11import GoTrueAdminApi from './GoTrueAdminApi'
2- import { DEFAULT_HEADERS , EXPIRY_MARGIN , GOTRUE_URL , STORAGE_KEY } from './lib/constants'
2+ import {
3+ DEFAULT_HEADERS ,
4+ EXPIRY_MARGIN_MS ,
5+ AUTO_REFRESH_TICK_DURATION_MS ,
6+ AUTO_REFRESH_TICK_THRESHOLD ,
7+ GOTRUE_URL ,
8+ STORAGE_KEY ,
9+ } from './lib/constants'
310import {
411 AuthError ,
512 AuthImplicitGrantRedirectError ,
@@ -89,13 +96,11 @@ import type {
8996 LockFunc ,
9097 UserIdentity ,
9198 SignInAnonymouslyCredentials ,
92- } from './lib/types'
93- import {
9499 MFAEnrollTOTPParams ,
95100 MFAEnrollPhoneParams ,
96101 AuthMFAEnrollTOTPResponse ,
97102 AuthMFAEnrollPhoneResponse ,
98- } from './lib/internal- types'
103+ } from './lib/types'
99104
100105polyfillGlobalThis ( ) // Make "globalThis" available
101106
@@ -111,13 +116,6 @@ const DEFAULT_OPTIONS: Omit<Required<GoTrueClientOptions>, 'fetch' | 'storage' |
111116 hasCustomAuthorizationHeader : false ,
112117}
113118
114- /** Current session will be checked for refresh at this interval. */
115- const AUTO_REFRESH_TICK_DURATION = 30 * 1000
116-
117- /**
118- * A token refresh will be attempted this many ticks before the current session expires. */
119- const AUTO_REFRESH_TICK_THRESHOLD = 3
120-
121119async function lockNoOp < R > ( name : string , acquireTimeout : number , fn : ( ) => Promise < R > ) : Promise < R > {
122120 return await fn ( )
123121}
@@ -307,8 +305,22 @@ export default class GoTrueClient {
307305 */
308306 private async _initialize ( ) : Promise < InitializeResult > {
309307 try {
310- if ( isBrowser ( ) && this . detectSessionInUrl ) {
311- const { data, error } = await this . _getSessionFromURL ( )
308+ const params = parseParametersFromURL ( window . location . href )
309+ let callbackUrlType = 'none'
310+ if ( this . _isImplicitGrantCallback ( params ) ) {
311+ callbackUrlType = 'implicit'
312+ } else if ( await this . _isPKCECallback ( params ) ) {
313+ callbackUrlType = 'pkce'
314+ }
315+
316+ /**
317+ * Attempt to get the session from the URL only if these conditions are fulfilled
318+ *
319+ * Note: If the URL isn't one of the callback url types (implicit or pkce),
320+ * then there could be an existing session so we don't want to prematurely remove it
321+ */
322+ if ( isBrowser ( ) && this . detectSessionInUrl && callbackUrlType !== 'none' ) {
323+ const { data, error } = await this . _getSessionFromURL ( params , callbackUrlType )
312324 if ( error ) {
313325 this . _debug ( '#_initialize()' , 'error detecting session from URL' , error )
314326
@@ -1095,8 +1107,13 @@ export default class GoTrueClient {
10951107 return { data : { session : null } , error : null }
10961108 }
10971109
1110+ // A session is considered expired before the access token _actually_
1111+ // expires. When the autoRefreshToken option is off (or when the tab is
1112+ // in the background), very eager users of getSession() -- like
1113+ // realtime-js -- might send a valid JWT which will expire by the time it
1114+ // reaches the server.
10981115 const hasExpired = currentSession . expires_at
1099- ? currentSession . expires_at <= Date . now ( ) / 1000
1116+ ? currentSession . expires_at * 1000 - Date . now ( ) < EXPIRY_MARGIN_MS
11001117 : false
11011118
11021119 this . _debug (
@@ -1411,7 +1428,10 @@ export default class GoTrueClient {
14111428 /**
14121429 * Gets the session data from a URL string
14131430 */
1414- private async _getSessionFromURL ( ) : Promise <
1431+ private async _getSessionFromURL (
1432+ params : { [ parameter : string ] : string } ,
1433+ callbackUrlType : string
1434+ ) : Promise <
14151435 | {
14161436 data : { session : Session ; redirectType : string | null }
14171437 error : null
@@ -1421,8 +1441,6 @@ export default class GoTrueClient {
14211441 try {
14221442 if ( ! isBrowser ( ) ) throw new AuthImplicitGrantRedirectError ( 'No browser detected.' )
14231443
1424- const params = parseParametersFromURL ( window . location . href )
1425-
14261444 // If there's an error in the URL, it doesn't matter what flow it is, we just return the error.
14271445 if ( params . error || params . error_description || params . error_code ) {
14281446 // The error class returned implies that the redirect is from an implicit grant flow
@@ -1436,23 +1454,25 @@ export default class GoTrueClient {
14361454 )
14371455 }
14381456
1439- const isRedirectFromImplicitGrantFlow = this . _isImplicitGrantFlow ( params )
1440- const isRedirectFromPKCEFlow = await this . _isPKCEFlow ( params )
1441-
14421457 // Checks for mismatches between the flowType initialised in the client and the URL parameters
1443- if ( ! isRedirectFromImplicitGrantFlow && ! isRedirectFromPKCEFlow ) {
1444- if ( this . flowType === 'implicit' ) {
1445- throw new AuthImplicitGrantRedirectError ( 'Not a valid implicit grant flow url.' )
1446- } else if ( this . flowType === 'pkce' ) {
1447- throw new AuthPKCEGrantCodeExchangeError ( 'Not a valid PKCE flow url.' )
1448- } else {
1449- throw new AuthError ( 'Invalid flow type.' )
1450- }
1458+ switch ( callbackUrlType ) {
1459+ case 'implicit' :
1460+ if ( this . flowType === 'pkce' ) {
1461+ throw new AuthPKCEGrantCodeExchangeError ( 'Not a valid PKCE flow url.' )
1462+ }
1463+ break
1464+ case 'pkce' :
1465+ if ( this . flowType === 'implicit' ) {
1466+ throw new AuthImplicitGrantRedirectError ( 'Not a valid implicit grant flow url.' )
1467+ }
1468+ break
1469+ default :
1470+ // there's no mismatch so we continue
14511471 }
14521472
14531473 // Since this is a redirect for PKCE, we attempt to retrieve the code from the URL for the code exchange
1454- if ( isRedirectFromPKCEFlow ) {
1455- this . _debug ( '#_initialize()' , 'begin' , 'is PKCE flow' , isRedirectFromPKCEFlow )
1474+ if ( callbackUrlType === 'pkce' ) {
1475+ this . _debug ( '#_initialize()' , 'begin' , 'is PKCE flow' , true )
14561476 if ( ! params . code ) throw new AuthPKCEGrantCodeExchangeError ( 'No code detected.' )
14571477 const { data, error } = await this . _exchangeCodeForSession ( params . code )
14581478 if ( error ) throw error
@@ -1488,7 +1508,7 @@ export default class GoTrueClient {
14881508 }
14891509
14901510 const actuallyExpiresIn = expiresAt - timeNow
1491- if ( actuallyExpiresIn * 1000 <= AUTO_REFRESH_TICK_DURATION ) {
1511+ if ( actuallyExpiresIn * 1000 <= AUTO_REFRESH_TICK_DURATION_MS ) {
14921512 console . warn (
14931513 `@supabase/gotrue-js: Session as retrieved from URL expires in ${ actuallyExpiresIn } ${ expiresIn }
14941514 )
@@ -1542,20 +1562,20 @@ export default class GoTrueClient {
15421562 /**
15431563 * Checks if the current URL contains parameters given by an implicit oauth grant flow (https://www.rfc-editor.org/rfc/rfc6749.html#section-4.2)
15441564 */
1545- private _isImplicitGrantFlow ( params : { [ parameter : string ] : string } ) : boolean {
1546- return ! ! ( ( params . access_token || params . error_description ) && this . flowType === 'implicit' )
1565+ private _isImplicitGrantCallback ( params : { [ parameter : string ] : string } ) : boolean {
1566+ return Boolean ( params . access_token || params . error_description )
15471567 }
15481568
15491569 /**
15501570 * Checks if the current URL and backing storage contain parameters given by a PKCE flow
15511571 */
1552- private async _isPKCEFlow ( params : { [ parameter : string ] : string } ) : Promise < boolean > {
1572+ private async _isPKCECallback ( params : { [ parameter : string ] : string } ) : Promise < boolean > {
15531573 const currentStorageContent = await getItemAsync (
15541574 this . storage ,
15551575 `${ this . storageKey }
15561576 )
15571577
1558- return ! ! ( params . code && currentStorageContent && this . flowType === 'pkce' )
1578+ return ! ! ( params . code && currentStorageContent )
15591579 }
15601580
15611581 /**
@@ -1835,7 +1855,7 @@ export default class GoTrueClient {
18351855 error &&
18361856 isAuthRetryableFetchError ( error ) &&
18371857 // retryable only if the request can be sent before the backoff overflows the tick duration
1838- Date . now ( ) + nextBackOffInterval - startedAt < AUTO_REFRESH_TICK_DURATION
1858+ Date . now ( ) + nextBackOffInterval - startedAt < AUTO_REFRESH_TICK_DURATION_MS
18391859 )
18401860 }
18411861 )
@@ -1908,12 +1928,12 @@ export default class GoTrueClient {
19081928 return
19091929 }
19101930
1911- const timeNow = Math . round ( Date . now ( ) / 1000 )
1912- const expiresWithMargin = ( currentSession . expires_at ?? Infinity ) < timeNow + EXPIRY_MARGIN
1931+ const expiresWithMargin =
1932+ ( currentSession . expires_at ?? Infinity ) * 1000 - Date . now ( ) < EXPIRY_MARGIN_MS
19131933
19141934 this . _debug (
19151935 debugName ,
1916- `session has${ expiresWithMargin ? '' : ' not' } ${ EXPIRY_MARGIN }
1936+ `session has${ expiresWithMargin ? '' : ' not' } ${ EXPIRY_MARGIN_MS }
19171937 )
19181938
19191939 if ( expiresWithMargin ) {
@@ -2086,7 +2106,7 @@ export default class GoTrueClient {
20862106
20872107 this . _debug ( '#_startAutoRefresh()' )
20882108
2089- const ticker = setInterval ( ( ) => this . _autoRefreshTokenTick ( ) , AUTO_REFRESH_TICK_DURATION )
2109+ const ticker = setInterval ( ( ) => this . _autoRefreshTokenTick ( ) , AUTO_REFRESH_TICK_DURATION_MS )
20902110 this . autoRefreshTicker = ticker
20912111
20922112 if ( ticker && typeof ticker === 'object' && typeof ticker . unref === 'function' ) {
@@ -2193,12 +2213,12 @@ export default class GoTrueClient {
21932213
21942214 // session will expire in this many ticks (or has already expired if <= 0)
21952215 const expiresInTicks = Math . floor (
2196- ( session . expires_at * 1000 - now ) / AUTO_REFRESH_TICK_DURATION
2216+ ( session . expires_at * 1000 - now ) / AUTO_REFRESH_TICK_DURATION_MS
21972217 )
21982218
21992219 this . _debug (
22002220 '#_autoRefreshTokenTick()' ,
2201- `access token expires in ${ expiresInTicks } ${ AUTO_REFRESH_TICK_DURATION } ${ AUTO_REFRESH_TICK_THRESHOLD }
2221+ `access token expires in ${ expiresInTicks } ${ AUTO_REFRESH_TICK_DURATION_MS } ${ AUTO_REFRESH_TICK_THRESHOLD }
22022222 )
22032223
22042224 if ( expiresInTicks <= AUTO_REFRESH_TICK_THRESHOLD ) {
0 commit comments