almost never persist tokens, we have to only to support edge case
-        // of multiple oidc instance in a single App with no iframe support.
-        restore_from_session_storage: {
-            assert(isUserStoreInMemoryOnly !== undefined, "3392204");
-
-            if (isUserStoreInMemoryOnly) {
-                break restore_from_session_storage;
-            }
-
-            let oidcClientTsUser: OidcClientTsUser | null;
-
-            try {
-                oidcClientTsUser = await oidcClientTsUserManager.getUser();
-            } catch {
-                // NOTE: Not sure if it can throw, but let's be safe.
-                oidcClientTsUser = null;
-                try {
-                    await oidcClientTsUserManager.removeUser();
-                } catch {}
-            }
-
-            if (oidcClientTsUser === null) {
-                break restore_from_session_storage;
-            }
-
-            log?.("Restored the auth from ephemeral session storage");
-
-            return {
-                oidcClientTsUser,
-                backFromAuthServer: undefined
-            };
-        }
-
         silent_login_if_possible_and_auto_login: {
             const persistedAuthState = getPersistedAuthState({ configId });
 
@@ -1002,8 +942,6 @@ export async function createOidc_nonMemoized<
                 ) {
                     log?.("Performing auto login with redirect");
 
-                    persistAuthState({ configId, state: undefined });
-
                     completeLoginOrRefreshProcess();
 
                     if (autoLogin && persistedAuthState !== "logged in") {
@@ -1015,16 +953,16 @@ export async function createOidc_nonMemoized<
                             getPrSafelyRestoredFromBfCacheAfterLoginBackNavigationOrInitializationError()
                     });
 
-                    if (persistedAuthState === "logged in") {
-                        globalContext.evtRequestToPersistTokens.post({
-                            configIdOfInstancePostingTheRequest: configId
-                        });
-                    }
-
                     await loginOrGoToAuthServer({
                         action: "login",
                         doForceReloadOnBfCache: true,
-                        redirectUrl: getRootRelativeOriginalLocationHref(),
+                        redirectUrl: (() => {
+                            if (evtIsThereMoreThanOneInstanceThatCantUserIframes.current) {
+                                return window.location.href;
+                            }
+
+                            return getRootRelativeOriginalLocationHref();
+                        })(),
                         // NOTE: Wether or not it's the preferred behavior, pushing to history
                         // only works on user interaction so it have to be false
                         doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: false,
@@ -1040,7 +978,10 @@ export async function createOidc_nonMemoized<
                             }
 
                             return "ensure no interaction";
-                        })()
+                        })(),
+                        preRedirectHook: () => {
+                            persistAuthState({ configId, state: undefined });
+                        }
                     });
                 }
 
@@ -1161,7 +1102,8 @@ export async function createOidc_nonMemoized<
                             interaction:
                                 getPersistedAuthState({ configId }) === "explicitly logged out"
                                     ? "ensure interaction"
-                                    : "directly redirect if active session show login otherwise"
+                                    : "directly redirect if active session show login otherwise",
+                            preRedirectHook: undefined
                         });
                     },
                     initializationError: undefined
@@ -1233,6 +1175,7 @@ export async function createOidc_nonMemoized<
                 state: {
                     stateDescription: "logged in",
                     refreshTokenExpirationTime: currentTokens.refreshTokenExpirationTime,
+                    serverDateNow: currentTokens.getServerDateNow(),
                     idleSessionLifetimeInSeconds
                 }
             });
@@ -1382,10 +1325,6 @@ export async function createOidc_nonMemoized<
                         prUnlock: new Promise<never>(() => {})
                     });
 
-                    globalContext.evtRequestToPersistTokens.post({
-                        configIdOfInstancePostingTheRequest: configId
-                    });
-
                     await loginOrGoToAuthServer({
                         action: "login",
                         redirectUrl: window.location.href,
@@ -1393,7 +1332,8 @@ export async function createOidc_nonMemoized<
                         extraQueryParams_local: undefined,
                         transformUrlBeforeRedirect_local: undefined,
                         doNavigateBackToLastPublicUrlIfTheTheUserNavigateBack: false,
-                        interaction: "directly redirect if active session show login otherwise"
+                        interaction: "directly redirect if active session show login otherwise",
+                        preRedirectHook: undefined
                     });
                     assert(false, "136134");
                 };
@@ -1514,6 +1454,7 @@ export async function createOidc_nonMemoized<
                         state: {
                             stateDescription: "logged in",
                             refreshTokenExpirationTime: currentTokens.refreshTokenExpirationTime,
+                            serverDateNow: currentTokens.getServerDateNow(),
                             idleSessionLifetimeInSeconds
                         }
                     });

package/src/core/instancesThatCantUseIframes.ts

@@ -0,0 +1,24 @@
+import { createStatefulEvt } from "../tools/StatefulEvt";
+
+const SESSION_STORAGE_KEY = "oidc-spa:more-than-one-instance-cant-use-iframe";
+
+export const evtIsThereMoreThanOneInstanceThatCantUserIframes = createStatefulEvt(
+    () => sessionStorage.getItem(SESSION_STORAGE_KEY) !== null
+);
+
+let count = 0;
+
+export function notifyNewInstanceThatCantUseIframes() {
+    count++;
+
+    if (count === 1) {
+        return;
+    }
+
+    if (evtIsThereMoreThanOneInstanceThatCantUserIframes.current) {
+        return;
+    }
+
+    sessionStorage.setItem(SESSION_STORAGE_KEY, "true");
+    evtIsThereMoreThanOneInstanceThatCantUserIframes.current = true;
+}

package/src/core/loginOrGoToAuthServer.ts

@@ -30,6 +30,7 @@ namespace Params {
             | "ensure no interaction"
             | "ensure interaction"
             | "directly redirect if active session show login otherwise";
+        preRedirectHook: (() => void) | undefined;
     };
 
     export type GoToAuthServer = Common & {
@@ -305,6 +306,10 @@ export function createLoginOrGoToAuthServer(params: {
 
         log?.(`redirectMethod: ${redirectMethod}`);
 
+        if (rest.action === "login") {
+            rest.preRedirectHook?.();
+        }
+
         return oidcClientTsUserManager
             .signinRedirect({
                 state: stateData,

package/src/core/persistedAuthState.ts

@@ -30,6 +30,7 @@ export function persistAuthState(params: {
               stateDescription: "logged in";
               idleSessionLifetimeInSeconds: number | undefined;
               refreshTokenExpirationTime: number | undefined;
+              serverDateNow: number;
           }
         | {
               stateDescription: "explicitly logged out";
@@ -56,14 +57,35 @@ export function persistAuthState(params: {
                                 __brand: "PersistedAuthState-v1",
                                 stateDescription: "logged in",
                                 untilTime: (() => {
-                                    const { idleSessionLifetimeInSeconds, refreshTokenExpirationTime } =
-                                        state;
+                                    const {
+                                        idleSessionLifetimeInSeconds,
+                                        refreshTokenExpirationTime,
+                                        serverDateNow
+                                    } = state;
+
+                                    const untilTime_real = (() => {
+                                        if (refreshTokenExpirationTime === undefined) {
+                                            return undefined;
+                                        }
+
+                                        const msBeforeExpirationOfTheSession =
+                                            refreshTokenExpirationTime - serverDateNow;
+
+                                        return Date.now() + msBeforeExpirationOfTheSession;
+                                    })();
+
+                                    const unitTime_userOverwrite = (() => {
+                                        if (idleSessionLifetimeInSeconds === undefined) {
+                                            return undefined;
+                                        }
 
-                                    if (idleSessionLifetimeInSeconds !== undefined) {
                                         return Date.now() + idleSessionLifetimeInSeconds * 1000;
-                                    }
+                                    })();
 
-                                    return refreshTokenExpirationTime;
+                                    return Math.min(
+                                        untilTime_real ?? Number.POSITIVE_INFINITY,
+                                        unitTime_userOverwrite ?? Number.POSITIVE_INFINITY
+                                    );
                                 })()
                             });
                         case "explicitly logged out":

package/src/tools/lazySessionStorage.ts

@@ -0,0 +1,119 @@
+import { assert } from "../tools/tsafe/assert";
+
+const SESSION_STORAGE_PREFIX = "lazy-session-storage:";
+
+export type LazySessionStorage = {
+    // `Storage` methods, we don't use the type directly because it has [name: string]: any;
+    readonly length: number;
+    clear(): void;
+    getItem(key: string): string | null;
+    key(index: number): string | null;
+    removeItem(key: string): void;
+    setItem(key: string, value: string): void;
+
+    // Custom method
+    persistCurrentStateAndSubsequentChanges: () => void;
+};
+
+export function createLazySessionStorage(): LazySessionStorage {
+    const entries: { key: string; value: string }[] = [];
+
+    for (let i = 0; i < sessionStorage.length; i++) {
+        const key = sessionStorage.key(i);
+        assert(key !== null, "470498");
+
+        if (!key.startsWith(SESSION_STORAGE_PREFIX)) {
+            continue;
+        }
+
+        const value = sessionStorage.getItem(key);
+
+        assert(value !== null, "846771");
+
+        sessionStorage.removeItem(key);
+
+        entries.push({
+            key: key.slice(SESSION_STORAGE_PREFIX.length),
+            value
+        });
+    }
+
+    let isPersistenceEnabled = false;
+
+    const storage: LazySessionStorage = {
+        persistCurrentStateAndSubsequentChanges: () => {
+            isPersistenceEnabled = true;
+
+            for (let i = 0; i < storage.length; i++) {
+                const key = storage.key(i);
+                assert(key !== null, "803385");
+
+                const value = storage.getItem(key);
+
+                assert(value !== null, "777098");
+
+                storage.setItem(key, value);
+            }
+        },
+        get length() {
+            return entries.length;
+        },
+        key: index => {
+            const entry = entries[index];
+
+            if (entry === undefined) {
+                return null;
+            }
+
+            return entry.key;
+        },
+        removeItem: key => {
+            const entry = entries.find(entry => entry.key === key);
+
+            if (entry === undefined) {
+                return;
+            }
+
+            sessionStorage.removeItem(`${SESSION_STORAGE_PREFIX}${entry.key}`);
+
+            const index = entries.indexOf(entry);
+
+            entries.splice(index, 1);
+        },
+        clear: () => {
+            for (let i = 0; i < storage.length; i++) {
+                const key = storage.key(i);
+                assert(key !== null, "290875");
+                storage.removeItem(key);
+            }
+        },
+        getItem: key => {
+            const entry = entries.find(entry => entry.key === key);
+            if (entry === undefined) {
+                return null;
+            }
+            return entry.value;
+        },
+        setItem: (key, value) => {
+            if (isPersistenceEnabled) {
+                sessionStorage.setItem(`${SESSION_STORAGE_PREFIX}${key}`, value);
+            }
+
+            update: {
+                const entry = entries.find(entry => entry.key === key);
+
+                if (entry === undefined) {
+                    break update;
+                }
+
+                entry.value = value;
+
+                return;
+            }
+
+            entries.push({ key, value });
+        }
+    };
+
+    return storage;
+}

package/src/vite-plugin/manageOptimizedDeps.ts

@@ -55,6 +55,8 @@ export function manageOptimizedDeps(params: {
                     moduleNames_include.push("zod");
                 }
 
+                moduleNames_include.push("oidc-spa");
+
                 ((userConfig.optimizeDeps ??= {}).include ??= []).push(...moduleNames_include);
             }
             break;

package/tools/{EphemeralSessionStorage.d.ts → lazySessionStorage.d.ts}

@@ -1,4 +1,4 @@
-export type EphemeralSessionStorage = {
+export type LazySessionStorage = {
     readonly length: number;
     clear(): void;
     getItem(key: string): string | null;
@@ -7,6 +7,4 @@ export type EphemeralSessionStorage = {
     setItem(key: string, value: string): void;
     persistCurrentStateAndSubsequentChanges: () => void;
 };
-export declare function createEphemeralSessionStorage(params: {
-    sessionStorageTtlMs: number;
-}): EphemeralSessionStorage;
+export declare function createLazySessionStorage(): LazySessionStorage;