Your session ends at {{ ceiling | date: 'medium' }}
+ } + `, +}) +export class SessionInfoComponent { + private auth = inject(AuthService); + + sessionCeiling$ = this.auth.idTokenClaims$.pipe( + map((claims) => + claims?.session_expiry ? new Date(claims.session_expiry * 1000) : null + ) + ); +} +``` + +### Upgrading existing apps + +Once the claim is present, `getAccessTokenSilently()` and `user$` can return `undefined`/`null` for a previously authenticated user. Apps that assume a token or user is always available after login should add null checks: + +```ts +this.auth.getAccessTokenSilently().subscribe((token) => { + if (!token) { + // The ceiling was reached and isAuthenticated$ has already been updated to false. + // Let AuthGuard / authGuardFn handle the redirect on the next navigation, or + // call loginWithRedirect() here if this page is not behind a guard. + return; + } + + this.http + .get('/api/data', { headers: { Authorization: `Bearer ${token}` } }) + .subscribe(); +}); +``` + +```ts +this.auth.user$.subscribe((user) => { + if (!user) { + return; + } + + console.log(`Hello, ${user.name}`); +}); +``` + +Using `AuthHttpInterceptor` to attach tokens and `AuthGuard` / `authGuardFn` to protect routes is the simpler alternative, since neither requires a null check. diff --git a/projects/auth0-angular/src/lib/auth.interceptor.spec.ts b/projects/auth0-angular/src/lib/auth.interceptor.spec.ts index 29089540..08910770 100644 --- a/projects/auth0-angular/src/lib/auth.interceptor.spec.ts +++ b/projects/auth0-angular/src/lib/auth.interceptor.spec.ts @@ -307,6 +307,25 @@ describe('The Auth HTTP Interceptor', () => { httpTestingController.expectNone('https://my-api.com/api/calendar'); }); + it('does not execute HTTP call and refreshes the auth state when getTokenSilently returns undefined (session_expiry ceiling reached)', async () => { + ( + auth0Client.getTokenSilently as unknown as MockInstance + ).mockResolvedValue(undefined); + vi.spyOn(authState, 'refresh'); + + httpClient.request('get', 'https://my-api.com/api/calendar').subscribe({ + error: (err) => expect(err).toEqual({ error: 'missing_token' }), + }); + + await new Promise(process.nextTick); + + httpTestingController.expectNone('https://my-api.com/api/calendar'); + expect(authState.refresh).toHaveBeenCalled(); + expect(authState.setError).toHaveBeenCalledWith({ + error: 'missing_token', + }); + }); + it('does execute HTTP call when not able to retrieve a token but allowAnonymous is set to true', async () => { (auth0Client.getTokenSilently as unknown as MockInstance).mockReturnValue( throwError({ error: 'login_required' }) diff --git a/projects/auth0-angular/src/lib/auth.service.spec.ts b/projects/auth0-angular/src/lib/auth.service.spec.ts index 0325be0e..4acd4c9c 100644 --- a/projects/auth0-angular/src/lib/auth.service.spec.ts +++ b/projects/auth0-angular/src/lib/auth.service.spec.ts @@ -978,6 +978,71 @@ describe('AuthService', () => { firstValueFrom(service.getAccessTokenSilently()) ).rejects.toBe(errorObj); }); + + describe('when the session_expiry ceiling (IPSIE) is reached', () => { + beforeEach(() => { + ( + auth0Client.isAuthenticated as unknown as MockInstance + ).mockResolvedValue(true); + (auth0Client.getUser as unknown as MockInstance).mockResolvedValue({ + sub: '__test_user__', + name: 'Test User', + }); + }); + + const breachCeiling = () => { + ( + auth0Client.getTokenSilently as unknown as MockInstance + ).mockResolvedValue(undefined); + ( + auth0Client.isAuthenticated as unknown as MockInstance + ).mockResolvedValue(false); + (auth0Client.getUser as unknown as MockInstance).mockResolvedValue( + undefined + ); + }; + + it('should return undefined without throwing or recording an error', async () => { + const service = createService(); + await firstValueFrom(loaded(service)); + const errorSpy = vi.spyOn(authState, 'setError'); + + breachCeiling(); + + const token = await firstValueFrom(service.getAccessTokenSilently()); + expect(auth0Client.getTokenSilently).toHaveBeenCalled(); + expect(token).toBeUndefined(); + expect(errorSpy).not.toHaveBeenCalled(); + }); + + it('should update isAuthenticated$ to false', async () => { + const service = createService(); + const pending = firstValueFrom( + service.isAuthenticated$.pipe(bufferCount(2)) + ); + expect(await firstValueFrom(service.isAuthenticated$)).toBe(true); + + breachCeiling(); + service.getAccessTokenSilently().subscribe(); + + expect(await pending).toEqual([true, false]); + }); + + it('should update user$ to null', async () => { + const service = createService(); + const pending = firstValueFrom(service.user$.pipe(bufferCount(2))); + expect(await firstValueFrom(service.user$)).toEqual({ + sub: '__test_user__', + name: 'Test User', + }); + + breachCeiling(); + service.getAccessTokenSilently().subscribe(); + + const values = await pending; + expect(values[1]).toBeNull(); + }); + }); }); describe('getAccessTokenWithPopup', () => { diff --git a/projects/auth0-angular/src/lib/auth.service.ts b/projects/auth0-angular/src/lib/auth.service.ts index d9e6c8da..cc5dbaa7 100644 --- a/projects/auth0-angular/src/lib/auth.service.ts +++ b/projects/auth0-angular/src/lib/auth.service.ts @@ -304,6 +304,10 @@ export class AuthService