@frontegg/redux-store 7.0.0-alpha.1 → 7.0.0-alpha.10

package/auth/GroupsState/interfaces.js

@@ -1,3 +1,5 @@
+// TODO: import from after adding teams State
+
 export let GroupsStateKeys;
 (function (GroupsStateKeys) {
   GroupsStateKeys["CREATE_GROUP"] = "CREATE_GROUP";

package/auth/GroupsState/state.d.ts

@@ -0,0 +1,4 @@
+import { GroupsState } from './interfaces';
+export declare const initialState: GroupsState;
+declare const _default: (overrideState?: Partial<GroupsState> | undefined) => GroupsState;
+export default _default;

package/auth/GroupsState/state.js

@@ -0,0 +1,8 @@
+import { createProxy } from '../../toolkit/proxy';
+export const initialState = {
+  loaders: {},
+  errors: {},
+  groups: [],
+  groupsConfiguration: {}
+};
+export default (overrideState => createProxy(initialState, overrideState));

package/auth/ImpersonateState/actions.d.ts

@@ -0,0 +1,8 @@
+import { FronteggState, RestApi, SharedActions, WithCallback } from '../../interfaces';
+import { IImpersonatePayload, ImpersonateState } from './interfaces';
+declare const _default: (store: FronteggState, api: RestApi, sharedActions: SharedActions) => {
+    setImpersonateState: (state: Partial<ImpersonateState>) => void;
+    resetImpersonateState: () => void;
+    impersonate: (_payload: WithCallback<IImpersonatePayload>) => Promise<void>;
+};
+export default _default;

package/auth/ImpersonateState/actions.js

@@ -0,0 +1,52 @@
+import _objectWithoutPropertiesLoose from "@babel/runtime/helpers/esm/objectWithoutPropertiesLoose";
+const _excluded = ["callback", "events"];
+import { ImpersonateStep } from './interfaces';
+import { errorHandler, deepClone, delay } from '../../helpers';
+import { initialState } from './state';
+export default ((store, api, sharedActions) => {
+  const actions = sharedActions;
+  const setImpersonateState = state => {
+    Object.assign(store.auth.impersonateState, state);
+  };
+  const resetImpersonateState = () => {
+    store.auth.impersonateState = deepClone(initialState);
+  };
+  const impersonate = async _payload => {
+    const {
+        callback
+      } = _payload,
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded);
+    setImpersonateState({
+      loading: true
+    });
+    try {
+      // TODO: check why this this response not used for setting user accessToken
+      //       https://github.com/frontegg/admin-box/blob/8ac579241250ac2ab627aacfcc6118b548a4c7e5/packages/redux-store/src/auth/ImpersonationState/saga.ts#L13
+      // eslint-disable-next-line @typescript-eslint/no-unused-vars
+      const data = await api.impersonate.impersonate(payload);
+      setImpersonateState({
+        step: ImpersonateStep.success
+      });
+      await delay(1000);
+      /**
+       * We want to avoid cleaning the origin of the redirect URL
+       * because we want to refresh the page and redirect to the same origin on embedded mode
+       */
+      await actions.afterAuthNavigation({
+        preventRedirectUrlOriginCleaning: true
+      });
+      resetImpersonateState();
+      callback == null ? void 0 : callback(true);
+    } catch (e) {
+      setImpersonateState({
+        loading: false,
+        error: errorHandler(e)
+      });
+    }
+  };
+  return {
+    setImpersonateState,
+    resetImpersonateState,
+    impersonate
+  };
+});

package/auth/ImpersonateState/index.d.ts

@@ -0,0 +1,3 @@
+import createImpersonateState from './state';
+import buildImpersonateActions from './actions';
+export { createImpersonateState, buildImpersonateActions };

package/auth/ImpersonateState/index.js

@@ -0,0 +1,3 @@
+import createImpersonateState from './state';
+import buildImpersonateActions from './actions';
+export { createImpersonateState, buildImpersonateActions };

package/auth/ImpersonateState/interfaces.d.ts

@@ -0,0 +1,14 @@
+import type { IImpersonate } from '@frontegg/rest-api';
+import type { CustomEventsOptions } from '../interfaces';
+export declare enum ImpersonateStep {
+    'impersonating' = "impersonating",
+    'success' = "success"
+}
+export interface ImpersonateState {
+    loading: boolean;
+    error?: string | null;
+    step: ImpersonateStep;
+}
+export interface IImpersonatePayload extends IImpersonate {
+    events?: CustomEventsOptions;
+}

package/auth/ImpersonateState/state.d.ts

@@ -0,0 +1,4 @@
+import { ImpersonateState } from './interfaces';
+export declare const initialState: ImpersonateState;
+declare const _default: (overrideState?: Partial<ImpersonateState> | undefined) => ImpersonateState;
+export default _default;

package/auth/ImpersonateState/state.js

@@ -0,0 +1,7 @@
+import { ImpersonateStep } from './interfaces';
+import { createProxy } from '../../toolkit/proxy';
+export const initialState = {
+  step: ImpersonateStep.impersonating,
+  loading: false
+};
+export default (overrideState => createProxy(initialState, overrideState));

package/auth/LoginState/actions/afterAuthNavigation.actions.d.ts

@@ -0,0 +1,11 @@
+import { ILoginResponseV3 } from '@frontegg/rest-api';
+import { FronteggState, RestApi, SharedActions } from '../../../interfaces';
+import { AfterAuthNavigationUtilOptions } from '../interfaces';
+import { AuthState } from '../../interfaces';
+declare const _default: (store: FronteggState, api: RestApi, sharedActions: SharedActions) => {
+    afterAuthNavigationUtil: (resetStateAction: (() => void) | (() => Promise<void>), options?: AfterAuthNavigationUtilOptions) => Promise<void>;
+    afterAuthNavigation: (payload?: Pick<AfterAuthNavigationUtilOptions, "preventRedirectUrlOriginCleaning"> | undefined) => Promise<void>;
+    afterStepUpAuthNavigation: () => Promise<void>;
+    __afterAuthenticationStateUpdate: ({ user, tenants, activeTenant }: ILoginResponseV3, additionalUpdate?: Partial<AuthState>) => void;
+};
+export default _default;

package/auth/LoginState/actions/afterAuthNavigation.actions.js

@@ -0,0 +1,183 @@
+import _extends from "@babel/runtime/helpers/esm/extends";
+import { getPathAndSearchParamsFromUrl, getRedirectUrl, isAbsoluteUrl } from '../helpers';
+import { FRONTEGG_AFTER_AUTH_REDIRECT_URL } from '../../../constants';
+import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
+import { delay } from '../../../helpers';
+import { isSteppedUp } from '../../StepUpState/helpers';
+export default ((store, api, sharedActions) => {
+  const actions = sharedActions;
+
+  /**
+   * @param url
+   * @returns url without the origin if it's the same origin as the current window origin
+   * @deprecated
+   * Don't use this unless you must
+   * In case the url is equal to the window.location.origin, it will return an empty string
+   */
+  function cleanUrlIfSameOrigin(url) {
+    var _window, _window2;
+    if (!url.startsWith((_window = window) == null ? void 0 : _window.location.origin)) {
+      return url;
+    }
+    return url.replace((_window2 = window) == null ? void 0 : _window2.location.origin, '');
+  }
+
+  /**
+   * @param user
+   * @param tenants
+   * @param activeTenant
+   * @param additionalUpdate
+   *
+   * @protected
+   */
+  function __afterAuthenticationStateUpdate({
+    user,
+    tenants = [],
+    activeTenant
+  }, additionalUpdate = {}) {
+    const currentTenantsState = store.auth.tenantsState;
+    actions.setAuthState(_extends({
+      user,
+      tenantsState: _extends({}, currentTenantsState, {
+        tenants,
+        activeTenant,
+        loading: false
+      })
+    }, additionalUpdate));
+  }
+
+  /**
+   * @param customLoginAuthenticatedUrl custom login authenticated url if exists
+   * @returns the authenticated url to redirect to after auth navigation
+   */
+  async function __getUrlForAfterAuthNavigation({
+    customLoginAuthenticatedUrl,
+    preventRedirectUrlOriginCleaning
+  }) {
+    const {
+      routes,
+      includeQueryParam = false,
+      enforceRedirectToSameSite = false,
+      allowedRedirectOrigins = []
+    } = store.auth;
+    if (customLoginAuthenticatedUrl) {
+      return getPathAndSearchParamsFromUrl(customLoginAuthenticatedUrl);
+    }
+    const {
+      authenticatedUrl,
+      loginUrl,
+      logoutUrl,
+      socialLoginCallbackUrl,
+      activateUrl
+    } = routes;
+    let finalUrl = window.localStorage.getItem(FRONTEGG_AFTER_AUTH_REDIRECT_URL);
+    if (!finalUrl || [loginUrl, logoutUrl, socialLoginCallbackUrl, activateUrl].includes(finalUrl)) {
+      finalUrl = authenticatedUrl;
+    }
+    const redirectUrl = getRedirectUrl({
+      authenticatedUrl: finalUrl,
+      includeQueryParam,
+      enforceRedirectToSameSite,
+      allowedRedirectOrigins
+    });
+    if (preventRedirectUrlOriginCleaning) {
+      return redirectUrl;
+    }
+    // clean origin if it's the same origin as the current window origin to avoid refresh in afterAuthNavigationUtil
+    return cleanUrlIfSameOrigin(redirectUrl);
+  }
+
+  /**
+   * Utility to share after auth navigation flow between login and step up
+   * @param resetStateAction reset state action
+   * @param options custom login authenticated url if exists
+   */
+  const afterAuthNavigationUtil = async (resetStateAction, options = {}) => {
+    const {
+      customLoginAuthenticatedUrl,
+      forceStepUpUrl,
+      shouldStepUpDuringLogin,
+      preventRedirectUrlOriginCleaning = false
+    } = options;
+
+    // TODO: change to store.root.onRedirectTo
+    const onRedirectTo = store.auth.onRedirectTo;
+    let redirectUrl = undefined;
+    if (forceStepUpUrl) {
+      // scenario to get to here: invalid max age, try to step up -> logout, login with magic code/link -> redirect to step up page for email code as the second factor
+      // we don't want to remove the FRONTEGG_AFTER_AUTH_REDIRECT_URL when we are in the step up flow
+      redirectUrl = forceStepUpUrl;
+    } else {
+      var _window3;
+      if (shouldStepUpDuringLogin) {
+        // getUrlForAfterAuthNavigation give priority to the redirectUrl
+        // avoiding use of getUrlForAfterAuthNavigation because we don't want to use the redirectUrl for magic link for example
+        const localStorageRedirectUrl = window.localStorage.getItem(FRONTEGG_AFTER_AUTH_REDIRECT_URL);
+        if (localStorageRedirectUrl && !isAbsoluteUrl(localStorageRedirectUrl)) {
+          redirectUrl = localStorageRedirectUrl;
+        }
+      }
+      if (!redirectUrl) {
+        redirectUrl = await __getUrlForAfterAuthNavigation({
+          customLoginAuthenticatedUrl,
+          preventRedirectUrlOriginCleaning
+        });
+      }
+      (_window3 = window) == null ? void 0 : _window3.localStorage.removeItem(FRONTEGG_AFTER_AUTH_REDIRECT_URL);
+    }
+    await delay(200);
+    await resetStateAction();
+    onRedirectTo(redirectUrl, {
+      refresh: redirectUrl.startsWith('http')
+    });
+  };
+
+  /**
+   * After auth navigation for login flow
+   * Handling also step up scenario when user silently logout to continue to step up
+   */
+  const afterAuthNavigation = async payload => {
+    var _window4, _payload$preventRedir;
+    const {
+      customLoginAuthenticatedUrl,
+      stepUpUrl
+    } = store.auth.routes;
+
+    // login with magic code, try to step up, no other mfa, invalid max age, force_enroll -> logout, login with first factor, not-stepped up jwt -> navigate to step up
+    const shouldStepUp = (_window4 = window) == null ? void 0 : _window4.localStorage.getItem(SHOULD_STEP_UP_KEY);
+    const user = store.auth.user;
+    if (shouldStepUp) {
+      var _window5;
+      (_window5 = window) == null ? void 0 : _window5.localStorage.removeItem(SHOULD_STEP_UP_KEY);
+    }
+    if (stepUpUrl && shouldStepUp && !isSteppedUp(user)) {
+      return afterAuthNavigationUtil(actions.resetLoginState, {
+        forceStepUpUrl: stepUpUrl
+      });
+    }
+    let customLoginURL = customLoginAuthenticatedUrl;
+    if (!customLoginAuthenticatedUrl) {
+      var _store$auth$routes;
+      await actions.loadCustomLoginRoutes();
+      customLoginURL = (_store$auth$routes = store.auth.routes) == null ? void 0 : _store$auth$routes.customLoginAuthenticatedUrl;
+    }
+    return afterAuthNavigationUtil(actions.resetLoginState, {
+      customLoginAuthenticatedUrl: customLoginURL,
+      shouldStepUpDuringLogin: !!shouldStepUp,
+      preventRedirectUrlOriginCleaning: (_payload$preventRedir = payload == null ? void 0 : payload.preventRedirectUrlOriginCleaning) != null ? _payload$preventRedir : false
+    });
+  };
+
+  /**
+   * After auth navigation for step up flow
+   */
+  const afterStepUpAuthNavigation = async () => {
+    return afterAuthNavigationUtil(actions.resetStepUpState);
+  };
+  return {
+    afterAuthNavigationUtil,
+    afterAuthNavigation,
+    afterStepUpAuthNavigation,
+    __afterAuthenticationStateUpdate
+  };
+});

package/auth/LoginState/actions/handleVerifyMFAResponse.actions.d.ts

@@ -0,0 +1,8 @@
+import { ILoginResponseV3 } from '@frontegg/rest-api';
+import { FronteggState, RestApi, SharedActions } from '../../../interfaces';
+export default function (store: FronteggState, api: RestApi, sharedActions: SharedActions): {
+    postHandleVerifyMFAResponseForStepUp: () => Promise<void>;
+    postHandleVerifyMFAResponseForLogin: (isAuthenticated: boolean) => Promise<void>;
+    handleVerifyMFAResponse: (payload: ILoginResponseV3, isStepUp?: boolean) => Promise<void>;
+    getFeatureFlags: (flags: string[]) => Promise<boolean[]>;
+};

package/auth/LoginState/actions/handleVerifyMFAResponse.actions.js

@@ -0,0 +1,92 @@
+import { FeatureFlags } from '@frontegg/rest-api';
+import { MFAStep } from '../../MfaState/interfaces';
+import { LoginFlow, LoginStep } from '../interfaces';
+export default function (store, api, sharedActions) {
+  const actions = sharedActions;
+
+  /**
+   * TODO: must be moved to a separate file
+   * @param flags
+   * @private
+   */
+  const getFeatureFlags = async flags => {
+    const appName = store.root.appName;
+    return FeatureFlags.getFeatureFlags(flags, appName);
+  };
+
+  /**
+   * Additional steps for after MFA authentication with authenticator app handler for step up flow
+   */
+  const postHandleVerifyMFAResponseForStepUp = async () => {
+    return await actions.afterStepUpAuthNavigation();
+  };
+
+  /**
+   * Additional steps for after MFA authentication with authenticator app handler for login flow
+   * @param isAuthenticated
+   */
+  const postHandleVerifyMFAResponseForLogin = async isAuthenticated => {
+    const loginState = store.auth.loginState;
+    const mfaStep = store.auth.mfaState.step;
+    const [securityCenterLoginFlows] = await getFeatureFlags(['security-center-show-login-flows']);
+    if (loginState.flow === LoginFlow.Login) {
+      if (securityCenterLoginFlows && loginState.isBreachedPassword && !isAuthenticated) {
+        actions.setLoginState({
+          step: LoginStep.breachedPassword,
+          loading: false
+        });
+      } else {
+        const shouldShowPrompt = await actions.__shouldShowPromptPasskeys();
+        if (mfaStep === MFAStep.smsVerifyCode && shouldShowPrompt) {
+          actions.setLoginState({
+            step: LoginStep.promptPasskeys,
+            loading: false
+          });
+        } else {
+          await actions.afterAuthNavigation();
+        }
+      }
+    }
+  };
+
+  /**
+   * Handle after MFA authentication with authenticator app
+   * @param payload.user
+   * @param payload.tenants
+   * @param payload.activeTenant
+   * @param payload
+   * @param isStepUp
+   *
+   * When using this saga, you should wrap it with try/catch block and handle according to your logic
+   */
+  const handleVerifyMFAResponse = async (payload, isStepUp = false) => {
+    const {
+      user,
+      tenants,
+      activeTenant
+    } = payload;
+    actions.setUser(user);
+    actions.setTenantsState({
+      tenants,
+      activeTenant,
+      loading: false
+    });
+    if (user.id) {
+      localStorage.setItem('userId', user.id);
+    }
+    const isAuthenticated = !!user.accessToken;
+    actions.setAuthState({
+      isAuthenticated
+    });
+    if (isStepUp) {
+      return await postHandleVerifyMFAResponseForStepUp();
+    }
+    return await postHandleVerifyMFAResponseForLogin(isAuthenticated);
+  };
+  return {
+    postHandleVerifyMFAResponseForStepUp,
+    postHandleVerifyMFAResponseForLogin,
+    handleVerifyMFAResponse,
+    getFeatureFlags
+  };
+}

package/auth/LoginState/actions/hostedLoginAuthorize.actions.d.ts

@@ -0,0 +1,15 @@
+import { FronteggState, RestApi, SharedActions } from '../../../interfaces';
+import { HostedLoginCallback, LoginDirectAction } from '../interfaces';
+declare const _default: (store: FronteggState, api: RestApi, sharedActions: SharedActions) => {
+    requestHostedLoginAuthorize: (additionalParams?: Record<string, string> | undefined) => Promise<void>;
+    requestHostedLoginAuthorizeV2: (payload?: {
+        additionalParams?: Record<string, string> | undefined;
+        shouldRedirectToLogin?: boolean | undefined;
+        firstTime?: boolean | undefined;
+        loginDirectAction?: LoginDirectAction | undefined;
+    } | undefined) => Promise<void>;
+    __requestHostedLoginAuthorize: (additionalParams?: Record<string, string> | undefined) => Promise<void>;
+    __requestHostedLoginSilentAuthorize: () => Promise<void>;
+    handleHostedLoginCallback: (payload: HostedLoginCallback) => Promise<void>;
+};
+export default _default;

package/auth/LoginState/actions/hostedLoginAuthorize.actions.js

@@ -0,0 +1,203 @@
+import _extends from "@babel/runtime/helpers/esm/extends";
+import { createRandomString, generateCodeChallenge } from '../../../helpers';
+import { HOSTED_LOGIN_VERIFIER_KEY } from '../../../constants';
+import { getBaseNameWithoutSlashSuffix, getSearchParam, isOauthCallbackRoute, TENANT_ID_PARAM_KEY } from '../helpers';
+import { getUri, isSteppedUp } from '../../helpers';
+import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
+export default ((store, api, sharedActions) => {
+  const actions = sharedActions;
+
+  /**
+   * @protected
+   */
+  const __requestHostedLoginSilentAuthorize = async () => {
+    const response = await api.auth.silentOAuthRefreshTokenV2();
+    if (response != null && response.user) {
+      await actions.__afterAuthenticationStateUpdate(response, {
+        isAuthenticated: true,
+        isLoading: false
+      });
+    } else {
+      throw new Error(`couldn't refresh user token with oauth service`);
+    }
+  };
+  const requestHostedLoginAuthorize = async additionalParams => {
+    var _store$auth$customLog;
+    const {
+      routes,
+      onRedirectTo
+    } = store.auth;
+    const {
+      context,
+      urlStrategy
+    } = store.root;
+    const activeUri = getUri(urlStrategy);
+    if (activeUri === routes.hostedLoginRedirectUrl) {
+      console.debug('Calling loginWithRedirect while in hostedLoginCallback route');
+      return;
+    }
+    actions.setAuthState({
+      isLoading: true
+    });
+    // Generate the relevant params for the redirect
+    const nonce = createRandomString();
+    const code_verifier = createRandomString();
+    const code_challenge = await generateCodeChallenge(code_verifier);
+
+    // We are saving the verifier in session storage to be able to validate the response
+    localStorage.setItem(HOSTED_LOGIN_VERIFIER_KEY, code_verifier);
+    const basename = getBaseNameWithoutSlashSuffix(store);
+    let redirectUrl = `${window.location.origin}${urlStrategy === 'path' ? '' : '#'}${basename != null ? basename : ''}${routes.hostedLoginRedirectUrl}`;
+    await actions.loadCustomLoginRoutes();
+    const customLoginSearchParam = (_store$auth$customLog = store.auth.customLoginState) == null ? void 0 : _store$auth$customLog.customLoginSearchParams;
+    if (customLoginSearchParam) {
+      if (redirectUrl.endsWith('/')) {
+        redirectUrl = redirectUrl.slice(0, -1);
+      }
+      redirectUrl += customLoginSearchParam;
+    }
+    const baseUrl = api.fetch.getBaseUrl(context, '/oauth/authorize');
+    // Hard coded for now
+    const oauthUrl = `${baseUrl}/oauth/authorize`;
+    const params = _extends({
+      response_type: 'code',
+      client_id: context.clientId || 'INVALID-CLIENT-ID',
+      scope: 'openid email profile',
+      redirect_uri: redirectUrl,
+      code_challenge: code_challenge,
+      code_challenge_method: 'S256',
+      nonce
+    }, additionalParams);
+    if (context.tenantResolver) {
+      var _context$tenantResolv;
+      const resolvedTenantResult = await ((_context$tenantResolv = context.tenantResolver) == null ? void 0 : _context$tenantResolv.call(context));
+      if (resolvedTenantResult != null && resolvedTenantResult.tenant) {
+        params['organization'] = resolvedTenantResult.tenant;
+      }
+    }
+    const tenantId = getSearchParam(TENANT_ID_PARAM_KEY);
+    if (tenantId) {
+      params['tenantId'] = tenantId;
+    }
+    const searchParams = new URLSearchParams(params);
+    const url = `${oauthUrl}?${searchParams.toString()}`;
+    onRedirectTo(url, {
+      refresh: true
+    });
+  };
+  const refreshOrRequestHostedLoginAuthorize = async additionalParams => {
+    var _localStorage;
+    // when the user pause the step up flow we may still have the key in the local storage in hosted - Remove it
+    (_localStorage = localStorage) == null ? void 0 : _localStorage.removeItem(SHOULD_STEP_UP_KEY);
+    const disableSilentRefresh = store.auth.disableSilentRefresh;
+    if ((additionalParams == null ? void 0 : additionalParams['prompt']) === 'login') {
+      return await requestHostedLoginAuthorize(additionalParams);
+    }
+    try {
+      if (disableSilentRefresh) {
+        throw new Error('silent refresh is disabled');
+      }
+      return await __requestHostedLoginSilentAuthorize();
+    } catch (e) {
+      return await requestHostedLoginAuthorize(additionalParams);
+    }
+  };
+  const refreshOrRequestHostedLoginAuthorizeV2 = async payload => {
+    var _localStorage2, _additionalParams;
+    const {
+      shouldRedirectToLogin,
+      firstTime,
+      loginDirectAction
+    } = payload != null ? payload : {};
+    let {
+      additionalParams
+    } = payload != null ? payload : {};
+    // when the user pause the step up flow we may still have the key in the local storage in hosted - Remove it
+    (_localStorage2 = localStorage) == null ? void 0 : _localStorage2.removeItem(SHOULD_STEP_UP_KEY);
+    if (firstTime) {
+      const urlStrategy = store.root.urlStrategy;
+      const activeUri = getUri(urlStrategy);
+      actions.setAuthState({
+        isLoading: true
+      });
+      if (isOauthCallbackRoute(activeUri)) {
+        return;
+      }
+    }
+    const disableSilentRefresh = store.auth.disableSilentRefresh;
+    if (loginDirectAction) {
+      additionalParams = additionalParams || {};
+      additionalParams['login_direct_action'] = btoa(JSON.stringify(loginDirectAction));
+    }
+    if (((_additionalParams = additionalParams) == null ? void 0 : _additionalParams['prompt']) === 'login') {
+      return await requestHostedLoginAuthorize(additionalParams);
+    }
+    try {
+      if (disableSilentRefresh) {
+        throw new Error('silent refresh is disabled');
+      }
+      return await __requestHostedLoginSilentAuthorize();
+    } catch (e) {
+      if (!shouldRedirectToLogin) {
+        actions.setAuthState({
+          isLoading: false
+        });
+        return;
+      }
+      return await requestHostedLoginAuthorize(additionalParams);
+    }
+  };
+  const handleHostedLoginCallback = async payload => {
+    var _store$auth$customLog2;
+    // Hard coded for now
+    const code_verifier = localStorage.getItem(HOSTED_LOGIN_VERIFIER_KEY) || 'INVALID-CODE-VERIFIER';
+    const routes = store.auth.routes;
+    const urlStrategy = store.root.urlStrategy;
+    const basename = getBaseNameWithoutSlashSuffix(store);
+    let redirectUrl = `${window.location.origin}${urlStrategy === 'path' ? '' : '#'}${basename != null ? basename : ''}${routes.hostedLoginRedirectUrl}`;
+    await actions.loadCustomLoginRoutes();
+    const customLoginSearchParam = (_store$auth$customLog2 = store.auth.customLoginState) == null ? void 0 : _store$auth$customLog2.customLoginSearchParams;
+    if (customLoginSearchParam) {
+      if (redirectUrl.endsWith('/')) {
+        redirectUrl = redirectUrl.slice(0, -1);
+      }
+      redirectUrl += customLoginSearchParam;
+    }
+    const body = {
+      code: payload.code,
+      redirect_uri: redirectUrl,
+      code_verifier,
+      grant_type: 'authorization_code'
+    };
+    try {
+      const response = await api.auth.exchangeOAuthTokensV2(body);
+      actions.__afterAuthenticationStateUpdate(response, {
+        isAuthenticated: true,
+        isLoading: false
+      });
+    } catch (e) {
+      actions.setAuthState({
+        isLoading: false
+      });
+      console.error('Failed to exchangeOAuthTokens', e);
+    } finally {
+      const user = store.auth.user;
+      const isStepUpFlow = window.localStorage.getItem(SHOULD_STEP_UP_KEY);
+      window.localStorage.removeItem(SHOULD_STEP_UP_KEY);
+
+      // when the user pause the step up flow we may still have the key in the local storage in hosted. Ignore it.
+      if (isStepUpFlow && isSteppedUp(user)) {
+        await actions.afterStepUpAuthNavigation();
+      } else {
+        await actions.afterAuthNavigation();
+      }
+    }
+  };
+  return {
+    requestHostedLoginAuthorize: refreshOrRequestHostedLoginAuthorize,
+    requestHostedLoginAuthorizeV2: refreshOrRequestHostedLoginAuthorizeV2,
+    __requestHostedLoginAuthorize: requestHostedLoginAuthorize,
+    __requestHostedLoginSilentAuthorize,
+    handleHostedLoginCallback
+  };
+});