@frontegg/redux-store 5.61.0 → 6.0.1-alpha.2

package/node/auth/LoginState/saga.js

@@ -0,0 +1,918 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.afterAuthNavigation = afterAuthNavigation;
+exports.getMfaRequiredState = getMfaRequiredState;
+exports.isMfaRequired = void 0;
+exports.loadSSOPublicConfigurationFunction = loadSSOPublicConfigurationFunction;
+exports.loginSagas = loginSagas;
+exports.loginSagasMock = loginSagasMock;
+exports.refreshMetadata = refreshMetadata;
+exports.refreshToken = refreshToken;
+
+var _objectWithoutPropertiesLoose2 = _interopRequireDefault(require("@babel/runtime/helpers/objectWithoutPropertiesLoose"));
+
+var _extends2 = _interopRequireDefault(require("@babel/runtime/helpers/extends"));
+
+var _effects = require("redux-saga/effects");
+
+var _restApi = require("@frontegg/rest-api");
+
+var _reducer = require("../reducer");
+
+var _constants = require("../../constants");
+
+var _interfaces = require("../interfaces");
+
+var _interfaces2 = require("./interfaces");
+
+var _saga = require("../SignUp/saga");
+
+var _interfaces3 = require("../MfaState/interfaces");
+
+var _dummy = require("../dummy");
+
+var _interfaces4 = require("../SSOState/interfaces");
+
+var _saga2 = require("../../vendor/saga");
+
+var _helpers = require("../../helpers");
+
+var _interfaces5 = require("../ResetPhoneNumberState/interfaces");
+
+const _excluded = ["callback"],
+      _excluded2 = ["callback", "events"],
+      _excluded3 = ["callback"];
+const authStrategyLoginStepMap = {
+  [_restApi.AuthStrategyEnum.Code]: _interfaces2.LoginStep.loginWithOtc,
+  [_restApi.AuthStrategyEnum.EmailAndPassword]: _interfaces2.LoginStep.loginWithPassword,
+  [_restApi.AuthStrategyEnum.MagicLink]: _interfaces2.LoginStep.magicLinkPreLoginSuccess,
+  [_restApi.AuthStrategyEnum.SmsCode]: _interfaces2.LoginStep.loginWithSmsOtc
+};
+
+function* afterAuthNavigation() {
+  var _window;
+
+  const onRedirectTo = _restApi.ContextHolder.onRedirectTo;
+  const {
+    routes,
+    includeQueryParam
+  } = yield (0, _effects.select)(state => state.auth);
+  const {
+    loginUrl,
+    logoutUrl,
+    socialLoginCallbackUrl,
+    activateUrl
+  } = routes;
+  let {
+    authenticatedUrl
+  } = routes;
+  const afterAuthRedirect = window.localStorage.getItem(_constants.FRONTEGG_AFTER_AUTH_REDIRECT_URL);
+
+  if (afterAuthRedirect && ![loginUrl, logoutUrl, socialLoginCallbackUrl, activateUrl].includes(afterAuthRedirect)) {
+    authenticatedUrl = afterAuthRedirect;
+  }
+
+  window.localStorage.removeItem(_constants.FRONTEGG_AFTER_AUTH_REDIRECT_URL);
+  yield (0, _effects.delay)(200);
+  (0, _effects.put)(_reducer.actions.resetLoginState());
+  const url = new URL((_window = window) == null ? void 0 : _window.location.href);
+  let redirectUrl = authenticatedUrl;
+
+  if (url.searchParams.get('redirectUrl')) {
+    var _url$searchParams$get;
+
+    redirectUrl = (_url$searchParams$get = url.searchParams.get('redirectUrl')) != null ? _url$searchParams$get : authenticatedUrl;
+  } else if (includeQueryParam) {
+    redirectUrl += window.location.search;
+  }
+
+  onRedirectTo(redirectUrl, {
+    refresh: redirectUrl.startsWith('http')
+  });
+}
+
+function* refreshMetadata() {
+  let ssoACS;
+
+  try {
+    var _metadata$configurati;
+
+    const metadata = yield (0, _effects.call)(_restApi.api.metadata.getSamlMetadata);
+    ssoACS = metadata == null ? void 0 : (_metadata$configurati = metadata.configuration) == null ? void 0 : _metadata$configurati.acsUrl;
+  } catch (e) {
+    console.error(e);
+  }
+
+  yield (0, _effects.put)(_reducer.actions.setState({
+    ssoACS
+  }));
+}
+
+function* loadSSOPublicConfigurationFunction() {
+  try {
+    const {
+      isActive
+    } = yield (0, _effects.call)(_restApi.api.auth.getSSOPublicConfiguration);
+    yield (0, _effects.put)(_reducer.actions.setState({
+      isSSOAuth: isActive
+    }));
+  } catch (e) {
+    console.error(e);
+  }
+}
+
+const isMfaRequired = user => {
+  if (user.mfaRequired && user.mfaToken) {
+    _restApi.ContextHolder.setAccessToken(null);
+
+    _restApi.ContextHolder.setUser(null);
+
+    return true;
+  } else {
+    _restApi.ContextHolder.setAccessToken(user.accessToken);
+
+    _restApi.ContextHolder.setUser(user);
+
+    return false;
+  }
+};
+
+exports.isMfaRequired = isMfaRequired;
+
+function* getMfaRequiredState(user) {
+  let setMfaState = {};
+  let step = _interfaces2.LoginStep.loginWithTwoFactor;
+  const {
+    loginState
+  } = yield (0, _effects.select)(state => state.auth);
+  const {
+    isAllowedToRemember,
+    mfaDeviceExpiration
+  } = yield (0, _effects.call)(_restApi.api.auth.checkIfAllowToRememberMfaDevice, user.mfaToken);
+
+  if (user.hasOwnProperty('mfaEnrolled') && !user.mfaEnrolled) {
+    setMfaState = {
+      mfaState: {
+        step: _interfaces3.MFAStep.verify,
+        qrCode: user.qrCode,
+        recoveryCode: user.recoveryCode,
+        loading: false,
+        mfaToken: user.mfaToken
+      }
+    };
+    step = _interfaces2.LoginStep.forceTwoFactor;
+  }
+
+  return (0, _extends2.default)({
+    user: undefined,
+    isAuthenticated: false
+  }, setMfaState, {
+    loginState: (0, _extends2.default)({}, loginState, {
+      mfaToken: user.mfaToken,
+      mfaRequired: user.mfaRequired,
+      loading: false,
+      error: undefined,
+      step,
+      tenantsLoading: true,
+      tenants: [],
+      allowRememberMfaDevice: isAllowedToRemember,
+      mfaDeviceExpiration
+    })
+  });
+}
+
+function* refreshToken() {
+  try {
+    const onRedirectTo = _restApi.ContextHolder.onRedirectTo;
+    const {
+      routes,
+      loginState
+    } = yield (0, _effects.select)(state => state.auth);
+    const {
+      user,
+      tenants
+    } = yield (0, _effects.call)(_restApi.api.auth.refreshTokenV2);
+
+    if (isMfaRequired(user)) {
+      const mfaRequiredState = yield getMfaRequiredState(user);
+      yield (0, _effects.put)(_reducer.actions.setState(mfaRequiredState));
+      onRedirectTo(routes.loginUrl, {
+        preserveQueryParams: true
+      });
+    } else {
+      yield (0, _effects.put)(_reducer.actions.setTenantsState({
+        tenants,
+        loading: false
+      }));
+      yield (0, _effects.put)(_reducer.actions.setState({
+        user,
+        isAuthenticated: true
+      }));
+
+      if ([routes.loginUrl, routes.socialLoginCallbackUrl, routes.signUpUrl, routes.oidcRedirectUrl, routes.samlCallbackUrl].some(url => url && window.location.pathname.endsWith(url))) {
+        if (loginState.isNewUser && routes.signUpSuccessUrl && routes.socialLoginCallbackUrl === window.location.pathname) {
+          onRedirectTo(routes.signUpSuccessUrl, {
+            refresh: routes.signUpSuccessUrl.startsWith('http')
+          });
+        } else {
+          yield afterAuthNavigation();
+        }
+      }
+    }
+  } catch (e) {
+    _restApi.ContextHolder.setAccessToken(null);
+
+    _restApi.ContextHolder.setUser(null);
+
+    yield (0, _effects.put)(_reducer.actions.setState({
+      user: undefined,
+      isAuthenticated: false
+    }));
+  }
+}
+
+function* requestAuthorize({
+  payload: firstTime
+}) {
+  const calls = [];
+
+  if (firstTime) {
+    yield (0, _effects.put)(_reducer.actions.setState({
+      isLoading: true
+    }));
+    yield (0, _effects.put)(_reducer.actions.loadSocialLoginsConfigurationV2());
+    calls.push((0, _effects.call)(_saga.loadAllowSignUps));
+    calls.push((0, _effects.call)(loadSSOPublicConfigurationFunction));
+    calls.push((0, _effects.call)(_saga2.loadVendorPublicInfo));
+    calls.push((0, _effects.call)(refreshMetadata));
+  }
+
+  calls.push((0, _effects.call)(refreshToken));
+  yield (0, _effects.all)(calls);
+  yield (0, _effects.put)(_reducer.actions.setState({
+    isLoading: false
+  }));
+}
+
+function* refreshTokenSSR(accessToken) {
+  if (!accessToken) {
+    _restApi.ContextHolder.setAccessToken(null);
+
+    _restApi.ContextHolder.setUser(null);
+
+    yield (0, _effects.put)(_reducer.actions.setState({
+      user: undefined,
+      isAuthenticated: false
+    }));
+    return;
+  }
+
+  try {
+    const onRedirectTo = _restApi.ContextHolder.onRedirectTo;
+    const {
+      routes
+    } = yield (0, _effects.select)(state => state.auth);
+    const {
+      user,
+      tenants
+    } = yield (0, _effects.call)(_restApi.api.auth.generateLoginResponseV2, {
+      accessToken
+    });
+
+    if (isMfaRequired(user)) {
+      const mfaRequiredState = yield getMfaRequiredState(user);
+      yield (0, _effects.put)(_reducer.actions.setState(mfaRequiredState));
+      onRedirectTo(routes.loginUrl, {
+        preserveQueryParams: true
+      });
+    } else {
+      yield (0, _effects.put)(_reducer.actions.setTenantsState({
+        tenants,
+        loading: false
+      }));
+      yield (0, _effects.put)(_reducer.actions.setState({
+        user,
+        isAuthenticated: true
+      }));
+    }
+  } catch (e) {
+    _restApi.ContextHolder.setAccessToken(null);
+
+    _restApi.ContextHolder.setUser(null);
+
+    yield (0, _effects.put)(_reducer.actions.setState({
+      user: undefined,
+      isAuthenticated: false
+    }));
+  }
+}
+
+function* requestAuthorizeSSR({
+  payload: accessToken
+}) {
+  const calls = [];
+  yield (0, _effects.put)(_reducer.actions.setState({
+    isLoading: true
+  }));
+  yield (0, _effects.put)(_reducer.actions.loadSocialLoginsConfigurationV2());
+  calls.push((0, _effects.call)(_saga.loadAllowSignUps));
+  calls.push((0, _effects.call)(loadSSOPublicConfigurationFunction));
+  calls.push((0, _effects.call)(_saga2.loadVendorPublicInfo));
+  calls.push((0, _effects.call)(refreshMetadata));
+  calls.push((0, _effects.call)(refreshTokenSSR, accessToken));
+  yield (0, _effects.all)(calls);
+  yield (0, _effects.put)(_reducer.actions.setState({
+    isLoading: false
+  }));
+}
+
+function* requestHostedLoginAuthorize() {
+  const {
+    routes,
+    context,
+    onRedirectTo
+  } = yield (0, _effects.select)(state => ({
+    routes: state.auth.routes,
+    onRedirectTo: state.auth.onRedirectTo,
+    context: state.root.context
+  }));
+  const nonce = (0, _helpers.createRandomString)();
+  const code_verifier = (0, _helpers.createRandomString)();
+  const code_challenge = yield (0, _effects.call)(_helpers.generateCodeChallenge, code_verifier);
+  localStorage.setItem(_constants.HOSTED_LOGIN_VERIFIER_KEY, code_verifier);
+  const redirectUrl = `${window.location.origin}${routes.hostedLoginRedirectUrl}`;
+
+  const baseUrl = _restApi.fetch.getBaseUrl(context, '/oauth/authorize');
+
+  const oauthUrl = `${baseUrl}/oauth/authorize`;
+  const params = {
+    response_type: 'code',
+    client_id: context.clientId || 'INVALID-CLIENT-ID',
+    scope: 'openid email profile',
+    redirect_uri: redirectUrl,
+    code_challenge: code_challenge,
+    code_challenge_method: 'S256',
+    nonce
+  };
+  const searchParams = new URLSearchParams(params);
+  const url = `${oauthUrl}?${searchParams.toString()}`;
+  onRedirectTo(url, {
+    refresh: true
+  });
+}
+
+function* handleHostedLoginCallback({
+  payload
+}) {
+  const code_verifier = localStorage.getItem(_constants.HOSTED_LOGIN_VERIFIER_KEY) || 'INVALID-CODE-VERIFIER';
+  const routes = yield (0, _effects.select)(state => state.auth.routes);
+  const redirectUrl = `${window.location.origin}${routes.hostedLoginRedirectUrl}`;
+  const body = {
+    code: payload.code,
+    redirect_uri: redirectUrl,
+    code_verifier,
+    grant_type: 'authorization_code'
+  };
+  const user = yield (0, _effects.call)(_restApi.api.auth.exchangeOAuthTokens, body);
+  yield (0, _effects.put)(_reducer.actions.setState({
+    user,
+    isAuthenticated: true
+  }));
+  yield (0, _effects.put)(_reducer.actions.loadTenants());
+  yield afterAuthNavigation();
+}
+
+function* passwordlessPreLogin(_ref) {
+  let {
+    payload: {
+      callback
+    }
+  } = _ref,
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_ref.payload, _excluded);
+
+  try {
+    const {
+      onRedirectTo,
+      routes
+    } = yield (0, _effects.select)(({
+      auth: {
+        onRedirectTo,
+        routes
+      }
+    }) => ({
+      onRedirectTo,
+      routes
+    }));
+    yield (0, _effects.put)(_reducer.actions.setLoginState({
+      loading: true
+    }));
+    const preloginRes = yield (0, _effects.call)(_restApi.api.auth.passwordlessPreLogin, payload);
+    const step = authStrategyLoginStepMap[payload.type];
+
+    if (step === _interfaces2.LoginStep.loginWithSmsOtc && preloginRes.resetPhoneNumberToken) {
+      yield (0, _effects.put)(_reducer.actions.setResetPhoneNumberState({
+        resetPhoneNumberToken: preloginRes.resetPhoneNumberToken,
+        step: _interfaces5.ResetPhoneNumberStep.VerifyResetPhoneNumber
+      }));
+      onRedirectTo(routes.resetPhoneNumberUrl);
+      return;
+    }
+
+    yield (0, _effects.put)(_reducer.actions.setLoginState({
+      step,
+      loading: false,
+      email: payload.email,
+      phoneNumber: preloginRes == null ? void 0 : preloginRes.phoneNumber
+    }));
+    callback == null ? void 0 : callback();
+  } catch (e) {
+    yield (0, _effects.put)(_reducer.actions.setLoginState({
+      error: e.message,
+      loading: false
+    }));
+    callback == null ? void 0 : callback();
+  }
+}
+
+function* passwordlessPostLogin(_ref2) {
+  let {
+    payload: {
+      callback,
+      events
+    }
+  } = _ref2,
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_ref2.payload, _excluded2);
+
+  try {
+    yield (0, _effects.put)(_reducer.actions.setLoginState({
+      loading: true
+    }));
+    const data = yield (0, _effects.call)(_restApi.api.auth.passwordlessPostLogin, payload);
+
+    if (isMfaRequired(data)) {
+      const onRedirectTo = _restApi.ContextHolder.onRedirectTo;
+      const {
+        routes
+      } = yield (0, _effects.select)(state => state.auth);
+      const mfaRequiredState = yield getMfaRequiredState(data);
+      yield (0, _effects.put)(_reducer.actions.setState(mfaRequiredState));
+      onRedirectTo(routes.loginUrl, {
+        preserveQueryParams: true
+      });
+    } else {
+      const user = yield (0, _effects.call)(_restApi.api.auth.generateLoginResponse, data);
+
+      if (data.emailVerified) {
+        var _events$userVerified;
+
+        events == null ? void 0 : (_events$userVerified = events.userVerified) == null ? void 0 : _events$userVerified.call(events, {
+          email: user.email,
+          origin: _interfaces.UserVeirifedOriginTypes.PASSWORDLESS,
+          id: user.id,
+          tenantId: user.tenantId,
+          createdAt: new Date(),
+          name: user.name
+        });
+      }
+
+      yield (0, _effects.put)(_reducer.actions.loadTenants());
+      yield (0, _effects.put)(_reducer.actions.setState({
+        user,
+        isAuthenticated: true
+      }));
+      yield afterAuthNavigation();
+    }
+
+    callback == null ? void 0 : callback(true);
+  } catch (e) {
+    var _e$message;
+
+    yield (0, _effects.put)(_reducer.actions.setLoginState({
+      error: (_e$message = e.message) != null ? _e$message : 'Failed to authenticate'
+    }));
+  } finally {
+    yield (0, _effects.put)(_reducer.actions.setLoginState({
+      loading: false
+    }));
+  }
+}
+
+function* verifyInviteToken({
+  payload
+}) {
+  try {
+    yield (0, _effects.put)(_reducer.actions.setLoginState({
+      loading: true
+    }));
+    const {
+      name: inviteTokenTenantName
+    } = yield (0, _effects.call)(_restApi.api.auth.verifyInviteToken, payload);
+    yield (0, _effects.put)(_reducer.actions.setLoginState({
+      inviteTokenTenantName
+    }));
+  } catch (e) {
+    var _e$message2;
+
+    console.error(e);
+    yield (0, _effects.put)(_reducer.actions.setLoginState({
+      inviteTokenError: (_e$message2 = e.message) != null ? _e$message2 : `We couldn't verify your invitation`
+    }));
+  } finally {
+    yield (0, _effects.put)(_reducer.actions.setLoginState({
+      loading: false
+    }));
+  }
+}
+
+function* preLogin({
+  payload: {
+    email,
+    recaptchaToken,
+    invitationToken,
+    callback
+  }
+}) {
+  yield (0, _effects.put)(_reducer.actions.setLoginState({
+    loading: true
+  }));
+
+  try {
+    const onRedirectTo = yield (0, _effects.select)(({
+      auth: {
+        onRedirectTo
+      }
+    }) => onRedirectTo);
+    let {
+      address,
+      idpType
+    } = yield (0, _effects.call)(_restApi.api.auth.preLoginV2, {
+      email
+    });
+
+    if (address) {
+      if (idpType === _interfaces4.SamlVendors.Oidc && !address.includes('redirect_uri')) {
+        const {
+          routes: {
+            oidcRedirectUrl
+          }
+        } = yield (0, _effects.select)(({
+          auth: {
+            routes
+          }
+        }) => ({
+          routes
+        }));
+        address += `&redirect_uri=${window.location.origin}${oidcRedirectUrl}`;
+      }
+
+      yield (0, _effects.put)(_reducer.actions.setLoginState({
+        step: _interfaces2.LoginStep.redirectToSSO,
+        loading: false,
+        ssoRedirectUrl: address
+      }));
+      setTimeout(() => {
+        onRedirectTo(address, {
+          refresh: true
+        });
+      }, 2000);
+    } else {
+      yield ssoPreloginFailed({
+        email,
+        recaptchaToken,
+        callback,
+        invitationToken
+      });
+    }
+  } catch (e) {
+    yield ssoPreloginFailed({
+      email,
+      recaptchaToken,
+      callback,
+      invitationToken
+    });
+  }
+}
+
+function* ssoPreloginFailed(_ref3) {
+  let {
+    callback
+  } = _ref3,
+      body = (0, _objectWithoutPropertiesLoose2.default)(_ref3, _excluded3);
+  const publicPolicy = yield (0, _effects.select)(({
+    auth: {
+      securityPolicyState: {
+        publicPolicy: {
+          policy: publicPolicy
+        }
+      }
+    }
+  }) => publicPolicy);
+
+  if (!(publicPolicy != null && publicPolicy.authStrategy)) {
+    yield (0, _effects.put)(_reducer.actions.setLoginState({
+      step: _interfaces2.LoginStep.loginWithPassword,
+      loading: false
+    }));
+    callback == null ? void 0 : callback();
+    return;
+  }
+
+  if ((publicPolicy == null ? void 0 : publicPolicy.authStrategy) === _restApi.AuthStrategyEnum.EmailAndPassword) {
+    yield (0, _effects.put)(_reducer.actions.setLoginState({
+      step: _interfaces2.LoginStep.loginWithPassword,
+      loading: false
+    }));
+    callback == null ? void 0 : callback();
+  } else if ([_restApi.AuthStrategyEnum.MagicLink, _restApi.AuthStrategyEnum.Code, _restApi.AuthStrategyEnum.SmsCode].includes(publicPolicy == null ? void 0 : publicPolicy.authStrategy)) {
+    yield (0, _effects.put)(_reducer.actions.passwordlessPreLogin((0, _extends2.default)({}, body, {
+      type: publicPolicy == null ? void 0 : publicPolicy.authStrategy,
+      callback
+    })));
+  } else {
+    yield (0, _effects.put)(_reducer.actions.setLoginState({
+      step: _interfaces2.LoginStep.loginWithPassword,
+      loading: false
+    }));
+    callback == null ? void 0 : callback();
+  }
+}
+
+function* postLogin({
+  payload
+}) {
+  const {
+    onRedirectTo,
+    routes
+  } = yield (0, _effects.select)(({
+    auth: {
+      onRedirectTo,
+      routes
+    }
+  }) => ({
+    onRedirectTo,
+    routes
+  }));
+  yield (0, _effects.put)(_reducer.actions.setLoginState({
+    loading: true
+  }));
+
+  try {
+    const user = yield (0, _effects.call)(_restApi.api.auth.postLogin, payload);
+
+    _restApi.ContextHolder.setAccessToken(user.accessToken);
+
+    _restApi.ContextHolder.setUser(user);
+
+    yield (0, _effects.put)(_reducer.actions.setState({
+      user: !!user.accessToken ? user : undefined,
+      isAuthenticated: !!user.accessToken
+    }));
+    yield afterAuthNavigation();
+  } catch (e) {
+    setTimeout(() => {
+      onRedirectTo(routes.authenticatedUrl);
+    }, 1000);
+    yield (0, _effects.put)(_reducer.actions.setLoginState({
+      step: _interfaces2.LoginStep.loginWithSSOFailed,
+      loading: false
+    }));
+  }
+}
+
+function* login({
+  payload: {
+    email,
+    password,
+    recaptchaToken,
+    invitationToken,
+    callback
+  }
+}) {
+  yield (0, _effects.put)(_reducer.actions.setLoginState({
+    loading: true
+  }));
+
+  try {
+    const user = yield (0, _effects.call)(_restApi.api.auth.login, {
+      email,
+      password,
+      recaptchaToken,
+      invitationToken
+    });
+
+    _restApi.ContextHolder.setAccessToken(user.accessToken);
+
+    _restApi.ContextHolder.setUser(user);
+
+    let setMfaState = {};
+    let step = _interfaces2.LoginStep.success;
+
+    if (user.mfaRequired && user.mfaToken) {
+      step = _interfaces2.LoginStep.loginWithTwoFactor;
+
+      if (user.hasOwnProperty('mfaEnrolled') && !user.mfaEnrolled) {
+        setMfaState = {
+          mfaState: {
+            step: _interfaces3.MFAStep.verify,
+            qrCode: user.qrCode,
+            recoveryCode: user.recoveryCode,
+            mfaToken: user.mfaToken,
+            loading: false
+          }
+        };
+        step = _interfaces2.LoginStep.forceTwoFactor;
+      }
+    }
+
+    const isAuthenticated = step === _interfaces2.LoginStep.success && !!user.accessToken;
+    const loggedInUser = step === _interfaces2.LoginStep.success && step === _interfaces2.LoginStep.success ? user : undefined;
+    let allowRememberDevice = {
+      isAllowedToRemember: false,
+      mfaDeviceExpiration: 0
+    };
+
+    if (user.mfaRequired && user.mfaToken) {
+      allowRememberDevice = yield (0, _effects.call)(_restApi.api.auth.checkIfAllowToRememberMfaDevice, user.mfaToken);
+    }
+
+    const {
+      isAllowedToRemember,
+      mfaDeviceExpiration
+    } = allowRememberDevice;
+    yield (0, _effects.put)(_reducer.actions.setState((0, _extends2.default)({
+      user: loggedInUser,
+      isAuthenticated
+    }, setMfaState, {
+      loginState: {
+        email,
+        loading: false,
+        error: undefined,
+        mfaToken: user.mfaToken,
+        step,
+        tenants: [],
+        tenantsLoading: true,
+        allowRememberMfaDevice: isAllowedToRemember,
+        mfaDeviceExpiration
+      }
+    })));
+
+    if (step === _interfaces2.LoginStep.success) {
+      yield (0, _effects.put)(_reducer.actions.loadTenants());
+      yield afterAuthNavigation();
+    }
+
+    callback == null ? void 0 : callback(true);
+  } catch (e) {
+    _restApi.ContextHolder.setAccessToken(null);
+
+    _restApi.ContextHolder.setUser(null);
+
+    yield (0, _effects.put)(_reducer.actions.setLoginState({
+      email,
+      error: e.message,
+      loading: false
+    }));
+  }
+}
+
+function* loginWithMfa({
+  payload: {
+    mfaToken,
+    value,
+    rememberDevice,
+    callback
+  }
+}) {
+  yield (0, _effects.put)(_reducer.actions.setLoginState({
+    loading: true
+  }));
+
+  try {
+    const user = yield (0, _effects.call)(_restApi.api.auth.loginWithMfa, {
+      mfaToken,
+      value,
+      rememberDevice
+    });
+    const step = _interfaces2.LoginStep.success;
+    yield (0, _effects.put)(_reducer.actions.setState({
+      loginState: {
+        loading: false,
+        error: undefined,
+        step,
+        tenantsLoading: true,
+        tenants: []
+      },
+      user,
+      isAuthenticated: true
+    }));
+    yield (0, _effects.put)(_reducer.actions.loadTenants());
+    callback == null ? void 0 : callback(true);
+
+    if (step === _interfaces2.LoginStep.success) {
+      yield afterAuthNavigation();
+    }
+  } catch (e) {
+    yield (0, _effects.put)(_reducer.actions.setLoginState({
+      error: e.message,
+      loading: false
+    }));
+    callback == null ? void 0 : callback(false, e);
+  }
+}
+
+function* recoverMfa({
+  payload
+}) {
+  yield (0, _effects.put)(_reducer.actions.setLoginState({
+    loading: true
+  }));
+
+  try {
+    yield (0, _effects.call)(_restApi.api.auth.recoverMfaToken, payload);
+    yield (0, _effects.put)(_reducer.actions.setLoginState({
+      loading: false,
+      error: undefined,
+      step: _interfaces2.LoginStep.preLogin
+    }));
+    yield (0, _effects.put)(_reducer.actions.setState({
+      user: undefined,
+      isAuthenticated: false
+    }));
+  } catch (e) {
+    yield (0, _effects.put)(_reducer.actions.setLoginState({
+      error: e.message,
+      loading: false
+    }));
+  }
+}
+
+function* logout({
+  payload
+}) {
+  yield (0, _effects.put)(_reducer.actions.setState({
+    isLoading: true
+  }));
+
+  try {
+    yield (0, _effects.call)(_restApi.api.auth.logout);
+  } catch {}
+
+  yield (0, _effects.put)(_reducer.actions.resetState());
+  yield (0, _effects.put)(_reducer.actions.requestAuthorize(true));
+  payload == null ? void 0 : payload();
+}
+
+function* silentLogout({
+  payload
+}) {
+  try {
+    yield (0, _effects.call)(_restApi.api.auth.logout);
+  } catch {}
+
+  setTimeout(() => payload == null ? void 0 : payload(), 500);
+}
+
+function* loginSagas() {
+  yield (0, _effects.takeLeading)(_reducer.actions.requestAuthorize, requestAuthorize);
+  yield (0, _effects.takeLeading)(_reducer.actions.requestAuthorizeSSR, requestAuthorizeSSR);
+  yield (0, _effects.takeLeading)(_reducer.actions.requestHostedLoginAuthorize, requestHostedLoginAuthorize);
+  yield (0, _effects.takeLeading)(_reducer.actions.handleHostedLoginCallback, handleHostedLoginCallback);
+  yield (0, _effects.takeLeading)(_reducer.actions.preLogin, preLogin);
+  yield (0, _effects.takeLeading)(_reducer.actions.postLogin, postLogin);
+  yield (0, _effects.takeLeading)(_reducer.actions.login, login);
+  yield (0, _effects.takeLeading)(_reducer.actions.logout, logout);
+  yield (0, _effects.takeLeading)(_reducer.actions.silentLogout, silentLogout);
+  yield (0, _effects.takeLeading)(_reducer.actions.loginWithMfa, loginWithMfa);
+  yield (0, _effects.takeLeading)(_reducer.actions.recoverMfa, recoverMfa);
+  yield (0, _effects.takeLeading)(_reducer.actions.passwordlessPreLogin, passwordlessPreLogin);
+  yield (0, _effects.takeLeading)(_reducer.actions.passwordlessPostLogin, passwordlessPostLogin);
+  yield (0, _effects.takeLeading)(_reducer.actions.verifyInviteToken, verifyInviteToken);
+}
+
+function* requestAuthorizeMock({
+  payload: firstTime
+}) {
+  if (firstTime) {
+    yield (0, _effects.put)(_reducer.actions.setState({
+      isLoading: true
+    }));
+  }
+
+  const user = _dummy.userDemo;
+  yield (0, _effects.put)(_reducer.actions.loadTenants());
+  yield (0, _effects.put)(_reducer.actions.setState({
+    user,
+    isAuthenticated: true,
+    isLoading: false
+  }));
+}
+
+function* loginSagasMock() {
+  yield (0, _effects.takeLeading)(_reducer.actions.requestAuthorize, requestAuthorizeMock);
+  yield (0, _effects.takeLeading)(_reducer.actions.afterAuthNavigation, afterAuthNavigation);
+}