[SDK-3738] Option to clear session only in Credentials Manager

src/hooks/__tests__/use-auth0.spec.js

@@ -5,6 +5,7 @@ import * as React from 'react';
 import {renderHook} from '@testing-library/react-hooks';
 import Auth0Provider from '../auth0-provider';
 import useAuth0 from '../use-auth0';
+import {act} from 'react-dom/test-utils';
 
 function makeJwt(claims) {
   const header = {alg: 'RS256', typ: 'JWT'};
@@ -257,6 +258,58 @@ describe('The useAuth0 hook', () => {
     );
   });
 
+  it('clearSession will not be called when we set credentialsManagerOnly to true', async () => {
+    const {result, waitForNextUpdate} = renderHook(() => useAuth0(), {wrapper});
+
+    result.current.clearSession({}, {credentialsManagerOnly: true});
+    await waitForNextUpdate();
+
+    expect(mockAuth0.webAuth.clearSession).not.toHaveBeenCalled();
+    expect(mockAuth0.credentialsManager.clearCredentials).toHaveBeenCalled();
+  });
+
+  it('clearSession will be called when we set credentialsManagerOnly to false', async () => {
+    const {result, waitForNextUpdate} = renderHook(() => useAuth0(), {wrapper});
+
+    result.current.clearSession({}, {credentialsManagerOnly: false});
+    await waitForNextUpdate();
+
+    expect(mockAuth0.webAuth.clearSession).toHaveBeenCalled();
+    expect(mockAuth0.credentialsManager.clearCredentials).toHaveBeenCalled();
+  });
+
+  it('clearSession will be called when we dont set credentialsManagerOnly', async () => {
+    const {result, waitForNextUpdate} = renderHook(() => useAuth0(), {wrapper});
+
+    result.current.clearSession();
+    await waitForNextUpdate();
+
+    expect(mockAuth0.webAuth.clearSession).toHaveBeenCalled();
+    expect(mockAuth0.credentialsManager.clearCredentials).toHaveBeenCalled();
+  });
+
+  it('sets the error property when we set both credentialsManagerOnly and federated to true', async () => {
+    const {result, waitForNextUpdate} = renderHook(() => useAuth0(), {wrapper});
+
+    const errorToThrow = new Error(
+      'It is invalid to set both the `federated` and `credentialsManagerOnly` options to `true`',
+    );
+
+    act(() => {
+      result.current.clearSession(
+        {federated: true},
+        {credentialsManagerOnly: true},
+      );
+    });
+    await waitForNextUpdate();
+
+    expect(result.current.error).toEqual(errorToThrow);
+    expect(mockAuth0.webAuth.clearSession).not.toHaveBeenCalled();
+    expect(
+      mockAuth0.credentialsManager.clearCredentials,
+    ).not.toHaveBeenCalled();
+  });
+
   it('sets the error property when an error is raised in authorize', async () => {
     const {result, waitForNextUpdate} = renderHook(() => useAuth0(), {wrapper});
     const errorToThrow = new Error('Authorize error');

src/hooks/auth0-provider.js

@@ -89,7 +89,16 @@ const Auth0Provider = ({domain, clientId, children}) => {
   const clearSession = useCallback(
     async (...options) => {
       try {
-        await client.webAuth.clearSession(...options);
+        const {federated} = options.length ? options[0] : {};
+        const {credentialsManagerOnly} = options.length > 1 ? options[1] : {};
+        if (credentialsManagerOnly && federated) {
+          throw new Error(
+            'It is invalid to set both the `federated` and `credentialsManagerOnly` options to `true`',
+          );
+        }
+        if (!credentialsManagerOnly) {
+          await client.webAuth.clearSession(...options);
+        }
         await client.credentialsManager.clearCredentials();
         dispatch({type: 'LOGOUT_COMPLETE'});
       } catch (error) {

src/hooks/use-auth0.js

@@ -6,7 +6,7 @@ import Auth0Context from './auth0-context';
  * @property {Object} user The user profile as decoded from the ID token after authentication
  * @property {Object} error An object representing the last exception
  * @property {Function} authorize Authorize the user using Auth0 Universal Login. See {@link WebAuth#authorize}
- * @property {Function} clearSession Clears the user's session and logs them out. See {@link WebAuth#clearSession}
+ * @property {Function} clearSession Clears the user's session and logs them out. See {@link WebAuth#clearSession}. `options.credentialsManagerOnly` can be set to true to clear the credentials in the Credential Manager without clearing the web session.
  * @property {Function} getCredentials Gets the user's credentials from the native credential store. See {@link CredentialsManager#getCredentials}
  * @property {Function} requireLocalAuthentication Enables Local Authentication (PIN, Biometric, Swipe etc) to get the credentials. See {@link CredentialsManager#requireLocalAuthentication}
  */