@darkauth/client 1.20.2 → 1.21.0

package/README.md

@@ -118,7 +118,7 @@ If `tokenStorage: 'localStorage'` or `drkStorage: 'localStorage'` is configured
 
 Refreshes the current session. In default first-party mode, the browser sends the DarkAuth refresh cookie and no JavaScript-readable refresh token is required. For non-ZK sessions, returns `drk` as an empty `Uint8Array`.
 
-Use `{ force: true }` after changing the DarkAuth session organization so the app receives tokens for the newly selected organization even if the current in-memory ID token has not expired.
+Use `{ force: true }` after hosted first-party organization changes so the app receives tokens for the newly selected organization even if the current in-memory ID token has not expired.
 
 ### Organization Switching
 
@@ -126,7 +126,7 @@ DarkAuth treats organization switching as choosing a new authorization context.
 
 #### `listOrganizations(): Promise<DarkAuthOrganization[]>`
 
-Returns the current user's organizations for app-owned switcher UI. Use `status` to decide which memberships are selectable.
+Returns the current user's organizations for app-owned switcher UI. When the SDK has a current app access token, the request is authorized with `Authorization: Bearer <access_token>` and does not depend on DarkAuth session cookies. Use `status` to decide which memberships are selectable.
 
 #### `getSessionInfo(): Promise<{ authenticated: boolean; sub?: string; email?: string | null; name?: string | null; organizationId?: string; organizationSlug?: string | null }>`
 
@@ -134,7 +134,7 @@ Returns current first-party session and organization context for app chrome befo
 
 #### `switchOrganization(organizationId: string, options?: SwitchOrganizationOptions): Promise<AuthSession | null>`
 
-Switches the selected organization. The default `silent` mode updates the DarkAuth session organization, forces a token refresh, and returns the refreshed session. `authorize` mode starts a new authorization-code flow. `hosted` mode redirects to DarkAuth's `/switch-org` page.
+Switches the selected organization. The default `token` mode exchanges the current app access token for fresh tokens scoped to the selected organization. `authorize` mode starts a new authorization-code flow. `hosted` mode redirects to DarkAuth's `/switch-org` page.
 
 #### App-owned switcher
 
@@ -156,7 +156,7 @@ async function selectOrganization(organizationId: string) {
 }
 ```
 
-After the refresh, verify that `selectedOrganizationId` matches the workspace being loaded. Treat the switch as a tenant or workspace state reset: clear tenant-local caches, selected resources, open realtime subscriptions, in-flight requests, and authorization decisions before loading data for the new `org_id`.
+After the exchange, verify that `selectedOrganizationId` matches the workspace being loaded. Treat the switch as a tenant or workspace state reset: clear tenant-local caches, selected resources, open realtime subscriptions, in-flight requests, and authorization decisions before loading data for the new `org_id`.
 
 Use `mode: 'authorize'` when a deployment should re-enter the redirect-based OAuth flow for every organization switch.
 

package/dist/index.d.ts

@@ -54,7 +54,7 @@ export type InitiateLoginOptions = {
     returnTo?: string;
 };
 export type SwitchOrganizationOptions = {
-    mode?: "silent" | "authorize" | "hosted";
+    mode?: "token" | "authorize" | "hosted";
     returnTo?: string;
 };
 export type RefreshSessionOptions = {

package/dist/index.js

@@ -647,7 +647,11 @@ export async function refreshSession(options = {}) {
     });
 }
 export async function listOrganizations() {
+    const accessToken = memorySession?.accessToken ||
+        (tokenStorageMode() === "localStorage" ? getStoredAccessToken() : null);
+    const headers = accessToken ? { authorization: `Bearer ${accessToken}` } : undefined;
     const response = await fetch(rootEndpoint("/api/user/organizations"), {
+        headers,
         credentials: fetchCredentials(),
     });
     if (!response.ok)
@@ -686,22 +690,44 @@ export async function getSessionInfo() {
     };
 }
 export async function switchOrganization(organizationId, options = {}) {
-    const mode = options.mode || "authorize";
-    if (mode === "silent") {
-        const response = await fetch(rootEndpoint("/api/user/session/organization"), {
+    const mode = options.mode || "token";
+    if (mode === "token") {
+        const current = getStoredSession();
+        const bearerToken = current?.accessToken;
+        if (!current || !bearerToken) {
+            await initiateLogin({ organizationId, returnTo: options.returnTo });
+            return null;
+        }
+        const response = await fetch(rootEndpoint("/api/token/organization"), {
             method: "POST",
-            headers: { "content-type": "application/json" },
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${bearerToken}`,
+            },
             body: JSON.stringify({
                 organization_id: organizationId,
-                return_to: options.returnTo,
                 client_id: cfg.clientId,
             }),
             credentials: fetchCredentials(),
         });
         if (!response.ok)
             throw await errorForResponse(response);
-        await response.json().catch(() => null);
-        return await refreshSession({ force: true });
+        const tokenResponse = await response.json();
+        const idToken = tokenResponse.id_token;
+        const accessToken = typeof tokenResponse.access_token === "string"
+            ? tokenResponse.access_token
+            : undefined;
+        const refreshToken = refreshMode() === "token" ? tokenResponse.refresh_token : undefined;
+        return storeSession({
+            idToken,
+            accessToken,
+            drk: current.drk || EMPTY_DRK,
+            clientAppKey: current.clientAppKey,
+            rootKey: current.rootKey,
+            deliveredKeyKind: current.deliveredKeyKind,
+            keyDeliveryVersion: current.keyDeliveryVersion,
+            refreshToken,
+        });
     }
     if (mode === "authorize") {
         await initiateLogin({ organizationId, returnTo: options.returnTo });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@darkauth/client",
-  "version": "1.20.2",
+  "version": "1.21.0",
   "license": "MIT",
   "repository": {
     "directory": "packages/darkauth-client",