[SDK-3105] Add httpTimeoutInSeconds to control fetch timeout

[stevehobbsdev]

Changes

This PR adds a new client configuration option httpTimeoutInSeconds that allows consumers to configure the fetch timeout when calling the oauth/token endpoint. The default remains at 10 seconds if not specified.

References

Fixes #871

Testing

• This change adds unit test coverage
• This change adds integration test coverage
• This change has been tested on the latest version of the platform/language

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All code quality tools/guidelines have been run/followed

[adamjmcgrath]

You're overriding the timeout in 1205

Not sure if anyone is doing getTokenSilently({ timeout: ... }) since it's not documented, but we should probably keep that working

[stevehobbsdev]

Good spot, was just an oversight.

I think it should still resolve to the same thing but agree it's a bit of a smell.

[adamjmcgrath]

actually, this is the place where I thought we might break getTokenSilently({ timeout: ... }) - not sure if anyone is using that?

Maybe we should do: timeout: customOptions.timeout || this.httpTimeoutMs?

[stevehobbsdev]

Ok, stepping back a bit the API does look a bit odd here.

With this PR it's now possible to construct a client like this:

const client = new Auth0Client({
  domain,
  clientId,
  httpTimeoutInSeconds: 60,
  authorizeTimeoutInSeconds: 60
});

// Then call getTokenSilently like this.
// `timeoutInSeconds` only affects the timeout on /authorize but no way to configure http timeout here
await client.getTokenSilently({ timeoutInSeconds: 30 });

Should we also add this config in to override at the getTokenSilently level, or do you think just explaining the behaviour of timeoutInSeconds in the docs is enough?

[stevehobbsdev]

Regardless, this:

Maybe we should do: timeout: customOptions.timeout || this.httpTimeoutMs?

customOptions.timeout here is documented as being "A maximum number of seconds to wait before declaring the background /authorize call as failed for timeout", so the two timeouts relate to different things. But would be confusing as I mentioned above.

[adamjmcgrath]

customOptions.timeout isn't documented anywhere, that's the docs for timeoutInSeconds

[adamjmcgrath]

Currently, if I call auth0.getTokenSilently({ timeout: 100 }) the HTTP Timeout for the code exchange will be 100ms

[stevehobbsdev]

Right, sorry - I think I see what you're saying. You're covering the case where someone has inadvertently used getTokenSilently({ timeout: 100 }); instead of the documented getTokenSilently({ timeoutInSeconds: 100 });, which they could well do because we allow arbitrary parameters?

It would be easy to cover off that use case, sure - just in case.

[stevehobbsdev]

I've changed this now 👍🏻 was a good spot, thanks