@frontegg/redux-store 7.114.0 → 7.115.0

package/auth/LoginState/actions/hostedLoginAuthorize.actions.js

@@ -2,7 +2,7 @@ import _extends from "@babel/runtime/helpers/esm/extends";
 import { createRandomString, generateCodeChallenge, GTMEventAction, reportGTMEvent } from '../../../helpers';
 import { HOSTED_LOGIN_VERIFIER_KEY } from '../../../constants';
 import { getBaseNameWithoutSlashSuffix, getSearchParam, isOauthCallbackRoute, TENANT_ID_PARAM_KEY } from '../helpers';
-import { getUri, isSteppedUp } from '../../helpers';
+import { getUri, getUrlDerivedStepUp, isSteppedUp, redirectByStepUpUrl } from '../../helpers';
 import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
 import { FronteggNativeModule } from '../../../toolkit';
 export default ((store, api, sharedActions) => {
@@ -114,7 +114,7 @@ export default ((store, api, sharedActions) => {
     }
   };
   const refreshOrRequestHostedLoginAuthorizeV2 = async payload => {
-    var _localStorage2, _additionalParams;
+    var _additionalParams;
     const {
       shouldRedirectToLogin,
       firstTime,
@@ -123,8 +123,12 @@ export default ((store, api, sharedActions) => {
     let {
       additionalParams
     } = payload != null ? payload : {};
-    // when the user pause the step up flow we may still have the key in the local storage in hosted - Remove it
-    (_localStorage2 = localStorage) == null ? void 0 : _localStorage2.removeItem(SHOULD_STEP_UP_KEY);
+    const urlDerivedStepUp = getUrlDerivedStepUp();
+    const isNativeStepUp = FronteggNativeModule.isGetTokensAvailable() && urlDerivedStepUp.isStepUpRequested;
+    if (!isNativeStepUp) {
+      var _localStorage2;
+      (_localStorage2 = localStorage) == null ? void 0 : _localStorage2.removeItem(SHOULD_STEP_UP_KEY);
+    }
     if (firstTime) {
       const urlStrategy = store.root.urlStrategy;
       const activeUri = getUri(urlStrategy);
@@ -146,6 +150,22 @@ export default ((store, api, sharedActions) => {
     if (((_additionalParams = additionalParams) == null ? void 0 : _additionalParams['prompt']) === 'login') {
       return await requestHostedLoginAuthorize(additionalParams);
     }
+    if (isNativeStepUp && !isSteppedUp(store.auth.user, {
+      maxAge: urlDerivedStepUp.maxAge
+    })) {
+      const {
+        routes,
+        onRedirectTo
+      } = store.auth;
+      if (routes.stepUpUrl && !window.location.href.includes(routes.stepUpUrl)) {
+        window.localStorage.setItem(SHOULD_STEP_UP_KEY, 'true');
+        actions.setAuthState({
+          isLoading: true
+        });
+        redirectByStepUpUrl(routes.stepUpUrl, onRedirectTo, urlDerivedStepUp.maxAge);
+        return;
+      }
+    }
     try {
       if (disableSilentRefresh) {
         throw new Error('silent refresh is disabled');

package/auth/StepUpState/helpers.d.ts

@@ -15,6 +15,11 @@ export interface SteppedUpJWTValues {
  * @returns true when the user is stepped up, false otherwise
  */
 export declare const isSteppedUp: (user?: SteppedUpJWTValues | null, { maxAge }?: IsSteppedUpOptions) => boolean;
+export interface UrlDerivedStepUp {
+    isStepUpRequested: boolean;
+    maxAge?: number;
+}
+export declare const getUrlDerivedStepUp: () => UrlDerivedStepUp;
 /**
  * Set the url and query params in the local storage FRONTEGG_AFTER_AUTH_REDIRECT_URL value
  */

package/auth/StepUpState/helpers.js

@@ -16,16 +16,38 @@ export const isSteppedUp = (user, {
     acr = '',
     auth_time
   } = user;
-  if (maxAge && auth_time) {
-    // when user is logged in for a long time (more than maxAge, but jwt is still valid because it's not refreshed yet)
-    const isMaxAgeValid = Date.now() / 1000 - auth_time <= maxAge;
-    if (!isMaxAgeValid) return false;
+  if (maxAge) {
+    // max_age requires a verifiable, fresh auth_time; a missing or stale one is not stepped up.
+    if (!auth_time || Date.now() / 1000 - auth_time > maxAge) {
+      return false;
+    }
   }
   const isACRValid = acr === ACR_VALUE;
   const isAMRIncludesMFA = amr.indexOf(AMR_MFA_VALUE) !== -1;
   const isAMRIncludesMethod = AMR_ADDITIONAL_VALUE.find(method => amr.indexOf(method)) !== undefined;
   return isACRValid && isAMRIncludesMFA && isAMRIncludesMethod;
 };
+export const getUrlDerivedStepUp = () => {
+  if (typeof window === 'undefined') {
+    return {
+      isStepUpRequested: false
+    };
+  }
+  try {
+    const params = new URLSearchParams(window.location.search);
+    const acrValues = params.get('acr_values');
+    const maxAgeParam = params.get('max_age');
+    const maxAge = maxAgeParam !== null && maxAgeParam !== '' ? Number(maxAgeParam) : undefined;
+    return {
+      isStepUpRequested: acrValues === ACR_VALUE,
+      maxAge: maxAge !== undefined && Number.isFinite(maxAge) ? maxAge : undefined
+    };
+  } catch {
+    return {
+      isStepUpRequested: false
+    };
+  }
+};
 
 /**
  * Set the url and query params in the local storage FRONTEGG_AFTER_AUTH_REDIRECT_URL value

package/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.114.0
+/** @license Frontegg v7.115.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/node/auth/LoginState/actions/hostedLoginAuthorize.actions.js

@@ -121,7 +121,7 @@ var _default = (store, api, sharedActions) => {
     }
   };
   const refreshOrRequestHostedLoginAuthorizeV2 = async payload => {
-    var _localStorage2, _additionalParams;
+    var _additionalParams;
     const {
       shouldRedirectToLogin,
       firstTime,
@@ -130,8 +130,12 @@ var _default = (store, api, sharedActions) => {
     let {
       additionalParams
     } = payload != null ? payload : {};
-    // when the user pause the step up flow we may still have the key in the local storage in hosted - Remove it
-    (_localStorage2 = localStorage) == null ? void 0 : _localStorage2.removeItem(_consts.SHOULD_STEP_UP_KEY);
+    const urlDerivedStepUp = (0, _helpers3.getUrlDerivedStepUp)();
+    const isNativeStepUp = _toolkit.FronteggNativeModule.isGetTokensAvailable() && urlDerivedStepUp.isStepUpRequested;
+    if (!isNativeStepUp) {
+      var _localStorage2;
+      (_localStorage2 = localStorage) == null ? void 0 : _localStorage2.removeItem(_consts.SHOULD_STEP_UP_KEY);
+    }
     if (firstTime) {
       const urlStrategy = store.root.urlStrategy;
       const activeUri = (0, _helpers3.getUri)(urlStrategy);
@@ -153,6 +157,22 @@ var _default = (store, api, sharedActions) => {
     if (((_additionalParams = additionalParams) == null ? void 0 : _additionalParams['prompt']) === 'login') {
       return await requestHostedLoginAuthorize(additionalParams);
     }
+    if (isNativeStepUp && !(0, _helpers3.isSteppedUp)(store.auth.user, {
+      maxAge: urlDerivedStepUp.maxAge
+    })) {
+      const {
+        routes,
+        onRedirectTo
+      } = store.auth;
+      if (routes.stepUpUrl && !window.location.href.includes(routes.stepUpUrl)) {
+        window.localStorage.setItem(_consts.SHOULD_STEP_UP_KEY, 'true');
+        actions.setAuthState({
+          isLoading: true
+        });
+        (0, _helpers3.redirectByStepUpUrl)(routes.stepUpUrl, onRedirectTo, urlDerivedStepUp.maxAge);
+        return;
+      }
+    }
     try {
       if (disableSilentRefresh) {
         throw new Error('silent refresh is disabled');

package/node/auth/StepUpState/helpers.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.redirectByStepUpUrl = exports.isSteppedUp = void 0;
+exports.redirectByStepUpUrl = exports.isSteppedUp = exports.getUrlDerivedStepUp = void 0;
 exports.setAfterAuthRedirectUrlForStepUp = setAfterAuthRedirectUrlForStepUp;
 var _constants = require("../../constants");
 var _consts = require("./consts");
@@ -23,21 +23,44 @@ const isSteppedUp = (user, {
     acr = '',
     auth_time
   } = user;
-  if (maxAge && auth_time) {
-    // when user is logged in for a long time (more than maxAge, but jwt is still valid because it's not refreshed yet)
-    const isMaxAgeValid = Date.now() / 1000 - auth_time <= maxAge;
-    if (!isMaxAgeValid) return false;
+  if (maxAge) {
+    // max_age requires a verifiable, fresh auth_time; a missing or stale one is not stepped up.
+    if (!auth_time || Date.now() / 1000 - auth_time > maxAge) {
+      return false;
+    }
   }
   const isACRValid = acr === _consts.ACR_VALUE;
   const isAMRIncludesMFA = amr.indexOf(_consts.AMR_MFA_VALUE) !== -1;
   const isAMRIncludesMethod = _consts.AMR_ADDITIONAL_VALUE.find(method => amr.indexOf(method)) !== undefined;
   return isACRValid && isAMRIncludesMFA && isAMRIncludesMethod;
 };
+exports.isSteppedUp = isSteppedUp;
+const getUrlDerivedStepUp = () => {
+  if (typeof window === 'undefined') {
+    return {
+      isStepUpRequested: false
+    };
+  }
+  try {
+    const params = new URLSearchParams(window.location.search);
+    const acrValues = params.get('acr_values');
+    const maxAgeParam = params.get('max_age');
+    const maxAge = maxAgeParam !== null && maxAgeParam !== '' ? Number(maxAgeParam) : undefined;
+    return {
+      isStepUpRequested: acrValues === _consts.ACR_VALUE,
+      maxAge: maxAge !== undefined && Number.isFinite(maxAge) ? maxAge : undefined
+    };
+  } catch {
+    return {
+      isStepUpRequested: false
+    };
+  }
+};
 
 /**
  * Set the url and query params in the local storage FRONTEGG_AFTER_AUTH_REDIRECT_URL value
  */
-exports.isSteppedUp = isSteppedUp;
+exports.getUrlDerivedStepUp = getUrlDerivedStepUp;
 function setAfterAuthRedirectUrlForStepUp() {
   const encodedRedirectUrl = window.location.pathname + window.location.search;
   window.localStorage.setItem(_constants.FRONTEGG_AFTER_AUTH_REDIRECT_URL, encodedRedirectUrl);

package/node/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.114.0
+/** @license Frontegg v7.115.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@frontegg/redux-store",
-  "version": "7.114.0",
+  "version": "7.115.0",
   "main": "./node/index.js",
   "license": "MIT",
   "author": "Frontegg LTD",
   "dependencies": {
     "@babel/runtime": "^7.18.6",
     "@frontegg/entitlements-javascript-commons": "1.1.2",
-    "@frontegg/rest-api": "7.114.0",
+    "@frontegg/rest-api": "7.115.0",
     "fast-deep-equal": "3.1.3",
     "get-value": "^3.0.1",
     "proxy-compare": "^3.0.0",