oidc-caep-client
    Preparing search index...

    Class AccountManager

    Every account signed in through one client in this browser, with ONE active account per tab — for an OP that keeps several signed-in accounts per browser (e.g. iya-sts authn.multipleAccounts).

    • One cache, shared by every tab. Each account's tokens are kept (IndexedDB by default) until it is signed out or its session ends, so any tab can make any signed-in account active with no trip to the OP.
    • One active account per tab. Only its tokens are reachable (getTokenSet()), and only its tokens are refreshed in the background. The others are dormant: stored, not used, not refreshed. activate(key) refreshes a dormant account's tokens if they are due and runs onActivate before it becomes active.
    • Refreshes hold a lock shared by the tabs (Web Locks), so two tabs never present one rotating refresh token twice; sign-outs and ended sessions are announced to the other tabs (BroadcastChannel).

    Signing in: signIn() lets the OP decide (its account picker when several are signed in there); chooseAccount() always shows the picker (prompt=select_account); addAccount() is a fresh sign-in (prompt=login). resume(key) and reauthenticate(key) name the account and refuse anybody else. signOut(key) revokes that account's tokens and names its ID token at logout, so the OP ends that account's session only.

    Events: "added" (account), "updated" (account), "activated" (account|undefined, previous|undefined), "refreshed" (account) for the active account, "signed-out" (account), "ended" (account, reason), "forgotten" (account), "activation_error" (account, error), and "change" after any of them, including changes made in another tab.

    Hierarchy (View Summary)

    Index
    constructor
    active activeKey
    accountsForSubject activate addAccount chooseAccount close emit end forget get getTokenSet handleCallback identity init list off on once reauthenticate refresh resume signIn signOut signOutAll

    • The accounts a security event's subject (sub_id) is about. A subject naming a session (an SSF complex subject with session) matches only the account signed in with that session.

      Parameters

      • subId: object

      Returns Account[]

    • Makes a listed account this tab's active account; the previous one becomes dormant. Nothing is sent to the OP unless the account's tokens are due for a refresh. An account that is not signed-in becomes active too, with no tokens; resume() or reauthenticate() it.

      When the refresh or onActivate fails, the previously active account is reactivated and the error thrown.

      Parameters

      • key: string

      Returns Promise<Account | undefined>

    • A fresh sign-in (prompt=login), never the OP's picker: whoever signs in is added as an account.

      Parameters

      • Optionalopts: {
            acrValues?: string;
            context?: any;
            expectedSub?: string;
            extraParams?: Record<string, string>;
            idTokenHint?: string;
            loginHint?: string;
            maxAge?: number;
            prompt?: string;
            redirectUri?: string;
            scope?: string;
        } = {}

      Returns Promise<{ state: string; url: string }>

    • A sign-in that always shows the OP's account picker (prompt=select_account).

      Parameters

      • Optionalopts: {
            acrValues?: string;
            context?: any;
            expectedSub?: string;
            extraParams?: Record<string, string>;
            idTokenHint?: string;
            loginHint?: string;
            maxAge?: number;
            prompt?: string;
            redirectUri?: string;
            scope?: string;
        } = {}

      Returns Promise<{ state: string; url: string }>

    • Ends an account's session in this browser because the OP or a security event says it has ended: onLeave runs, its tokens are removed from the cache (not revoked: the OP already knows), and it stays listed as ended with the reason. When it was this tab's active account, the most recently added signed-in account becomes active. Does nothing for an account that is not signed in.

      Parameters

      • key: string
      • Optionalreason: string

      Returns Promise<Account | undefined>

    • Removes an account that is not signed in from the list. A signed-in account must be signed out first.

      Parameters

      • key: string

      Returns Promise<void>

    • The active account's tokens, refreshed first when (nearly) expired. A dormant account's tokens cannot be reached: activate the account first.

      Parameters

      • Optionalopts: { forceRefresh?: boolean }

      Returns Promise<TokenSet>

    • Completes any of the requests above from the redirect. The account signed in is added to the cache (or, when it is already listed, signed in again) and becomes this tab's active account.

      An error the OP returned is thrown as an OAuthError with err.context ({ intent, key? }) and, for resume/reauth, err.account.

      Parameters

      • response: string | Record<string, string> | URLSearchParams

      Returns Promise<
          { account: Account; added: boolean; intent: string; tokenSet: TokenSet },
      >

    • Parameters

      • key: string

      Returns
          | {
              email?: string;
              email_verified?: boolean;
              iss: string;
              phone_number?: string;
              phone_number_verified?: boolean;
              sid?: string;
              sub: string;
          }
          | undefined

    • Signs this account's person in again at the OP (prompt=login by default), e.g. for step-up with acrValues/maxAge. A sign-in as anybody else is refused at the callback (account_mismatch).

      Parameters

      • key: string
      • Optionalopts: {
            acrValues?: string;
            context?: any;
            expectedSub?: string;
            extraParams?: Record<string, string>;
            idTokenHint?: string;
            loginHint?: string;
            maxAge?: number;
            prompt?: string;
            redirectUri?: string;
            scope?: string;
        } = {}

      Returns Promise<{ state: string; url: string }>

    • Asks the OP for this account's tokens again without showing a screen (prompt=none, naming the account with login_hint and, where cached, id_token_hint). Answers with an OAuthError for which needsInteraction() is true when the account's session at the OP has ended; reauthenticate() then.

      Parameters

      • key: string
      • Optionalopts: {
            acrValues?: string;
            context?: any;
            expectedSub?: string;
            extraParams?: Record<string, string>;
            idTokenHint?: string;
            loginHint?: string;
            maxAge?: number;
            prompt?: string;
            redirectUri?: string;
            scope?: string;
        } = {}

      Returns Promise<{ state: string; url: string }>

    • A sign-in that leaves the choice to the OP: with several accounts signed in there, it shows its account picker; with one, it answers as that account.

      Parameters

      • Optionalopts: {
            acrValues?: string;
            context?: any;
            expectedSub?: string;
            extraParams?: Record<string, string>;
            idTokenHint?: string;
            loginHint?: string;
            maxAge?: number;
            prompt?: string;
            redirectUri?: string;
            scope?: string;
        } = {}

      Returns Promise<{ state: string; url: string }>

    • Signs one account out of this browser: onLeave runs, its tokens are revoked (with revoke) and removed from the cache, and it stays listed as signed-out. When it was this tab's active account, the most recently added signed-in account becomes active. Answers an RP-Initiated Logout request naming that account's ID token, so the OP ends that account's session only (or undefined: no end_session_endpoint, or endSession: false).

      Parameters

      • Optionalkey: string = ...

        Default: the active account.

      • Optionalopts: { endSession?: boolean; postLogoutRedirectUri?: string; revoke?: boolean } = {}

      Returns Promise<{ state: string; url: string } | undefined>

    • Signs every account out of this browser. Answers one logout request that names nobody, so an OP holding several accounts asks the person which to end (or all of them).

      Parameters

      • Optionalopts: { endSession?: boolean; postLogoutRedirectUri?: string; revoke?: boolean } = {}

      Returns Promise<{ state: string; url: string } | undefined>

    Settings
    Member Visibility

    On This Page
    Constructors
    Accessors
    Methods