fix behavioral change

[kkignatov]

Fix: restore null return for anonymous users in public showrooms

Problem

After updating @elfsquad/authentication with BFF (Backend for Frontend) support, getAccessToken() began throwing an error when no access token and no refresh source were available:

▎ @elfsquad/authentication: Access token expired and no refresh source is available.

This broke public showrooms where anonymous users legitimately have no tokens. The error surfaced because getAccessToken() is called on every HTTP request to attach an Authorization header — even for unauthenticated users.

The root cause: the new throw was placed in a code path that applies to all flows, not just the BFF flow it was intended to guard.

Fix

getAccessToken() — restore the pre-BFF behavior of returning null when there is no valid token and no refresh source (no refreshAccessToken callback, no stored refresh token). This is the correct outcome for anonymous users; callers that need an authenticated token handle the null case.

The throw would only be meaningful for the BFF flow, but the BFF flow never reaches this code path — when options.refreshAccessToken is set, the condition !options.refreshAccessToken is false, so it proceeds
directly to the callback.

getIdToken() — fixed a downstream null-dereference. After getAccessToken() returns null, this.accessTokenResponse remains null, so accessing .idToken on it would throw a TypeError. Added an early return of null when getAccessToken() returns null.

Tests

• Updated signOut test: getIdToken() no longer throws for anonymous users — it returns null. Removed the now-unnecessary console.warn spy.
• Added getAccessToken test: returns null for anonymous users with no refresh source (regression guard for the old-flow behavior).
• Added getIdToken test: returns null in the same scenario.

[Copilot]

Pull request overview

Restores pre-BFF behavior where getAccessToken() returns null instead of throwing for anonymous users, and fixes a downstream null-dereference in getIdToken().

Changes:

• getAccessToken() returns null instead of throwing when no refresh source is available
• getIdToken() handles the null return from getAccessToken() to avoid a TypeError
• Tests updated and added to cover anonymous user scenarios

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/authentication/authenticationContext.ts	Restore null return in getAccessToken() and add null guard in getIdToken()
src/authentication/authenticationContext.spec.ts	Update/add tests for anonymous user token scenarios

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.