Class: AccountManager

AccountManager(client, optsopt)

Every account signed in through one client in this browser, with ONE active account per tab — for an OP that keeps several signed-in accounts per browser (e.g. iya-sts authn.multipleAccounts).

  • One cache, shared by every tab. Each account's tokens are kept (IndexedDB by default) until it is signed out or its session ends, so any tab can make any signed-in account active with no trip to the OP.
  • One active account per tab. Only its tokens are reachable (getTokenSet()), and only its tokens are refreshed in the background. The others are dormant: stored, not used, not refreshed. activate(key) refreshes a dormant account's tokens if they are due and runs onActivate before it becomes active.
  • Refreshes hold a lock shared by the tabs (Web Locks), so two tabs never present one rotating refresh token twice; sign-outs and ended sessions are announced to the other tabs (BroadcastChannel).

Signing in: signIn() lets the OP decide (its account picker when several are signed in there); chooseAccount() always shows the picker (prompt=select_account); addAccount() is a fresh sign-in (prompt=login). resume(key) and reauthenticate(key) name the account and refuse anybody else. signOut(key) revokes that account's tokens and names its ID token at logout, so the OP ends that account's session only.

Events: "added" (account), "updated" (account), "activated" (account|undefined, previous|undefined), "refreshed" (account) for the active account, "signed-out" (account), "ended" (account, reason), "forgotten" (account), "activation_error" (account, error), and "change" after any of them, including changes made in another tab.

Constructor

new AccountManager(client, optsopt)

Parameters:
Name Type Attributes Description
client *

(TypeScript: import('./oidc-client.js').OIDCClient)
opts AccountManagerOptions <optional>
Source:

Classes

AccountManager

Members

active

Source:

Methods

accountsForSubject(subId) → {Array.<Account>}

The accounts a security event's subject (sub_id) is about. A subject naming a session (an SSF complex subject with session) matches only the account signed in with that session.

Parameters:
Name Type Description
subId object
Source:
Returns:
Type
Array.<Account>

(async) activate(key) → {Promise.<(Account|undefined)>}

Makes a listed account this tab's active account; the previous one becomes dormant. Nothing is sent to the OP unless the account's tokens are due for a refresh. An account that is not signed-in becomes active too, with no tokens; resume() or reauthenticate() it.

When the refresh or onActivate fails, the previously active account is reactivated and the error thrown.

Parameters:
Name Type Description
key string
Source:
Returns:
Type
Promise.<(Account|undefined)>

addAccount(optsopt) → {Promise.<{url: string, state: string}>}

A fresh sign-in (prompt=login), never the OP's picker: whoever signs in is added as an account.

Parameters:
Name Type Attributes Description
opts * <optional>

(TypeScript: Parameters<import('./oidc-client.js').OIDCClient['createAuthorizationRequest']>[0])
Source:
Returns:
Type
Promise.<{url: string, state: string}>

chooseAccount(optsopt) → {Promise.<{url: string, state: string}>}

A sign-in that always shows the OP's account picker (prompt=select_account).

Parameters:
Name Type Attributes Description
opts * <optional>

(TypeScript: Parameters<import('./oidc-client.js').OIDCClient['createAuthorizationRequest']>[0])
Source:
Returns:
Type
Promise.<{url: string, state: string}>

close()

Cancels refresh timers and stops listening to other tabs (call on shutdown).

Source:

(async) end(key, reasonopt) → {Promise.<(Account|undefined)>}

Ends an account's session in this browser because the OP or a security event says it has ended: onLeave runs, its tokens are removed from the cache (not revoked: the OP already knows), and it stays listed as ended with the reason. When it was this tab's active account, the most recently added signed-in account becomes active. Does nothing for an account that is not signed in.

Parameters:
Name Type Attributes Description
key string
reason string <optional>
Source:
Returns:
Type
Promise.<(Account|undefined)>

(async) forget(key) → {Promise.<void>}

Removes an account that is not signed in from the list. A signed-in account must be signed out first.

Parameters:
Name Type Description
key string
Source:
Returns:
Type
Promise.<void>

get(key)

Parameters:
Name Type Description
key string

@returns {Account|undefined}
Source:

getTokenSet(optsopt) → {Promise}

The active account's tokens, refreshed first when (nearly) expired. A dormant account's tokens cannot be reached: activate the account first.

Parameters:
Name Type Attributes Description
opts Object <optional>

(TypeScript: { forceRefresh?: boolean })
Source:
Returns:

(TypeScript: Promise<import('./token-set.js').TokenSet>)

Type
Promise

(async) handleCallback(response) → {Promise}

Completes any of the requests above from the redirect. The account signed in is added to the cache (or, when it is already listed, signed in again) and becomes this tab's active account.

An error the OP returned is thrown as an OAuthError with err.context ({ intent, key? }) and, for resume/reauth, err.account.

Parameters:
Name Type Description
response URLSearchParams | Record.<string, string> | string
Source:
Returns:

(TypeScript: Promise<{ account: Account, tokenSet: import('./token-set.js').TokenSet, intent: string, added: boolean }>)

Type
Promise

identity(key) → {Object}

Parameters:
Name Type Description
key string
Source:
Returns:

(TypeScript: { iss: string, sub: string, sid?: string, email?: string, email_verified?: boolean, phone_number?: string, phone_number_verified?: boolean }|undefined)

Type
Object

(async) init()

Loads the shared account list and reactivates the account this tab had active (refreshing its tokens if due and running onActivate). A failed reactivation leaves the tab with no active account and is emitted as "activation_error".

Source:

list() → {Array.<Account>}

Source:
Returns:

Every account in this browser, in the order added.

Type
Array.<Account>

reauthenticate(key, optsopt) → {Promise.<{url: string, state: string}>}

Signs this account's person in again at the OP (prompt=login by default), e.g. for step-up with acrValues/maxAge. A sign-in as anybody else is refused at the callback (account_mismatch).

Parameters:
Name Type Attributes Description
key string
opts * <optional>

(TypeScript: Parameters<import('./oidc-client.js').OIDCClient['createAuthorizationRequest']>[0])
Source:
Returns:
Type
Promise.<{url: string, state: string}>

refresh() → {Promise}

Refreshes the active account's tokens now.

Source:
Returns:

(TypeScript: Promise<import('./token-set.js').TokenSet>)

Type
Promise

resume(key, optsopt) → {Promise.<{url: string, state: string}>}

Asks the OP for this account's tokens again without showing a screen (prompt=none, naming the account with login_hint and, where cached, id_token_hint). Answers with an OAuthError for which needsInteraction() is true when the account's session at the OP has ended; reauthenticate() then.

Parameters:
Name Type Attributes Description
key string
opts * <optional>

(TypeScript: Parameters<import('./oidc-client.js').OIDCClient['createAuthorizationRequest']>[0])
Source:
Returns:
Type
Promise.<{url: string, state: string}>

signIn(optsopt) → {Promise.<{url: string, state: string}>}

A sign-in that leaves the choice to the OP: with several accounts signed in there, it shows its account picker; with one, it answers as that account.

Parameters:
Name Type Attributes Description
opts * <optional>

(TypeScript: Parameters<import('./oidc-client.js').OIDCClient['createAuthorizationRequest']>[0])
Source:
Returns:
Type
Promise.<{url: string, state: string}>

(async) signOut(keyopt, optsopt) → {Promise.<({url: string, state: string}|undefined)>}

Signs one account out of this browser: onLeave runs, its tokens are revoked (with revoke) and removed from the cache, and it stays listed as signed-out. When it was this tab's active account, the most recently added signed-in account becomes active. Answers an RP-Initiated Logout request naming that account's ID token, so the OP ends that account's session only (or undefined: no end_session_endpoint, or endSession: false).

Parameters:
Name Type Attributes Description
key string <optional>

Default: the active account.
opts Object <optional>

(TypeScript: { revoke?: boolean, endSession?: boolean, postLogoutRedirectUri?: string })
Source:
Returns:
Type
Promise.<({url: string, state: string}|undefined)>

(async) signOutAll(optsopt)

Signs every account out of this browser. Answers one logout request that names nobody, so an OP holding several accounts asks the person which to end (or all of them).

Parameters:
Name Type Attributes Description
opts Object <optional>

(TypeScript: { revoke?: boolean, endSession?: boolean, postLogoutRedirectUri?: string })
Source: