@eintrek/erp-shell 0.1.60 → 0.1.61

package/dist/http/axios.d.ts

@@ -1,3 +1,11 @@
 import { AxiosInstance } from "axios";
+declare module "axios" {
+    interface AxiosRequestConfig {
+        /** Send this request without X-Organization-ID. */
+        erpWithoutOrganization?: boolean;
+        /** Send this request for this organisation, whatever the tab has active. */
+        erpOrganizationId?: string;
+    }
+}
 declare const instance: AxiosInstance;
 export default instance;

package/dist/http/organization-fallback.d.ts

@@ -0,0 +1 @@
+export declare function retryWithStoredOrganizations<T>(config: Record<string, unknown> | undefined, status: number | undefined, send: (config: Record<string, unknown>) => Promise<T>): Promise<T | undefined>;

package/dist/index.d.ts

@@ -23,7 +23,7 @@ export { OrganizationSwitcher, type OrganizationSwitcherProps, type Organization
 export { SidebarHeader } from "./navigation/sidebar-header";
 export { AppSidebar, type AppSidebarProps } from "./navigation/app-sidebar";
 export { AppLayoutShell, type AppLayoutShellProps, type AppLayoutShellOrganization, } from "./navigation/app-layout-shell";
-export { resolveUrlOrgGate, findOrganizationForCode, type UrlOrgGate, type UrlOrgGateInput, type OrganizationsStatus, } from "./navigation/url-org-gate";
+export { resolveUrlOrgGate, findOrganizationForCode, resolveStaleOrganization, type StaleOrganizationRecovery, type UrlOrgGate, type UrlOrgGateInput, type OrganizationsStatus, } from "./navigation/url-org-gate";
 export { type ShellChrome, type WorkspaceHeaderTone, WORKSPACE_HEADER_VARS, WORKSPACE_LIGHT_HEADER_VARS, } from "./navigation/chrome";
 export { WorkspaceBrand, type WorkspaceBrandProps } from "./navigation/workspace-brand";
 export { SidebarHelpCard, SidebarHelpLink, type SidebarHelpCardProps, type SidebarHelpLinkProps, } from "./navigation/sidebar-help-card";
@@ -54,6 +54,7 @@ export { unwrapApiResponse } from "./http/unwrap";
 export { getAccessToken, clearAccessTokenCache, } from "./http/auth-token-manager";
 export { runGlobalRequestPrecheck } from "./http/request-precheck";
 export { getOrganizationId, setOrganizationId, clearOrganizationId, } from "./organization/organization-id";
-export { getRequestOrganizationId, getTabOrganizationId, setTabOrganizationId, } from "./organization/active-organization";
+export { getRequestOrganizationId, getTabOrganizationId, setTabOrganizationId, setKnownOrganizationIds, isKnownStaleOrganizationId, withoutOrganization, WITHOUT_ORGANIZATION_FLAG, FOR_ORGANIZATION_FIELD, getStoredOrganizationIds, clearStoredOrganization, } from "./organization/active-organization";
+export { retryWithStoredOrganizations } from "./http/organization-fallback";
 export declare const updateOrganizationId: (organizationId: string | null) => void;
 export declare const getAxiosErrorMessage: (error: unknown) => string;

package/dist/index.esm.js

@@ -305,20 +305,154 @@ function readOrganizationStorage() {
         return null;
     }
 }
+/**
+ * The organisations the signed-in user belongs to, once their list has
+ * loaded (AppLayoutShell reports it); null until then.
+ */
+let knownOrganizationIds = null;
+/**
+ * Record the user's organisations (browser only). From then on a stored or
+ * tab organisation that is not among them loses to one that is: a browser
+ * that still remembers a deleted organisation — or one the user has left —
+ * must not keep sending it while the cookie names a good one.
+ */
+function setKnownOrganizationIds(ids) {
+    if (!isBrowser$1())
+        return;
+    if (ids === null) {
+        knownOrganizationIds = null;
+        return;
+    }
+    const set = new Set();
+    for (const id of ids) {
+        const value = normalise(id);
+        if (value)
+            set.add(value);
+    }
+    knownOrganizationIds = set;
+}
+/** Whether the loaded list says the user is NOT a member of `id`. */
+function isKnownStaleOrganizationId(id) {
+    const value = normalise(id);
+    return (value !== null &&
+        knownOrganizationIds !== null &&
+        !knownOrganizationIds.has(value));
+}
+/**
+ * Marks a request that must not carry X-Organization-ID: the user's own list
+ * of organisations is how a stale organisation id is found out, so it cannot
+ * depend on one. An app's interceptor honours it by passing the request's
+ * config to getRequestOrganizationId(config).
+ *
+ *   axiosInstance.get("/organizations", withoutOrganization({ params }))
+ */
+const WITHOUT_ORGANIZATION_FLAG = "erpWithoutOrganization";
+function withoutOrganization(config) {
+    return { ...(config ?? {}), [WITHOUT_ORGANIZATION_FLAG]: true };
+}
+/**
+ * Marks a request for one particular organisation, whatever this tab has
+ * active. Used to retry the organisation list under each stored id when an
+ * API refuses it without one (see http/organization-fallback.ts).
+ */
+const FOR_ORGANIZATION_FIELD = "erpOrganizationId";
+function isWithoutOrganization(config) {
+    return (!!config &&
+        typeof config === "object" &&
+        config[WITHOUT_ORGANIZATION_FLAG] === true);
+}
+function explicitOrganization(config) {
+    if (!config || typeof config !== "object")
+        return null;
+    const value = config[FOR_ORGANIZATION_FIELD];
+    return typeof value === "string" || typeof value === "number"
+        ? normalise(value)
+        : null;
+}
+/**
+ * Every organisation id this browser has stored for the tab — the tab's
+ * own, localStorage, the cookie — distinct, in that order.
+ */
+function getStoredOrganizationIds() {
+    const ids = [
+        getTabOrganizationId(),
+        readOrganizationStorage(),
+        readOrganizationCookie(),
+    ].filter((id) => id !== null);
+    return [...new Set(ids)];
+}
 /**
  * The organisation a request from this tab belongs to: the tab's own, then
  * localStorage, then the cookie. Use it for the X-Organization-ID header —
  * and read it before any `await` in the interceptor, so the header names the
  * organisation that was active when the request was made.
  *
+ * Pass the request's config: a request marked withoutOrganization() gets
+ * null, so no header.
+ *
  * localStorage before the cookie: setOrganizationId writes localStorage
  * synchronously and then awaits a server action for the cookie, so during
  * that round trip the cookie still names the previous organisation.
+ *
+ * Once the user's organisations are known (setKnownOrganizationIds), the
+ * first of those that is one of them wins: 0.1.60 let a deleted
+ * organisation's id left in localStorage beat a valid cookie, and every
+ * request — the organisation list included — was refused. If none is a
+ * member the first is still sent, as before: the list may simply be behind
+ * (an organisation created a moment ago).
+ */
+function getRequestOrganizationId(config) {
+    const explicit = explicitOrganization(config);
+    if (explicit)
+        return explicit;
+    if (isWithoutOrganization(config))
+        return null;
+    const candidates = [
+        getTabOrganizationId(),
+        readOrganizationStorage(),
+        readOrganizationCookie(),
+    ];
+    if (knownOrganizationIds !== null) {
+        const member = candidates.find(id => id !== null && knownOrganizationIds.has(id));
+        if (member)
+            return member;
+    }
+    return candidates.find(id => id !== null) ?? null;
+}
+function expireOrganizationCookie() {
+    // The cookie is set by the host's server action, host-only or on a parent
+    // domain (AUTH_COOKIE_DOMAIN, e.g. .antniti.com). The browser does not say
+    // which, so expire it on the host and on every parent domain.
+    const base = `${ORGANIZATION_ID_KEY}=; Max-Age=0; path=/; SameSite=Lax`;
+    try {
+        document.cookie = base;
+        const labels = window.location.hostname.split(".");
+        for (let i = 0; i < labels.length - 1; i++) {
+            document.cookie = `${base}; domain=.${labels.slice(i).join(".")}`;
+        }
+    }
+    catch {
+        // Cookies unavailable: nothing to clear.
+    }
+}
+/**
+ * Forget the active organisation everywhere this browser keeps it: the tab,
+ * localStorage and the `erp.organizationId` cookie. Call on sign-out, so the
+ * next person to sign in on this browser does not start in the previous
+ * person's organisation.
  */
-function getRequestOrganizationId() {
-    return (getTabOrganizationId() ??
-        readOrganizationStorage() ??
-        readOrganizationCookie());
+function clearStoredOrganization() {
+    if (!isBrowser$1())
+        return;
+    tabOrganizationId = null;
+    knownOrganizationIds = null;
+    try {
+        localStorage.removeItem(ORGANIZATION_ID_KEY);
+    }
+    catch {
+        // Storage unavailable: nothing to clear.
+    }
+    expireOrganizationCookie();
 }
 
 const SELECTED_ORG_STORAGE_KEY = "erp.organizationId";
@@ -1412,6 +1546,44 @@ const runGlobalRequestPrecheck = (config) => {
     return validateGoodsReceiptChecks(config.data);
 };
 
+/**
+ * The organisation list is asked for without an organisation (see
+ * withoutOrganization), but some APIs still refuse it without one: Peoplx's
+ * GET /organizations sits behind its module.hr plan gate, which answers 400
+ * "organization context required" to no header and 403 to an organisation
+ * that does not exist. Until those routes stop needing one, a refused list is
+ * asked again under each organisation this browser has stored — the tab's,
+ * localStorage's, the cookie's — so one good id among stale ones still gets
+ * the user their list, and with it the way back to a working organisation.
+ *
+ * `send` re-sends the request (an axios instance call). Returns the first
+ * answer that succeeds, or undefined when none did or the request is not a
+ * refused organisation-less one. Each retry is marked, so it never retries
+ * itself.
+ */
+const RETRIED = "_erpOrganizationFallback";
+async function retryWithStoredOrganizations(config, status, send) {
+    if (!config ||
+        config[WITHOUT_ORGANIZATION_FLAG] !== true ||
+        config[RETRIED] === true ||
+        (status !== 400 && status !== 403)) {
+        return undefined;
+    }
+    for (const id of getStoredOrganizationIds()) {
+        try {
+            return await send({
+                ...config,
+                [RETRIED]: true,
+                [FOR_ORGANIZATION_FIELD]: id,
+            });
+        }
+        catch {
+            // That one was refused too; try the next.
+        }
+    }
+    return undefined;
+}
+
 const isBrowser = () => typeof window !== "undefined";
 const isAuthEndpoint = (url) => !!url && url.includes("/api/auth/");
 const isAuthPage = () => isBrowser() && window.location.pathname.startsWith("/auth/");
@@ -1420,7 +1592,7 @@ const redirectToLogout = async () => {
         return;
     localStorage.clear();
     sessionStorage.clear();
-    setOrganizationId(null);
+    clearStoredOrganization();
     clearAccessTokenCache();
     await signOut({ callbackUrl: "/auth/signin" });
 };
@@ -1452,7 +1624,7 @@ instance.interceptors.request.use(async (config) => {
     // Read before the token await: the header must name the organisation that
     // was active when the request was made (and under which its query is
     // cached), not whatever is active once the token resolves.
-    const organizationId = getRequestOrganizationId();
+    const organizationId = getRequestOrganizationId(config);
     const token = await getAccessToken(false);
     if (token) {
         config.headers.Authorization = `Bearer ${token}`;
@@ -1512,6 +1684,9 @@ instance.interceptors.response.use(response => {
             window.dispatchEvent(new CustomEvent("erp:employee-record-required"));
         }
     }
+    const listed = await retryWithStoredOrganizations(originalRequest, error.response?.status, config => instance(config));
+    if (listed !== undefined)
+        return listed;
     return Promise.reject(toApiError(error));
 });
 
@@ -1538,7 +1713,7 @@ function platformApiBase(app) {
  * This package's version, attached to help messages so the back office can
  * tell which shell a report came from. Keep in step with package.json.
  */
-const SHELL_VERSION = "0.1.60";
+const SHELL_VERSION = "0.1.61";
 
 const HELP_APP_LABEL = {
     platform: "แพลตฟอร์ม",
@@ -1861,6 +2036,9 @@ function NavUser({ organization, avatarSrc, profileHref, selectOrganizationHref
     };
     const handleSignOut = async () => {
         setIsSigningOut(true);
+        // The next person to sign in on this browser must not start in this
+        // person's organisation: forget it in the tab, localStorage and cookie.
+        clearStoredOrganization();
         try {
             await signOut({ callbackUrl: signInRedirectHref, redirect: true });
         }
@@ -3254,6 +3432,31 @@ function resolveUrlOrgGate({ code, organizations, organizationsStatus, organizat
             return { state: "unverified" };
     }
 }
+function resolveStaleOrganization({ code, organizations, organizationsStatus, organizationId, }) {
+    const status = organizationsStatus ?? (organizations.length > 0 ? "success" : undefined);
+    if (status !== "success")
+        return { action: "none" };
+    const activeId = organizationId === null || organizationId === undefined
+        ? ""
+        : String(organizationId).trim();
+    if (activeId === "")
+        return { action: "none" };
+    if (organizations.some(org => String(org.id) === activeId)) {
+        return { action: "none" };
+    }
+    const urlOrg = findOrganizationForCode(code, organizations);
+    if (urlOrg) {
+        return { action: "use", targetId: String(urlOrg.id), fromUrl: true };
+    }
+    if (organizations.length === 1) {
+        return {
+            action: "use",
+            targetId: String(organizations[0].id),
+            fromUrl: false,
+        };
+    }
+    return { action: "forget" };
+}
 
 /**
  * Top-level app chrome: sticky header, sidebar slot, content gutter and the
@@ -3315,6 +3518,44 @@ function AppLayoutShell({ children, sidebar, loadingComponent, breadcrumb, permi
         requestedSwitchRef.current = switchTargetId;
         void setOrganizationId(switchTargetId);
     }, [switchTargetId, setOrganizationId]);
+    // Once the user's organisations are known, requests prefer a stored
+    // organisation that is one of them (getRequestOrganizationId).
+    const organizationsLoaded = (organizationsStatus ??
+        (organizations.length > 0 ? "success" : undefined)) === "success";
+    useEffect(() => {
+        if (organizationsLoaded) {
+            setKnownOrganizationIds(organizations.map(org => org.id));
+        }
+    }, [organizationsLoaded, organizations]);
+    // An active organisation that is not one of the user's — deleted, or left —
+    // is replaced, so it stops being sent with every request. The URL's
+    // organisation, when the user is a member, is the gate's switch above;
+    // otherwise the user's only organisation, or none (they pick one: the
+    // refusal below offers it, and a path without a code goes to the picker).
+    // Once per stale id and target, so a setter that does not take cannot loop.
+    const staleRecovery = resolveStaleOrganization({
+        code,
+        organizations,
+        organizationsStatus,
+        organizationId,
+    });
+    const staleRecoveryTarget = staleRecovery.action === "forget"
+        ? null
+        : staleRecovery.action === "use" && !staleRecovery.fromUrl
+            ? staleRecovery.targetId
+            : undefined;
+    const staleRecoveryKey = staleRecoveryTarget === undefined
+        ? null
+        : `${String(organizationId)}>${staleRecoveryTarget ?? ""}`;
+    const handledStaleRecoveryRef = useRef(null);
+    useEffect(() => {
+        if (staleRecoveryKey === null || staleRecoveryTarget === undefined)
+            return;
+        if (handledStaleRecoveryRef.current === staleRecoveryKey)
+            return;
+        handledStaleRecoveryRef.current = staleRecoveryKey;
+        void setOrganizationId(staleRecoveryTarget);
+    }, [staleRecoveryKey, staleRecoveryTarget, setOrganizationId]);
     // Key for the content subtree. It exists so switching organizations throws
     // away the previous org's component state — but it must react ONLY to a real
     // switch. organizationId legitimately passes through null while the context
@@ -4025,5 +4266,5 @@ const getAxiosErrorMessage = (error) => {
     return String(error);
 };
 
-export { AccessDenied, ApiError, AppBreadcrumb, AppLayoutShell, AppSidebar, EMPLOYEE_RECORD_OK_EVENT, EMPLOYEE_RECORD_REQUIRED, EMPLOYEE_RECORD_REQUIRED_EVENT, EmployeeRequiredGate, FeatureFlagsProvider, HeaderBackground, HelpButton, HelpDialogHost, NavMain, NavTools, NavUser, OWNER_CHIP, OrganizationSwitcher, PLAN_FEATURES, PermissionGateShell, PermissionProvider, PermissionRulesProvider, ReactQueryProvider, SHELL_VERSION, SessionBackedProfileCacheSeeder, SessionRefreshTrigger, SidebarContent, SidebarFooter, SidebarHeader, SidebarHelpCard, SidebarHelpLink, SidebarProvider, SidebarTrigger, TapMenu, ThemeProvider, WORKSPACE_HEADER_VARS, WORKSPACE_LIGHT_HEADER_VARS, WorkspaceBrand, instance as axiosInstance, buildSystemLinks, buildUrlWithCode, canAccessNavPermissionRoute, clearAccessTokenCache, clearOrganizationId, closeHelp, decodeJWT, describeAttached, describeBrowser, detectHelpApp, filterNavigationModulesByPermission, filterNavigationToolsByPermission, findOrganizationForCode, getAccessToken, getActiveModule, getActiveSubModule, getAxiosErrorMessage, getOrganizationId, getQueryClientConfig, getRequestOrganizationId, getRequiredChildGroups, getTabOrganizationId, hasPlanFeature, isLikelyTransientNetworkError, isPathActive, myRolesQueryKey, normalizePathnameForPermissionRules, openHelp, organizationScopedQueryHash, parseMyRoles, resolveActiveNav, resolveSidebarNav, resolveUiRoutePermission, resolveUrlOrgGate, roleSummary, runGlobalRequestPrecheck, runWithTransientRetry, setOrganizationId, setTabOrganizationId, shouldRetryQuery, toApiError, unwrapApiResponse, updateOrganizationId, useClearOrgOnUserChange, useFeatureFlag, useFeatureFlags, useInvalidateQueriesOnOrgChange, useKeycloakRoles, useMyRoles, useOrganizationIdState, usePermissionRules, useSessionRefresh, useSidebar, useSidebarToggle };
+export { AccessDenied, ApiError, AppBreadcrumb, AppLayoutShell, AppSidebar, EMPLOYEE_RECORD_OK_EVENT, EMPLOYEE_RECORD_REQUIRED, EMPLOYEE_RECORD_REQUIRED_EVENT, EmployeeRequiredGate, FOR_ORGANIZATION_FIELD, FeatureFlagsProvider, HeaderBackground, HelpButton, HelpDialogHost, NavMain, NavTools, NavUser, OWNER_CHIP, OrganizationSwitcher, PLAN_FEATURES, PermissionGateShell, PermissionProvider, PermissionRulesProvider, ReactQueryProvider, SHELL_VERSION, SessionBackedProfileCacheSeeder, SessionRefreshTrigger, SidebarContent, SidebarFooter, SidebarHeader, SidebarHelpCard, SidebarHelpLink, SidebarProvider, SidebarTrigger, TapMenu, ThemeProvider, WITHOUT_ORGANIZATION_FLAG, WORKSPACE_HEADER_VARS, WORKSPACE_LIGHT_HEADER_VARS, WorkspaceBrand, instance as axiosInstance, buildSystemLinks, buildUrlWithCode, canAccessNavPermissionRoute, clearAccessTokenCache, clearOrganizationId, clearStoredOrganization, closeHelp, decodeJWT, describeAttached, describeBrowser, detectHelpApp, filterNavigationModulesByPermission, filterNavigationToolsByPermission, findOrganizationForCode, getAccessToken, getActiveModule, getActiveSubModule, getAxiosErrorMessage, getOrganizationId, getQueryClientConfig, getRequestOrganizationId, getRequiredChildGroups, getStoredOrganizationIds, getTabOrganizationId, hasPlanFeature, isKnownStaleOrganizationId, isLikelyTransientNetworkError, isPathActive, myRolesQueryKey, normalizePathnameForPermissionRules, openHelp, organizationScopedQueryHash, parseMyRoles, resolveActiveNav, resolveSidebarNav, resolveStaleOrganization, resolveUiRoutePermission, resolveUrlOrgGate, retryWithStoredOrganizations, roleSummary, runGlobalRequestPrecheck, runWithTransientRetry, setKnownOrganizationIds, setOrganizationId, setTabOrganizationId, shouldRetryQuery, toApiError, unwrapApiResponse, updateOrganizationId, useClearOrgOnUserChange, useFeatureFlag, useFeatureFlags, useInvalidateQueriesOnOrgChange, useKeycloakRoles, useMyRoles, useOrganizationIdState, usePermissionRules, useSessionRefresh, useSidebar, useSidebarToggle, withoutOrganization };
 //# sourceMappingURL=index.esm.js.map