Class TokenManager

Caches TokenSets per key (typically a user session id) and keeps them fresh.

getAccessToken(key) always returns a token valid for at least refreshSkewSec, refreshing on demand.
With autoRefresh (default), a timer refreshes each token refreshSkewSec before it expires.
Concurrent refreshes for the same key are coalesced into one token-endpoint call; across tabs sharing a store, a refresh holds a Web Lock and reuses the tokens another tab has just obtained, so a rotating refresh token is never presented twice.
set(key, ts, { schedule: false }) / unschedule(key) keep a key's tokens without refreshing them.

Events: "refreshed" (key, tokenSet) — new tokens obtained via refresh_token "refresh_error" (key, error) — refresh failed (tokens are dropped if the grant is invalid) "expired" (key) — tokens for key could not be renewed and were removed "removed" (key) — tokens deleted via delete()

Hierarchy (View Summary)

Emitter
- TokenManager

Index

Constructors

constructor

Methods

close delete emit get getAccessToken getTokenSet off on once refresh schedule set unschedule

Constructors

constructor

new TokenManager(
    client: OIDCClient,
    opts?: {
        autoRefresh?: boolean;
        minRefreshDelayMs?: number;
        refreshSkewSec?: number;
        retryDelayMs?: number;
        store?: TokenStore;
    },
): TokenManager
Parameters
- client: OIDCClient
- Optionalopts: {
      autoRefresh?: boolean;
      minRefreshDelayMs?: number;
      refreshSkewSec?: number;
      retryDelayMs?: number;
      store?: TokenStore;
  } = {}
Returns TokenManager
Overrides Emitter.constructor
- Defined in packages/oidc-caep-client/src/token-manager.js:36

Methods

close

close(): void
Cancels all refresh timers (call on shutdown).

Returns void
- Defined in packages/oidc-caep-client/src/token-manager.js:189

delete

delete(key: string, opts?: { revoke?: boolean }): Promise<TokenSet | undefined>
Removes tokens for key, optionally revoking them at the OP (RFC 7009).
Parameters
- key: string
- Optionalopts: { revoke?: boolean } = {}
Returns Promise<TokenSet | undefined>
- Defined in packages/oidc-caep-client/src/token-manager.js:149

emit

emit(event: string, ...args: any[]): boolean
Parameters
- event: string
- ...args: any[]
Returns boolean
Inherited from Emitter.emit
- Defined in packages/oidc-caep-client/src/util.js:79

get

get(key: string): Promise<TokenSet | undefined>
Parameters
- key: string
Returns Promise<TokenSet | undefined>
Cached tokens (possibly expired) for key.
- Defined in packages/oidc-caep-client/src/token-manager.js:83

getAccessToken

getAccessToken(key: string, opts?: { forceRefresh?: boolean }): Promise<string>
Returns a usable access token for key, refreshing first if it is expired or about to expire.
Parameters
- key: string
- Optionalopts: { forceRefresh?: boolean }
Returns Promise<string>
- Defined in packages/oidc-caep-client/src/token-manager.js:94

getTokenSet

getTokenSet(key: string, opts?: { forceRefresh?: boolean }): Promise<TokenSet>
Returns the cached TokenSet for key, refreshing first if the access token is (nearly) expired. Use this rather than getAccessToken() when the token may be DPoP-bound: the caller needs its token_type to build the right Authorization header (OIDCClient.resourceHeaders()).
Parameters
- key: string
- Optionalopts: { forceRefresh?: boolean } = {}
Returns Promise<TokenSet>
- Defined in packages/oidc-caep-client/src/token-manager.js:174

off

off(event: string, fn: (...args: any[]) => void): TokenManager
Parameters
- event: string
- fn: (...args: any[]) => void
Returns TokenManager
Inherited from Emitter.off
- Defined in packages/oidc-caep-client/src/util.js:64

on

on(event: string, fn: (...args: any[]) => void): TokenManager
Parameters
- event: string
- fn: (...args: any[]) => void
Returns TokenManager
Inherited from Emitter.on
- Defined in packages/oidc-caep-client/src/util.js:57

once

once(event: string, fn: (...args: any[]) => void): TokenManager
Parameters
- event: string
- fn: (...args: any[]) => void
Returns TokenManager
Inherited from Emitter.once
- Defined in packages/oidc-caep-client/src/util.js:70

refresh

refresh(key: string): Promise<TokenSet>
Refreshes tokens for key now. Concurrent calls share a single request.
Parameters
- key: string
Returns Promise<TokenSet>
- Defined in packages/oidc-caep-client/src/token-manager.js:103

schedule

schedule(key: string): Promise<void>
Schedules the proactive refresh of the tokens already stored for key.
Parameters
- key: string
Returns Promise<void>
- Defined in packages/oidc-caep-client/src/token-manager.js:63

set

set(
    key: string,
    tokenSet: object | TokenSet,
    opts?: { schedule?: boolean },
): Promise<TokenSet>
Stores tokens for a key and (unless schedule: false) schedules their proactive refresh.
Parameters
- key: string
- tokenSet: object | TokenSet
- Optionalopts: { schedule?: boolean } = {}
Returns Promise<TokenSet>
- Defined in packages/oidc-caep-client/src/token-manager.js:49

unschedule

unschedule(key: string): void
Stops refreshing key's tokens in the background; they stay stored.
Parameters
- key: string
Returns void
- Defined in packages/oidc-caep-client/src/token-manager.js:73

Class TokenManager

Hierarchy (View Summary)

Index

Constructors

Methods

Constructors

constructor

Parameters

Returns TokenManager

Methods

close

Returns void

delete

Parameters

Returns Promise<TokenSet | undefined>

emit

Parameters

Returns boolean

get

Parameters

Returns Promise<TokenSet | undefined>

getAccessToken

Parameters

Returns Promise<string>

getTokenSet

Parameters

Returns Promise<TokenSet>

off

Parameters

Returns TokenManager

on

Parameters

Returns TokenManager

once

Parameters

Returns TokenManager

refresh

Parameters

Returns Promise<TokenSet>

schedule

Parameters

Returns Promise<void>

set

Parameters

Returns Promise<TokenSet>

unschedule

Parameters

Returns void

Settings

On This Page