@frontegg/redux-store 7.113.0 → 7.114.0

package/auth/LoginState/actions/afterAuthNavigation.actions.js

@@ -4,9 +4,17 @@ import { FRONTEGG_AFTER_AUTH_REDIRECT_URL } from '../../../constants';
 import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
 import { delay } from '../../../helpers';
 import { isSteppedUp } from '../../StepUpState/helpers';
+import { clearHostedOAuthState, isHostedOAuthStateExpired } from '../oauthStorage';
 export default ((store, api, sharedActions) => {
   const actions = sharedActions;
 
+  // Drop only stale (expired) hosted OAuth state so a fresh, in-progress flow is never affected.
+  const clearExpiredHostedOAuthState = () => {
+    if (isHostedOAuthStateExpired()) {
+      clearHostedOAuthState();
+    }
+  };
+
   /**
    * @param url
    * @returns url without the origin if it's the same origin as the current window origin
@@ -95,6 +103,7 @@ export default ((store, api, sharedActions) => {
    * @param options custom login authenticated url if exists
    */
   const afterAuthNavigationUtil = async (resetStateAction, options = {}) => {
+    clearExpiredHostedOAuthState();
     const {
       customLoginAuthenticatedUrl,
       forceStepUpUrl,
@@ -129,6 +138,9 @@ export default ((store, api, sharedActions) => {
     }
     await delay(200);
     await resetStateAction();
+    if (redirectUrl.startsWith('http')) {
+      clearHostedOAuthState();
+    }
     onRedirectTo(redirectUrl, {
       refresh: redirectUrl.startsWith('http')
     });

package/auth/LoginState/actions/index.js

@@ -28,6 +28,8 @@ import { initialState } from '../state';
 import { getSearchParam, isEmailPayload, isUsernamePayload, shouldShowPasswordRotationPromptFunc, TENANT_ID_PARAM_KEY } from '../helpers';
 import { AuthStrategyEnum, ContextHolder, FeatureFlags, getTabTenantFromSessionStorage, removeTabTenantFromSessionStorage, WebAuthnDeviceType } from '@frontegg/rest-api';
 import hostedLoginAuthorizeActions from './hostedLoginAuthorize.actions';
+import { clearHostedOAuthState } from '../oauthStorage';
+import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
 import { FronteggNativeModule, isEntitlementsDeeplyEqual } from '../../../toolkit';
 import { REQUEST_NAME, UserVerifiedOriginTypes } from '../../interfaces';
 import { authStrategyLoginStepMap } from '../consts';
@@ -628,6 +630,17 @@ export default ((store, api, sharedActions) => {
       });
     }
   };
+  const clearLogoutLocalState = ({
+    keepHostedOAuthState = false
+  } = {}) => {
+    if (contextHolder.isSessionPerTenantEnabled()) {
+      removeTabTenantFromSessionStorage();
+    }
+    // Step-up re-login goes through silentLogout but still needs the hosted OAuth state to finish the client flow.
+    if (!keepHostedOAuthState) {
+      clearHostedOAuthState();
+    }
+  };
   const logout = async payload => {
     const hostedLoginBox = store.auth.hostedLoginBox;
     actions.setAuthState({
@@ -642,23 +655,22 @@ export default ((store, api, sharedActions) => {
     } catch {
       /* empty */
     }
-    if (contextHolder.isSessionPerTenantEnabled()) {
-      removeTabTenantFromSessionStorage();
-    }
+    clearLogoutLocalState();
     actions.resetAuthState();
     await actions.requestAuthorize(true);
     payload == null ? void 0 : payload();
   };
   const silentLogout = async payload => {
-    var _payload$callbackTime;
+    var _window2, _payload$callbackTime;
     try {
       await api.auth.logout();
     } catch {
       /* empty */
     }
-    if (contextHolder.isSessionPerTenantEnabled()) {
-      removeTabTenantFromSessionStorage();
-    }
+    const isStepUpInProgress = !!((_window2 = window) != null && _window2.localStorage.getItem(SHOULD_STEP_UP_KEY));
+    clearLogoutLocalState({
+      keepHostedOAuthState: isStepUpInProgress
+    });
     setTimeout(() => {
       var _payload$callback3;
       return payload == null ? void 0 : (_payload$callback3 = payload.callback) == null ? void 0 : _payload$callback3.call(payload, true);

package/auth/LoginState/oauthStorage.d.ts

@@ -0,0 +1,19 @@
+export declare const FRONTEGG_OAUTH_LOGIN_HINT = "FRONTEGG_OAUTH_LOGIN_HINT";
+export declare const FRONTEGG_OAUTH_LOGIN_DIRECT_ACTION = "FRONTEGG_OAUTH_LOGIN_DIRECT_ACTION";
+export declare const FRONTEGG_OAUTH_ORGANIZATION = "FRONTEGG_OAUTH_ORGANIZATION";
+export declare const FRONTEGG_OAUTH_STEP_UP_ACR_VALUES = "FRONTEGG_OAUTH_STEP_UP_ACR_VALUES";
+export declare const FRONTEGG_OAUTH_STEP_UP_MAX_AGE = "FRONTEGG_OAUTH_STEP_UP_MAX_AGE";
+export declare const FRONTEGG_OAUTH_TENANT_ID = "FRONTEGG_OAUTH_TENANT_ID";
+export declare const FRONTEGG_OAUTH_APP_ID = "FRONTEGG_OAUTH_APP_ID";
+export declare const FRONTEGG_OAUTH_STATE_AFTER_LOGIN = "FRONTEGG_OAUTH_STATE_AFTER_LOGIN";
+export declare const FRONTEGG_OAUTH_INVITATION_TOKEN_KEY = "FRONTEGG_OAUTH_INVITATION_TOKEN_KEY";
+export declare const FRONTEGG_OAUTH_REDIRECT_AFTER_LOGIN = "FRONTEGG_OAUTH_REDIRECT_AFTER_LOGIN";
+export declare const FRONTEGG_AUTHENTICATION_FLOWS_REDIRECT_AFTER_LOGIN = "FRONTEGG_AUTHENTICATION_FLOWS_REDIRECT_AFTER_LOGIN";
+export declare const FRONTEGG_OAUTH_SILENT_REDIRECT_ADDRESS = "FRONTEGG_OAUTH_SILENT_REDIRECT_ADDRESS";
+export declare const FRONTEGG_OAUTH_STATE_SAVED_AT = "FRONTEGG_OAUTH_STATE_SAVED_AT";
+/** Slightly under typical Redis OAuth session TTL to avoid stale postlogin attempts. */
+export declare const HOSTED_OAUTH_STATE_MAX_AGE_MS: number;
+export declare const HOSTED_OAUTH_STORAGE_KEYS: readonly ["FRONTEGG_OAUTH_REDIRECT_AFTER_LOGIN", "FRONTEGG_OAUTH_STATE_AFTER_LOGIN", "FRONTEGG_OAUTH_STATE_SAVED_AT", "FRONTEGG_AUTHENTICATION_FLOWS_REDIRECT_AFTER_LOGIN", "FRONTEGG_OAUTH_INVITATION_TOKEN_KEY", "FRONTEGG_OAUTH_ORGANIZATION", "FRONTEGG_OAUTH_TENANT_ID", "FRONTEGG_OAUTH_STEP_UP_ACR_VALUES", "FRONTEGG_OAUTH_STEP_UP_MAX_AGE", "FRONTEGG_OAUTH_APP_ID", "FRONTEGG_OAUTH_LOGIN_HINT", "FRONTEGG_OAUTH_LOGIN_DIRECT_ACTION", "FRONTEGG_OAUTH_SILENT_REDIRECT_ADDRESS"];
+export declare function clearHostedOAuthState(): void;
+export declare function markHostedOAuthStateSaved(): void;
+export declare function isHostedOAuthStateExpired(): boolean;

package/auth/LoginState/oauthStorage.js

@@ -0,0 +1,74 @@
+export const FRONTEGG_OAUTH_LOGIN_HINT = 'FRONTEGG_OAUTH_LOGIN_HINT';
+export const FRONTEGG_OAUTH_LOGIN_DIRECT_ACTION = 'FRONTEGG_OAUTH_LOGIN_DIRECT_ACTION';
+export const FRONTEGG_OAUTH_ORGANIZATION = 'FRONTEGG_OAUTH_ORGANIZATION';
+export const FRONTEGG_OAUTH_STEP_UP_ACR_VALUES = 'FRONTEGG_OAUTH_STEP_UP_ACR_VALUES';
+export const FRONTEGG_OAUTH_STEP_UP_MAX_AGE = 'FRONTEGG_OAUTH_STEP_UP_MAX_AGE';
+export const FRONTEGG_OAUTH_TENANT_ID = 'FRONTEGG_OAUTH_TENANT_ID';
+export const FRONTEGG_OAUTH_APP_ID = 'FRONTEGG_OAUTH_APP_ID';
+export const FRONTEGG_OAUTH_STATE_AFTER_LOGIN = 'FRONTEGG_OAUTH_STATE_AFTER_LOGIN';
+export const FRONTEGG_OAUTH_INVITATION_TOKEN_KEY = 'FRONTEGG_OAUTH_INVITATION_TOKEN_KEY';
+export const FRONTEGG_OAUTH_REDIRECT_AFTER_LOGIN = 'FRONTEGG_OAUTH_REDIRECT_AFTER_LOGIN';
+export const FRONTEGG_AUTHENTICATION_FLOWS_REDIRECT_AFTER_LOGIN = 'FRONTEGG_AUTHENTICATION_FLOWS_REDIRECT_AFTER_LOGIN';
+export const FRONTEGG_OAUTH_SILENT_REDIRECT_ADDRESS = 'FRONTEGG_OAUTH_SILENT_REDIRECT_ADDRESS';
+export const FRONTEGG_OAUTH_STATE_SAVED_AT = 'FRONTEGG_OAUTH_STATE_SAVED_AT';
+
+/** Slightly under typical Redis OAuth session TTL to avoid stale postlogin attempts. */
+export const HOSTED_OAUTH_STATE_MAX_AGE_MS = 23 * 60 * 60 * 1000;
+export const HOSTED_OAUTH_STORAGE_KEYS = [FRONTEGG_OAUTH_REDIRECT_AFTER_LOGIN, FRONTEGG_OAUTH_STATE_AFTER_LOGIN, FRONTEGG_OAUTH_STATE_SAVED_AT, FRONTEGG_AUTHENTICATION_FLOWS_REDIRECT_AFTER_LOGIN, FRONTEGG_OAUTH_INVITATION_TOKEN_KEY, FRONTEGG_OAUTH_ORGANIZATION, FRONTEGG_OAUTH_TENANT_ID, FRONTEGG_OAUTH_STEP_UP_ACR_VALUES, FRONTEGG_OAUTH_STEP_UP_MAX_AGE, FRONTEGG_OAUTH_APP_ID, FRONTEGG_OAUTH_LOGIN_HINT, FRONTEGG_OAUTH_LOGIN_DIRECT_ACTION, FRONTEGG_OAUTH_SILENT_REDIRECT_ADDRESS];
+function removeHostedOAuthCookie(key) {
+  document.cookie = `${encodeURIComponent(key)}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/`;
+}
+function getStoredHostedOAuthValue(key) {
+  const fromLocalStorage = window.localStorage.getItem(key);
+  if (fromLocalStorage) {
+    return fromLocalStorage;
+  }
+  const fromSessionStorage = window.sessionStorage.getItem(key);
+  if (fromSessionStorage) {
+    return fromSessionStorage;
+  }
+  const decodedName = encodeURIComponent(key);
+  const cookies = document.cookie.split(';');
+  for (let cookie of cookies) {
+    cookie = cookie.trim();
+    if (cookie.indexOf(`${decodedName}=`) === 0) {
+      return decodeURIComponent(cookie.substring(decodedName.length + 1));
+    }
+  }
+  return null;
+}
+export function clearHostedOAuthState() {
+  if (typeof window === 'undefined') {
+    return;
+  }
+  HOSTED_OAUTH_STORAGE_KEYS.forEach(key => {
+    window.localStorage.removeItem(key);
+    window.sessionStorage.removeItem(key);
+    removeHostedOAuthCookie(key);
+  });
+}
+export function markHostedOAuthStateSaved() {
+  if (typeof window === 'undefined') {
+    return;
+  }
+  const value = Date.now().toString();
+  window.localStorage.setItem(FRONTEGG_OAUTH_STATE_SAVED_AT, value);
+  window.sessionStorage.setItem(FRONTEGG_OAUTH_STATE_SAVED_AT, value);
+  const expires = new Date();
+  expires.setTime(expires.getTime() + HOSTED_OAUTH_STATE_MAX_AGE_MS);
+  document.cookie = `${encodeURIComponent(FRONTEGG_OAUTH_STATE_SAVED_AT)}=${encodeURIComponent(value)};expires=${expires.toUTCString()};path=/`;
+}
+export function isHostedOAuthStateExpired() {
+  if (typeof window === 'undefined') {
+    return false;
+  }
+  const savedAt = getStoredHostedOAuthValue(FRONTEGG_OAUTH_STATE_SAVED_AT);
+  if (!savedAt) {
+    return false;
+  }
+  const savedAtMs = Number(savedAt);
+  if (Number.isNaN(savedAtMs)) {
+    return false;
+  }
+  return Date.now() - savedAtMs > HOSTED_OAUTH_STATE_MAX_AGE_MS;
+}

package/auth/MSP/actions.js

@@ -70,7 +70,8 @@ export default ((store, api, sharedActions) => {
           jwt
         });
         const tenantsUsersCountArray = await api.tenants.getTenantsUsersCount({
-          tenantIds: items.map(tenant => tenant.tenantId)
+          tenantIds: items.map(tenant => tenant.tenantId),
+          excludeInvisibleUsers: true
         }, {
           jwt
         });
@@ -100,7 +101,8 @@ export default ((store, api, sharedActions) => {
           _links
         } = await api.tenants.searchSubTenants(searchSubTenantsQueryParams);
         const tenantsUsersCountArray = await api.tenants.getTenantsUsersCount({
-          tenantIds: items.map(i => i.tenantId)
+          tenantIds: items.map(i => i.tenantId),
+          excludeInvisibleUsers: true
         });
         const accountsWithUsersCount = getAccountsWithUsersCount({
           items
@@ -812,7 +814,8 @@ export default ((store, api, sharedActions) => {
     try {
       var _tenantUsersCount$;
       const tenantUsersCount = await api.tenants.getTenantsUsersCount({
-        tenantIds: [activeTenant == null ? void 0 : activeTenant.tenantId]
+        tenantIds: [activeTenant == null ? void 0 : activeTenant.tenantId],
+        excludeInvisibleUsers: true
       });
       const rootAccount = {
         name: activeTenant == null ? void 0 : activeTenant.name,
@@ -859,7 +862,8 @@ export default ((store, api, sharedActions) => {
         jwt
       });
       const [numberOfUsersArray, parentsAccounts, subAccountsAmount] = await Promise.all([api.tenants.getTenantsUsersCount({
-        tenantIds: [(_accountSettings$tena = accountSettings == null ? void 0 : accountSettings.tenantId) != null ? _accountSettings$tena : '']
+        tenantIds: [(_accountSettings$tena = accountSettings == null ? void 0 : accountSettings.tenantId) != null ? _accountSettings$tena : ''],
+        excludeInvisibleUsers: true
       }, {
         jwt
       }), api.tenants.getParentTenants({
@@ -913,7 +917,8 @@ export default ((store, api, sharedActions) => {
         value: true
       });
       const numberOfUsersArray = await api.tenants.getTenantsUsersCount({
-        tenantIds: [tenantId]
+        tenantIds: [tenantId],
+        excludeInvisibleUsers: true
       }, {
         jwt
       });

package/auth/index.d.ts

@@ -76,6 +76,7 @@ export * from './UsernamesState/interfaces';
 export * from './UsersEmailsPolicyState/interfaces';
 export * from './interfaces';
 export { FORGOT_PASSWORD_ERROR_KEYS };
+export * from './LoginState/oauthStorage';
 export declare const createAuthState: (_overrideState?: DeepPartial<AuthState>) => AuthState;
 export declare const buildAuthActions: (store: FronteggState, api: RestApi, actions: FronteggActions, snapshotAuthState: AuthState) => [AuthActions, AuthStateActions];
 export type AcceptInvitationActions = ReturnType<typeof buildAcceptInvitationActions>;

package/auth/index.js

@@ -80,6 +80,7 @@ export * from './UsernamesState/interfaces';
 export * from './UsersEmailsPolicyState/interfaces';
 export * from './interfaces';
 export { FORGOT_PASSWORD_ERROR_KEYS };
+export * from './LoginState/oauthStorage';
 export const createAuthState = _overrideState => {
   const _ref = _overrideState != null ? _overrideState : {},
     {

package/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.113.0
+/** @license Frontegg v7.114.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/node/auth/LoginState/actions/afterAuthNavigation.actions.js

@@ -11,9 +11,17 @@ var _constants = require("../../../constants");
 var _consts = require("../../StepUpState/consts");
 var _helpers2 = require("../../../helpers");
 var _helpers3 = require("../../StepUpState/helpers");
+var _oauthStorage = require("../oauthStorage");
 var _default = (store, api, sharedActions) => {
   const actions = sharedActions;
 
+  // Drop only stale (expired) hosted OAuth state so a fresh, in-progress flow is never affected.
+  const clearExpiredHostedOAuthState = () => {
+    if ((0, _oauthStorage.isHostedOAuthStateExpired)()) {
+      (0, _oauthStorage.clearHostedOAuthState)();
+    }
+  };
+
   /**
    * @param url
    * @returns url without the origin if it's the same origin as the current window origin
@@ -102,6 +110,7 @@ var _default = (store, api, sharedActions) => {
    * @param options custom login authenticated url if exists
    */
   const afterAuthNavigationUtil = async (resetStateAction, options = {}) => {
+    clearExpiredHostedOAuthState();
     const {
       customLoginAuthenticatedUrl,
       forceStepUpUrl,
@@ -136,6 +145,9 @@ var _default = (store, api, sharedActions) => {
     }
     await (0, _helpers2.delay)(200);
     await resetStateAction();
+    if (redirectUrl.startsWith('http')) {
+      (0, _oauthStorage.clearHostedOAuthState)();
+    }
     onRedirectTo(redirectUrl, {
       refresh: redirectUrl.startsWith('http')
     });

package/node/auth/LoginState/actions/index.js

@@ -20,9 +20,11 @@ var _state = require("../state");
 var _helpers2 = require("../helpers");
 var _restApi = require("@frontegg/rest-api");
 var _hostedLoginAuthorize = _interopRequireDefault(require("./hostedLoginAuthorize.actions"));
+var _oauthStorage = require("../oauthStorage");
+var _consts = require("../../StepUpState/consts");
 var _toolkit = require("../../../toolkit");
 var _interfaces2 = require("../../interfaces");
-var _consts = require("../consts");
+var _consts2 = require("../consts");
 var _helpers3 = require("../../helpers");
 var _interfaces3 = require("../../MfaState/interfaces");
 var _interfaces4 = require("../../SSOState/interfaces");
@@ -635,6 +637,17 @@ var _default = (store, api, sharedActions) => {
       });
     }
   };
+  const clearLogoutLocalState = ({
+    keepHostedOAuthState = false
+  } = {}) => {
+    if (contextHolder.isSessionPerTenantEnabled()) {
+      (0, _restApi.removeTabTenantFromSessionStorage)();
+    }
+    // Step-up re-login goes through silentLogout but still needs the hosted OAuth state to finish the client flow.
+    if (!keepHostedOAuthState) {
+      (0, _oauthStorage.clearHostedOAuthState)();
+    }
+  };
   const logout = async payload => {
     const hostedLoginBox = store.auth.hostedLoginBox;
     actions.setAuthState({
@@ -649,23 +662,22 @@ var _default = (store, api, sharedActions) => {
     } catch {
       /* empty */
     }
-    if (contextHolder.isSessionPerTenantEnabled()) {
-      (0, _restApi.removeTabTenantFromSessionStorage)();
-    }
+    clearLogoutLocalState();
     actions.resetAuthState();
     await actions.requestAuthorize(true);
     payload == null ? void 0 : payload();
   };
   const silentLogout = async payload => {
-    var _payload$callbackTime;
+    var _window2, _payload$callbackTime;
     try {
       await api.auth.logout();
     } catch {
       /* empty */
     }
-    if (contextHolder.isSessionPerTenantEnabled()) {
-      (0, _restApi.removeTabTenantFromSessionStorage)();
-    }
+    const isStepUpInProgress = !!((_window2 = window) != null && _window2.localStorage.getItem(_consts.SHOULD_STEP_UP_KEY));
+    clearLogoutLocalState({
+      keepHostedOAuthState: isStepUpInProgress
+    });
     setTimeout(() => {
       var _payload$callback3;
       return payload == null ? void 0 : (_payload$callback3 = payload.callback) == null ? void 0 : _payload$callback3.call(payload, true);
@@ -798,7 +810,7 @@ var _default = (store, api, sharedActions) => {
         username: (_username = username) != null ? _username : ''
       }));
       // @ts-ignore
-      const step = _consts.authStrategyLoginStepMap[payload.type];
+      const step = _consts2.authStrategyLoginStepMap[payload.type];
       setLoginState({
         step,
         loading: false,

package/node/auth/LoginState/oauthStorage.js

@@ -0,0 +1,98 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.HOSTED_OAUTH_STORAGE_KEYS = exports.HOSTED_OAUTH_STATE_MAX_AGE_MS = exports.FRONTEGG_OAUTH_TENANT_ID = exports.FRONTEGG_OAUTH_STEP_UP_MAX_AGE = exports.FRONTEGG_OAUTH_STEP_UP_ACR_VALUES = exports.FRONTEGG_OAUTH_STATE_SAVED_AT = exports.FRONTEGG_OAUTH_STATE_AFTER_LOGIN = exports.FRONTEGG_OAUTH_SILENT_REDIRECT_ADDRESS = exports.FRONTEGG_OAUTH_REDIRECT_AFTER_LOGIN = exports.FRONTEGG_OAUTH_ORGANIZATION = exports.FRONTEGG_OAUTH_LOGIN_HINT = exports.FRONTEGG_OAUTH_LOGIN_DIRECT_ACTION = exports.FRONTEGG_OAUTH_INVITATION_TOKEN_KEY = exports.FRONTEGG_OAUTH_APP_ID = exports.FRONTEGG_AUTHENTICATION_FLOWS_REDIRECT_AFTER_LOGIN = void 0;
+exports.clearHostedOAuthState = clearHostedOAuthState;
+exports.isHostedOAuthStateExpired = isHostedOAuthStateExpired;
+exports.markHostedOAuthStateSaved = markHostedOAuthStateSaved;
+const FRONTEGG_OAUTH_LOGIN_HINT = 'FRONTEGG_OAUTH_LOGIN_HINT';
+exports.FRONTEGG_OAUTH_LOGIN_HINT = FRONTEGG_OAUTH_LOGIN_HINT;
+const FRONTEGG_OAUTH_LOGIN_DIRECT_ACTION = 'FRONTEGG_OAUTH_LOGIN_DIRECT_ACTION';
+exports.FRONTEGG_OAUTH_LOGIN_DIRECT_ACTION = FRONTEGG_OAUTH_LOGIN_DIRECT_ACTION;
+const FRONTEGG_OAUTH_ORGANIZATION = 'FRONTEGG_OAUTH_ORGANIZATION';
+exports.FRONTEGG_OAUTH_ORGANIZATION = FRONTEGG_OAUTH_ORGANIZATION;
+const FRONTEGG_OAUTH_STEP_UP_ACR_VALUES = 'FRONTEGG_OAUTH_STEP_UP_ACR_VALUES';
+exports.FRONTEGG_OAUTH_STEP_UP_ACR_VALUES = FRONTEGG_OAUTH_STEP_UP_ACR_VALUES;
+const FRONTEGG_OAUTH_STEP_UP_MAX_AGE = 'FRONTEGG_OAUTH_STEP_UP_MAX_AGE';
+exports.FRONTEGG_OAUTH_STEP_UP_MAX_AGE = FRONTEGG_OAUTH_STEP_UP_MAX_AGE;
+const FRONTEGG_OAUTH_TENANT_ID = 'FRONTEGG_OAUTH_TENANT_ID';
+exports.FRONTEGG_OAUTH_TENANT_ID = FRONTEGG_OAUTH_TENANT_ID;
+const FRONTEGG_OAUTH_APP_ID = 'FRONTEGG_OAUTH_APP_ID';
+exports.FRONTEGG_OAUTH_APP_ID = FRONTEGG_OAUTH_APP_ID;
+const FRONTEGG_OAUTH_STATE_AFTER_LOGIN = 'FRONTEGG_OAUTH_STATE_AFTER_LOGIN';
+exports.FRONTEGG_OAUTH_STATE_AFTER_LOGIN = FRONTEGG_OAUTH_STATE_AFTER_LOGIN;
+const FRONTEGG_OAUTH_INVITATION_TOKEN_KEY = 'FRONTEGG_OAUTH_INVITATION_TOKEN_KEY';
+exports.FRONTEGG_OAUTH_INVITATION_TOKEN_KEY = FRONTEGG_OAUTH_INVITATION_TOKEN_KEY;
+const FRONTEGG_OAUTH_REDIRECT_AFTER_LOGIN = 'FRONTEGG_OAUTH_REDIRECT_AFTER_LOGIN';
+exports.FRONTEGG_OAUTH_REDIRECT_AFTER_LOGIN = FRONTEGG_OAUTH_REDIRECT_AFTER_LOGIN;
+const FRONTEGG_AUTHENTICATION_FLOWS_REDIRECT_AFTER_LOGIN = 'FRONTEGG_AUTHENTICATION_FLOWS_REDIRECT_AFTER_LOGIN';
+exports.FRONTEGG_AUTHENTICATION_FLOWS_REDIRECT_AFTER_LOGIN = FRONTEGG_AUTHENTICATION_FLOWS_REDIRECT_AFTER_LOGIN;
+const FRONTEGG_OAUTH_SILENT_REDIRECT_ADDRESS = 'FRONTEGG_OAUTH_SILENT_REDIRECT_ADDRESS';
+exports.FRONTEGG_OAUTH_SILENT_REDIRECT_ADDRESS = FRONTEGG_OAUTH_SILENT_REDIRECT_ADDRESS;
+const FRONTEGG_OAUTH_STATE_SAVED_AT = 'FRONTEGG_OAUTH_STATE_SAVED_AT';
+
+/** Slightly under typical Redis OAuth session TTL to avoid stale postlogin attempts. */
+exports.FRONTEGG_OAUTH_STATE_SAVED_AT = FRONTEGG_OAUTH_STATE_SAVED_AT;
+const HOSTED_OAUTH_STATE_MAX_AGE_MS = 23 * 60 * 60 * 1000;
+exports.HOSTED_OAUTH_STATE_MAX_AGE_MS = HOSTED_OAUTH_STATE_MAX_AGE_MS;
+const HOSTED_OAUTH_STORAGE_KEYS = [FRONTEGG_OAUTH_REDIRECT_AFTER_LOGIN, FRONTEGG_OAUTH_STATE_AFTER_LOGIN, FRONTEGG_OAUTH_STATE_SAVED_AT, FRONTEGG_AUTHENTICATION_FLOWS_REDIRECT_AFTER_LOGIN, FRONTEGG_OAUTH_INVITATION_TOKEN_KEY, FRONTEGG_OAUTH_ORGANIZATION, FRONTEGG_OAUTH_TENANT_ID, FRONTEGG_OAUTH_STEP_UP_ACR_VALUES, FRONTEGG_OAUTH_STEP_UP_MAX_AGE, FRONTEGG_OAUTH_APP_ID, FRONTEGG_OAUTH_LOGIN_HINT, FRONTEGG_OAUTH_LOGIN_DIRECT_ACTION, FRONTEGG_OAUTH_SILENT_REDIRECT_ADDRESS];
+exports.HOSTED_OAUTH_STORAGE_KEYS = HOSTED_OAUTH_STORAGE_KEYS;
+function removeHostedOAuthCookie(key) {
+  document.cookie = `${encodeURIComponent(key)}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/`;
+}
+function getStoredHostedOAuthValue(key) {
+  const fromLocalStorage = window.localStorage.getItem(key);
+  if (fromLocalStorage) {
+    return fromLocalStorage;
+  }
+  const fromSessionStorage = window.sessionStorage.getItem(key);
+  if (fromSessionStorage) {
+    return fromSessionStorage;
+  }
+  const decodedName = encodeURIComponent(key);
+  const cookies = document.cookie.split(';');
+  for (let cookie of cookies) {
+    cookie = cookie.trim();
+    if (cookie.indexOf(`${decodedName}=`) === 0) {
+      return decodeURIComponent(cookie.substring(decodedName.length + 1));
+    }
+  }
+  return null;
+}
+function clearHostedOAuthState() {
+  if (typeof window === 'undefined') {
+    return;
+  }
+  HOSTED_OAUTH_STORAGE_KEYS.forEach(key => {
+    window.localStorage.removeItem(key);
+    window.sessionStorage.removeItem(key);
+    removeHostedOAuthCookie(key);
+  });
+}
+function markHostedOAuthStateSaved() {
+  if (typeof window === 'undefined') {
+    return;
+  }
+  const value = Date.now().toString();
+  window.localStorage.setItem(FRONTEGG_OAUTH_STATE_SAVED_AT, value);
+  window.sessionStorage.setItem(FRONTEGG_OAUTH_STATE_SAVED_AT, value);
+  const expires = new Date();
+  expires.setTime(expires.getTime() + HOSTED_OAUTH_STATE_MAX_AGE_MS);
+  document.cookie = `${encodeURIComponent(FRONTEGG_OAUTH_STATE_SAVED_AT)}=${encodeURIComponent(value)};expires=${expires.toUTCString()};path=/`;
+}
+function isHostedOAuthStateExpired() {
+  if (typeof window === 'undefined') {
+    return false;
+  }
+  const savedAt = getStoredHostedOAuthValue(FRONTEGG_OAUTH_STATE_SAVED_AT);
+  if (!savedAt) {
+    return false;
+  }
+  const savedAtMs = Number(savedAt);
+  if (Number.isNaN(savedAtMs)) {
+    return false;
+  }
+  return Date.now() - savedAtMs > HOSTED_OAUTH_STATE_MAX_AGE_MS;
+}

package/node/auth/MSP/actions.js

@@ -77,7 +77,8 @@ var _default = (store, api, sharedActions) => {
           jwt
         });
         const tenantsUsersCountArray = await api.tenants.getTenantsUsersCount({
-          tenantIds: items.map(tenant => tenant.tenantId)
+          tenantIds: items.map(tenant => tenant.tenantId),
+          excludeInvisibleUsers: true
         }, {
           jwt
         });
@@ -107,7 +108,8 @@ var _default = (store, api, sharedActions) => {
           _links
         } = await api.tenants.searchSubTenants(searchSubTenantsQueryParams);
         const tenantsUsersCountArray = await api.tenants.getTenantsUsersCount({
-          tenantIds: items.map(i => i.tenantId)
+          tenantIds: items.map(i => i.tenantId),
+          excludeInvisibleUsers: true
         });
         const accountsWithUsersCount = (0, _helpers2.getAccountsWithUsersCount)({
           items
@@ -819,7 +821,8 @@ var _default = (store, api, sharedActions) => {
     try {
       var _tenantUsersCount$;
       const tenantUsersCount = await api.tenants.getTenantsUsersCount({
-        tenantIds: [activeTenant == null ? void 0 : activeTenant.tenantId]
+        tenantIds: [activeTenant == null ? void 0 : activeTenant.tenantId],
+        excludeInvisibleUsers: true
       });
       const rootAccount = {
         name: activeTenant == null ? void 0 : activeTenant.name,
@@ -866,7 +869,8 @@ var _default = (store, api, sharedActions) => {
         jwt
       });
       const [numberOfUsersArray, parentsAccounts, subAccountsAmount] = await Promise.all([api.tenants.getTenantsUsersCount({
-        tenantIds: [(_accountSettings$tena = accountSettings == null ? void 0 : accountSettings.tenantId) != null ? _accountSettings$tena : '']
+        tenantIds: [(_accountSettings$tena = accountSettings == null ? void 0 : accountSettings.tenantId) != null ? _accountSettings$tena : ''],
+        excludeInvisibleUsers: true
       }, {
         jwt
       }), api.tenants.getParentTenants({
@@ -920,7 +924,8 @@ var _default = (store, api, sharedActions) => {
         value: true
       });
       const numberOfUsersArray = await api.tenants.getTenantsUsersCount({
-        tenantIds: [tenantId]
+        tenantIds: [tenantId],
+        excludeInvisibleUsers: true
       }, {
         jwt
       });

package/node/auth/index.js

@@ -513,6 +513,18 @@ Object.keys(_interfaces37).forEach(function (key) {
     }
   });
 });
+var _oauthStorage = require("./LoginState/oauthStorage");
+Object.keys(_oauthStorage).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
+  if (key in exports && exports[key] === _oauthStorage[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _oauthStorage[key];
+    }
+  });
+});
 const _excluded = ["routes"],
   _excluded2 = ["requestName"];
 const createAuthState = _overrideState => {

package/node/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.113.0
+/** @license Frontegg v7.114.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@frontegg/redux-store",
-  "version": "7.113.0",
+  "version": "7.114.0",
   "main": "./node/index.js",
   "license": "MIT",
   "author": "Frontegg LTD",
   "dependencies": {
     "@babel/runtime": "^7.18.6",
     "@frontegg/entitlements-javascript-commons": "1.1.2",
-    "@frontegg/rest-api": "7.113.0",
+    "@frontegg/rest-api": "7.114.0",
     "fast-deep-equal": "3.1.3",
     "get-value": "^3.0.1",
     "proxy-compare": "^3.0.0",