@emilgroup/account-sdk 1.49.1-beta.12 → 1.49.1-beta.16

package/README.md

@@ -17,11 +17,11 @@ Although this package can be used in both TypeScript and JavaScript, it is inten
 Navigate to the folder of your consuming project and run one of the following commands:
 
 ```
-npm install @emilgroup/account-sdk@1.49.1-beta.12 --save
+npm install @emilgroup/account-sdk@1.49.1-beta.16 --save
 ```
 or 
 ```
-yarn add @emilgroup/account-sdk@1.49.1-beta.12
+yarn add @emilgroup/account-sdk@1.49.1-beta.16
 ```
 
 And then you can import `AccountsApi`.

package/api/accounts-api.ts

@@ -67,8 +67,10 @@ export const AccountsApiAxiosParamCreator = function (configuration?: Configurat
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -115,8 +117,10 @@ export const AccountsApiAxiosParamCreator = function (configuration?: Configurat
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -165,8 +169,10 @@ export const AccountsApiAxiosParamCreator = function (configuration?: Configurat
                 localVarQueryParameter['expand'] = expand;
             }
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -215,8 +221,10 @@ export const AccountsApiAxiosParamCreator = function (configuration?: Configurat
                 localVarQueryParameter['expand'] = expand;
             }
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -291,8 +299,10 @@ export const AccountsApiAxiosParamCreator = function (configuration?: Configurat
                 localVarQueryParameter['filters'] = filters;
             }
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -339,8 +349,10 @@ export const AccountsApiAxiosParamCreator = function (configuration?: Configurat
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token; an empty value is never sent.
+            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+            if (authorizationValue) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 

package/base.ts

@@ -32,9 +32,20 @@ export const COLLECTION_FORMATS = {
     pipes: "|",
 };
 
+export interface SessionClass {
+    sub: string;
+    username?: string;
+    email?: string;
+    tenantSlug?: string;
+    permissions?: string;
+    expiresAt?: number;
+}
+
 export interface LoginClass {
     accessToken: string;
     permissions: string;
+    authMode?: string;
+    session?: SessionClass;
 }
 
 export interface SwitchWorkspaceRequest {
@@ -45,6 +56,8 @@ export interface SwitchWorkspaceRequest {
 export interface SwitchWorkspaceResponseClass {
     accessToken: string;
     permissions: string;
+    authMode?: string;
+    session?: SessionClass;
 }
 
 export enum Environment {
@@ -77,10 +90,19 @@ interface TokenData {
     accessToken?: string;
     username?: string;
     permissions?: string;
+    // 'both' or 'session' when authservice keeps the tokens in a server session.
+    authMode?: string;
+    sub?: string;
 }
 
 const NETWORK_ERROR_MESSAGE = "Network Error";
 const TOKEN_DATA = 'APP_TOKEN';
+// Sent only to authservice, to ask for a server session.
+const AUTH_MODE_HEADER = 'X-Emil-Auth-Mode';
+// Names the account on every call; one browser session can hold several.
+const ACCOUNT_HEADER = 'X-Emil-Account';
+const SESSION_MODES = ['both', 'session'];
+const RESEND_SAFE_METHODS = ['get', 'head', 'options'];
 
 /**
  *
@@ -103,7 +125,11 @@ export class BaseAPI {
             this.basePath = configuration.basePath || this.basePath;
 
             if (configuration.cookieAuth) {
-                this.useCookieAuth();
+                this.configuration.username = this.configuration.username || this.tokenData.username;
+            }
+
+            if (this.usesSession()) {
+                this.useSessionAuth();
             } else {
                 // Use config token if provided, otherwise use tokenData token
                 const configToken = this.configuration.accessToken;
@@ -123,10 +149,105 @@ export class BaseAPI {
         this.attachInterceptor(axios);
     }
 
-    // Cookie mode: the browser sends the HttpOnly access cookie, so no token is read from storage.
-    private useCookieAuth() {
-        this.configuration.username = this.configuration.username || this.tokenData.username;
-        this.configuration.baseOptions = { ...this.configuration.baseOptions, withCredentials: true };
+    // The app's own account wins over APP_TOKEN, which holds whichever tab wrote last.
+    private sessionAccount(): string | undefined {
+        return this.configuration.account || this.tokenData.sub;
+    }
+
+    // Apps may pass the address as the second argument only; authservice is on the same host.
+    private authBasePath(): string {
+        return this.configuration.basePath || this.basePath;
+    }
+
+    private usesSession(): boolean {
+        return !!this.configuration.cookieAuth && SESSION_MODES.indexOf(this.tokenData.authMode) !== -1 && !!this.sessionAccount();
+    }
+
+    private useSessionAuth() {
+        const { headers, ...baseOptions } = this.configuration.baseOptions || {};
+        this.configuration.accessToken = '';
+        this.configuration.baseOptions = {
+            ...baseOptions,
+            withCredentials: true,
+            headers: { ...headers, [ACCOUNT_HEADER]: this.sessionAccount() },
+        };
+    }
+
+    private useHeaderAuth(accessToken: string) {
+        this.configuration.accessToken = accessToken ? `Bearer ${accessToken}` : '';
+        this.tokenData.accessToken = accessToken;
+        delete this.tokenData.authMode;
+        delete this.tokenData.sub;
+        if (this.configuration.cookieAuth) {
+            const { withCredentials, headers, ...baseOptions } = this.configuration.baseOptions || {};
+            const { [ACCOUNT_HEADER]: account, ...otherHeaders } = headers || {};
+            this.configuration.baseOptions = { ...baseOptions, headers: otherHeaders };
+        }
+    }
+
+    private applyTokenReply({ accessToken, authMode, session }: LoginClass) {
+        if (this.configuration.cookieAuth && SESSION_MODES.indexOf(authMode) !== -1 && session?.sub) {
+            this.tokenData.authMode = authMode;
+            this.tokenData.sub = session.sub;
+            if (this.configuration.account) {
+                // A workspace switch moves the app to another account.
+                this.configuration.account = session.sub;
+            }
+            // Both keeps the token for apps not moved yet; session mode keeps no token at all.
+            if (authMode === 'both' && accessToken) {
+                this.tokenData.accessToken = accessToken;
+            } else {
+                delete this.tokenData.accessToken;
+            }
+            this.useSessionAuth();
+        } else {
+            this.useHeaderAuth(accessToken);
+        }
+    }
+
+    private sessionHeaders(): Record<string, string> {
+        if (!this.configuration.cookieAuth) {
+            return {};
+        }
+        return {
+            [AUTH_MODE_HEADER]: 'session',
+            ...(this.usesSession() && { [ACCOUNT_HEADER]: this.sessionAccount() }),
+        };
+    }
+
+    private withCurrentAuth(config: AxiosRequestConfig): AxiosRequestConfig {
+        delete config.headers['Authorization'];
+        delete config.headers[ACCOUNT_HEADER];
+        if (this.usesSession()) {
+            config.headers[ACCOUNT_HEADER] = this.sessionAccount();
+            config.withCredentials = true;
+        } else if (this.configuration.accessToken) {
+            config.headers['Authorization'] = this.configuration.accessToken;
+        }
+        return config;
+    }
+
+    // Both keeps the token, so a session call the browser could not complete can be sent again with it.
+    private canRetryWithToken(config: AxiosRequestConfig): boolean {
+        return !!config.withCredentials && !!config.headers?.[ACCOUNT_HEADER]
+            && !!this.tokenData.accessToken && this.tokenData.authMode !== 'session';
+    }
+
+    // A network error can come after the server ran the call, so only a call that is safe to repeat is sent again.
+    private canResend(config: AxiosRequestConfig): boolean {
+        return RESEND_SAFE_METHODS.indexOf((config.method || 'get').toLowerCase()) !== -1
+            || Object.keys(config.headers || {}).some((name) => name.toLowerCase() === 'idempotency-key');
+    }
+
+    private switchToToken() {
+        this.useHeaderAuth(this.tokenData.accessToken);
+        this.storeTokenData(this.tokenData);
+    }
+
+    private retryWithToken(axios: AxiosInstance, config: AxiosRequestConfig) {
+        this.switchToToken();
+        config.withCredentials = false;
+        return axios(this.withCurrentAuth(config));
     }
 
     selectEnvironment(env: Environment) {
@@ -148,8 +269,8 @@ export class BaseAPI {
     async authorize(username: string, password: string, targetWorkspace?: string): Promise<void> {
         const options: AxiosRequestConfig = {
             method: 'POST',
-            url: `${this.configuration.basePath}/authservice/v1/login`,
-            headers: { 'Content-Type': 'application/json' },
+            url: `${this.authBasePath()}/authservice/v1/login`,
+            headers: { 'Content-Type': 'application/json', ...(this.configuration.cookieAuth && { [AUTH_MODE_HEADER]: 'session' }) },
             data: {
                 username,
                 password,
@@ -159,15 +280,10 @@ export class BaseAPI {
 
         const response = await globalAxios.request<LoginClass>(options);
 
-        const { data: { accessToken, permissions } } = response;
-
         this.configuration.username = username;
         this.tokenData.username = username;
-        this.tokenData.permissions = permissions;
-        if (!this.configuration.cookieAuth) {
-            this.configuration.accessToken = `Bearer ${accessToken}`;
-            this.tokenData.accessToken = accessToken;
-        }
+        this.tokenData.permissions = response.data.permissions;
+        this.applyTokenReply(response.data);
 
         // Switch workspace if provided
         if (targetWorkspace) {
@@ -187,10 +303,11 @@ export class BaseAPI {
     async switchWorkspace(targetWorkspace: string): Promise<void> {
         const options: AxiosRequestConfig = {
             method: 'POST',
-            url: `${this.configuration.basePath}/authservice/v1/workspaces/switch`,
+            url: `${this.authBasePath()}/authservice/v1/workspaces/switch`,
             headers: {
                 'Content-Type': 'application/json',
-                ...(this.configuration.cookieAuth ? {} : { 'Authorization': `Bearer ${this.configuration.accessToken}` }),
+                ...this.sessionHeaders(),
+                ...(!this.usesSession() && !!this.configuration.accessToken && { 'Authorization': this.configuration.accessToken as string }),
             },
             data: {
                 username: this.configuration.username,
@@ -201,13 +318,8 @@ export class BaseAPI {
 
         const response = await globalAxios.request<SwitchWorkspaceResponseClass>(options);
 
-        const { data: { accessToken, permissions } } = response;
-
-        this.tokenData.permissions = permissions;
-        if (!this.configuration.cookieAuth) {
-            this.configuration.accessToken = `Bearer ${accessToken}`;
-            this.tokenData.accessToken = accessToken;
-        }
+        this.tokenData.permissions = response.data.permissions;
+        this.applyTokenReply(response.data);
 
         this.storeTokenData({
             ...this.tokenData
@@ -233,9 +345,10 @@ export class BaseAPI {
 
         const options: AxiosRequestConfig = {
             method: 'POST',
-            url: `${this.configuration.basePath}/authservice/v1/refresh-token`,
+            url: `${this.authBasePath()}/authservice/v1/refresh-token`,
             headers: {
                 'Content-Type': 'application/json',
+                ...this.sessionHeaders(),
             },
             data: { username: username },
             withCredentials: true,
@@ -247,11 +360,6 @@ export class BaseAPI {
 
     private storeTokenData(tokenData?: TokenData) {
         if (typeof window !== 'undefined') {
-            if (tokenData && this.configuration?.cookieAuth) {
-                // Cookie mode saves who is logged in, never the token; a token saved by apps not yet migrated stays.
-                const { username, permissions } = tokenData;
-                tokenData = { ...(defaultStorage().get<TokenData>(TOKEN_DATA) || {}), username, permissions };
-            }
             defaultStorage().set<TokenData>(TOKEN_DATA, tokenData);
         }
     }
@@ -281,22 +389,22 @@ export class BaseAPI {
                         && !originalConfig._retry) {
                         originalConfig._retry = true;
                         try {
-                            const { accessToken: tokenString, permissions } = await this.refreshTokenInternal();
-                            this.tokenData.permissions = permissions;
-
-                            delete originalConfig.headers['Authorization']
+                            const reply = await this.refreshTokenInternal();
+                            this.tokenData.permissions = reply.permissions;
+                            this.applyTokenReply(reply);
+                            this.storeTokenData(this.tokenData);
 
-                            // In cookie mode the refresh reply renewed the access cookie, so retry without a header.
-                            if (!this.configuration.cookieAuth) {
-                                const accessToken = `Bearer ${tokenString}`;
-                                originalConfig.headers['Authorization'] = accessToken;
-                                this.configuration.accessToken = accessToken;
-                                this.tokenData.accessToken = tokenString;
+                            if (!this.usesSession()) {
+                                return axios(this.withCurrentAuth(originalConfig));
                             }
 
-                            this.storeTokenData(this.tokenData);
-
-                            return axios(originalConfig);
+                            // Both mode: if the browser does not send the session cookie (another site), use the token.
+                            return axios(this.withCurrentAuth(originalConfig)).catch((retryError) => {
+                                if (retryError?.response?.status !== 401 || !this.tokenData.accessToken) {
+                                    return Promise.reject(retryError);
+                                }
+                                return this.retryWithToken(axios, originalConfig);
+                            });
                         } catch (_error) {
                             if (_error.response && _error.response.data) {
                                 return Promise.reject(_error.response.data);
@@ -304,26 +412,30 @@ export class BaseAPI {
                             return Promise.reject(_error);
                         }
                     }
+                } else if (err.message === NETWORK_ERROR_MESSAGE && this.canRetryWithToken(originalConfig)) {
+                    // Both mode: the browser blocked the session call or hid its reply; later calls use the token.
+                    if (!this.canResend(originalConfig)) {
+                        this.switchToToken();
+                        return Promise.reject(err);
+                    }
+                    return this.retryWithToken(axios, originalConfig);
                 } else if (err.message === NETWORK_ERROR_MESSAGE
-                    && originalConfig.headers.hasOwnProperty('Authorization')
+                    && (originalConfig.headers.hasOwnProperty('Authorization')
+                        || (this.configuration.cookieAuth && originalConfig.withCredentials && this.canResend(originalConfig)))
                     && _retry_count < 4
                 ) {
                     _retry_count++;
                     try {
-                        const { accessToken: tokenString, permissions } = await this.refreshTokenInternal();
-                        const accessToken = `Bearer ${tokenString}`;
-                        this.tokenData.permissions = permissions;
+                        // In session mode an unreadable 401 (no CORS headers on the error reply) also lands here.
+                        const reply = await this.refreshTokenInternal();
+                        this.tokenData.permissions = reply.permissions;
 
                         _retry = true;
-                        originalConfig.headers['Authorization'] = accessToken;
-
-                        this.configuration.accessToken = accessToken;
-                        this.tokenData.accessToken = tokenString;
-
+                        this.applyTokenReply(reply);
                         this.storeTokenData(this.tokenData);
 
                         return axios.request({
-                            ...originalConfig,
+                            ...this.withCurrentAuth(originalConfig),
                         });
                     } catch (_error) {
                         if (_error.response && _error.response.data) {

package/common.ts

@@ -130,9 +130,10 @@ export const toPathString = function (url: URL) {
  * @export
  */
 export const createRequestFunction = function (axiosArgs: RequestArgs, globalAxios: AxiosInstance, BASE_PATH: string, configuration?: Configuration) {
-    return <T = unknown, R = AxiosResponse<T>>(axios: AxiosInstance = globalAxios, basePath: string = BASE_PATH) => {
+    // Typed by hand: since axios 1.20, request() returns an internal axios type that SDK declarations cannot name.
+    return <T = unknown, R = AxiosResponse<T>>(axios: AxiosInstance = globalAxios, basePath: string = BASE_PATH): Promise<R> => {
         const axiosRequestArgs = {...axiosArgs.options, url: (configuration?.basePath || basePath) + axiosArgs.url};
-        return axios.request<T, R>(axiosRequestArgs);
+        return axios.request<T, R>(axiosRequestArgs) as Promise<R>;
     };
 }
 

package/configuration.ts

@@ -22,6 +22,7 @@ export interface ConfigurationParameters {
     baseOptions?: any;
     formDataCtor?: new () => any;
     cookieAuth?: boolean;
+    account?: string;
 }
 
 export class Configuration {
@@ -76,13 +77,20 @@ export class Configuration {
     formDataCtor?: new () => any;
 
     /**
-     * Authenticate with the HttpOnly access cookie instead of a stored token: every call sends credentials.
-     * The browser holds one cookie, so use it with one logged-in account; log out through the auth service.
+     * Use a server session when authservice makes one; otherwise the token, as without this option.
+     * Set `account` too, so each SDK object keeps its own account.
      *
      * @type {boolean}
      * @memberof Configuration
      */
     cookieAuth?: boolean;
+    /**
+     * The session account (Cognito sub) this app shows, so the SDK never takes another tab's account.
+     *
+     * @type {string}
+     * @memberof Configuration
+     */
+    account?: string;
 
     constructor(param: ConfigurationParameters = {}) {
         this.apiKey = param.apiKey;
@@ -93,6 +101,7 @@ export class Configuration {
         this.baseOptions = param.baseOptions;
         this.formDataCtor = param.formDataCtor;
         this.cookieAuth = param.cookieAuth;
+        this.account = param.account;
     }
 
     /**

package/dist/api/accounts-api.d.ts

@@ -408,7 +408,7 @@ export declare class AccountsApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof AccountsApi
      */
-    createAccount(requestParameters: AccountsApiCreateAccountRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<CreateAccountResponseClass, any, {}>>;
+    createAccount(requestParameters: AccountsApiCreateAccountRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<CreateAccountResponseClass, any, {}, any>>;
     /**
      * Permanently deletes the account. Supply the unique code that was returned when you created the account and this will delete it.  **Required Permissions**  \"partner-management.partners.delete\"
      * @summary Delete the account
@@ -417,7 +417,7 @@ export declare class AccountsApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof AccountsApi
      */
-    deleteAccount(requestParameters: AccountsApiDeleteAccountRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}>>;
+    deleteAccount(requestParameters: AccountsApiDeleteAccountRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<void, any, {}, any>>;
     /**
      * Retrieves the details of the account that was previously created. Supply the unique account code      that was returned when you created it and Emil Api will return the corresponding account information.  **Required Permissions**  \"partner-management.partners.view\"
      * @summary Retrieve the account
@@ -426,7 +426,7 @@ export declare class AccountsApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof AccountsApi
      */
-    getAccount(requestParameters: AccountsApiGetAccountRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<GetAccountResponseClass, any, {}>>;
+    getAccount(requestParameters: AccountsApiGetAccountRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<GetAccountResponseClass, any, {}, any>>;
     /**
      * Retrieves the details of the account that was previously created. Supply the email      that was returned when you created it and Emil Api will return the corresponding account information. Email matching is case-insensitive.  **Required Permissions**  \"partner-management.partners.view\"
      * @summary Retrieve the account
@@ -435,7 +435,7 @@ export declare class AccountsApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof AccountsApi
      */
-    getAccountByEmail(requestParameters: AccountsApiGetAccountByEmailRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<GetAccountResponseClass, any, {}>>;
+    getAccountByEmail(requestParameters: AccountsApiGetAccountByEmailRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<GetAccountResponseClass, any, {}, any>>;
     /**
      * Returns a list of accounts you have previously created.        The accounts are returned in sorted order, with the oldest one appearing first.        For more information about pagination, read the Pagination documentation.  **Required Permissions**  \"partner-management.partners.view\"
      * @summary List accounts
@@ -444,7 +444,7 @@ export declare class AccountsApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof AccountsApi
      */
-    listAccounts(requestParameters?: AccountsApiListAccountsRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<ListAccountsResponseClass, any, {}>>;
+    listAccounts(requestParameters?: AccountsApiListAccountsRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<ListAccountsResponseClass, any, {}, any>>;
     /**
      * Updates the specified account by setting the values of the parameters passed. Any parameters not provided will be left unchanged.  **Required Permissions**  \"partner-management.partners.update\"
      * @summary Update the account
@@ -453,5 +453,5 @@ export declare class AccountsApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof AccountsApi
      */
-    updateAccount(requestParameters: AccountsApiUpdateAccountRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<UpdateAccountResponseClass, any, {}>>;
+    updateAccount(requestParameters: AccountsApiUpdateAccountRequest, options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<UpdateAccountResponseClass, any, {}, any>>;
 }

package/dist/api/accounts-api.js

@@ -103,7 +103,7 @@ var AccountsApiAxiosParamCreator = function (configuration) {
         createAccount: function (createAccountRequestDto, authorization, options) {
             if (options === void 0) { options = {}; }
             return __awaiter(_this, void 0, void 0, function () {
-                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, headersFromBaseOptions;
+                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, authorizationValue, headersFromBaseOptions;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -120,13 +120,16 @@ var AccountsApiAxiosParamCreator = function (configuration) {
                             localVarQueryParameter = {};
                             // authentication bearer required
                             // http bearer authentication required
-                            return [4 /*yield*/, (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration)];
+                            return [4 /*yield*/, (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration)
+                                // Only Authorization falls back to the configured token; an empty value is never sent.
+                            ];
                         case 1:
                             // authentication bearer required
                             // http bearer authentication required
                             _a.sent();
-                            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+                            authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+                            if (authorizationValue) {
+                                localVarHeaderParameter['Authorization'] = String(authorizationValue);
                             }
                             localVarHeaderParameter['Content-Type'] = 'application/json';
                             (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
@@ -152,7 +155,7 @@ var AccountsApiAxiosParamCreator = function (configuration) {
         deleteAccount: function (code, authorization, options) {
             if (options === void 0) { options = {}; }
             return __awaiter(_this, void 0, void 0, function () {
-                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, headersFromBaseOptions;
+                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, authorizationValue, headersFromBaseOptions;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -170,13 +173,16 @@ var AccountsApiAxiosParamCreator = function (configuration) {
                             localVarQueryParameter = {};
                             // authentication bearer required
                             // http bearer authentication required
-                            return [4 /*yield*/, (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration)];
+                            return [4 /*yield*/, (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration)
+                                // Only Authorization falls back to the configured token; an empty value is never sent.
+                            ];
                         case 1:
                             // authentication bearer required
                             // http bearer authentication required
                             _a.sent();
-                            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+                            authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+                            if (authorizationValue) {
+                                localVarHeaderParameter['Authorization'] = String(authorizationValue);
                             }
                             (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
                             headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
@@ -201,7 +207,7 @@ var AccountsApiAxiosParamCreator = function (configuration) {
         getAccount: function (code, authorization, expand, options) {
             if (options === void 0) { options = {}; }
             return __awaiter(_this, void 0, void 0, function () {
-                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, headersFromBaseOptions;
+                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, authorizationValue, headersFromBaseOptions;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -227,8 +233,9 @@ var AccountsApiAxiosParamCreator = function (configuration) {
                             if (expand !== undefined) {
                                 localVarQueryParameter['expand'] = expand;
                             }
-                            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+                            authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+                            if (authorizationValue) {
+                                localVarHeaderParameter['Authorization'] = String(authorizationValue);
                             }
                             (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
                             headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
@@ -253,7 +260,7 @@ var AccountsApiAxiosParamCreator = function (configuration) {
         getAccountByEmail: function (email, authorization, expand, options) {
             if (options === void 0) { options = {}; }
             return __awaiter(_this, void 0, void 0, function () {
-                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, headersFromBaseOptions;
+                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, authorizationValue, headersFromBaseOptions;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -279,8 +286,9 @@ var AccountsApiAxiosParamCreator = function (configuration) {
                             if (expand !== undefined) {
                                 localVarQueryParameter['expand'] = expand;
                             }
-                            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+                            authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+                            if (authorizationValue) {
+                                localVarHeaderParameter['Authorization'] = String(authorizationValue);
                             }
                             (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
                             headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
@@ -310,7 +318,7 @@ var AccountsApiAxiosParamCreator = function (configuration) {
         listAccounts: function (authorization, pageSize, pageToken, filter, search, order, expand, filters, options) {
             if (options === void 0) { options = {}; }
             return __awaiter(_this, void 0, void 0, function () {
-                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, headersFromBaseOptions;
+                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, authorizationValue, headersFromBaseOptions;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -351,8 +359,9 @@ var AccountsApiAxiosParamCreator = function (configuration) {
                             if (filters !== undefined) {
                                 localVarQueryParameter['filters'] = filters;
                             }
-                            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+                            authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+                            if (authorizationValue) {
+                                localVarHeaderParameter['Authorization'] = String(authorizationValue);
                             }
                             (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
                             headersFromBaseOptions = baseOptions && baseOptions.headers ? baseOptions.headers : {};
@@ -377,7 +386,7 @@ var AccountsApiAxiosParamCreator = function (configuration) {
         updateAccount: function (code, updateAccountRequestDto, authorization, options) {
             if (options === void 0) { options = {}; }
             return __awaiter(_this, void 0, void 0, function () {
-                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, headersFromBaseOptions;
+                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, authorizationValue, headersFromBaseOptions;
                 return __generator(this, function (_a) {
                     switch (_a.label) {
                         case 0:
@@ -397,13 +406,16 @@ var AccountsApiAxiosParamCreator = function (configuration) {
                             localVarQueryParameter = {};
                             // authentication bearer required
                             // http bearer authentication required
-                            return [4 /*yield*/, (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration)];
+                            return [4 /*yield*/, (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration)
+                                // Only Authorization falls back to the configured token; an empty value is never sent.
+                            ];
                         case 1:
                             // authentication bearer required
                             // http bearer authentication required
                             _a.sent();
-                            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+                            authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
+                            if (authorizationValue) {
+                                localVarHeaderParameter['Authorization'] = String(authorizationValue);
                             }
                             localVarHeaderParameter['Content-Type'] = 'application/json';
                             (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);

package/dist/api/health-api.d.ts

@@ -66,5 +66,5 @@ export declare class HealthApi extends BaseAPI {
      * @throws {RequiredError}
      * @memberof HealthApi
      */
-    check(options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<InlineResponse200, any, {}>>;
+    check(options?: AxiosRequestConfig): Promise<import("axios").AxiosResponse<InlineResponse200, any, {}, any>>;
 }

package/dist/base.d.ts

@@ -22,9 +22,19 @@ export declare const COLLECTION_FORMATS: {
     tsv: string;
     pipes: string;
 };
+export interface SessionClass {
+    sub: string;
+    username?: string;
+    email?: string;
+    tenantSlug?: string;
+    permissions?: string;
+    expiresAt?: number;
+}
 export interface LoginClass {
     accessToken: string;
     permissions: string;
+    authMode?: string;
+    session?: SessionClass;
 }
 export interface SwitchWorkspaceRequest {
     username: string;
@@ -33,6 +43,8 @@ export interface SwitchWorkspaceRequest {
 export interface SwitchWorkspaceResponseClass {
     accessToken: string;
     permissions: string;
+    authMode?: string;
+    session?: SessionClass;
 }
 export declare enum Environment {
     Production = "https://apiv2.emil.de",
@@ -63,7 +75,18 @@ export declare class BaseAPI {
     protected configuration: Configuration | undefined;
     private tokenData?;
     constructor(configuration?: Configuration, basePath?: string, axios?: AxiosInstance);
-    private useCookieAuth;
+    private sessionAccount;
+    private authBasePath;
+    private usesSession;
+    private useSessionAuth;
+    private useHeaderAuth;
+    private applyTokenReply;
+    private sessionHeaders;
+    private withCurrentAuth;
+    private canRetryWithToken;
+    private canResend;
+    private switchToToken;
+    private retryWithToken;
     selectEnvironment(env: Environment): void;
     selectBasePath(path: string): void;
     getPermissions(): Array<string>;

package/dist/base.js

@@ -74,6 +74,17 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
         if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
     }
 };
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -112,6 +123,12 @@ function resetRetry() {
 exports.resetRetry = resetRetry;
 var NETWORK_ERROR_MESSAGE = "Network Error";
 var TOKEN_DATA = 'APP_TOKEN';
+// Sent only to authservice, to ask for a server session.
+var AUTH_MODE_HEADER = 'X-Emil-Auth-Mode';
+// Names the account on every call; one browser session can hold several.
+var ACCOUNT_HEADER = 'X-Emil-Account';
+var SESSION_MODES = ['both', 'session'];
+var RESEND_SAFE_METHODS = ['get', 'head', 'options'];
 /**
  *
  * @export
@@ -129,7 +146,10 @@ var BaseAPI = /** @class */ (function () {
             this.configuration = configuration;
             this.basePath = configuration.basePath || this.basePath;
             if (configuration.cookieAuth) {
-                this.useCookieAuth();
+                this.configuration.username = this.configuration.username || this.tokenData.username;
+            }
+            if (this.usesSession()) {
+                this.useSessionAuth();
             }
             else {
                 // Use config token if provided, otherwise use tokenData token
@@ -148,10 +168,94 @@ var BaseAPI = /** @class */ (function () {
         }
         this.attachInterceptor(axios);
     }
-    // Cookie mode: the browser sends the HttpOnly access cookie, so no token is read from storage.
-    BaseAPI.prototype.useCookieAuth = function () {
-        this.configuration.username = this.configuration.username || this.tokenData.username;
-        this.configuration.baseOptions = __assign(__assign({}, this.configuration.baseOptions), { withCredentials: true });
+    // The app's own account wins over APP_TOKEN, which holds whichever tab wrote last.
+    BaseAPI.prototype.sessionAccount = function () {
+        return this.configuration.account || this.tokenData.sub;
+    };
+    // Apps may pass the address as the second argument only; authservice is on the same host.
+    BaseAPI.prototype.authBasePath = function () {
+        return this.configuration.basePath || this.basePath;
+    };
+    BaseAPI.prototype.usesSession = function () {
+        return !!this.configuration.cookieAuth && SESSION_MODES.indexOf(this.tokenData.authMode) !== -1 && !!this.sessionAccount();
+    };
+    BaseAPI.prototype.useSessionAuth = function () {
+        var _a;
+        var _b = this.configuration.baseOptions || {}, headers = _b.headers, baseOptions = __rest(_b, ["headers"]);
+        this.configuration.accessToken = '';
+        this.configuration.baseOptions = __assign(__assign({}, baseOptions), { withCredentials: true, headers: __assign(__assign({}, headers), (_a = {}, _a[ACCOUNT_HEADER] = this.sessionAccount(), _a)) });
+    };
+    BaseAPI.prototype.useHeaderAuth = function (accessToken) {
+        this.configuration.accessToken = accessToken ? "Bearer ".concat(accessToken) : '';
+        this.tokenData.accessToken = accessToken;
+        delete this.tokenData.authMode;
+        delete this.tokenData.sub;
+        if (this.configuration.cookieAuth) {
+            var _a = this.configuration.baseOptions || {}, withCredentials = _a.withCredentials, headers = _a.headers, baseOptions = __rest(_a, ["withCredentials", "headers"]);
+            var _b = headers || {}, _c = ACCOUNT_HEADER, account = _b[_c], otherHeaders = __rest(_b, [typeof _c === "symbol" ? _c : _c + ""]);
+            this.configuration.baseOptions = __assign(__assign({}, baseOptions), { headers: otherHeaders });
+        }
+    };
+    BaseAPI.prototype.applyTokenReply = function (_a) {
+        var accessToken = _a.accessToken, authMode = _a.authMode, session = _a.session;
+        if (this.configuration.cookieAuth && SESSION_MODES.indexOf(authMode) !== -1 && (session === null || session === void 0 ? void 0 : session.sub)) {
+            this.tokenData.authMode = authMode;
+            this.tokenData.sub = session.sub;
+            if (this.configuration.account) {
+                // A workspace switch moves the app to another account.
+                this.configuration.account = session.sub;
+            }
+            // Both keeps the token for apps not moved yet; session mode keeps no token at all.
+            if (authMode === 'both' && accessToken) {
+                this.tokenData.accessToken = accessToken;
+            }
+            else {
+                delete this.tokenData.accessToken;
+            }
+            this.useSessionAuth();
+        }
+        else {
+            this.useHeaderAuth(accessToken);
+        }
+    };
+    BaseAPI.prototype.sessionHeaders = function () {
+        var _a, _b;
+        if (!this.configuration.cookieAuth) {
+            return {};
+        }
+        return __assign((_a = {}, _a[AUTH_MODE_HEADER] = 'session', _a), (this.usesSession() && (_b = {}, _b[ACCOUNT_HEADER] = this.sessionAccount(), _b)));
+    };
+    BaseAPI.prototype.withCurrentAuth = function (config) {
+        delete config.headers['Authorization'];
+        delete config.headers[ACCOUNT_HEADER];
+        if (this.usesSession()) {
+            config.headers[ACCOUNT_HEADER] = this.sessionAccount();
+            config.withCredentials = true;
+        }
+        else if (this.configuration.accessToken) {
+            config.headers['Authorization'] = this.configuration.accessToken;
+        }
+        return config;
+    };
+    // Both keeps the token, so a session call the browser could not complete can be sent again with it.
+    BaseAPI.prototype.canRetryWithToken = function (config) {
+        var _a;
+        return !!config.withCredentials && !!((_a = config.headers) === null || _a === void 0 ? void 0 : _a[ACCOUNT_HEADER])
+            && !!this.tokenData.accessToken && this.tokenData.authMode !== 'session';
+    };
+    // A network error can come after the server ran the call, so only a call that is safe to repeat is sent again.
+    BaseAPI.prototype.canResend = function (config) {
+        return RESEND_SAFE_METHODS.indexOf((config.method || 'get').toLowerCase()) !== -1
+            || Object.keys(config.headers || {}).some(function (name) { return name.toLowerCase() === 'idempotency-key'; });
+    };
+    BaseAPI.prototype.switchToToken = function () {
+        this.useHeaderAuth(this.tokenData.accessToken);
+        this.storeTokenData(this.tokenData);
+    };
+    BaseAPI.prototype.retryWithToken = function (axios, config) {
+        this.switchToToken();
+        config.withCredentials = false;
+        return axios(this.withCurrentAuth(config));
     };
     BaseAPI.prototype.selectEnvironment = function (env) {
         this.selectBasePath(env);
@@ -168,14 +272,15 @@ var BaseAPI = /** @class */ (function () {
     };
     BaseAPI.prototype.authorize = function (username, password, targetWorkspace) {
         return __awaiter(this, void 0, void 0, function () {
-            var options, response, _a, accessToken, permissions;
+            var options, response;
+            var _a;
             return __generator(this, function (_b) {
                 switch (_b.label) {
                     case 0:
                         options = {
                             method: 'POST',
-                            url: "".concat(this.configuration.basePath, "/authservice/v1/login"),
-                            headers: { 'Content-Type': 'application/json' },
+                            url: "".concat(this.authBasePath(), "/authservice/v1/login"),
+                            headers: __assign({ 'Content-Type': 'application/json' }, (this.configuration.cookieAuth && (_a = {}, _a[AUTH_MODE_HEADER] = 'session', _a))),
                             data: {
                                 username: username,
                                 password: password,
@@ -185,14 +290,10 @@ var BaseAPI = /** @class */ (function () {
                         return [4 /*yield*/, axios_1.default.request(options)];
                     case 1:
                         response = _b.sent();
-                        _a = response.data, accessToken = _a.accessToken, permissions = _a.permissions;
                         this.configuration.username = username;
                         this.tokenData.username = username;
-                        this.tokenData.permissions = permissions;
-                        if (!this.configuration.cookieAuth) {
-                            this.configuration.accessToken = "Bearer ".concat(accessToken);
-                            this.tokenData.accessToken = accessToken;
-                        }
+                        this.tokenData.permissions = response.data.permissions;
+                        this.applyTokenReply(response.data);
                         if (!targetWorkspace) return [3 /*break*/, 3];
                         return [4 /*yield*/, this.switchWorkspace(targetWorkspace)];
                     case 2:
@@ -211,14 +312,14 @@ var BaseAPI = /** @class */ (function () {
     };
     BaseAPI.prototype.switchWorkspace = function (targetWorkspace) {
         return __awaiter(this, void 0, void 0, function () {
-            var options, response, _a, accessToken, permissions;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
+            var options, response;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
                     case 0:
                         options = {
                             method: 'POST',
-                            url: "".concat(this.configuration.basePath, "/authservice/v1/workspaces/switch"),
-                            headers: __assign({ 'Content-Type': 'application/json' }, (this.configuration.cookieAuth ? {} : { 'Authorization': "Bearer ".concat(this.configuration.accessToken) })),
+                            url: "".concat(this.authBasePath(), "/authservice/v1/workspaces/switch"),
+                            headers: __assign(__assign({ 'Content-Type': 'application/json' }, this.sessionHeaders()), (!this.usesSession() && !!this.configuration.accessToken && { 'Authorization': this.configuration.accessToken })),
                             data: {
                                 username: this.configuration.username,
                                 targetWorkspace: targetWorkspace,
@@ -227,13 +328,9 @@ var BaseAPI = /** @class */ (function () {
                         };
                         return [4 /*yield*/, axios_1.default.request(options)];
                     case 1:
-                        response = _b.sent();
-                        _a = response.data, accessToken = _a.accessToken, permissions = _a.permissions;
-                        this.tokenData.permissions = permissions;
-                        if (!this.configuration.cookieAuth) {
-                            this.configuration.accessToken = "Bearer ".concat(accessToken);
-                            this.tokenData.accessToken = accessToken;
-                        }
+                        response = _a.sent();
+                        this.tokenData.permissions = response.data.permissions;
+                        this.applyTokenReply(response.data);
                         this.storeTokenData(__assign({}, this.tokenData));
                         return [2 /*return*/];
                 }
@@ -260,10 +357,8 @@ var BaseAPI = /** @class */ (function () {
                         });
                         options = {
                             method: 'POST',
-                            url: "".concat(this.configuration.basePath, "/authservice/v1/refresh-token"),
-                            headers: {
-                                'Content-Type': 'application/json',
-                            },
+                            url: "".concat(this.authBasePath(), "/authservice/v1/refresh-token"),
+                            headers: __assign({ 'Content-Type': 'application/json' }, this.sessionHeaders()),
                             data: { username: username },
                             withCredentials: true,
                         };
@@ -276,13 +371,7 @@ var BaseAPI = /** @class */ (function () {
         });
     };
     BaseAPI.prototype.storeTokenData = function (tokenData) {
-        var _a;
         if (typeof window !== 'undefined') {
-            if (tokenData && ((_a = this.configuration) === null || _a === void 0 ? void 0 : _a.cookieAuth)) {
-                // Cookie mode saves who is logged in, never the token; a token saved by apps not yet migrated stays.
-                var username = tokenData.username, permissions = tokenData.permissions;
-                tokenData = __assign(__assign({}, ((0, common_1.defaultStorage)().get(TOKEN_DATA) || {})), { username: username, permissions: permissions });
-            }
             (0, common_1.defaultStorage)().set(TOKEN_DATA, tokenData);
         }
     };
@@ -302,65 +391,75 @@ var BaseAPI = /** @class */ (function () {
         axios.interceptors.response.use(function (res) {
             return res;
         }, function (err) { return __awaiter(_this, void 0, void 0, function () {
-            var originalConfig, _a, tokenString, permissions, accessToken, _error_1, _b, tokenString, permissions, accessToken, _error_2;
-            return __generator(this, function (_c) {
-                switch (_c.label) {
+            var originalConfig, reply, _error_1, reply, _error_2;
+            var _this = this;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
                     case 0:
                         originalConfig = err.config;
                         if (!(err.response && !(err.response instanceof XMLHttpRequest))) return [3 /*break*/, 5];
                         if (!((err.response.status === 401 || err.response.status === 403)
                             && !originalConfig._retry)) return [3 /*break*/, 4];
                         originalConfig._retry = true;
-                        _c.label = 1;
+                        _a.label = 1;
                     case 1:
-                        _c.trys.push([1, 3, , 4]);
+                        _a.trys.push([1, 3, , 4]);
                         return [4 /*yield*/, this.refreshTokenInternal()];
                     case 2:
-                        _a = _c.sent(), tokenString = _a.accessToken, permissions = _a.permissions;
-                        this.tokenData.permissions = permissions;
-                        delete originalConfig.headers['Authorization'];
-                        // In cookie mode the refresh reply renewed the access cookie, so retry without a header.
-                        if (!this.configuration.cookieAuth) {
-                            accessToken = "Bearer ".concat(tokenString);
-                            originalConfig.headers['Authorization'] = accessToken;
-                            this.configuration.accessToken = accessToken;
-                            this.tokenData.accessToken = tokenString;
-                        }
+                        reply = _a.sent();
+                        this.tokenData.permissions = reply.permissions;
+                        this.applyTokenReply(reply);
                         this.storeTokenData(this.tokenData);
-                        return [2 /*return*/, axios(originalConfig)];
+                        if (!this.usesSession()) {
+                            return [2 /*return*/, axios(this.withCurrentAuth(originalConfig))];
+                        }
+                        // Both mode: if the browser does not send the session cookie (another site), use the token.
+                        return [2 /*return*/, axios(this.withCurrentAuth(originalConfig)).catch(function (retryError) {
+                                var _a;
+                                if (((_a = retryError === null || retryError === void 0 ? void 0 : retryError.response) === null || _a === void 0 ? void 0 : _a.status) !== 401 || !_this.tokenData.accessToken) {
+                                    return Promise.reject(retryError);
+                                }
+                                return _this.retryWithToken(axios, originalConfig);
+                            })];
                     case 3:
-                        _error_1 = _c.sent();
+                        _error_1 = _a.sent();
                         if (_error_1.response && _error_1.response.data) {
                             return [2 /*return*/, Promise.reject(_error_1.response.data)];
                         }
                         return [2 /*return*/, Promise.reject(_error_1)];
-                    case 4: return [3 /*break*/, 9];
+                    case 4: return [3 /*break*/, 10];
                     case 5:
+                        if (!(err.message === NETWORK_ERROR_MESSAGE && this.canRetryWithToken(originalConfig))) return [3 /*break*/, 6];
+                        // Both mode: the browser blocked the session call or hid its reply; later calls use the token.
+                        if (!this.canResend(originalConfig)) {
+                            this.switchToToken();
+                            return [2 /*return*/, Promise.reject(err)];
+                        }
+                        return [2 /*return*/, this.retryWithToken(axios, originalConfig)];
+                    case 6:
                         if (!(err.message === NETWORK_ERROR_MESSAGE
-                            && originalConfig.headers.hasOwnProperty('Authorization')
-                            && _retry_count < 4)) return [3 /*break*/, 9];
+                            && (originalConfig.headers.hasOwnProperty('Authorization')
+                                || (this.configuration.cookieAuth && originalConfig.withCredentials && this.canResend(originalConfig)))
+                            && _retry_count < 4)) return [3 /*break*/, 10];
                         _retry_count++;
-                        _c.label = 6;
-                    case 6:
-                        _c.trys.push([6, 8, , 9]);
-                        return [4 /*yield*/, this.refreshTokenInternal()];
+                        _a.label = 7;
                     case 7:
-                        _b = _c.sent(), tokenString = _b.accessToken, permissions = _b.permissions;
-                        accessToken = "Bearer ".concat(tokenString);
-                        this.tokenData.permissions = permissions;
+                        _a.trys.push([7, 9, , 10]);
+                        return [4 /*yield*/, this.refreshTokenInternal()];
+                    case 8:
+                        reply = _a.sent();
+                        this.tokenData.permissions = reply.permissions;
                         _retry = true;
-                        originalConfig.headers['Authorization'] = accessToken;
-                        this.configuration.accessToken = accessToken;
-                        this.tokenData.accessToken = tokenString;
+                        this.applyTokenReply(reply);
                         this.storeTokenData(this.tokenData);
-                        return [2 /*return*/, axios.request(__assign({}, originalConfig))];
-                    case 8:
-                        _error_2 = _c.sent();
+                        return [2 /*return*/, axios.request(__assign({}, this.withCurrentAuth(originalConfig)))];
+                    case 9:
+                        _error_2 = _a.sent();
                         if (_error_2.response && _error_2.response.data) {
                             return [2 /*return*/, Promise.reject(_error_2.response.data)];
                         }
                         return [2 /*return*/, Promise.reject(_error_2)];
-                    case 9: return [2 /*return*/, Promise.reject(err)];
+                    case 10: return [2 /*return*/, Promise.reject(err)];
                 }
             });
         }); });

package/dist/common.d.ts

@@ -62,7 +62,7 @@ export declare const toPathString: (url: URL) => string;
  *
  * @export
  */
-export declare const createRequestFunction: (axiosArgs: RequestArgs, globalAxios: AxiosInstance, BASE_PATH: string, configuration?: Configuration) => <T = unknown, R = AxiosResponse<T, any, {}>>(axios?: AxiosInstance, basePath?: string) => Promise<R>;
+export declare const createRequestFunction: (axiosArgs: RequestArgs, globalAxios: AxiosInstance, BASE_PATH: string, configuration?: Configuration) => <T = unknown, R = AxiosResponse<T, any, {}, any>>(axios?: AxiosInstance, basePath?: string) => Promise<R>;
 /**
  * EMIL AccountService
  * The EMIL AccountService API description

package/dist/common.js

@@ -233,6 +233,7 @@ exports.toPathString = toPathString;
  * @export
  */
 var createRequestFunction = function (axiosArgs, globalAxios, BASE_PATH, configuration) {
+    // Typed by hand: since axios 1.20, request() returns an internal axios type that SDK declarations cannot name.
     return function (axios, basePath) {
         if (axios === void 0) { axios = globalAxios; }
         if (basePath === void 0) { basePath = BASE_PATH; }

package/dist/configuration.d.ts

@@ -18,6 +18,7 @@ export interface ConfigurationParameters {
     baseOptions?: any;
     formDataCtor?: new () => any;
     cookieAuth?: boolean;
+    account?: string;
 }
 export declare class Configuration {
     /**
@@ -70,13 +71,20 @@ export declare class Configuration {
      */
     formDataCtor?: new () => any;
     /**
-     * Authenticate with the HttpOnly access cookie instead of a stored token: every call sends credentials.
-     * The browser holds one cookie, so use it with one logged-in account; log out through the auth service.
+     * Use a server session when authservice makes one; otherwise the token, as without this option.
+     * Set `account` too, so each SDK object keeps its own account.
      *
      * @type {boolean}
      * @memberof Configuration
      */
     cookieAuth?: boolean;
+    /**
+     * The session account (Cognito sub) this app shows, so the SDK never takes another tab's account.
+     *
+     * @type {string}
+     * @memberof Configuration
+     */
+    account?: string;
     constructor(param?: ConfigurationParameters);
     /**
      * Check if the given MIME is a JSON MIME.

package/dist/configuration.js

@@ -25,6 +25,7 @@ var Configuration = /** @class */ (function () {
         this.baseOptions = param.baseOptions;
         this.formDataCtor = param.formDataCtor;
         this.cookieAuth = param.cookieAuth;
+        this.account = param.account;
     }
     /**
      * Check if the given MIME is a JSON MIME.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@emilgroup/account-sdk",
-  "version": "1.49.1-beta.12",
+  "version": "1.49.1-beta.16",
   "description": "OpenAPI client for @emilgroup/account-sdk",
   "author": "OpenAPI-Generator Contributors",
   "keywords": [
@@ -18,7 +18,7 @@
     "prepare": "npm run build"
   },
   "dependencies": {
-    "axios": "1.18.0"
+    "axios": "1.20.0"
   },
   "devDependencies": {