filterProtocolClaims deletes properties required by the IdTokenClaims type

If filterProtocolClaims is set to true (the default), the properties iss, aud, exp and iat that are required by the IdTokenClaims type are deleted and undefined, thus breaking the defined types.

const userManager = new UserManager({
  // ... other options omitted
  filterProtocolClaims: true, // defaults to true
  // ...
});
const user = await userManager.getUser();
const exp = user.profile.exp; // TypeScript says this is a number
console.log(typeof exp) // Should be "number" but is "undefined"

Relevant parts of the code

These properties are deleted from the response: https://github.com/authts/oidc-client-ts/blob/bcfe363c685e8f243b43bc588ecba7495f88ffa9/src/ResponseValidator.ts#L26-L41 https://github.com/authts/oidc-client-ts/blob/bcfe363c685e8f243b43bc588ecba7495f88ffa9/src/ResponseValidator.ts#L225-L235 Some of which are mandatory here: https://github.com/authts/oidc-client-ts/blob/bcfe363c685e8f243b43bc588ecba7495f88ffa9/src/Claims.ts#L109

[Badisi]

The userManager.getUser().profile property is of type UserProfile and equals to IdTokenClaims: https://github.com/authts/oidc-client-ts/blob/bcfe363c685e8f243b43bc588ecba7495f88ffa9/src/User.ts#L11

IdTokenClaims requires iss, sub, aud, exp, iat to be mandatory as per the OIDC specs, and any other properties are optionals: https://github.com/authts/oidc-client-ts/blob/bcfe363c685e8f243b43bc588ecba7495f88ffa9/src/Claims.ts#L103-L109

So I think those 5 should never be deleted no matter what (even to reduce storage space).

---

We could simply modify ProtocolClaims like this:

const ProtocolClaims = [ 
     // "iss", should never be excluded, it is required as per the OIDC specs
     // "sub", should never be excluded, we need access to it internally 
     // "aud", should never be excluded, it is required as per the OIDC specs
     // "exp", should never be excluded, it is required as per the OIDC specs
     // "iat", should never be excluded, it is required as per the OIDC specs
     "nbf", 
     "jti", 
     "auth_time", 
     "nonce", 
     "acr", 
     "amr", 
     "azp", 
     "at_hash", // https://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken 
 ] as const; 

But beyond that, I don’t like the idea that a user could be biased because of the filtering process. (ie. a user may receive an undefined property that is defined but was deleted) So if we want to keep it that way, we will also have to reduce the scope of UserProfile (something like UserProfile = Omit<IdTokenClaims, keyof ProtocolClaims>)

or… drop the filtering completely as suggested by @pamapa.

[niklasholm]

@brockallen @pamapa My use case is that I use them for informational/debugging purposes, for example printing the time of issue, which I can do just fine by disabling the filter, so it’s beside the point I’m trying to make. This issue is about the type being incorrect. If the properties are not guaranteed to be defined, they must be typed as optional, simple as that.