$ show authts/oidc-client-ts
This is a TypeScript library implementing an OpenID Connect (OIDC) and OAuth2 client for browser-based applications. It supports Authorization Code Grant with PKCE, refresh tokens, resource owner password credentials, and DPoP, while explicitly excluding the deprecated implicit grant. The library provides both a low-level `OidcClient` for raw protocol operations and a higher-level `UserManager` with session management, event notifications, and automatic silent token renewal via iframes or pop-ups. It is a fork of the archived `oidc-client-js` project, ported to TypeScript with strict typing, comprehensive testing (vitest, jsdom), and modern build tooling (esbuild, ESLint, Husky). The architecture is cleanly layered: a settings store with defaults, navigator abstraction for browser UI (redirect, popup, iframe), storage abstraction for state persistence (in-memory, localStorage, IndexedDB), and an event system for lifecycle callbacks. The codebase demonstrates high craftsmanship with well-isolated, reusable components such as the generic Event emitter, a sleep-aware Timer, and a strategy-pattern for navigation. DPoP support is implemented with secure key storage in IndexedDB and automatic nonce retry. External runtime dependencies are minimal (only `jwt-decode`). Active maintenance is evidenced by regular commits, dependabot configuration, CI workflows, and a versioned release process. This library is suitable for any browser-based SPA requiring standards-compliant OIDC/OAuth2 authentication.
The LLM identified 3 files worth highlighting for reuse:
A generic, strongly-typed event emitter class (`Event<EventType>`) that provides `addHandler`, `removeHandler`, and `raise` methods. This component is self-contained, has no internal library dependencies, and can be extracted to any TypeScript project requiring typed event handling. It demonstrates thoughtful design with proper handler management and a clear interface.
A timer class extending the `Event` emitter that uses short polling intervals (e.g., 200ms) to handle device sleep states where `setTimeout` callbacks may be delayed or lost. It fires `expiring` and `expired` events with precise tolerances. This is a non-obvious solution to a common browser timing issue and is fully reusable outside of OIDC contexts.
Defines the `INavigator` interface with `prepare` and `callback` methods, decoupling OIDC protocol flow from browser navigation mechanisms. Implementations (`RedirectNavigator`, `PopupNavigator`, `IFrameNavigator`) each handle different browser UI windows. The interface is clean, minimal, and can be reused in any project needing abstracted window management, with implementations that leverage `postMessage` and `BroadcastChannel` for cross-window communication.