feat: add support for Online Access (Online Refresh Tokens)#934
feat: add support for Online Access (Online Refresh Tokens)#934NandanPrabhu wants to merge 7 commits into
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe Angular SDK updates its SPA SDK dependency, re-exports online refresh-token symbols, and adds documentation for online access configuration, validation, and MRRT compatibility. ChangesOnline refresh token support
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
c6eb44d to
5a36e7e
Compare
16c2c76 to
ea70d32
Compare
|
Snyk vulnerability check failing — root cause is an Angular major version, not a patch fix CI is flagging 4 vulnerabilities in @angular/common, @angular/compiler, and @angular/core (currently pinned to ^19.2.21, resolving to 19.2.25):
19.2.25 is already the latest published patch in the 19.x line — there is no 19.x release that fixes these. Snyk's own remediation advice confirms the fix only lands in I tried a narrow fix — bumping only @angular/common, @angular/compiler, and @angular/core to ^20.3.25 while leaving the rest of the @angular/* packages at 19.2.21 — but npm install fails with ERESOLVE: @angular/animations, @angular/platform-browser, @angular/router, @angular/forms, and @angular/compiler-cli all declare a peer dependency on @angular/common@"19.2.25" (and its siblings) at that exact version. Angular's own packages are lockstep-versioned, so they can't be upgraded independently — this isn't fixable without upgrading the full Angular toolchain together. This means fixing the Snyk finding requires a full Angular 19 → 20 major upgrade (@angular/, @angular/cli, @angular-devkit/build-angular, @angular-eslint/, ng-packagr,
|
a7a6678 to
ef06256
Compare
ef06256 to
f48600a
Compare
Adds revokeRefreshToken() to AuthService, following the same Observable pattern as logout() — wraps the underlying Auth0Client call and triggers AuthState.refresh() so isAuthenticated$/user$/idTokenClaims$ reflect the result. This is the one gap in Online Access support — refreshTokenMode, useDpop, and useMrrt already pass through AuthConfig's existing Auth0ClientOptions config surface. Also exports RefreshTokenMode, InvalidConfigurationError, MissingScopesError, and RevokeRefreshTokenOptions from the package root, and documents the feature in EXAMPLES.md.
Online Access (Online Refresh Tokens) is gated behind Auth0 account team enablement. Adds the same Early Access notice used for the MFA section.
RefreshTokenMode is not exported until 2.23.0 — the previous ^2.21.0 range let installs resolve to an older minor where RefreshTokenMode is undefined, breaking refreshTokenMode: RefreshTokenMode.Online at runtime.
Drops the revokeRefreshToken() method, its RevokeRefreshTokenOptions export, tests, and EXAMPLES.md section added in 2b81160. Online Access (refreshTokenMode, useDpop, useMrrt) and the other new exports (RefreshTokenMode, InvalidConfigurationError, MissingScopesError) are unaffected.
f48600a to
3629525
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
package.json (1)
41-49: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winKeep Angular packages on one release line
package.json:41-49,62-71mixes Angular 19.2 runtime packages independencieswith 20.3 Angular packages indevDependencies(@angular-devkit/build-angular,@angular/cli,@angular/compiler-cli,@angular/forms,ng-packagr, and@angular-eslint/*). That breaks strict peer-dependency installs. Align everything to 19.x or 20.x.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@package.json` around lines 41 - 49, Align all Angular-related packages in package.json to a single major release line, including runtime dependencies and the listed devDependencies such as `@angular-devkit/build-angular`, `@angular/cli`, `@angular/compiler-cli`, `@angular/forms`, ng-packagr, and `@angular-eslint/`*. Preserve compatible versions within the selected 19.x or 20.x line so strict peer-dependency installation succeeds.Source: MCP tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@package.json`:
- Around line 41-49: Align all Angular-related packages in package.json to a
single major release line, including runtime dependencies and the listed
devDependencies such as `@angular-devkit/build-angular`, `@angular/cli`,
`@angular/compiler-cli`, `@angular/forms`, ng-packagr, and `@angular-eslint/`*.
Preserve compatible versions within the selected 19.x or 20.x line so strict
peer-dependency installation succeeds.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: de78a42f-1aaa-4c46-9ef7-5eab2e904c5e
📒 Files selected for processing (3)
EXAMPLES.mdpackage.jsonprojects/auth0-angular/src/public-api.ts
🚧 Files skipped from review as they are similar to previous changes (2)
- projects/auth0-angular/src/public-api.ts
- EXAMPLES.md
- Remove online_refresh_tokens flag mention and unverified "on by default" claim for allow_online_access - Add missing TOC entry for Online Access section - Fix dead try/catch in InvalidConfigurationError example; Auth0Client is constructed lazily during Angular bootstrap, so the error must be caught via .catch() on the bootstrap promise or an ErrorHandler - Document that Online Refresh Tokens do not yet support resource servers with Ephemeral Sessions enabled
2 participants
Summary
Adds full support for Online Access (Online Refresh Tokens / ORTs) in
auth0-angular, mirroring the underlyingauth0-spa-jsfeature.Most of the configuration surface (
refreshTokenMode,useDpop,useMrrt,useRefreshTokens) already passed through automatically sinceAuthConfig extends Auth0ClientOptionsandAuth0ClientFactoryspreads config directly — no changes needed there.Changes
RefreshTokenMode,InvalidConfigurationError,MissingScopesErrorfrompublic-api.tsEXAMPLES.md, covering bothAuthModule.forRootand standaloneprovideAuth0configuration stylesUsage
Testing
npx jest --no-coverage— 184 tests)npx tsc --noEmit— zero TypeScript errorsnpx ng build auth0-angular— builds cleanlynpx ng lint— zero errorsauth0-spa-jsand smoke-testedRefreshTokenModeresolve correctly