cache client instances in Auth0ClientFactory to prevent duplicate state (#1506)

Author: subhankarmaiti

src/factory/Auth0ClientFactory.ts

@@ -10,18 +10,38 @@ import { NativeAuth0Client } from '../platforms/native';
  * A factory class responsible for creating the Native-specific
  * IAuth0Client instance. This file is automatically selected by the Metro
  * bundler during a build for iOS or Android.
+ *
+ * Instances are cached by domain+clientId so that React component
+ * remounts (e.g., Auth0Provider unmount/remount) reuse the same
+ * client and its in-flight state, preventing duplicate refresh token
+ * exchanges.
  */
 export class Auth0ClientFactory {
+  private static clientCache = new Map<string, IAuth0Client>();
+
   /**
-   * Creates and returns a NativeAuth0Client instance.
+   * Creates or returns a cached NativeAuth0Client instance.
    *
    * @param options The configuration options for the Auth0 client.
    * @returns An instance of NativeAuth0Client.
    */
   static createClient(options: Auth0Options): IAuth0Client {
     validateAuth0Options(options);
 
-    // No platform detection needed. We know we are on native.
-    return new NativeAuth0Client(options as NativeAuth0Options);
+    const cacheKey = `${options.domain}|${options.clientId}`;
+    let client = Auth0ClientFactory.clientCache.get(cacheKey);
+    if (!client) {
+      client = new NativeAuth0Client(options as NativeAuth0Options);
+      Auth0ClientFactory.clientCache.set(cacheKey, client);
+    }
+    return client;
+  }
+
+  /**
+   * Reset the client cache. Used for testing purposes.
+   * @internal
+   */
+  static resetClientCache(): void {
+    Auth0ClientFactory.clientCache.clear();
   }
 }

src/factory/Auth0ClientFactory.web.ts

@@ -10,18 +10,38 @@ import { WebAuth0Client } from '../platforms/web';
  * A factory class responsible for creating the Web-specific
  * IAuth0Client instance. This file is automatically selected by bundlers
  * like Webpack when targeting the web.
+ *
+ * Instances are cached by domain+clientId so that React component
+ * remounts (e.g., Auth0Provider unmount/remount) reuse the same
+ * client and its in-flight state, preventing duplicate refresh token
+ * exchanges.
  */
 export class Auth0ClientFactory {
+  private static clientCache = new Map<string, IAuth0Client>();
+
   /**
-   * Creates and returns a WebAuth0Client instance.
+   * Creates or returns a cached WebAuth0Client instance.
    *
    * @param options The configuration options for the Auth0 client.
    * @returns An instance of WebAuth0Client.
    */
   static createClient(options: Auth0Options): IAuth0Client {
     validateAuth0Options(options);
 
-    // No platform detection needed. We know we are on the web.
-    return new WebAuth0Client(options as WebAuth0Options);
+    const cacheKey = `${options.domain}|${options.clientId}`;
+    let client = Auth0ClientFactory.clientCache.get(cacheKey);
+    if (!client) {
+      client = new WebAuth0Client(options as WebAuth0Options);
+      Auth0ClientFactory.clientCache.set(cacheKey, client);
+    }
+    return client;
+  }
+
+  /**
+   * Reset the client cache. Used for testing purposes.
+   * @internal
+   */
+  static resetClientCache(): void {
+    Auth0ClientFactory.clientCache.clear();
   }
 }

src/factory/__tests__/Auth0ClientFactory.spec.ts

@@ -19,6 +19,7 @@ describe('Auth0ClientFactory (Native)', () => {
 
   beforeEach(() => {
     jest.clearAllMocks();
+    Auth0ClientFactory.resetClientCache();
   });
 
   it('should call validateAuth0Options with the provided options', () => {
@@ -33,4 +34,32 @@ describe('Auth0ClientFactory (Native)', () => {
     expect(MockNativeAuth0Client).toHaveBeenCalledWith(options);
     expect(client).toBeInstanceOf(MockNativeAuth0Client);
   });
+
+  it('should return the same cached client for the same domain+clientId', () => {
+    const client1 = Auth0ClientFactory.createClient(options);
+    const client2 = Auth0ClientFactory.createClient(options);
+
+    expect(client1).toBe(client2);
+    expect(MockNativeAuth0Client).toHaveBeenCalledTimes(1);
+  });
+
+  it('should create separate clients for different domain+clientId', () => {
+    const client1 = Auth0ClientFactory.createClient(options);
+    const client2 = Auth0ClientFactory.createClient({
+      domain: 'other-tenant.auth0.com',
+      clientId: 'OtherClientId',
+    });
+
+    expect(client1).not.toBe(client2);
+    expect(MockNativeAuth0Client).toHaveBeenCalledTimes(2);
+  });
+
+  it('should create a new client after cache is reset', () => {
+    const client1 = Auth0ClientFactory.createClient(options);
+    Auth0ClientFactory.resetClientCache();
+    const client2 = Auth0ClientFactory.createClient(options);
+
+    expect(client1).not.toBe(client2);
+    expect(MockNativeAuth0Client).toHaveBeenCalledTimes(2);
+  });
 });