Oauth token expiration handling

Description

Hi, it’d be great to have out-of-the box oauth token expiration handling.

After token expiration luigi could ask if token should be renewed. Otherwise user should be redirected to the logout page set in the oauth configuration. Please notice that currently it may act weird if there is set the same redirect_uri and logoutUrl because of the auto-login behavior

oAuth2ImplicitGrant: {
                    authorizeUrl: 'http://example.com/oauth/authorize',
                    logoutUrl: 'http://localhost:4200',
                    oAuthData: {
                        client_id: 'my.client',
                        redirect_uri: 'http://localhost:4200',
                        response_type: 'token',
                    }
}

[maxmarkus]

@sebarys LuigiClient should not be capable of doing that.

But you should be already be able to do that. Luigi configuration allows to execute a function after logout and login. I have recognized this is not documented yet.

auth: {
  events: {
    onLogout: () => {
      console.log('onLogout');
    },
    onAuthSuccessful: data => {
      console.log('onAuthSuccessful', data);
    }

With OpenID Connect we have tested single logout in combination with google auth successfully. logoutUrl had the URL to the OpenID Connect logout endpoint and query parameters for redirecting back to window.location.origin right after logout. So manually executing something with onLogout should not be necessary.

[y-kkamil]

A number of remarks regarding this task:

• For now, if authorisation is set to something different than OpenID Connect and/or silent token refresh is disabled, user will be redirected to the logout page without any warning - not good if he has some unsaved work. There is a follow-up for that - #179

• New tokens are issued and silently passed to luigi-client. This way, getToken() function always responds with fresh token. However, it might be also beneficial to send an event of a new type that informs client apps of token update.

• I couldn’t find a way to check for 3rd party cookies other than the script provided in third-party-cookies. This method requires user of Luigi core to deploy scripts on a different domain than his main app. Also, it only warns about disabled third-party cookies in console. Maybe we should add some other way? Side note: we’re not in control of the logout page, however, if the user has been logged out (possibly, we cannot be sure) because of disabled cookies support, Luigi will add query params (?reason=tokenExpired&thirdPartyCookies=disabled). This way, application developer can add more meaningful message according to his needs.