fix: avoid reinitiating partial authentication flow when user is already authenticated

[jamesdh]

Fixes: #922, and possibly some others. Influenced by authts/oidc-client-ts#402.

TLDR:

The problem here is that the stored state is removed immediately after the redirection from login. So if the user presses "back", then logs again, there is no more state available, even tho the redirect URL contains a state parameter. In other words, oidc-client-ts tries to load the stored state, but none is available because it removed it the first time the user logged in.

Personally what I discovered was that upon redirect from login, we still had the auth params in our query string. So if one were to reload the page or browse forward a page then hit the back button, we'd encounter the same thing. hasCodeInUrl() would pass which would trigger an invalid auth flow again. Therefore, I simply add a check that not only does hasCodeInUrl check out, but also that userManager doesn't actively have a user already authenticated.

I feel like I might be missing something here since I'm not very aware of all the possible authentication flows that are being used with oidc-react. If I could get some additional eyes on this I'd greatly appreciate it.

[codecov]

Codecov Report

❗ No coverage uploaded for pull request base (main@3eaf620). Click here to learn what that means.
The diff coverage is n/a.

@@           Coverage Diff            @@
##             main      #962   +/-   ##
========================================
  Coverage        ?   100.00%           
========================================
  Files           ?         1           
  Lines           ?        83           
  Branches        ?        31           
========================================
  Hits            ?        83           
  Misses          ?         0           
  Partials        ?         0           

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[simenandre]

Let's land this and get it out there to people. From what I can understand, it wouldn't hurt anything and its just logical that the user object should be falsy together with having the code in the URL.