v2.0.0

Breaking Changes

• Node 16 is no longer supported. The global fetch function is used instead of @inrupt/universal-fetch.
  This means this library now only works with Node 18 and higher.
• The Session class no longer extends EventEmitter. Instead, it exposes an events attribute implementing
  EventEmitter. We do not recommend to use Session instance's events attribute as an arbitrary events emitter,
  and encourage users to only use the supported events and documented API.
• Session methods onLogin, onLogout, onError, onSessionRestore, onSessionExpiration and onNewRefreshToken
  have been removed. They are replaced by calls to session.events.on, using the appropriate event name.
• Session constructor changes:
  • the onNewRefreshToken parameter is no longer supported. Its usage is replaced by calling session.events.on
    using the EVENTS.NEW_REFRESH_TOKEN constant as a first parameter, and a callback handling the token as a
    second parameter.
  • The useEssSession parameter is no longer supported.
• The getClientAuthenticationWithDependencies is no longer exported as part of the public API, and is now internal-only.
• The UMD build of @inrupt/oidc-client-ext is no longer available. Since this is a package only intended to be
  consumed by @inrupt/solid-client-authn-browser, which doesn't have a UMD build, this change should have no
  impact.

Build system changes

• Moved from rollup-plugin-typescript2 to @rollup/plugin-typescript. Although this should not be a breaking change,
  upgrading may require extra attention.

v1.17.5

Internal changes

• This refactors how the the node-based end-to-end tests run to make it possible to run them without having playwright installed. This should not impact downstream consumers.

v1.17.4

Bugfixes

node

• #2985: RFC9207 adds an iss parameter to the callback IRI, and the Node library wasn't removing it before comparing the effective callback URL to the URL used when making the Authorization request.

1.17.3

Bugfixes

browser

• Mismatching redirect URI on refresh: the root cause of the bug was a race
  condition because of the asynchronous nature of updating the browser URL. The appropriate event is now awaited for, which should prevent
  the issue from manifesting.

browser and node

• JSDoc comments are preserved in emitted files, which gives a better developer experience in IDEs supporting them.

v1.17.2

Bugfixes

browser

• Mismatching redirect URI on refresh: this bug was caused by an invalid redirect URL stored with session data.
  Saving an invalid redirect URL is now prohibited, and in addition the storage of users impacted by this bug will be cleared so that they don't have to do anything manually
  to clear their local storage. Users affected by this bug will be asked to log back in, as if they logged out.

v1.17.1

Bugfixes

• The fetch function is now bound to the window object in all uses within authn-browser

v1.17.0

New Features

• Support for RP-Initiated Logout in Node and Browser libraries.
• ESM support for Node and Browser packages.

v1.16.0

New Feature

• Node 20 support

v1.15.0

New features

• Add Node 18 support

v1.14.0

browser and node

New features

• The Session exposes an events attribute implementing EventEmitter, with
  type hints to guide which events are supported. It allows to register a callback
  listening on events using session.events.on, but also to unregister a callback
  using session.events.off, or to register a one-off callback using session.events.once.
  This attribute intends at replacing exising Session methods to listen on events,
  namely onLogin, onLogout, onError, onSessionRestore, onSessionExpiration,
  onNewRefreshToken.

Deprecation notice

The following have been deprecated, and will be removed in future major releases.

• The Session class will no longer extend EventEmitter. Instead, it will expose
  an events attribute implementing EventEmitter. We do not recommand to use
  either a Session instance or its events attribute as an arbitrary events emitter,
  and encourage users to only use the supported events and documented API.
• Session methods onLogin, onLogout, onError, onSessionRestore,
  onSessionExpiration, onNewRefreshToken are deprecated in favor of session.events.on
  called with the appropriate event name.

node

Bugfixes

• The session expiration date was incorrectly computed in the authorization code flow.