@emilgroup/account-sdk 1.49.1-beta.19 → 1.49.1-beta.21

package/README.md

@@ -17,11 +17,11 @@ Although this package can be used in both TypeScript and JavaScript, it is inten
 Navigate to the folder of your consuming project and run one of the following commands:
 
 ```
-npm install @emilgroup/account-sdk@1.49.1-beta.19 --save
+npm install @emilgroup/account-sdk@1.49.1-beta.21 --save
 ```
 or 
 ```
-yarn add @emilgroup/account-sdk@1.49.1-beta.19
+yarn add @emilgroup/account-sdk@1.49.1-beta.21
 ```
 
 And then you can import `AccountsApi`.

package/api/accounts-api.ts

@@ -67,9 +67,12 @@ export const AccountsApiAxiosParamCreator = function (configuration?: Configurat
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            // Only Authorization falls back to the configured token; an empty value is never sent.
-            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
-            if (authorizationValue) {
+            // Only Authorization falls back to the configured token. Without a session it is sent as before, empty when
+            // no token is stored, so a refused call still refreshes; a session call (account header) sends none.
+            const authorizationIsAuth = 'Authorization'.toLowerCase() === 'authorization';
+            const authorizationValue = authorizationIsAuth ? (authorization || baseAccessToken) : authorization;
+            const authorizationKeepEmpty = authorizationIsAuth && authorizationValue === '' && !baseOptions?.headers?.['X-Emil-Account'];
+            if (authorizationValue || authorizationKeepEmpty) {
                 localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
@@ -117,9 +120,12 @@ export const AccountsApiAxiosParamCreator = function (configuration?: Configurat
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            // Only Authorization falls back to the configured token; an empty value is never sent.
-            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
-            if (authorizationValue) {
+            // Only Authorization falls back to the configured token. Without a session it is sent as before, empty when
+            // no token is stored, so a refused call still refreshes; a session call (account header) sends none.
+            const authorizationIsAuth = 'Authorization'.toLowerCase() === 'authorization';
+            const authorizationValue = authorizationIsAuth ? (authorization || baseAccessToken) : authorization;
+            const authorizationKeepEmpty = authorizationIsAuth && authorizationValue === '' && !baseOptions?.headers?.['X-Emil-Account'];
+            if (authorizationValue || authorizationKeepEmpty) {
                 localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
@@ -169,9 +175,12 @@ export const AccountsApiAxiosParamCreator = function (configuration?: Configurat
                 localVarQueryParameter['expand'] = expand;
             }
 
-            // Only Authorization falls back to the configured token; an empty value is never sent.
-            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
-            if (authorizationValue) {
+            // Only Authorization falls back to the configured token. Without a session it is sent as before, empty when
+            // no token is stored, so a refused call still refreshes; a session call (account header) sends none.
+            const authorizationIsAuth = 'Authorization'.toLowerCase() === 'authorization';
+            const authorizationValue = authorizationIsAuth ? (authorization || baseAccessToken) : authorization;
+            const authorizationKeepEmpty = authorizationIsAuth && authorizationValue === '' && !baseOptions?.headers?.['X-Emil-Account'];
+            if (authorizationValue || authorizationKeepEmpty) {
                 localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
@@ -221,9 +230,12 @@ export const AccountsApiAxiosParamCreator = function (configuration?: Configurat
                 localVarQueryParameter['expand'] = expand;
             }
 
-            // Only Authorization falls back to the configured token; an empty value is never sent.
-            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
-            if (authorizationValue) {
+            // Only Authorization falls back to the configured token. Without a session it is sent as before, empty when
+            // no token is stored, so a refused call still refreshes; a session call (account header) sends none.
+            const authorizationIsAuth = 'Authorization'.toLowerCase() === 'authorization';
+            const authorizationValue = authorizationIsAuth ? (authorization || baseAccessToken) : authorization;
+            const authorizationKeepEmpty = authorizationIsAuth && authorizationValue === '' && !baseOptions?.headers?.['X-Emil-Account'];
+            if (authorizationValue || authorizationKeepEmpty) {
                 localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
@@ -299,9 +311,12 @@ export const AccountsApiAxiosParamCreator = function (configuration?: Configurat
                 localVarQueryParameter['filters'] = filters;
             }
 
-            // Only Authorization falls back to the configured token; an empty value is never sent.
-            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
-            if (authorizationValue) {
+            // Only Authorization falls back to the configured token. Without a session it is sent as before, empty when
+            // no token is stored, so a refused call still refreshes; a session call (account header) sends none.
+            const authorizationIsAuth = 'Authorization'.toLowerCase() === 'authorization';
+            const authorizationValue = authorizationIsAuth ? (authorization || baseAccessToken) : authorization;
+            const authorizationKeepEmpty = authorizationIsAuth && authorizationValue === '' && !baseOptions?.headers?.['X-Emil-Account'];
+            if (authorizationValue || authorizationKeepEmpty) {
                 localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
@@ -349,9 +364,12 @@ export const AccountsApiAxiosParamCreator = function (configuration?: Configurat
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            // Only Authorization falls back to the configured token; an empty value is never sent.
-            const authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
-            if (authorizationValue) {
+            // Only Authorization falls back to the configured token. Without a session it is sent as before, empty when
+            // no token is stored, so a refused call still refreshes; a session call (account header) sends none.
+            const authorizationIsAuth = 'Authorization'.toLowerCase() === 'authorization';
+            const authorizationValue = authorizationIsAuth ? (authorization || baseAccessToken) : authorization;
+            const authorizationKeepEmpty = authorizationIsAuth && authorizationValue === '' && !baseOptions?.headers?.['X-Emil-Account'];
+            if (authorizationValue || authorizationKeepEmpty) {
                 localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
@@ -753,7 +771,7 @@ export class AccountsApi extends BaseAPI {
      * @memberof AccountsApi
      */
     public createAccount(requestParameters: AccountsApiCreateAccountRequest, options?: AxiosRequestConfig) {
-        return AccountsApiFp(this.configuration).createAccount(requestParameters.createAccountRequestDto, requestParameters.authorization, options).then((request) => request(this.axios, this.basePath));
+        return AccountsApiFp(this.configuration).createAccount(requestParameters.createAccountRequestDto, requestParameters.authorization, this.withOwner(options)).then((request) => request(this.axios, this.basePath));
     }
 
     /**
@@ -765,7 +783,7 @@ export class AccountsApi extends BaseAPI {
      * @memberof AccountsApi
      */
     public deleteAccount(requestParameters: AccountsApiDeleteAccountRequest, options?: AxiosRequestConfig) {
-        return AccountsApiFp(this.configuration).deleteAccount(requestParameters.code, requestParameters.authorization, options).then((request) => request(this.axios, this.basePath));
+        return AccountsApiFp(this.configuration).deleteAccount(requestParameters.code, requestParameters.authorization, this.withOwner(options)).then((request) => request(this.axios, this.basePath));
     }
 
     /**
@@ -777,7 +795,7 @@ export class AccountsApi extends BaseAPI {
      * @memberof AccountsApi
      */
     public getAccount(requestParameters: AccountsApiGetAccountRequest, options?: AxiosRequestConfig) {
-        return AccountsApiFp(this.configuration).getAccount(requestParameters.code, requestParameters.authorization, requestParameters.expand, options).then((request) => request(this.axios, this.basePath));
+        return AccountsApiFp(this.configuration).getAccount(requestParameters.code, requestParameters.authorization, requestParameters.expand, this.withOwner(options)).then((request) => request(this.axios, this.basePath));
     }
 
     /**
@@ -789,7 +807,7 @@ export class AccountsApi extends BaseAPI {
      * @memberof AccountsApi
      */
     public getAccountByEmail(requestParameters: AccountsApiGetAccountByEmailRequest, options?: AxiosRequestConfig) {
-        return AccountsApiFp(this.configuration).getAccountByEmail(requestParameters.email, requestParameters.authorization, requestParameters.expand, options).then((request) => request(this.axios, this.basePath));
+        return AccountsApiFp(this.configuration).getAccountByEmail(requestParameters.email, requestParameters.authorization, requestParameters.expand, this.withOwner(options)).then((request) => request(this.axios, this.basePath));
     }
 
     /**
@@ -801,7 +819,7 @@ export class AccountsApi extends BaseAPI {
      * @memberof AccountsApi
      */
     public listAccounts(requestParameters: AccountsApiListAccountsRequest = {}, options?: AxiosRequestConfig) {
-        return AccountsApiFp(this.configuration).listAccounts(requestParameters.authorization, requestParameters.pageSize, requestParameters.pageToken, requestParameters.filter, requestParameters.search, requestParameters.order, requestParameters.expand, requestParameters.filters, options).then((request) => request(this.axios, this.basePath));
+        return AccountsApiFp(this.configuration).listAccounts(requestParameters.authorization, requestParameters.pageSize, requestParameters.pageToken, requestParameters.filter, requestParameters.search, requestParameters.order, requestParameters.expand, requestParameters.filters, this.withOwner(options)).then((request) => request(this.axios, this.basePath));
     }
 
     /**
@@ -813,6 +831,6 @@ export class AccountsApi extends BaseAPI {
      * @memberof AccountsApi
      */
     public updateAccount(requestParameters: AccountsApiUpdateAccountRequest, options?: AxiosRequestConfig) {
-        return AccountsApiFp(this.configuration).updateAccount(requestParameters.code, requestParameters.updateAccountRequestDto, requestParameters.authorization, options).then((request) => request(this.axios, this.basePath));
+        return AccountsApiFp(this.configuration).updateAccount(requestParameters.code, requestParameters.updateAccountRequestDto, requestParameters.authorization, this.withOwner(options)).then((request) => request(this.axios, this.basePath));
     }
 }

package/api/health-api.ts

@@ -119,6 +119,6 @@ export class HealthApi extends BaseAPI {
      * @memberof HealthApi
      */
     public check(options?: AxiosRequestConfig) {
-        return HealthApiFp(this.configuration).check(options).then((request) => request(this.axios, this.basePath));
+        return HealthApiFp(this.configuration).check(this.withOwner(options)).then((request) => request(this.axios, this.basePath));
     }
 }

package/base.ts

@@ -72,6 +72,10 @@ export enum Environment {
 let _retry_count = 0
 let _retry = null
 
+// Marks each request with the account (username) of the SDK object that sent it: only SDK objects of that
+// account refresh and resend it, never an object of another account open in the same browser.
+const REQUEST_OWNER = '_emilSdkOwner';
+
 export function resetRetry() {
     _retry_count = 0
 }
@@ -120,6 +124,15 @@ export class BaseAPI {
         this.loadTokenData();
 
         if (configuration) {
+            // Two accounts in one browser share APP_TOKEN: never take the token or session account saved for
+            // another account. The mode stays (an app naming its account keeps its session). Saved with the next refresh.
+            const ownUser = configuration.username;
+            const storedUser = this.tokenData.username;
+            if (ownUser && storedUser && ownUser.toLowerCase() !== storedUser.toLowerCase()) {
+                delete this.tokenData.accessToken;
+                delete this.tokenData.sub;
+                this.tokenData.username = ownUser;
+            }
             const { accessToken } = this.tokenData;
             this.configuration = configuration;
             this.basePath = configuration.basePath || this.basePath;
@@ -173,11 +186,14 @@ export class BaseAPI {
         };
     }
 
-    private useHeaderAuth(accessToken: string) {
+    private useHeaderAuth(accessToken: string, keepSessionData = false) {
         this.configuration.accessToken = accessToken ? `Bearer ${accessToken}` : '';
         this.tokenData.accessToken = accessToken;
-        delete this.tokenData.authMode;
-        delete this.tokenData.sub;
+        // An app without cookieAuth does not own the session fields: its refresh leaves them for the session apps.
+        if (!keepSessionData || this.configuration.cookieAuth) {
+            delete this.tokenData.authMode;
+            delete this.tokenData.sub;
+        }
         if (this.configuration.cookieAuth) {
             const { withCredentials, headers, ...baseOptions } = this.configuration.baseOptions || {};
             const { [ACCOUNT_HEADER]: account, ...otherHeaders } = headers || {};
@@ -185,7 +201,7 @@ export class BaseAPI {
         }
     }
 
-    private applyTokenReply({ accessToken, authMode, session }: LoginClass) {
+    private applyTokenReply({ accessToken, authMode, session }: LoginClass, fromRefresh = false) {
         if (this.configuration.cookieAuth && SESSION_MODES.indexOf(authMode) !== -1 && session?.sub) {
             this.tokenData.authMode = authMode;
             this.tokenData.sub = session.sub;
@@ -201,7 +217,7 @@ export class BaseAPI {
             }
             this.useSessionAuth();
         } else {
-            this.useHeaderAuth(accessToken);
+            this.useHeaderAuth(accessToken, fromRefresh);
         }
     }
 
@@ -335,9 +351,34 @@ export class BaseAPI {
 
         const refreshTokenAxios = globalAxios.create()
         refreshTokenAxios.interceptors.response.use(response => {
-          const { permissions } = response.data;
-
+          const { permissions, accessToken, authMode } = response.data;
+          // Decided before the merge below: newer session data must not keep the new token from this object.
+          const onSession = this.usesSession();
+
+          // Newer data saved for this account (e.g. the session mode the shell saved later) wins over the copy
+          // read when the object was made; data of another account or another workspace (sub) is never taken.
+          const latest = ((typeof window !== 'undefined' && defaultStorage().get<TokenData>(TOKEN_DATA)) || {}) as TokenData;
+          const ownSub = this.sessionAccount();
+          if (latest.username?.toLowerCase() === username.toLowerCase()
+              && (!ownSub || !latest.sub || latest.sub === ownSub)) {
+              // A bare reset ({username}, an app's account check) keeps this copy's other fields; any fuller record
+              // is the truth, so fields it lacks were removed on purpose (e.g. a rollback) and stay removed.
+              const bareReset = Object.keys(latest).every((key) => key === 'username');
+              this.tokenData = bareReset ? { ...this.tokenData, ...latest } : { ...latest };
+          }
+          // The reply is for this account: label it, or an SDK object of another account would take the token.
+          if (this.tokenData.username?.toLowerCase() !== username.toLowerCase()) {
+              this.tokenData.username = username;
+          }
           this.tokenData.permissions = permissions;
+          // Keep the new token for the page's next SDK objects; session data is left as it is.
+          if (accessToken && !onSession) {
+              this.tokenData.accessToken = accessToken;
+              this.configuration.accessToken = `Bearer ${accessToken}`;
+          } else if (accessToken && authMode === 'both') {
+              // Both: this app stays on the session; the token is kept for apps not moved yet.
+              this.tokenData.accessToken = accessToken;
+          }
           this.storeTokenData(this.tokenData);
 
           return response;
@@ -376,6 +417,18 @@ export class BaseAPI {
         this.storeTokenData(null);
     }
 
+    private ownAccount(): string {
+        return (this.configuration.username || '').toLowerCase();
+    }
+
+    protected withOwner(options?: AxiosRequestConfig): AxiosRequestConfig {
+        // An object without a username cannot refresh itself: its requests stay unmarked, as before.
+        if (!this.ownAccount()) {
+            return { ...options };
+        }
+        return { ...options, [REQUEST_OWNER]: this.ownAccount() } as AxiosRequestConfig;
+    }
+
     private attachInterceptor(axios: AxiosInstance) {
         axios.interceptors.response.use(
             (res) => {
@@ -383,6 +436,11 @@ export class BaseAPI {
             },
             async (err) => {
                 let originalConfig = err.config;
+                // Sent for another account: only that account's SDK objects handle it. Unmarked requests as before.
+                const owner = originalConfig?.[REQUEST_OWNER];
+                if (owner !== undefined && owner !== this.ownAccount()) {
+                    return Promise.reject(err);
+                }
                 if (err.response && !(err.response instanceof XMLHttpRequest)) { // sometimes buggy and is of type request
                     // Access Token was expired
                     if ((err.response.status === 401 || err.response.status === 403)
@@ -391,7 +449,7 @@ export class BaseAPI {
                         try {
                             const reply = await this.refreshTokenInternal();
                             this.tokenData.permissions = reply.permissions;
-                            this.applyTokenReply(reply);
+                            this.applyTokenReply(reply, true);
                             this.storeTokenData(this.tokenData);
 
                             if (!this.usesSession()) {
@@ -431,11 +489,16 @@ export class BaseAPI {
                         this.tokenData.permissions = reply.permissions;
 
                         _retry = true;
-                        this.applyTokenReply(reply);
+                        this.applyTokenReply(reply, true);
                         this.storeTokenData(this.tokenData);
 
+                        // The limit is for refreshes that do not help; one that worked starts the count again.
+                        // Not awaited, so a failed retry reaches the app as the same axios error as before.
                         return axios.request({
                             ...this.withCurrentAuth(originalConfig),
+                        }).then((retried) => {
+                            _retry_count = 0;
+                            return retried;
                         });
                     } catch (_error) {
                         if (_error.response && _error.response.data) {

package/dist/api/accounts-api.js

@@ -103,9 +103,10 @@ var AccountsApiAxiosParamCreator = function (configuration) {
         createAccount: function (createAccountRequestDto, authorization, options) {
             if (options === void 0) { options = {}; }
             return __awaiter(_this, void 0, void 0, function () {
-                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, authorizationValue, headersFromBaseOptions;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
+                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, authorizationIsAuth, authorizationValue, authorizationKeepEmpty, headersFromBaseOptions;
+                var _a;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
                         case 0:
                             // verify required parameter 'createAccountRequestDto' is not null or undefined
                             (0, common_1.assertParamExists)('createAccount', 'createAccountRequestDto', createAccountRequestDto);
@@ -121,14 +122,17 @@ var AccountsApiAxiosParamCreator = function (configuration) {
                             // authentication bearer required
                             // http bearer authentication required
                             return [4 /*yield*/, (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration)
-                                // Only Authorization falls back to the configured token; an empty value is never sent.
+                                // Only Authorization falls back to the configured token. Without a session it is sent as before, empty when
+                                // no token is stored, so a refused call still refreshes; a session call (account header) sends none.
                             ];
                         case 1:
                             // authentication bearer required
                             // http bearer authentication required
-                            _a.sent();
-                            authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
-                            if (authorizationValue) {
+                            _b.sent();
+                            authorizationIsAuth = 'Authorization'.toLowerCase() === 'authorization';
+                            authorizationValue = authorizationIsAuth ? (authorization || baseAccessToken) : authorization;
+                            authorizationKeepEmpty = authorizationIsAuth && authorizationValue === '' && !((_a = baseOptions === null || baseOptions === void 0 ? void 0 : baseOptions.headers) === null || _a === void 0 ? void 0 : _a['X-Emil-Account']);
+                            if (authorizationValue || authorizationKeepEmpty) {
                                 localVarHeaderParameter['Authorization'] = String(authorizationValue);
                             }
                             localVarHeaderParameter['Content-Type'] = 'application/json';
@@ -155,9 +159,10 @@ var AccountsApiAxiosParamCreator = function (configuration) {
         deleteAccount: function (code, authorization, options) {
             if (options === void 0) { options = {}; }
             return __awaiter(_this, void 0, void 0, function () {
-                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, authorizationValue, headersFromBaseOptions;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
+                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, authorizationIsAuth, authorizationValue, authorizationKeepEmpty, headersFromBaseOptions;
+                var _a;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
                         case 0:
                             // verify required parameter 'code' is not null or undefined
                             (0, common_1.assertParamExists)('deleteAccount', 'code', code);
@@ -174,14 +179,17 @@ var AccountsApiAxiosParamCreator = function (configuration) {
                             // authentication bearer required
                             // http bearer authentication required
                             return [4 /*yield*/, (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration)
-                                // Only Authorization falls back to the configured token; an empty value is never sent.
+                                // Only Authorization falls back to the configured token. Without a session it is sent as before, empty when
+                                // no token is stored, so a refused call still refreshes; a session call (account header) sends none.
                             ];
                         case 1:
                             // authentication bearer required
                             // http bearer authentication required
-                            _a.sent();
-                            authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
-                            if (authorizationValue) {
+                            _b.sent();
+                            authorizationIsAuth = 'Authorization'.toLowerCase() === 'authorization';
+                            authorizationValue = authorizationIsAuth ? (authorization || baseAccessToken) : authorization;
+                            authorizationKeepEmpty = authorizationIsAuth && authorizationValue === '' && !((_a = baseOptions === null || baseOptions === void 0 ? void 0 : baseOptions.headers) === null || _a === void 0 ? void 0 : _a['X-Emil-Account']);
+                            if (authorizationValue || authorizationKeepEmpty) {
                                 localVarHeaderParameter['Authorization'] = String(authorizationValue);
                             }
                             (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
@@ -207,9 +215,10 @@ var AccountsApiAxiosParamCreator = function (configuration) {
         getAccount: function (code, authorization, expand, options) {
             if (options === void 0) { options = {}; }
             return __awaiter(_this, void 0, void 0, function () {
-                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, authorizationValue, headersFromBaseOptions;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
+                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, authorizationIsAuth, authorizationValue, authorizationKeepEmpty, headersFromBaseOptions;
+                var _a;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
                         case 0:
                             // verify required parameter 'code' is not null or undefined
                             (0, common_1.assertParamExists)('getAccount', 'code', code);
@@ -229,12 +238,14 @@ var AccountsApiAxiosParamCreator = function (configuration) {
                         case 1:
                             // authentication bearer required
                             // http bearer authentication required
-                            _a.sent();
+                            _b.sent();
                             if (expand !== undefined) {
                                 localVarQueryParameter['expand'] = expand;
                             }
-                            authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
-                            if (authorizationValue) {
+                            authorizationIsAuth = 'Authorization'.toLowerCase() === 'authorization';
+                            authorizationValue = authorizationIsAuth ? (authorization || baseAccessToken) : authorization;
+                            authorizationKeepEmpty = authorizationIsAuth && authorizationValue === '' && !((_a = baseOptions === null || baseOptions === void 0 ? void 0 : baseOptions.headers) === null || _a === void 0 ? void 0 : _a['X-Emil-Account']);
+                            if (authorizationValue || authorizationKeepEmpty) {
                                 localVarHeaderParameter['Authorization'] = String(authorizationValue);
                             }
                             (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
@@ -260,9 +271,10 @@ var AccountsApiAxiosParamCreator = function (configuration) {
         getAccountByEmail: function (email, authorization, expand, options) {
             if (options === void 0) { options = {}; }
             return __awaiter(_this, void 0, void 0, function () {
-                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, authorizationValue, headersFromBaseOptions;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
+                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, authorizationIsAuth, authorizationValue, authorizationKeepEmpty, headersFromBaseOptions;
+                var _a;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
                         case 0:
                             // verify required parameter 'email' is not null or undefined
                             (0, common_1.assertParamExists)('getAccountByEmail', 'email', email);
@@ -282,12 +294,14 @@ var AccountsApiAxiosParamCreator = function (configuration) {
                         case 1:
                             // authentication bearer required
                             // http bearer authentication required
-                            _a.sent();
+                            _b.sent();
                             if (expand !== undefined) {
                                 localVarQueryParameter['expand'] = expand;
                             }
-                            authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
-                            if (authorizationValue) {
+                            authorizationIsAuth = 'Authorization'.toLowerCase() === 'authorization';
+                            authorizationValue = authorizationIsAuth ? (authorization || baseAccessToken) : authorization;
+                            authorizationKeepEmpty = authorizationIsAuth && authorizationValue === '' && !((_a = baseOptions === null || baseOptions === void 0 ? void 0 : baseOptions.headers) === null || _a === void 0 ? void 0 : _a['X-Emil-Account']);
+                            if (authorizationValue || authorizationKeepEmpty) {
                                 localVarHeaderParameter['Authorization'] = String(authorizationValue);
                             }
                             (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
@@ -318,9 +332,10 @@ var AccountsApiAxiosParamCreator = function (configuration) {
         listAccounts: function (authorization, pageSize, pageToken, filter, search, order, expand, filters, options) {
             if (options === void 0) { options = {}; }
             return __awaiter(_this, void 0, void 0, function () {
-                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, authorizationValue, headersFromBaseOptions;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
+                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, authorizationIsAuth, authorizationValue, authorizationKeepEmpty, headersFromBaseOptions;
+                var _a;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
                         case 0:
                             localVarPath = "/accountservice/v1/accounts";
                             localVarUrlObj = new URL(localVarPath, common_1.DUMMY_BASE_URL);
@@ -337,7 +352,7 @@ var AccountsApiAxiosParamCreator = function (configuration) {
                         case 1:
                             // authentication bearer required
                             // http bearer authentication required
-                            _a.sent();
+                            _b.sent();
                             if (pageSize !== undefined) {
                                 localVarQueryParameter['pageSize'] = pageSize;
                             }
@@ -359,8 +374,10 @@ var AccountsApiAxiosParamCreator = function (configuration) {
                             if (filters !== undefined) {
                                 localVarQueryParameter['filters'] = filters;
                             }
-                            authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
-                            if (authorizationValue) {
+                            authorizationIsAuth = 'Authorization'.toLowerCase() === 'authorization';
+                            authorizationValue = authorizationIsAuth ? (authorization || baseAccessToken) : authorization;
+                            authorizationKeepEmpty = authorizationIsAuth && authorizationValue === '' && !((_a = baseOptions === null || baseOptions === void 0 ? void 0 : baseOptions.headers) === null || _a === void 0 ? void 0 : _a['X-Emil-Account']);
+                            if (authorizationValue || authorizationKeepEmpty) {
                                 localVarHeaderParameter['Authorization'] = String(authorizationValue);
                             }
                             (0, common_1.setSearchParams)(localVarUrlObj, localVarQueryParameter);
@@ -386,9 +403,10 @@ var AccountsApiAxiosParamCreator = function (configuration) {
         updateAccount: function (code, updateAccountRequestDto, authorization, options) {
             if (options === void 0) { options = {}; }
             return __awaiter(_this, void 0, void 0, function () {
-                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, authorizationValue, headersFromBaseOptions;
-                return __generator(this, function (_a) {
-                    switch (_a.label) {
+                var localVarPath, localVarUrlObj, baseOptions, baseAccessToken, localVarRequestOptions, localVarHeaderParameter, localVarQueryParameter, authorizationIsAuth, authorizationValue, authorizationKeepEmpty, headersFromBaseOptions;
+                var _a;
+                return __generator(this, function (_b) {
+                    switch (_b.label) {
                         case 0:
                             // verify required parameter 'code' is not null or undefined
                             (0, common_1.assertParamExists)('updateAccount', 'code', code);
@@ -407,14 +425,17 @@ var AccountsApiAxiosParamCreator = function (configuration) {
                             // authentication bearer required
                             // http bearer authentication required
                             return [4 /*yield*/, (0, common_1.setBearerAuthToObject)(localVarHeaderParameter, configuration)
-                                // Only Authorization falls back to the configured token; an empty value is never sent.
+                                // Only Authorization falls back to the configured token. Without a session it is sent as before, empty when
+                                // no token is stored, so a refused call still refreshes; a session call (account header) sends none.
                             ];
                         case 1:
                             // authentication bearer required
                             // http bearer authentication required
-                            _a.sent();
-                            authorizationValue = 'Authorization'.toLowerCase() === 'authorization' ? (authorization || baseAccessToken) : authorization;
-                            if (authorizationValue) {
+                            _b.sent();
+                            authorizationIsAuth = 'Authorization'.toLowerCase() === 'authorization';
+                            authorizationValue = authorizationIsAuth ? (authorization || baseAccessToken) : authorization;
+                            authorizationKeepEmpty = authorizationIsAuth && authorizationValue === '' && !((_a = baseOptions === null || baseOptions === void 0 ? void 0 : baseOptions.headers) === null || _a === void 0 ? void 0 : _a['X-Emil-Account']);
+                            if (authorizationValue || authorizationKeepEmpty) {
                                 localVarHeaderParameter['Authorization'] = String(authorizationValue);
                             }
                             localVarHeaderParameter['Content-Type'] = 'application/json';
@@ -684,7 +705,7 @@ var AccountsApi = /** @class */ (function (_super) {
      */
     AccountsApi.prototype.createAccount = function (requestParameters, options) {
         var _this = this;
-        return (0, exports.AccountsApiFp)(this.configuration).createAccount(requestParameters.createAccountRequestDto, requestParameters.authorization, options).then(function (request) { return request(_this.axios, _this.basePath); });
+        return (0, exports.AccountsApiFp)(this.configuration).createAccount(requestParameters.createAccountRequestDto, requestParameters.authorization, this.withOwner(options)).then(function (request) { return request(_this.axios, _this.basePath); });
     };
     /**
      * Permanently deletes the account. Supply the unique code that was returned when you created the account and this will delete it.  **Required Permissions**  \"partner-management.partners.delete\"
@@ -696,7 +717,7 @@ var AccountsApi = /** @class */ (function (_super) {
      */
     AccountsApi.prototype.deleteAccount = function (requestParameters, options) {
         var _this = this;
-        return (0, exports.AccountsApiFp)(this.configuration).deleteAccount(requestParameters.code, requestParameters.authorization, options).then(function (request) { return request(_this.axios, _this.basePath); });
+        return (0, exports.AccountsApiFp)(this.configuration).deleteAccount(requestParameters.code, requestParameters.authorization, this.withOwner(options)).then(function (request) { return request(_this.axios, _this.basePath); });
     };
     /**
      * Retrieves the details of the account that was previously created. Supply the unique account code      that was returned when you created it and Emil Api will return the corresponding account information.  **Required Permissions**  \"partner-management.partners.view\"
@@ -708,7 +729,7 @@ var AccountsApi = /** @class */ (function (_super) {
      */
     AccountsApi.prototype.getAccount = function (requestParameters, options) {
         var _this = this;
-        return (0, exports.AccountsApiFp)(this.configuration).getAccount(requestParameters.code, requestParameters.authorization, requestParameters.expand, options).then(function (request) { return request(_this.axios, _this.basePath); });
+        return (0, exports.AccountsApiFp)(this.configuration).getAccount(requestParameters.code, requestParameters.authorization, requestParameters.expand, this.withOwner(options)).then(function (request) { return request(_this.axios, _this.basePath); });
     };
     /**
      * Retrieves the details of the account that was previously created. Supply the email      that was returned when you created it and Emil Api will return the corresponding account information. Email matching is case-insensitive.  **Required Permissions**  \"partner-management.partners.view\"
@@ -720,7 +741,7 @@ var AccountsApi = /** @class */ (function (_super) {
      */
     AccountsApi.prototype.getAccountByEmail = function (requestParameters, options) {
         var _this = this;
-        return (0, exports.AccountsApiFp)(this.configuration).getAccountByEmail(requestParameters.email, requestParameters.authorization, requestParameters.expand, options).then(function (request) { return request(_this.axios, _this.basePath); });
+        return (0, exports.AccountsApiFp)(this.configuration).getAccountByEmail(requestParameters.email, requestParameters.authorization, requestParameters.expand, this.withOwner(options)).then(function (request) { return request(_this.axios, _this.basePath); });
     };
     /**
      * Returns a list of accounts you have previously created.        The accounts are returned in sorted order, with the oldest one appearing first.        For more information about pagination, read the Pagination documentation.  **Required Permissions**  \"partner-management.partners.view\"
@@ -733,7 +754,7 @@ var AccountsApi = /** @class */ (function (_super) {
     AccountsApi.prototype.listAccounts = function (requestParameters, options) {
         var _this = this;
         if (requestParameters === void 0) { requestParameters = {}; }
-        return (0, exports.AccountsApiFp)(this.configuration).listAccounts(requestParameters.authorization, requestParameters.pageSize, requestParameters.pageToken, requestParameters.filter, requestParameters.search, requestParameters.order, requestParameters.expand, requestParameters.filters, options).then(function (request) { return request(_this.axios, _this.basePath); });
+        return (0, exports.AccountsApiFp)(this.configuration).listAccounts(requestParameters.authorization, requestParameters.pageSize, requestParameters.pageToken, requestParameters.filter, requestParameters.search, requestParameters.order, requestParameters.expand, requestParameters.filters, this.withOwner(options)).then(function (request) { return request(_this.axios, _this.basePath); });
     };
     /**
      * Updates the specified account by setting the values of the parameters passed. Any parameters not provided will be left unchanged.  **Required Permissions**  \"partner-management.partners.update\"
@@ -745,7 +766,7 @@ var AccountsApi = /** @class */ (function (_super) {
      */
     AccountsApi.prototype.updateAccount = function (requestParameters, options) {
         var _this = this;
-        return (0, exports.AccountsApiFp)(this.configuration).updateAccount(requestParameters.code, requestParameters.updateAccountRequestDto, requestParameters.authorization, options).then(function (request) { return request(_this.axios, _this.basePath); });
+        return (0, exports.AccountsApiFp)(this.configuration).updateAccount(requestParameters.code, requestParameters.updateAccountRequestDto, requestParameters.authorization, this.withOwner(options)).then(function (request) { return request(_this.axios, _this.basePath); });
     };
     return AccountsApi;
 }(base_1.BaseAPI));

package/dist/api/health-api.js

@@ -193,7 +193,7 @@ var HealthApi = /** @class */ (function (_super) {
      */
     HealthApi.prototype.check = function (options) {
         var _this = this;
-        return (0, exports.HealthApiFp)(this.configuration).check(options).then(function (request) { return request(_this.axios, _this.basePath); });
+        return (0, exports.HealthApiFp)(this.configuration).check(this.withOwner(options)).then(function (request) { return request(_this.axios, _this.basePath); });
     };
     return HealthApi;
 }(base_1.BaseAPI));

package/dist/base.d.ts

@@ -96,6 +96,8 @@ export declare class BaseAPI {
     private storeTokenData;
     loadTokenData(): void;
     cleanTokenData(): void;
+    private ownAccount;
+    protected withOwner(options?: AxiosRequestConfig): AxiosRequestConfig;
     private attachInterceptor;
 }
 /**

package/dist/base.js

@@ -117,6 +117,9 @@ var Environment;
 })(Environment = exports.Environment || (exports.Environment = {}));
 var _retry_count = 0;
 var _retry = null;
+// Marks each request with the account (username) of the SDK object that sent it: only SDK objects of that
+// account refresh and resend it, never an object of another account open in the same browser.
+var REQUEST_OWNER = '_emilSdkOwner';
 function resetRetry() {
     _retry_count = 0;
 }
@@ -142,6 +145,15 @@ var BaseAPI = /** @class */ (function () {
         this.axios = axios;
         this.loadTokenData();
         if (configuration) {
+            // Two accounts in one browser share APP_TOKEN: never take the token or session account saved for
+            // another account. The mode stays (an app naming its account keeps its session). Saved with the next refresh.
+            var ownUser = configuration.username;
+            var storedUser = this.tokenData.username;
+            if (ownUser && storedUser && ownUser.toLowerCase() !== storedUser.toLowerCase()) {
+                delete this.tokenData.accessToken;
+                delete this.tokenData.sub;
+                this.tokenData.username = ownUser;
+            }
             var accessToken = this.tokenData.accessToken;
             this.configuration = configuration;
             this.basePath = configuration.basePath || this.basePath;
@@ -185,19 +197,24 @@ var BaseAPI = /** @class */ (function () {
         this.configuration.accessToken = '';
         this.configuration.baseOptions = __assign(__assign({}, baseOptions), { withCredentials: true, headers: __assign(__assign({}, headers), (_a = {}, _a[ACCOUNT_HEADER] = this.sessionAccount(), _a)) });
     };
-    BaseAPI.prototype.useHeaderAuth = function (accessToken) {
+    BaseAPI.prototype.useHeaderAuth = function (accessToken, keepSessionData) {
+        if (keepSessionData === void 0) { keepSessionData = false; }
         this.configuration.accessToken = accessToken ? "Bearer ".concat(accessToken) : '';
         this.tokenData.accessToken = accessToken;
-        delete this.tokenData.authMode;
-        delete this.tokenData.sub;
+        // An app without cookieAuth does not own the session fields: its refresh leaves them for the session apps.
+        if (!keepSessionData || this.configuration.cookieAuth) {
+            delete this.tokenData.authMode;
+            delete this.tokenData.sub;
+        }
         if (this.configuration.cookieAuth) {
             var _a = this.configuration.baseOptions || {}, withCredentials = _a.withCredentials, headers = _a.headers, baseOptions = __rest(_a, ["withCredentials", "headers"]);
             var _b = headers || {}, _c = ACCOUNT_HEADER, account = _b[_c], otherHeaders = __rest(_b, [typeof _c === "symbol" ? _c : _c + ""]);
             this.configuration.baseOptions = __assign(__assign({}, baseOptions), { headers: otherHeaders });
         }
     };
-    BaseAPI.prototype.applyTokenReply = function (_a) {
+    BaseAPI.prototype.applyTokenReply = function (_a, fromRefresh) {
         var accessToken = _a.accessToken, authMode = _a.authMode, session = _a.session;
+        if (fromRefresh === void 0) { fromRefresh = false; }
         if (this.configuration.cookieAuth && SESSION_MODES.indexOf(authMode) !== -1 && (session === null || session === void 0 ? void 0 : session.sub)) {
             this.tokenData.authMode = authMode;
             this.tokenData.sub = session.sub;
@@ -215,7 +232,7 @@ var BaseAPI = /** @class */ (function () {
             this.useSessionAuth();
         }
         else {
-            this.useHeaderAuth(accessToken);
+            this.useHeaderAuth(accessToken, fromRefresh);
         }
     };
     BaseAPI.prototype.sessionHeaders = function () {
@@ -350,8 +367,35 @@ var BaseAPI = /** @class */ (function () {
                         }
                         refreshTokenAxios = axios_1.default.create();
                         refreshTokenAxios.interceptors.response.use(function (response) {
-                            var permissions = response.data.permissions;
+                            var _a, _b;
+                            var _c = response.data, permissions = _c.permissions, accessToken = _c.accessToken, authMode = _c.authMode;
+                            // Decided before the merge below: newer session data must not keep the new token from this object.
+                            var onSession = _this.usesSession();
+                            // Newer data saved for this account (e.g. the session mode the shell saved later) wins over the copy
+                            // read when the object was made; data of another account or another workspace (sub) is never taken.
+                            var latest = ((typeof window !== 'undefined' && (0, common_1.defaultStorage)().get(TOKEN_DATA)) || {});
+                            var ownSub = _this.sessionAccount();
+                            if (((_a = latest.username) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === username.toLowerCase()
+                                && (!ownSub || !latest.sub || latest.sub === ownSub)) {
+                                // A bare reset ({username}, an app's account check) keeps this copy's other fields; any fuller record
+                                // is the truth, so fields it lacks were removed on purpose (e.g. a rollback) and stay removed.
+                                var bareReset = Object.keys(latest).every(function (key) { return key === 'username'; });
+                                _this.tokenData = bareReset ? __assign(__assign({}, _this.tokenData), latest) : __assign({}, latest);
+                            }
+                            // The reply is for this account: label it, or an SDK object of another account would take the token.
+                            if (((_b = _this.tokenData.username) === null || _b === void 0 ? void 0 : _b.toLowerCase()) !== username.toLowerCase()) {
+                                _this.tokenData.username = username;
+                            }
                             _this.tokenData.permissions = permissions;
+                            // Keep the new token for the page's next SDK objects; session data is left as it is.
+                            if (accessToken && !onSession) {
+                                _this.tokenData.accessToken = accessToken;
+                                _this.configuration.accessToken = "Bearer ".concat(accessToken);
+                            }
+                            else if (accessToken && authMode === 'both') {
+                                // Both: this app stays on the session; the token is kept for apps not moved yet.
+                                _this.tokenData.accessToken = accessToken;
+                            }
                             _this.storeTokenData(_this.tokenData);
                             return response;
                         });
@@ -386,17 +430,32 @@ var BaseAPI = /** @class */ (function () {
     BaseAPI.prototype.cleanTokenData = function () {
         this.storeTokenData(null);
     };
+    BaseAPI.prototype.ownAccount = function () {
+        return (this.configuration.username || '').toLowerCase();
+    };
+    BaseAPI.prototype.withOwner = function (options) {
+        var _a;
+        // An object without a username cannot refresh itself: its requests stay unmarked, as before.
+        if (!this.ownAccount()) {
+            return __assign({}, options);
+        }
+        return __assign(__assign({}, options), (_a = {}, _a[REQUEST_OWNER] = this.ownAccount(), _a));
+    };
     BaseAPI.prototype.attachInterceptor = function (axios) {
         var _this = this;
         axios.interceptors.response.use(function (res) {
             return res;
         }, function (err) { return __awaiter(_this, void 0, void 0, function () {
-            var originalConfig, reply, _error_1, reply, _error_2;
+            var originalConfig, owner, reply, _error_1, reply, _error_2;
             var _this = this;
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
                         originalConfig = err.config;
+                        owner = originalConfig === null || originalConfig === void 0 ? void 0 : originalConfig[REQUEST_OWNER];
+                        if (owner !== undefined && owner !== this.ownAccount()) {
+                            return [2 /*return*/, Promise.reject(err)];
+                        }
                         if (!(err.response && !(err.response instanceof XMLHttpRequest))) return [3 /*break*/, 5];
                         if (!((err.response.status === 401 || err.response.status === 403)
                             && !originalConfig._retry)) return [3 /*break*/, 4];
@@ -408,7 +467,7 @@ var BaseAPI = /** @class */ (function () {
                     case 2:
                         reply = _a.sent();
                         this.tokenData.permissions = reply.permissions;
-                        this.applyTokenReply(reply);
+                        this.applyTokenReply(reply, true);
                         this.storeTokenData(this.tokenData);
                         if (!this.usesSession()) {
                             return [2 /*return*/, axios(this.withCurrentAuth(originalConfig))];
@@ -450,9 +509,14 @@ var BaseAPI = /** @class */ (function () {
                         reply = _a.sent();
                         this.tokenData.permissions = reply.permissions;
                         _retry = true;
-                        this.applyTokenReply(reply);
+                        this.applyTokenReply(reply, true);
                         this.storeTokenData(this.tokenData);
-                        return [2 /*return*/, axios.request(__assign({}, this.withCurrentAuth(originalConfig)))];
+                        // The limit is for refreshes that do not help; one that worked starts the count again.
+                        // Not awaited, so a failed retry reaches the app as the same axios error as before.
+                        return [2 /*return*/, axios.request(__assign({}, this.withCurrentAuth(originalConfig))).then(function (retried) {
+                                _retry_count = 0;
+                                return retried;
+                            })];
                     case 9:
                         _error_2 = _a.sent();
                         if (_error_2.response && _error_2.response.data) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@emilgroup/account-sdk",
-  "version": "1.49.1-beta.19",
+  "version": "1.49.1-beta.21",
   "description": "OpenAPI client for @emilgroup/account-sdk",
   "author": "OpenAPI-Generator Contributors",
   "keywords": [