update token expiry check with 30 sec leeway

Author: CodeSchwert

packages/passport/sdk/src/authManager.ts

@@ -13,7 +13,7 @@ import { getDetail, Detail } from '@imtbl/metrics';
 import localForage from 'localforage';
 import DeviceCredentialsManager from './storage/device_credentials_manager';
 import logger from './utils/logger';
-import { isTokenExpired } from './utils/token';
+import { isAccessTokenExpiredOrExpiring } from './utils/token';
 import { PassportError, PassportErrorType, withPassportError } from './errors/passportError';
 import {
   PassportMetadata,
@@ -70,7 +70,7 @@ const getAuthConfiguration = (config: PassportConfiguration): UserManagerSetting
       end_session_endpoint: endSessionEndpoint.toString(),
       revocation_endpoint: `${authenticationDomain}/oauth/revoke`,
     },
-    mergeClaimsStrategy: { array: 'merge' },
+    // mergeClaimsStrategy: { array: 'merge' },
     automaticSilentRenew: false, // Disabled until https://github.com/authts/oidc-client-ts/issues/430 has been resolved
     scope: oidcConfiguration.scope,
     userStore,
@@ -458,13 +458,15 @@ export default class AuthManager {
     const oidcUser = await this.userManager.getUser();
     if (!oidcUser) return null;
 
-    if (!isTokenExpired(oidcUser)) {
+    // if the token is not expired or expiring in 30 seconds or less, return the user
+    if (!isAccessTokenExpiredOrExpiring(oidcUser)) {
       const user = AuthManager.mapOidcUserToDomainModel(oidcUser);
       if (user && typeAssertion(user)) {
         return user;
       }
     }
 
+    // if the token is expired or expiring in 30 seconds or less, refresh the token
     if (oidcUser.refresh_token) {
       const user = await this.refreshTokenAndUpdatePromise();
       if (user && typeAssertion(user)) {

packages/passport/sdk/src/utils/token.ts

@@ -14,10 +14,21 @@ export function isIdTokenExpired(idToken: string | undefined): boolean {
   return decodedToken.exp < now;
 }
 
-export function isTokenExpired(oidcUser: OidcUser): boolean {
-  const { id_token: idToken, expired } = oidcUser;
+export function isAccessTokenExpiredOrExpiring(oidcUser: OidcUser): boolean {
+  const { id_token: idToken, expired, expires_in } = oidcUser;
   if (expired) {
     return true;
   }
+
+  // if token will expire in 30 seconds or less, return true
+  if (expires_in && expires_in <= 30) {
+    return true;
+  }
+
+  // Handle missing idToken - assume they need to login again
+  if (!idToken) {
+    return true;
+  }
+
   return isIdTokenExpired(idToken);
 }