$ show auth0/auth0-spa-js
The auth0-spa-js repository is a JavaScript/TypeScript SDK for authenticating Single Page Applications (SPAs) with Auth0. It implements the Authorization Code Flow with PKCE, providing methods for user login (redirect and popup), silent token acquisition, token refresh, logout, and user information retrieval. The SDK includes advanced features such as Multi-Factor Authentication (MFA), passkey/WebAuthn support, DPoP (Demonstrating Proof of Possession) for token security, Multi-Resource Refresh Tokens (MRRT), and custom token exchange per RFC 8693. Architecture-wise, it is modular with separate concerns: core authentication (Auth0Client), caching (memory and localStorage), storage (cookies and session storage), Web Worker for token operations, and specialized modules for MFA, passkeys, and account management. Key entry points include the `createAuth0Client` factory function and the `Auth0Client` class. The library relies on @auth0/auth0-auth-js for low-level Auth0 interactions and browser-tabs-lock for cross-tab synchronization.
The LLM identified 3 files worth highlighting for reuse:
Provides a singlePromise utility that memoizes promises based on input parameters to prevent duplicate asynchronous requests. This pattern is useful for avoiding redundant network calls or expensive computations in concurrent scenarios. The implementation is self-contained with no external dependencies beyond TypeScript utilities, making it easily reusable in other projects.
Implements a cross-tab locking mechanism using the browser-tabs-lock package to prevent concurrent authentication flows in multiple browser tabs. Exposes a simple acquire/release API through a singleton instance. This solves a common problem in SPAs where multiple tabs might initiate conflicting authentication processes, demonstrating non-obvious skill in coordinating state across browser contexts.
Provides a cross-browser abstraction for cookie and sessionStorage operations with a simple get/set/remove API. Handles encoding/decoding and browser inconsistencies internally. This self-contained module has minimal dependencies (only on global.ts for constants) and can be extracted for use in any web project needing reliable client-side storage without worrying about browser quirks.