@darkauth/client 1.20.3 → 1.21.0

package/README.md

@@ -118,7 +118,7 @@ If `tokenStorage: 'localStorage'` or `drkStorage: 'localStorage'` is configured
 
 Refreshes the current session. In default first-party mode, the browser sends the DarkAuth refresh cookie and no JavaScript-readable refresh token is required. For non-ZK sessions, returns `drk` as an empty `Uint8Array`.
 
-Use `{ force: true }` after changing the DarkAuth session organization so the app receives tokens for the newly selected organization even if the current in-memory ID token has not expired.
+Use `{ force: true }` after hosted first-party organization changes so the app receives tokens for the newly selected organization even if the current in-memory ID token has not expired.
 
 ### Organization Switching
 
@@ -126,7 +126,7 @@ DarkAuth treats organization switching as choosing a new authorization context.
 
 #### `listOrganizations(): Promise<DarkAuthOrganization[]>`
 
-Returns the current user's organizations for app-owned switcher UI. Use `status` to decide which memberships are selectable.
+Returns the current user's organizations for app-owned switcher UI. When the SDK has a current app access token, the request is authorized with `Authorization: Bearer <access_token>` and does not depend on DarkAuth session cookies. Use `status` to decide which memberships are selectable.
 
 #### `getSessionInfo(): Promise<{ authenticated: boolean; sub?: string; email?: string | null; name?: string | null; organizationId?: string; organizationSlug?: string | null }>`
 
@@ -134,7 +134,7 @@ Returns current first-party session and organization context for app chrome befo
 
 #### `switchOrganization(organizationId: string, options?: SwitchOrganizationOptions): Promise<AuthSession | null>`
 
-Switches the selected organization. The default `silent` mode updates the DarkAuth session organization, forces a token refresh, and returns the refreshed session. `authorize` mode starts a new authorization-code flow. `hosted` mode redirects to DarkAuth's `/switch-org` page.
+Switches the selected organization. The default `token` mode exchanges the current app access token for fresh tokens scoped to the selected organization. `authorize` mode starts a new authorization-code flow. `hosted` mode redirects to DarkAuth's `/switch-org` page.
 
 #### App-owned switcher
 
@@ -156,7 +156,7 @@ async function selectOrganization(organizationId: string) {
 }
 ```
 
-After the refresh, verify that `selectedOrganizationId` matches the workspace being loaded. Treat the switch as a tenant or workspace state reset: clear tenant-local caches, selected resources, open realtime subscriptions, in-flight requests, and authorization decisions before loading data for the new `org_id`.
+After the exchange, verify that `selectedOrganizationId` matches the workspace being loaded. Treat the switch as a tenant or workspace state reset: clear tenant-local caches, selected resources, open realtime subscriptions, in-flight requests, and authorization decisions before loading data for the new `org_id`.
 
 Use `mode: 'authorize'` when a deployment should re-enter the redirect-based OAuth flow for every organization switch.
 

package/dist/index.d.ts

@@ -54,7 +54,7 @@ export type InitiateLoginOptions = {
     returnTo?: string;
 };
 export type SwitchOrganizationOptions = {
-    mode?: "token" | "silent" | "authorize" | "hosted";
+    mode?: "token" | "authorize" | "hosted";
     returnTo?: string;
 };
 export type RefreshSessionOptions = {

package/dist/index.js

@@ -647,7 +647,11 @@ export async function refreshSession(options = {}) {
     });
 }
 export async function listOrganizations() {
+    const accessToken = memorySession?.accessToken ||
+        (tokenStorageMode() === "localStorage" ? getStoredAccessToken() : null);
+    const headers = accessToken ? { authorization: `Bearer ${accessToken}` } : undefined;
     const response = await fetch(rootEndpoint("/api/user/organizations"), {
+        headers,
         credentials: fetchCredentials(),
     });
     if (!response.ok)
@@ -689,7 +693,7 @@ export async function switchOrganization(organizationId, options = {}) {
     const mode = options.mode || "token";
     if (mode === "token") {
         const current = getStoredSession();
-        const bearerToken = current?.accessToken || current?.idToken;
+        const bearerToken = current?.accessToken;
         if (!current || !bearerToken) {
             await initiateLogin({ organizationId, returnTo: options.returnTo });
             return null;
@@ -725,22 +729,6 @@ export async function switchOrganization(organizationId, options = {}) {
             refreshToken,
         });
     }
-    if (mode === "silent") {
-        const response = await fetch(rootEndpoint("/api/user/session/organization"), {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify({
-                organization_id: organizationId,
-                return_to: options.returnTo,
-                client_id: cfg.clientId,
-            }),
-            credentials: fetchCredentials(),
-        });
-        if (!response.ok)
-            throw await errorForResponse(response);
-        await response.json().catch(() => null);
-        return await refreshSession({ force: true });
-    }
     if (mode === "authorize") {
         await initiateLogin({ organizationId, returnTo: options.returnTo });
         return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@darkauth/client",
-  "version": "1.20.3",
+  "version": "1.21.0",
   "license": "MIT",
   "repository": {
     "directory": "packages/darkauth-client",