feat: add support for Online Access (Online Refresh Tokens)

[NandanPrabhu]

Summary

Adds full support for Online Access (Online Refresh Tokens / ORTs) in auth0-react, mirroring the underlying auth0-spa-js feature.

Most of the configuration surface (refreshTokenMode, useDpop, useMrrt, useRefreshTokens) already passed through automatically via Auth0Provider's existing Auth0ClientOptions spread — no changes needed there.

Changes

• revokeRefreshToken in Auth0Provider re-syncs user/isAuthenticated via client.getUser() — this correctly reflects both online-mode session clearing and offline-mode no-op behavior, and still re-syncs (to the unchanged state) if revocation fails
• Added a dedicated SYNC_USER reducer action for this state re-sync, instead of reusing GET_ACCESS_TOKEN_COMPLETE, so the action name reflects what's actually happening
• Exported RefreshTokenMode, InvalidConfigurationError, MissingScopesError from the package root
• Updated the Auth0Client Jest mock
• 4 tests covering method availability/memoization, options forwarding, online-mode session-clearing behavior, and error propagation (rethrow without touching state)
• New "Online Access (Online Refresh Tokens)" section in EXAMPLES.md, including a React error-boundary example for catching InvalidConfigurationError — Auth0Provider constructs Auth0Client inside useState() during render, so a call-site try/catch can't catch it, but an error boundary can

Usage

import { useAuth0, RefreshTokenMode } from '@auth0/auth0-react';

<Auth0Provider
  domain={domain}
  clientId={clientId}
  useRefreshTokens={true}
  refreshTokenMode={RefreshTokenMode.Online}
  useDpop={true}
  authorizationParams={{ redirect_uri: window.location.origin }}
>
  <App />
</Auth0Provider>

Testing

• All tests pass (npx jest --no-coverage — 143 tests)
• npx tsc --noEmit — zero TypeScript errors
• npm run lint — zero errors/warnings
• Built against a local, linked copy of auth0-spa-js and smoke-tested RefreshTokenMode resolves correctly

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds revokeRefreshToken to the Auth0 context and provider, updates public exports, mocks, tests, documentation, and bumps @auth0/auth0-spa-js to ^2.23.0.

Changes

Online Refresh Token (ORT) Revocation

Layer / File(s)	Summary
Context interface and public exports src/auth0-context.tsx, src/index.tsx	Adds revokeRefreshToken to the context and re-exports its options type, RefreshTokenMode, MissingScopesError, and InvalidConfigurationError.
Provider implementation of revokeRefreshToken src/auth0-provider.tsx	Calls the client revocation method, refreshes user state, dispatches GET_ACCESS_TOKEN_COMPLETE, and exposes the callback through context.
Mocks and provider validation __mocks__/@auth0/auth0-spa-js.tsx, __tests__/auth-provider.test.tsx	Mocks revocation and tests online option forwarding, online/offline state behavior, and error propagation.
Online access documentation and dependency alignment EXAMPLES.md, package.json	Documents online refresh tokens and updates @auth0/auth0-spa-js from ^2.22.0 to ^2.23.0.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant App
  participant Auth0Provider
  participant Auth0Client

  App->>Auth0Provider: revokeRefreshToken(options)
  Auth0Provider->>Auth0Client: revokeRefreshToken(opts)
  Auth0Client-->>Auth0Provider: revocation complete
  Auth0Provider->>Auth0Client: getUser()
  Auth0Client-->>Auth0Provider: user state
  Auth0Provider->>Auth0Provider: dispatch GET_ACCESS_TOKEN_COMPLETE
  Auth0Provider-->>App: updated auth state

Loading

Suggested reviewers: kishore7snehil

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: adding support for Online Access/Online Refresh Tokens.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/online-access

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@EXAMPLES.md`:
- Around line 829-840: The current example shows a try/catch without actually
exercising the failing path, so replace it with a real validation or
error-boundary pattern tied to Auth0Provider/Auth0Client. Use the Auth0Provider
render path or an explicit pre-render configuration check that invokes the same
options that trigger InvalidConfigurationError, then catch and handle that error
with the suggested fix. Make sure the example demonstrates a concrete,
executable path that can actually raise and catch InvalidConfigurationError
rather than a placeholder block.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a62d0e85-f108-4cd5-b93b-f27378bdf821

📥 Commits

Reviewing files that changed from the base of the PR and between 04818a5 and 3368a78.

📒 Files selected for processing (7)

• EXAMPLES.md
• __mocks__/@auth0/auth0-spa-js.tsx
• __tests__/auth-provider.test.tsx
• package.json
• src/auth0-context.tsx
• src/auth0-provider.tsx
• src/index.tsx

[cschetan77]

Can you also sign all the commits and push them back up. Some of them are missing signatures.