@emilgroup/account-sdk 1.49.1-beta.20 → 1.49.1-beta.21

package/README.md

@@ -17,11 +17,11 @@ Although this package can be used in both TypeScript and JavaScript, it is inten
 Navigate to the folder of your consuming project and run one of the following commands:
 
 ```
-npm install @emilgroup/account-sdk@1.49.1-beta.20 --save
+npm install @emilgroup/account-sdk@1.49.1-beta.21 --save
 ```
 or 
 ```
-yarn add @emilgroup/account-sdk@1.49.1-beta.20
+yarn add @emilgroup/account-sdk@1.49.1-beta.21
 ```
 
 And then you can import `AccountsApi`.

package/api/accounts-api.ts

@@ -67,8 +67,13 @@ export const AccountsApiAxiosParamCreator = function (configuration?: Configurat
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token. Without a session it is sent as before, empty when
+            // no token is stored, so a refused call still refreshes; a session call (account header) sends none.
+            const authorizationIsAuth = 'Authorization'.toLowerCase() === 'authorization';
+            const authorizationValue = authorizationIsAuth ? (authorization || baseAccessToken) : authorization;
+            const authorizationKeepEmpty = authorizationIsAuth && authorizationValue === '' && !baseOptions?.headers?.['X-Emil-Account'];
+            if (authorizationValue || authorizationKeepEmpty) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -115,8 +120,13 @@ export const AccountsApiAxiosParamCreator = function (configuration?: Configurat
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token. Without a session it is sent as before, empty when
+            // no token is stored, so a refused call still refreshes; a session call (account header) sends none.
+            const authorizationIsAuth = 'Authorization'.toLowerCase() === 'authorization';
+            const authorizationValue = authorizationIsAuth ? (authorization || baseAccessToken) : authorization;
+            const authorizationKeepEmpty = authorizationIsAuth && authorizationValue === '' && !baseOptions?.headers?.['X-Emil-Account'];
+            if (authorizationValue || authorizationKeepEmpty) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -165,8 +175,13 @@ export const AccountsApiAxiosParamCreator = function (configuration?: Configurat
                 localVarQueryParameter['expand'] = expand;
             }
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token. Without a session it is sent as before, empty when
+            // no token is stored, so a refused call still refreshes; a session call (account header) sends none.
+            const authorizationIsAuth = 'Authorization'.toLowerCase() === 'authorization';
+            const authorizationValue = authorizationIsAuth ? (authorization || baseAccessToken) : authorization;
+            const authorizationKeepEmpty = authorizationIsAuth && authorizationValue === '' && !baseOptions?.headers?.['X-Emil-Account'];
+            if (authorizationValue || authorizationKeepEmpty) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -215,8 +230,13 @@ export const AccountsApiAxiosParamCreator = function (configuration?: Configurat
                 localVarQueryParameter['expand'] = expand;
             }
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token. Without a session it is sent as before, empty when
+            // no token is stored, so a refused call still refreshes; a session call (account header) sends none.
+            const authorizationIsAuth = 'Authorization'.toLowerCase() === 'authorization';
+            const authorizationValue = authorizationIsAuth ? (authorization || baseAccessToken) : authorization;
+            const authorizationKeepEmpty = authorizationIsAuth && authorizationValue === '' && !baseOptions?.headers?.['X-Emil-Account'];
+            if (authorizationValue || authorizationKeepEmpty) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -291,8 +311,13 @@ export const AccountsApiAxiosParamCreator = function (configuration?: Configurat
                 localVarQueryParameter['filters'] = filters;
             }
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token. Without a session it is sent as before, empty when
+            // no token is stored, so a refused call still refreshes; a session call (account header) sends none.
+            const authorizationIsAuth = 'Authorization'.toLowerCase() === 'authorization';
+            const authorizationValue = authorizationIsAuth ? (authorization || baseAccessToken) : authorization;
+            const authorizationKeepEmpty = authorizationIsAuth && authorizationValue === '' && !baseOptions?.headers?.['X-Emil-Account'];
+            if (authorizationValue || authorizationKeepEmpty) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -339,8 +364,13 @@ export const AccountsApiAxiosParamCreator = function (configuration?: Configurat
             // http bearer authentication required
             await setBearerAuthToObject(localVarHeaderParameter, configuration)
 
-            if (authorization !== undefined && authorization !== null || baseAccessToken !== undefined && baseAccessToken !== null) {
-                localVarHeaderParameter['Authorization'] = String(authorization ? authorization : baseAccessToken);
+            // Only Authorization falls back to the configured token. Without a session it is sent as before, empty when
+            // no token is stored, so a refused call still refreshes; a session call (account header) sends none.
+            const authorizationIsAuth = 'Authorization'.toLowerCase() === 'authorization';
+            const authorizationValue = authorizationIsAuth ? (authorization || baseAccessToken) : authorization;
+            const authorizationKeepEmpty = authorizationIsAuth && authorizationValue === '' && !baseOptions?.headers?.['X-Emil-Account'];
+            if (authorizationValue || authorizationKeepEmpty) {
+                localVarHeaderParameter['Authorization'] = String(authorizationValue);
             }
 
 
@@ -741,7 +771,7 @@ export class AccountsApi extends BaseAPI {
      * @memberof AccountsApi
      */
     public createAccount(requestParameters: AccountsApiCreateAccountRequest, options?: AxiosRequestConfig) {
-        return AccountsApiFp(this.configuration).createAccount(requestParameters.createAccountRequestDto, requestParameters.authorization, options).then((request) => request(this.axios, this.basePath));
+        return AccountsApiFp(this.configuration).createAccount(requestParameters.createAccountRequestDto, requestParameters.authorization, this.withOwner(options)).then((request) => request(this.axios, this.basePath));
     }
 
     /**
@@ -753,7 +783,7 @@ export class AccountsApi extends BaseAPI {
      * @memberof AccountsApi
      */
     public deleteAccount(requestParameters: AccountsApiDeleteAccountRequest, options?: AxiosRequestConfig) {
-        return AccountsApiFp(this.configuration).deleteAccount(requestParameters.code, requestParameters.authorization, options).then((request) => request(this.axios, this.basePath));
+        return AccountsApiFp(this.configuration).deleteAccount(requestParameters.code, requestParameters.authorization, this.withOwner(options)).then((request) => request(this.axios, this.basePath));
     }
 
     /**
@@ -765,7 +795,7 @@ export class AccountsApi extends BaseAPI {
      * @memberof AccountsApi
      */
     public getAccount(requestParameters: AccountsApiGetAccountRequest, options?: AxiosRequestConfig) {
-        return AccountsApiFp(this.configuration).getAccount(requestParameters.code, requestParameters.authorization, requestParameters.expand, options).then((request) => request(this.axios, this.basePath));
+        return AccountsApiFp(this.configuration).getAccount(requestParameters.code, requestParameters.authorization, requestParameters.expand, this.withOwner(options)).then((request) => request(this.axios, this.basePath));
     }
 
     /**
@@ -777,7 +807,7 @@ export class AccountsApi extends BaseAPI {
      * @memberof AccountsApi
      */
     public getAccountByEmail(requestParameters: AccountsApiGetAccountByEmailRequest, options?: AxiosRequestConfig) {
-        return AccountsApiFp(this.configuration).getAccountByEmail(requestParameters.email, requestParameters.authorization, requestParameters.expand, options).then((request) => request(this.axios, this.basePath));
+        return AccountsApiFp(this.configuration).getAccountByEmail(requestParameters.email, requestParameters.authorization, requestParameters.expand, this.withOwner(options)).then((request) => request(this.axios, this.basePath));
     }
 
     /**
@@ -789,7 +819,7 @@ export class AccountsApi extends BaseAPI {
      * @memberof AccountsApi
      */
     public listAccounts(requestParameters: AccountsApiListAccountsRequest = {}, options?: AxiosRequestConfig) {
-        return AccountsApiFp(this.configuration).listAccounts(requestParameters.authorization, requestParameters.pageSize, requestParameters.pageToken, requestParameters.filter, requestParameters.search, requestParameters.order, requestParameters.expand, requestParameters.filters, options).then((request) => request(this.axios, this.basePath));
+        return AccountsApiFp(this.configuration).listAccounts(requestParameters.authorization, requestParameters.pageSize, requestParameters.pageToken, requestParameters.filter, requestParameters.search, requestParameters.order, requestParameters.expand, requestParameters.filters, this.withOwner(options)).then((request) => request(this.axios, this.basePath));
     }
 
     /**
@@ -801,6 +831,6 @@ export class AccountsApi extends BaseAPI {
      * @memberof AccountsApi
      */
     public updateAccount(requestParameters: AccountsApiUpdateAccountRequest, options?: AxiosRequestConfig) {
-        return AccountsApiFp(this.configuration).updateAccount(requestParameters.code, requestParameters.updateAccountRequestDto, requestParameters.authorization, options).then((request) => request(this.axios, this.basePath));
+        return AccountsApiFp(this.configuration).updateAccount(requestParameters.code, requestParameters.updateAccountRequestDto, requestParameters.authorization, this.withOwner(options)).then((request) => request(this.axios, this.basePath));
     }
 }

package/api/health-api.ts

@@ -119,6 +119,6 @@ export class HealthApi extends BaseAPI {
      * @memberof HealthApi
      */
     public check(options?: AxiosRequestConfig) {
-        return HealthApiFp(this.configuration).check(options).then((request) => request(this.axios, this.basePath));
+        return HealthApiFp(this.configuration).check(this.withOwner(options)).then((request) => request(this.axios, this.basePath));
     }
 }

package/base.ts

@@ -32,9 +32,20 @@ export const COLLECTION_FORMATS = {
     pipes: "|",
 };
 
+export interface SessionClass {
+    sub: string;
+    username?: string;
+    email?: string;
+    tenantSlug?: string;
+    permissions?: string;
+    expiresAt?: number;
+}
+
 export interface LoginClass {
     accessToken: string;
     permissions: string;
+    authMode?: string;
+    session?: SessionClass;
 }
 
 export interface SwitchWorkspaceRequest {
@@ -45,6 +56,8 @@ export interface SwitchWorkspaceRequest {
 export interface SwitchWorkspaceResponseClass {
     accessToken: string;
     permissions: string;
+    authMode?: string;
+    session?: SessionClass;
 }
 
 export enum Environment {
@@ -59,6 +72,10 @@ export enum Environment {
 let _retry_count = 0
 let _retry = null
 
+// Marks each request with the account (username) of the SDK object that sent it: only SDK objects of that
+// account refresh and resend it, never an object of another account open in the same browser.
+const REQUEST_OWNER = '_emilSdkOwner';
+
 export function resetRetry() {
     _retry_count = 0
 }
@@ -77,10 +94,19 @@ interface TokenData {
     accessToken?: string;
     username?: string;
     permissions?: string;
+    // 'both' or 'session' when authservice keeps the tokens in a server session.
+    authMode?: string;
+    sub?: string;
 }
 
 const NETWORK_ERROR_MESSAGE = "Network Error";
 const TOKEN_DATA = 'APP_TOKEN';
+// Sent only to authservice, to ask for a server session.
+const AUTH_MODE_HEADER = 'X-Emil-Auth-Mode';
+// Names the account on every call; one browser session can hold several.
+const ACCOUNT_HEADER = 'X-Emil-Account';
+const SESSION_MODES = ['both', 'session'];
+const RESEND_SAFE_METHODS = ['get', 'head', 'options'];
 
 /**
  *
@@ -98,14 +124,31 @@ export class BaseAPI {
         this.loadTokenData();
 
         if (configuration) {
+            // Two accounts in one browser share APP_TOKEN: never take the token or session account saved for
+            // another account. The mode stays (an app naming its account keeps its session). Saved with the next refresh.
+            const ownUser = configuration.username;
+            const storedUser = this.tokenData.username;
+            if (ownUser && storedUser && ownUser.toLowerCase() !== storedUser.toLowerCase()) {
+                delete this.tokenData.accessToken;
+                delete this.tokenData.sub;
+                this.tokenData.username = ownUser;
+            }
             const { accessToken } = this.tokenData;
             this.configuration = configuration;
             this.basePath = configuration.basePath || this.basePath;
 
-            // Use config token if provided, otherwise use tokenData token
-            const configToken = this.configuration.accessToken;
-            const storedToken = accessToken ? `Bearer ${accessToken}` : '';
-            this.configuration.accessToken = configToken || storedToken;
+            if (configuration.cookieAuth) {
+                this.configuration.username = this.configuration.username || this.tokenData.username;
+            }
+
+            if (this.usesSession()) {
+                this.useSessionAuth();
+            } else {
+                // Use config token if provided, otherwise use tokenData token
+                const configToken = this.configuration.accessToken;
+                const storedToken = accessToken ? `Bearer ${accessToken}` : '';
+                this.configuration.accessToken = configToken || storedToken;
+            }
         } else {
             const { accessToken, username } = this.tokenData;
 
@@ -119,6 +162,110 @@ export class BaseAPI {
         this.attachInterceptor(axios);
     }
 
+    // The app's own account wins over APP_TOKEN, which holds whichever tab wrote last.
+    private sessionAccount(): string | undefined {
+        return this.configuration.account || this.tokenData.sub;
+    }
+
+    // Apps may pass the address as the second argument only; authservice is on the same host.
+    private authBasePath(): string {
+        return this.configuration.basePath || this.basePath;
+    }
+
+    private usesSession(): boolean {
+        return !!this.configuration.cookieAuth && SESSION_MODES.indexOf(this.tokenData.authMode) !== -1 && !!this.sessionAccount();
+    }
+
+    private useSessionAuth() {
+        const { headers, ...baseOptions } = this.configuration.baseOptions || {};
+        this.configuration.accessToken = '';
+        this.configuration.baseOptions = {
+            ...baseOptions,
+            withCredentials: true,
+            headers: { ...headers, [ACCOUNT_HEADER]: this.sessionAccount() },
+        };
+    }
+
+    private useHeaderAuth(accessToken: string, keepSessionData = false) {
+        this.configuration.accessToken = accessToken ? `Bearer ${accessToken}` : '';
+        this.tokenData.accessToken = accessToken;
+        // An app without cookieAuth does not own the session fields: its refresh leaves them for the session apps.
+        if (!keepSessionData || this.configuration.cookieAuth) {
+            delete this.tokenData.authMode;
+            delete this.tokenData.sub;
+        }
+        if (this.configuration.cookieAuth) {
+            const { withCredentials, headers, ...baseOptions } = this.configuration.baseOptions || {};
+            const { [ACCOUNT_HEADER]: account, ...otherHeaders } = headers || {};
+            this.configuration.baseOptions = { ...baseOptions, headers: otherHeaders };
+        }
+    }
+
+    private applyTokenReply({ accessToken, authMode, session }: LoginClass, fromRefresh = false) {
+        if (this.configuration.cookieAuth && SESSION_MODES.indexOf(authMode) !== -1 && session?.sub) {
+            this.tokenData.authMode = authMode;
+            this.tokenData.sub = session.sub;
+            if (this.configuration.account) {
+                // A workspace switch moves the app to another account.
+                this.configuration.account = session.sub;
+            }
+            // Both keeps the token for apps not moved yet; session mode keeps no token at all.
+            if (authMode === 'both' && accessToken) {
+                this.tokenData.accessToken = accessToken;
+            } else {
+                delete this.tokenData.accessToken;
+            }
+            this.useSessionAuth();
+        } else {
+            this.useHeaderAuth(accessToken, fromRefresh);
+        }
+    }
+
+    private sessionHeaders(): Record<string, string> {
+        if (!this.configuration.cookieAuth) {
+            return {};
+        }
+        return {
+            [AUTH_MODE_HEADER]: 'session',
+            ...(this.usesSession() && { [ACCOUNT_HEADER]: this.sessionAccount() }),
+        };
+    }
+
+    private withCurrentAuth(config: AxiosRequestConfig): AxiosRequestConfig {
+        delete config.headers['Authorization'];
+        delete config.headers[ACCOUNT_HEADER];
+        if (this.usesSession()) {
+            config.headers[ACCOUNT_HEADER] = this.sessionAccount();
+            config.withCredentials = true;
+        } else if (this.configuration.accessToken) {
+            config.headers['Authorization'] = this.configuration.accessToken;
+        }
+        return config;
+    }
+
+    // Both keeps the token, so a session call the browser could not complete can be sent again with it.
+    private canRetryWithToken(config: AxiosRequestConfig): boolean {
+        return !!config.withCredentials && !!config.headers?.[ACCOUNT_HEADER]
+            && !!this.tokenData.accessToken && this.tokenData.authMode !== 'session';
+    }
+
+    // A network error can come after the server ran the call, so only a call that is safe to repeat is sent again.
+    private canResend(config: AxiosRequestConfig): boolean {
+        return RESEND_SAFE_METHODS.indexOf((config.method || 'get').toLowerCase()) !== -1
+            || Object.keys(config.headers || {}).some((name) => name.toLowerCase() === 'idempotency-key');
+    }
+
+    private switchToToken() {
+        this.useHeaderAuth(this.tokenData.accessToken);
+        this.storeTokenData(this.tokenData);
+    }
+
+    private retryWithToken(axios: AxiosInstance, config: AxiosRequestConfig) {
+        this.switchToToken();
+        config.withCredentials = false;
+        return axios(this.withCurrentAuth(config));
+    }
+
     selectEnvironment(env: Environment) {
         this.selectBasePath(env);
     }
@@ -138,8 +285,8 @@ export class BaseAPI {
     async authorize(username: string, password: string, targetWorkspace?: string): Promise<void> {
         const options: AxiosRequestConfig = {
             method: 'POST',
-            url: `${this.configuration.basePath}/authservice/v1/login`,
-            headers: { 'Content-Type': 'application/json' },
+            url: `${this.authBasePath()}/authservice/v1/login`,
+            headers: { 'Content-Type': 'application/json', ...(this.configuration.cookieAuth && { [AUTH_MODE_HEADER]: 'session' }) },
             data: {
                 username,
                 password,
@@ -149,13 +296,10 @@ export class BaseAPI {
 
         const response = await globalAxios.request<LoginClass>(options);
 
-        const { data: { accessToken, permissions } } = response;
-
         this.configuration.username = username;
-        this.configuration.accessToken = `Bearer ${accessToken}`;
         this.tokenData.username = username;
-        this.tokenData.accessToken = accessToken;
-        this.tokenData.permissions = permissions;
+        this.tokenData.permissions = response.data.permissions;
+        this.applyTokenReply(response.data);
 
         // Switch workspace if provided
         if (targetWorkspace) {
@@ -175,10 +319,11 @@ export class BaseAPI {
     async switchWorkspace(targetWorkspace: string): Promise<void> {
         const options: AxiosRequestConfig = {
             method: 'POST',
-            url: `${this.configuration.basePath}/authservice/v1/workspaces/switch`,
+            url: `${this.authBasePath()}/authservice/v1/workspaces/switch`,
             headers: {
                 'Content-Type': 'application/json',
-                'Authorization': `Bearer ${this.configuration.accessToken}`,
+                ...this.sessionHeaders(),
+                ...(!this.usesSession() && !!this.configuration.accessToken && { 'Authorization': this.configuration.accessToken as string }),
             },
             data: {
                 username: this.configuration.username,
@@ -189,11 +334,8 @@ export class BaseAPI {
 
         const response = await globalAxios.request<SwitchWorkspaceResponseClass>(options);
 
-        const { data: { accessToken, permissions } } = response;
-        
-        this.configuration.accessToken = `Bearer ${accessToken}`;
-        this.tokenData.accessToken = accessToken;
-        this.tokenData.permissions = permissions;
+        this.tokenData.permissions = response.data.permissions;
+        this.applyTokenReply(response.data);
 
         this.storeTokenData({
             ...this.tokenData
@@ -209,9 +351,34 @@ export class BaseAPI {
 
         const refreshTokenAxios = globalAxios.create()
         refreshTokenAxios.interceptors.response.use(response => {
-          const { permissions } = response.data;
-
+          const { permissions, accessToken, authMode } = response.data;
+          // Decided before the merge below: newer session data must not keep the new token from this object.
+          const onSession = this.usesSession();
+
+          // Newer data saved for this account (e.g. the session mode the shell saved later) wins over the copy
+          // read when the object was made; data of another account or another workspace (sub) is never taken.
+          const latest = ((typeof window !== 'undefined' && defaultStorage().get<TokenData>(TOKEN_DATA)) || {}) as TokenData;
+          const ownSub = this.sessionAccount();
+          if (latest.username?.toLowerCase() === username.toLowerCase()
+              && (!ownSub || !latest.sub || latest.sub === ownSub)) {
+              // A bare reset ({username}, an app's account check) keeps this copy's other fields; any fuller record
+              // is the truth, so fields it lacks were removed on purpose (e.g. a rollback) and stay removed.
+              const bareReset = Object.keys(latest).every((key) => key === 'username');
+              this.tokenData = bareReset ? { ...this.tokenData, ...latest } : { ...latest };
+          }
+          // The reply is for this account: label it, or an SDK object of another account would take the token.
+          if (this.tokenData.username?.toLowerCase() !== username.toLowerCase()) {
+              this.tokenData.username = username;
+          }
           this.tokenData.permissions = permissions;
+          // Keep the new token for the page's next SDK objects; session data is left as it is.
+          if (accessToken && !onSession) {
+              this.tokenData.accessToken = accessToken;
+              this.configuration.accessToken = `Bearer ${accessToken}`;
+          } else if (accessToken && authMode === 'both') {
+              // Both: this app stays on the session; the token is kept for apps not moved yet.
+              this.tokenData.accessToken = accessToken;
+          }
           this.storeTokenData(this.tokenData);
 
           return response;
@@ -219,9 +386,10 @@ export class BaseAPI {
 
         const options: AxiosRequestConfig = {
             method: 'POST',
-            url: `${this.configuration.basePath}/authservice/v1/refresh-token`,
+            url: `${this.authBasePath()}/authservice/v1/refresh-token`,
             headers: {
                 'Content-Type': 'application/json',
+                ...this.sessionHeaders(),
             },
             data: { username: username },
             withCredentials: true,
@@ -249,6 +417,18 @@ export class BaseAPI {
         this.storeTokenData(null);
     }
 
+    private ownAccount(): string {
+        return (this.configuration.username || '').toLowerCase();
+    }
+
+    protected withOwner(options?: AxiosRequestConfig): AxiosRequestConfig {
+        // An object without a username cannot refresh itself: its requests stay unmarked, as before.
+        if (!this.ownAccount()) {
+            return { ...options };
+        }
+        return { ...options, [REQUEST_OWNER]: this.ownAccount() } as AxiosRequestConfig;
+    }
+
     private attachInterceptor(axios: AxiosInstance) {
         axios.interceptors.response.use(
             (res) => {
@@ -256,26 +436,33 @@ export class BaseAPI {
             },
             async (err) => {
                 let originalConfig = err.config;
+                // Sent for another account: only that account's SDK objects handle it. Unmarked requests as before.
+                const owner = originalConfig?.[REQUEST_OWNER];
+                if (owner !== undefined && owner !== this.ownAccount()) {
+                    return Promise.reject(err);
+                }
                 if (err.response && !(err.response instanceof XMLHttpRequest)) { // sometimes buggy and is of type request
                     // Access Token was expired
                     if ((err.response.status === 401 || err.response.status === 403)
                         && !originalConfig._retry) {
                         originalConfig._retry = true;
                         try {
-                            const { accessToken: tokenString, permissions } = await this.refreshTokenInternal();
-                            const accessToken = `Bearer ${tokenString}`;
-                            this.tokenData.permissions = permissions;
-
-                            delete originalConfig.headers['Authorization']
-
-                            originalConfig.headers['Authorization'] = accessToken;
-
-                            this.configuration.accessToken = accessToken;
-                            this.tokenData.accessToken = tokenString;
-
+                            const reply = await this.refreshTokenInternal();
+                            this.tokenData.permissions = reply.permissions;
+                            this.applyTokenReply(reply, true);
                             this.storeTokenData(this.tokenData);
 
-                            return axios(originalConfig);
+                            if (!this.usesSession()) {
+                                return axios(this.withCurrentAuth(originalConfig));
+                            }
+
+                            // Both mode: if the browser does not send the session cookie (another site), use the token.
+                            return axios(this.withCurrentAuth(originalConfig)).catch((retryError) => {
+                                if (retryError?.response?.status !== 401 || !this.tokenData.accessToken) {
+                                    return Promise.reject(retryError);
+                                }
+                                return this.retryWithToken(axios, originalConfig);
+                            });
                         } catch (_error) {
                             if (_error.response && _error.response.data) {
                                 return Promise.reject(_error.response.data);
@@ -283,26 +470,35 @@ export class BaseAPI {
                             return Promise.reject(_error);
                         }
                     }
+                } else if (err.message === NETWORK_ERROR_MESSAGE && this.canRetryWithToken(originalConfig)) {
+                    // Both mode: the browser blocked the session call or hid its reply; later calls use the token.
+                    if (!this.canResend(originalConfig)) {
+                        this.switchToToken();
+                        return Promise.reject(err);
+                    }
+                    return this.retryWithToken(axios, originalConfig);
                 } else if (err.message === NETWORK_ERROR_MESSAGE
-                    && originalConfig.headers.hasOwnProperty('Authorization')
+                    && (originalConfig.headers.hasOwnProperty('Authorization')
+                        || (this.configuration.cookieAuth && originalConfig.withCredentials && this.canResend(originalConfig)))
                     && _retry_count < 4
                 ) {
                     _retry_count++;
                     try {
-                        const { accessToken: tokenString, permissions } = await this.refreshTokenInternal();
-                        const accessToken = `Bearer ${tokenString}`;
-                        this.tokenData.permissions = permissions;
+                        // In session mode an unreadable 401 (no CORS headers on the error reply) also lands here.
+                        const reply = await this.refreshTokenInternal();
+                        this.tokenData.permissions = reply.permissions;
 
                         _retry = true;
-                        originalConfig.headers['Authorization'] = accessToken;
-
-                        this.configuration.accessToken = accessToken;
-                        this.tokenData.accessToken = tokenString;
-
+                        this.applyTokenReply(reply, true);
                         this.storeTokenData(this.tokenData);
 
+                        // The limit is for refreshes that do not help; one that worked starts the count again.
+                        // Not awaited, so a failed retry reaches the app as the same axios error as before.
                         return axios.request({
-                            ...originalConfig,
+                            ...this.withCurrentAuth(originalConfig),
+                        }).then((retried) => {
+                            _retry_count = 0;
+                            return retried;
                         });
                     } catch (_error) {
                         if (_error.response && _error.response.data) {

package/common.ts

@@ -130,9 +130,10 @@ export const toPathString = function (url: URL) {
  * @export
  */
 export const createRequestFunction = function (axiosArgs: RequestArgs, globalAxios: AxiosInstance, BASE_PATH: string, configuration?: Configuration) {
-    return <T = unknown, R = AxiosResponse<T>>(axios: AxiosInstance = globalAxios, basePath: string = BASE_PATH) => {
+    // Typed by hand: since axios 1.20, request() returns an internal axios type that SDK declarations cannot name.
+    return <T = unknown, R = AxiosResponse<T>>(axios: AxiosInstance = globalAxios, basePath: string = BASE_PATH): Promise<R> => {
         const axiosRequestArgs = {...axiosArgs.options, url: (configuration?.basePath || basePath) + axiosArgs.url};
-        return axios.request<T, R>(axiosRequestArgs);
+        return axios.request<T, R>(axiosRequestArgs) as Promise<R>;
     };
 }
 

package/configuration.ts

@@ -21,6 +21,8 @@ export interface ConfigurationParameters {
     basePath?: string;
     baseOptions?: any;
     formDataCtor?: new () => any;
+    cookieAuth?: boolean;
+    account?: string;
 }
 
 export class Configuration {
@@ -74,6 +76,22 @@ export class Configuration {
      */
     formDataCtor?: new () => any;
 
+    /**
+     * Use a server session when authservice makes one; otherwise the token, as without this option.
+     * Set `account` too, so each SDK object keeps its own account.
+     *
+     * @type {boolean}
+     * @memberof Configuration
+     */
+    cookieAuth?: boolean;
+    /**
+     * The session account (Cognito sub) this app shows, so the SDK never takes another tab's account.
+     *
+     * @type {string}
+     * @memberof Configuration
+     */
+    account?: string;
+
     constructor(param: ConfigurationParameters = {}) {
         this.apiKey = param.apiKey;
         this.username = param.username;
@@ -82,6 +100,8 @@ export class Configuration {
         this.basePath = param.basePath;
         this.baseOptions = param.baseOptions;
         this.formDataCtor = param.formDataCtor;
+        this.cookieAuth = param.cookieAuth;
+        this.account = param.account;
     }
 
     /**