Preserve client metadata on silent login

inrupt · Jan 15, 2025 · ebd6c3e · ebd6c3e
1 parent a318914
commit ebd6c3e
Show file tree

Hide file tree

Showing 2 changed files with 35 additions and 6 deletions.
diff --git a/packages/browser/src/ClientAuthentication.spec.ts b/packages/browser/src/ClientAuthentication.spec.ts
@@ -230,6 +230,35 @@ describe("ClientAuthentication", () => {
       ).resolves.toBeUndefined();
     });
 
+    it("should not clear the local storage when logging in with prompt set to none", async () => {
+      const nonEmptyStorage = mockStorageUtility({
+        someUser: { someKey: "someValue" },
+      });
+      await nonEmptyStorage.setForUser(
+        "someUser",
+        { someKey: "someValue" },
+        { secure: false },
+      );
+      const clientAuthn = getClientAuthentication({
+        sessionInfoManager: mockSessionInfoManager(nonEmptyStorage),
+      });
+      await clientAuthn.login(
+        {
+          sessionId: "someUser",
+          tokenType: "DPoP",
+          clientId: "coolApp",
+          clientName: "coolApp Name",
+          redirectUrl: "https://coolapp.com/redirect",
+          oidcIssuer: "https://idp.com",
+          prompt: "none",
+        },
+        mockEmitter,
+      );
+      await expect(
+        nonEmptyStorage.getForUser("someUser", "someKey", { secure: false }),
+      ).resolves.toBe("someValue");
+    });
+
     it("throws if the redirect IRI is a malformed URL", async () => {
       const clientAuthn = getClientAuthentication();
       await expect(() =>

diff --git a/packages/browser/src/ClientAuthentication.ts b/packages/browser/src/ClientAuthentication.ts
@@ -48,13 +48,13 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
     options: ILoginOptions,
     eventEmitter: EventEmitter,
   ): Promise<void> => {
+
     // In order to get a clean start, make sure that the session is logged out
-    // on login.
-    // But we may want to preserve our client application info, particularly if
-    // we used Dynamic Client Registration to register (since we don't
-    // necessarily want the user to have to register this app each time they
-    // login).
-    await this.sessionInfoManager.clear(options.sessionId);
+    // on login, except when doing a silent login so that Dynamic Client information
+    // is preserved.
+    if (options.prompt !== "none") {
+      await this.sessionInfoManager.clear(options.sessionId);
+    }
 
     // In the case of the user hitting the 'back' button in their browser, they
     // could return to a previous redirect URL that contains OIDC params that