feat(extraTokenProperties): Add extra token properties

Author: benMain

docs/oidc-client-ts.api.md

@@ -969,12 +969,13 @@ export class User {
         expires_at?: number;
         userState?: unknown;
         url_state?: string;
-    });
+    }, extraTokenResponseKeys?: string[]);
     access_token: string;
     get expired(): boolean | undefined;
     expires_at?: number;
     get expires_in(): number | undefined;
     set expires_in(value: number | undefined);
+    extraTokenResponseProperties?: Record<string, unknown>;
     // (undocumented)
     static fromStorageString(storageString: string): User;
     id_token?: string;
@@ -1122,6 +1123,7 @@ export interface UserManagerSettings extends OidcClientSettings {
     accessTokenExpiringNotificationTimeInSeconds?: number;
     automaticSilentRenew?: boolean;
     checkSessionIntervalInSeconds?: number;
+    extraTokenResponseKeys?: string[];
     iframeAttributes?: Record<string, string> | undefined;
     iframeNotifyParentOrigin?: string;
     iframeScriptOrigin?: string;
@@ -1160,6 +1162,8 @@ export class UserManagerSettingsStore extends OidcClientSettingsStore {
     // (undocumented)
     readonly checkSessionIntervalInSeconds: number;
     // (undocumented)
+    readonly extraTokenResponseKeys: string[];
+    // (undocumented)
     readonly iframeAttributes?: Record<string, string>;
     // (undocumented)
     readonly iframeNotifyParentOrigin: string | undefined;

src/User.test.ts

@@ -46,4 +46,21 @@ describe("User", () => {
             expect(subject.scopes).toEqual(["foo", "bar", "baz"]);
         });
     });
+
+    describe("extraTokenResponseProperties", () => {
+        it("should not provide extraTokenResponseProperties if extraTokenResponseKeys is not provided", () => {
+            const subject = new User({} as never);
+            expect(subject.extraTokenResponseProperties).not.toBeDefined();
+        });
+        it("should provide extraTokenResponseProperties if extraTokenResponseKeys is provided", () => {
+            const patient = "12345";
+            const subject = new User({ access_token: "notAToken", id_token: "not", patient, token_type: "Bearer" } as never, ["patient"]);
+            const actualTokenProps = subject.extraTokenResponseProperties ?? {};
+            const keys = Object.keys(actualTokenProps);
+            const values = Object.values(actualTokenProps);
+            expect(subject.extraTokenResponseProperties).toBeDefined();
+            expect(keys).toContain("patient");
+            expect(values).toContain(patient);
+        });
+    });
 });

src/User.ts

@@ -49,6 +49,12 @@ export class User {
     /** The expires at returned from the OIDC provider. */
     public expires_at?: number;
 
+    /**
+     * The additional token response properties the user has requested to keep via settings.
+     * @see {@link UserManagerSettings.extraTokenResponseKeys}
+     */
+    public extraTokenResponseProperties?: Record<string, unknown>;
+
     /** custom state data set during the initial signin request */
     public readonly state: unknown;
     public readonly url_state?: string;
@@ -64,7 +70,7 @@ export class User {
         expires_at?: number;
         userState?: unknown;
         url_state?: string;
-    }) {
+    }, extraTokenResponseKeys?: string[]) {
         this.id_token = args.id_token;
         this.session_state = args.session_state ?? null;
         this.access_token = args.access_token;
@@ -76,6 +82,16 @@ export class User {
         this.expires_at = args.expires_at;
         this.state = args.userState;
         this.url_state = args.url_state;
+
+        if (extraTokenResponseKeys?.length) {
+            this.extraTokenResponseProperties = {};
+            for (const key of extraTokenResponseKeys) {
+                const extraToken = (args as Record<string, unknown>)[key];
+                if (extraToken) {
+                    this.extraTokenResponseProperties[key] = extraToken;
+                }
+            }
+        }
     }
 
     /** Computed number of seconds the access token has remaining. */

src/UserManager.ts

@@ -548,7 +548,7 @@ export class UserManager {
 
     protected async _buildUser(signinResponse: SigninResponse, verifySub?: string) {
         const logger = this._logger.create("_buildUser");
-        const user = new User(signinResponse);
+        const user = new User(signinResponse, this.settings.extraTokenResponseKeys);
         if (verifySub) {
             if (verifySub !== user.profile.sub) {
                 logger.debug("current user does not match user returned from signin. sub from signin:", user.profile.sub);

src/UserManagerSettings.test.ts

@@ -421,4 +421,24 @@ describe("UserManagerSettings", () => {
             expect(subject.silentRequestTimeoutInSeconds).toEqual(10);
         });
     });
+
+    describe("extraTokenResponseKeys", () => {
+        it("should return value from the initial settings", () => {
+            const subject = new UserManagerSettingsStore({
+                authority: "authority",
+                client_id: "client",
+                redirect_uri: "redirect",
+                extraTokenResponseKeys: ["testProp"],
+            });
+            expect(subject.extraTokenResponseKeys).toEqual(["testProp"]);
+        });
+        it("should return the default value", () => {
+            const subject = new UserManagerSettingsStore({
+                authority: "authority",
+                client_id: "client",
+                redirect_uri: "redirect",
+            });
+            expect(subject.extraTokenResponseKeys).toEqual([]);
+        });
+    });
 });

src/UserManagerSettings.ts

@@ -92,6 +92,13 @@ export interface UserManagerSettings extends OidcClientSettings {
      */
     maxSilentRenewTimeoutRetries?: number;
 
+    /**
+     * By default the user object only preserves the standard properties
+     * (access_token, session_state, id_token, refresh_token, token_type, scope, profile, and expiration).
+     * Any additional properties returned by the OIDC/OAuth2 token response will be ignored unless explicitly listed here. (default: [])
+     */
+    extraTokenResponseKeys?: string[];
+
     /**
      * Storage object used to persist User for currently authenticated user (default: window.sessionStorage, InMemoryWebStorage iff no window).
      *  E.g. `userStore: new WebStorageStateStore({ store: window.localStorage })`
@@ -136,6 +143,8 @@ export class UserManagerSettingsStore extends OidcClientSettingsStore {
     public readonly accessTokenExpiringNotificationTimeInSeconds: number;
     public readonly maxSilentRenewTimeoutRetries?: number;
 
+    public readonly extraTokenResponseKeys: string[];
+
     public readonly userStore: StateStore;
 
     public constructor(args: UserManagerSettings) {
@@ -169,9 +178,10 @@ export class UserManagerSettingsStore extends OidcClientSettingsStore {
             includeIdTokenInSilentSignout = false,
 
             accessTokenExpiringNotificationTimeInSeconds = DefaultAccessTokenExpiringNotificationTimeInSeconds,
-
             maxSilentRenewTimeoutRetries,
 
+            extraTokenResponseKeys = [],
+
             userStore,
         } = args;
 
@@ -206,6 +216,7 @@ export class UserManagerSettingsStore extends OidcClientSettingsStore {
 
         this.accessTokenExpiringNotificationTimeInSeconds = accessTokenExpiringNotificationTimeInSeconds;
         this.maxSilentRenewTimeoutRetries = maxSilentRenewTimeoutRetries;
+        this.extraTokenResponseKeys = extraTokenResponseKeys;
 
         if (userStore) {
             this.userStore = userStore;