fix(oidc-client): address PR feedback

Author: vatsalparikh

.changeset/brave-foxes-dance.md

@@ -3,4 +3,4 @@
 '@forgerock/oidc-client': minor
 ---
 
-Add `session.check()` method to oidc client for OIDC prompt=none session verification, with `response_type=none` and `response_type=id_token` support.
+Add `user.session()` method to oidc client for OIDC prompt=none session verification, with `response_type=none` and `response_type=id_token` support.

e2e/oidc-app/src/utils/oidc-app.ts

@@ -215,7 +215,7 @@ export async function oidcApp({
   });
 
   document.getElementById('session-check-btn')?.addEventListener('click', async () => {
-    const result = await oidcClient.session?.check();
+    const result = await oidcClient.user?.session();
     const appEl = document.getElementById('app');
     const el = document.createElement('div');
     el.innerHTML = `<p><strong>Session Check (none):</strong></p><pre id="session-check-result">${JSON.stringify(result, null, 2)}</pre>`;
@@ -224,7 +224,7 @@ export async function oidcApp({
 
   document.getElementById('session-check-id-token-btn')?.addEventListener('click', async () => {
     const options: SessionCheckOptions = { responseType: 'id_token' };
-    const result = await oidcClient.session?.check(options);
+    const result = await oidcClient.user?.session(options);
     const appEl = document.getElementById('app');
     const el = document.createElement('div');
     el.innerHTML = `<p><strong>Session Check (id_token):</strong></p><pre id="session-check-id-token-result">${JSON.stringify(result, null, 2)}</pre>`;

e2e/oidc-suites/src/session.spec.ts

@@ -29,7 +29,7 @@ function makeFakeJwt(payload: Record<string, unknown>): string {
   return `${header}.${body}.fakesignature`;
 }
 
-test.describe('session.check() tests', () => {
+test.describe('user.session() tests', () => {
   test('session check (none) succeeds after login', async ({ page }) => {
     const { navigate } = asyncEvents(page);
     await navigate('/ping-am/');
@@ -126,6 +126,7 @@ test.describe('session.check() tests', () => {
     await page.getByRole('button', { name: 'Session Check (id_token)' }).click();
     await expect(page.locator('#session-check-id-token-result')).not.toBeEmpty();
     const resultText = await page.locator('#session-check-id-token-result').textContent();
+    expect(resultText).toContain('"mode"');
     expect(resultText).toContain('"claims"');
     expect(resultText).not.toContain('"error"');
   });

packages/oidc-client/api-report/oidc-client.api.md

@@ -15,6 +15,7 @@ import type { FetchBaseQueryError } from '@reduxjs/toolkit/query';
 import { FetchBaseQueryMeta } from '@reduxjs/toolkit/query';
 import { GenericError } from '@forgerock/sdk-types';
 import { GetAuthorizationUrlOptions } from '@forgerock/sdk-types';
+import type { JWTPayload } from 'jose';
 import { logger } from '@forgerock/sdk-logger';
 import { LogLevel } from '@forgerock/sdk-logger';
 import { LogMessage } from '@forgerock/sdk-logger';
@@ -277,7 +278,6 @@ export function oidc<ActionType extends ActionTypes = ActionTypes>(input: {
     authorize?: undefined;
     token?: undefined;
     user?: undefined;
-    session?: undefined;
 } | {
     subscribe: (listener: () => void) => Unsubscribe;
     authorize: {
@@ -292,9 +292,7 @@ export function oidc<ActionType extends ActionTypes = ActionTypes>(input: {
     user: {
         info: () => Promise<GenericError | UserInfoResponse>;
         logout: () => Promise<GenericError | LogoutSuccessResult | LogoutErrorResult>;
-    };
-    session: {
-        check: (options?: SessionCheckOptions) => Promise<SessionCheckSuccess | GenericError>;
+        session: (options?: SessionCheckOptions) => Promise<SessionCheckSuccess | GenericError>;
     };
     error?: undefined;
     type?: undefined;
@@ -362,18 +360,15 @@ export interface SessionCheckOptions {
 }
 
 // @public (undocumented)
-export const SessionCheckResponseType: {
-    readonly IdToken: "id_token";
-    readonly None: "none";
-};
-
-// @public (undocumented)
-export type SessionCheckResponseType = (typeof SessionCheckResponseType)[keyof typeof SessionCheckResponseType];
+export type SessionCheckResponseType = 'id_token' | 'none';
 
 // @public (undocumented)
-export interface SessionCheckSuccess {
-    claims?: Record<string, unknown>;
-}
+export type SessionCheckSuccess = {
+    mode: 'none';
+} | {
+    mode: 'id_token';
+    claims: JWTPayload;
+};
 
 export { StorageConfig }
 

packages/oidc-client/api-report/oidc-client.types.api.md

@@ -15,6 +15,7 @@ import type { FetchBaseQueryError } from '@reduxjs/toolkit/query';
 import { FetchBaseQueryMeta } from '@reduxjs/toolkit/query';
 import { GenericError } from '@forgerock/sdk-types';
 import { GetAuthorizationUrlOptions } from '@forgerock/sdk-types';
+import type { JWTPayload } from 'jose';
 import { logger } from '@forgerock/sdk-logger';
 import { LogLevel } from '@forgerock/sdk-logger';
 import { LogMessage } from '@forgerock/sdk-logger';
@@ -277,7 +278,6 @@ export function oidc<ActionType extends ActionTypes = ActionTypes>(input: {
     authorize?: undefined;
     token?: undefined;
     user?: undefined;
-    session?: undefined;
 } | {
     subscribe: (listener: () => void) => Unsubscribe;
     authorize: {
@@ -292,9 +292,7 @@ export function oidc<ActionType extends ActionTypes = ActionTypes>(input: {
     user: {
         info: () => Promise<GenericError | UserInfoResponse>;
         logout: () => Promise<GenericError | LogoutSuccessResult | LogoutErrorResult>;
-    };
-    session: {
-        check: (options?: SessionCheckOptions) => Promise<SessionCheckSuccess | GenericError>;
+        session: (options?: SessionCheckOptions) => Promise<SessionCheckSuccess | GenericError>;
     };
     error?: undefined;
     type?: undefined;
@@ -362,18 +360,15 @@ export interface SessionCheckOptions {
 }
 
 // @public (undocumented)
-export const SessionCheckResponseType: {
-    readonly IdToken: "id_token";
-    readonly None: "none";
-};
-
-// @public (undocumented)
-export type SessionCheckResponseType = (typeof SessionCheckResponseType)[keyof typeof SessionCheckResponseType];
+export type SessionCheckResponseType = 'id_token' | 'none';
 
 // @public (undocumented)
-export interface SessionCheckSuccess {
-    claims?: Record<string, unknown>;
-}
+export type SessionCheckSuccess = {
+    mode: 'none';
+} | {
+    mode: 'id_token';
+    claims: JWTPayload;
+};
 
 export { StorageConfig }
 

packages/oidc-client/src/lib/client.store.test.ts

@@ -719,7 +719,7 @@ describe('authorize.url() with PAR enabled on non-pi.flow server', async () => {
   });
 });
 
-describe('session.check()', async () => {
+describe('user.session()', async () => {
   const config: OidcConfig = {
     clientId: '123456789',
     redirectUri: 'https://example.com/callback.html',
@@ -740,7 +740,7 @@ describe('session.check()', async () => {
     const oidcClient = await oidc({ config, storage: customStorageConfig });
     if ('error' in oidcClient) throw new Error('Error creating OIDC Client');
 
-    const result = await oidcClient.session.check();
+    const result = await oidcClient.user.session();
 
     if (!('error' in result)) {
       expect.fail('Expected SessionCheckError, got success');

packages/oidc-client/src/lib/client.store.ts

@@ -12,7 +12,7 @@ import { causeIsDie, exitIsFail, exitIsSuccess } from 'effect/Micro';
 
 import { authorizeµ, createParAuthorizeUrlµ } from './authorize.request.js';
 import { buildTokenExchangeµ } from './exchange.request.js';
-import { createClientStore, createTokenError } from './client.store.utils.js';
+import { createClientStore, createTokenError, runMicroExit } from './client.store.utils.js';
 import { isExpiryWithinThreshold } from './token.utils.js';
 import { logoutµ } from './logout.request.js';
 import { oidcApi } from './oidc.api.js';
@@ -35,7 +35,6 @@ import type {
 import type { OauthTokens, OidcConfig } from './config.types.js';
 import type { AuthorizationError, AuthorizationSuccess } from './authorize.request.types.js';
 import type { TokenExchangeErrorResponse } from './exchange.types.js';
-import { SessionCheckResponseType } from './session.types.js';
 import type { SessionCheckOptions, SessionCheckSuccess } from './session.types.js';
 
 /**
@@ -258,20 +257,7 @@ export async function oidc<ActionType extends ActionTypes = ActionTypes>({
           }),
         );
 
-        const result = await Micro.runPromiseExit(getTokensµ);
-
-        if (exitIsSuccess(result)) {
-          return result.value;
-        } else if (exitIsFail(result)) {
-          return result.cause.error;
-        } else {
-          const defect = causeIsDie(result.cause) ? result.cause.defect : undefined;
-          return {
-            error: 'Token Exchange failure',
-            message: defect instanceof Error ? defect.message : String(defect ?? 'Unknown defect'),
-            type: 'exchange_error',
-          };
-        }
+        return runMicroExit(getTokensµ, 'Token Exchange failure', 'exchange_error');
       },
 
       /**
@@ -457,20 +443,7 @@ export async function oidc<ActionType extends ActionTypes = ActionTypes>({
           ),
         );
 
-        const result = await Micro.runPromiseExit(revokeµ);
-
-        if (exitIsSuccess(result)) {
-          return result.value;
-        } else if (exitIsFail(result)) {
-          return result.cause.error;
-        } else {
-          const defect = causeIsDie(result.cause) ? result.cause.defect : undefined;
-          return {
-            error: 'Token revocation failure',
-            message: defect instanceof Error ? defect.message : String(defect ?? 'Unknown defect'),
-            type: 'auth_error',
-          };
-        }
+        return runMicroExit(revokeµ, 'Token revocation failure', 'auth_error');
       },
     },
 
@@ -533,20 +506,7 @@ export async function oidc<ActionType extends ActionTypes = ActionTypes>({
           }),
         );
 
-        const result = await Micro.runPromiseExit(info);
-
-        if (exitIsSuccess(result)) {
-          return result.value;
-        } else if (exitIsFail(result)) {
-          return result.cause.error;
-        } else {
-          const defect = causeIsDie(result.cause) ? result.cause.defect : undefined;
-          return {
-            error: 'User Info retrieval failure',
-            message: defect instanceof Error ? defect.message : String(defect ?? 'Unknown defect'),
-            type: 'auth_error',
-          };
-        }
+        return runMicroExit(info, 'User Info retrieval failure', 'auth_error');
       },
 
       /**
@@ -587,38 +547,24 @@ export async function oidc<ActionType extends ActionTypes = ActionTypes>({
           return createTokenError('no_id_token');
         }
 
-        const result = await Micro.runPromiseExit(
+        return runMicroExit(
           logoutµ({ tokens, config, wellknown, store, storageClient }),
+          'Logout_Failure',
+          'auth_error',
         );
-
-        if (exitIsSuccess(result)) {
-          return result.value;
-        } else if (exitIsFail(result)) {
-          return result.cause.error;
-        } else {
-          const defect = causeIsDie(result.cause) ? result.cause.defect : undefined;
-          return {
-            error: 'Logout_Failure',
-            message: defect instanceof Error ? defect.message : String(defect ?? 'Unknown defect'),
-            type: 'auth_error',
-          };
-        }
       },
-    },
 
-    /**
-     * An object containing methods for OIDC session management
-     */
-    session: {
       /**
-       * @method check
+       * @method session
        * @description Checks whether the user has an active session at the authorization server
        *              using a hidden iframe with prompt=none. Supports response_type=none (default)
        *              and response_type=id_token.
        * @param {SessionCheckOptions} options - Optional parameters for the session check.
        * @returns {Promise<SessionCheckSuccess | GenericError>} - Never throws; returns a typed result.
        */
-      check: async (options?: SessionCheckOptions): Promise<SessionCheckSuccess | GenericError> => {
+      session: async (
+        options?: SessionCheckOptions,
+      ): Promise<SessionCheckSuccess | GenericError> => {
         const state = store.getState();
         const wellknown = wellknownSelector(wellknownUrl, state);
 
@@ -631,24 +577,11 @@ export async function oidc<ActionType extends ActionTypes = ActionTypes>({
         }
 
         const micro =
-          options?.responseType === SessionCheckResponseType.IdToken
+          options?.responseType === 'id_token'
             ? sessionCheckIdTokenµ(wellknown, config, store, storageClient, log, options)
             : sessionCheckNoneµ(wellknown, config, store, storageClient, log, options);
 
-        const result = await Micro.runPromiseExit(micro);
-
-        if (exitIsSuccess(result)) {
-          return result.value;
-        } else if (exitIsFail(result)) {
-          return result.cause.error;
-        } else {
-          const defect = causeIsDie(result.cause) ? result.cause.defect : undefined;
-          return {
-            error: 'Session check failure',
-            message: defect instanceof Error ? defect.message : String(defect ?? 'Unknown defect'),
-            type: 'unknown_error',
-          };
-        }
+        return runMicroExit(micro, 'Session check failure', 'unknown_error');
       },
     },
   };

packages/oidc-client/src/lib/client.store.utils.ts

@@ -8,6 +8,8 @@ import type { ActionTypes, RequestMiddleware } from '@forgerock/sdk-request-midd
 import { logger as loggerFn } from '@forgerock/sdk-logger';
 
 import { configureStore, type SerializedError } from '@reduxjs/toolkit';
+import { Micro } from 'effect';
+import { causeIsDie, exitIsFail, exitIsSuccess } from 'effect/Micro';
 import { oidcApi } from './oidc.api.js';
 import { wellknownApi } from './wellknown.api.js';
 
@@ -82,6 +84,26 @@ export function createLogoutError(
   return null;
 }
 
+export async function runMicroExit<T, E>(
+  micro: Micro.Micro<T, E>,
+  defectError: string,
+  defectType: GenericError['type'],
+): Promise<T | E | GenericError> {
+  const result = await Micro.runPromiseExit(micro);
+  if (exitIsSuccess(result)) {
+    return result.value;
+  }
+  if (exitIsFail(result)) {
+    return result.cause.error;
+  }
+  const defect = causeIsDie(result.cause) ? result.cause.defect : undefined;
+  return {
+    error: defectError,
+    message: defect instanceof Error ? defect.message : String(defect ?? 'Unknown defect'),
+    type: defectType,
+  };
+}
+
 export function createTokenError(type: 'no_tokens' | 'no_access_token' | 'no_id_token') {
   let error: GenericError;