@frontegg/redux-store 7.114.0 → 7.116.0

package/auth/LoginState/actions/hostedLoginAuthorize.actions.js

@@ -1,8 +1,8 @@
 import _extends from "@babel/runtime/helpers/esm/extends";
-import { createRandomString, generateCodeChallenge, GTMEventAction, reportGTMEvent } from '../../../helpers';
+import { createRandomString, generateCodeChallenge, GTMEventAction, refreshTokenWithRetry, reportGTMEvent } from '../../../helpers';
 import { HOSTED_LOGIN_VERIFIER_KEY } from '../../../constants';
 import { getBaseNameWithoutSlashSuffix, getSearchParam, isOauthCallbackRoute, TENANT_ID_PARAM_KEY } from '../helpers';
-import { getUri, isSteppedUp } from '../../helpers';
+import { getUri, getUrlDerivedStepUp, isSteppedUp, redirectByStepUpUrl } from '../../helpers';
 import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
 import { FronteggNativeModule } from '../../../toolkit';
 export default ((store, api, sharedActions) => {
@@ -15,8 +15,11 @@ export default ((store, api, sharedActions) => {
     var _response;
     let response;
     if (FronteggNativeModule.isGetTokensAvailable()) {
-      const tokens = await FronteggNativeModule.getTokens();
-      response = await api.auth.silentOAuthRefreshTokenV3(tokens);
+      const authApi = api.auth;
+      response = await refreshTokenWithRetry(async () => {
+        const tokens = await FronteggNativeModule.getTokens();
+        return await authApi.silentOAuthRefreshTokenV3(tokens);
+      });
     } else {
       response = await api.auth.silentOAuthRefreshTokenV2();
     }
@@ -114,7 +117,7 @@ export default ((store, api, sharedActions) => {
     }
   };
   const refreshOrRequestHostedLoginAuthorizeV2 = async payload => {
-    var _localStorage2, _additionalParams;
+    var _additionalParams;
     const {
       shouldRedirectToLogin,
       firstTime,
@@ -123,8 +126,12 @@ export default ((store, api, sharedActions) => {
     let {
       additionalParams
     } = payload != null ? payload : {};
-    // when the user pause the step up flow we may still have the key in the local storage in hosted - Remove it
-    (_localStorage2 = localStorage) == null ? void 0 : _localStorage2.removeItem(SHOULD_STEP_UP_KEY);
+    const urlDerivedStepUp = getUrlDerivedStepUp();
+    const isNativeStepUp = FronteggNativeModule.isGetTokensAvailable() && urlDerivedStepUp.isStepUpRequested;
+    if (!isNativeStepUp) {
+      var _localStorage2;
+      (_localStorage2 = localStorage) == null ? void 0 : _localStorage2.removeItem(SHOULD_STEP_UP_KEY);
+    }
     if (firstTime) {
       const urlStrategy = store.root.urlStrategy;
       const activeUri = getUri(urlStrategy);
@@ -146,6 +153,22 @@ export default ((store, api, sharedActions) => {
     if (((_additionalParams = additionalParams) == null ? void 0 : _additionalParams['prompt']) === 'login') {
       return await requestHostedLoginAuthorize(additionalParams);
     }
+    if (isNativeStepUp && !isSteppedUp(store.auth.user, {
+      maxAge: urlDerivedStepUp.maxAge
+    })) {
+      const {
+        routes,
+        onRedirectTo
+      } = store.auth;
+      if (routes.stepUpUrl && !window.location.href.includes(routes.stepUpUrl)) {
+        window.localStorage.setItem(SHOULD_STEP_UP_KEY, 'true');
+        actions.setAuthState({
+          isLoading: true
+        });
+        redirectByStepUpUrl(routes.stepUpUrl, onRedirectTo, urlDerivedStepUp.maxAge);
+        return;
+      }
+    }
     try {
       if (disableSilentRefresh) {
         throw new Error('silent refresh is disabled');

package/auth/LoginState/actions/index.js

@@ -23,7 +23,7 @@ import mfaWithEmailCodeActions from './mfaWithEmailCode.actions';
 import mfaWithSMSActions from './mfaWithSMS.actions';
 import mfaWithWebAuthnActions from './mfaWithWebAuthn.actions';
 import { LoginFlow, LoginStep } from '../interfaces';
-import { base64urlDecode, deepResetState, delay, errorHandler, errorTraceId, GTMEventAction, publicKeyCredentialToJSON, reportGTMEvent, retryIfNeeded, withRetryConfig } from '../../../helpers';
+import { base64urlDecode, deepResetState, delay, errorHandler, errorTraceId, GTMEventAction, publicKeyCredentialToJSON, refreshTokenWithRetry, reportGTMEvent, retryIfNeeded, withRetryConfig } from '../../../helpers';
 import { initialState } from '../state';
 import { getSearchParam, isEmailPayload, isUsernamePayload, shouldShowPasswordRotationPromptFunc, TENANT_ID_PARAM_KEY } from '../helpers';
 import { AuthStrategyEnum, ContextHolder, FeatureFlags, getTabTenantFromSessionStorage, removeTabTenantFromSessionStorage, WebAuthnDeviceType } from '@frontegg/rest-api';
@@ -40,6 +40,7 @@ import { DEFAULT_RETRY_CONFIG } from '../../../constants';
 export default ((store, api, sharedActions) => {
   const actions = sharedActions;
   const contextHolder = ContextHolder.for(store.root.appName);
+
   /** @private */
   const __refreshTokenHosted = async () => {
     const user = store.auth.user;
@@ -98,7 +99,7 @@ export default ((store, api, sharedActions) => {
         user,
         tenants = [],
         activeTenant
-      } = await api.auth.refreshTokenV3();
+      } = await refreshTokenWithRetry(() => api.auth.refreshTokenV3());
       if (isMfaRequired(user, store.root.appName)) {
         const mfaRequiredState = await actions.getMfaRequiredState(user);
         actions.setAuthState(mfaRequiredState);
@@ -141,8 +142,11 @@ export default ((store, api, sharedActions) => {
   /** @private */
   const __refreshTokenWithNativeTokens = async () => {
     try {
-      const tokens = await FronteggNativeModule.getTokens();
-      const response = await api.auth.silentOAuthRefreshTokenV3(tokens);
+      const authApi = api.auth;
+      const response = await refreshTokenWithRetry(async () => {
+        const tokens = await FronteggNativeModule.getTokens();
+        return await authApi.silentOAuthRefreshTokenV3(tokens);
+      });
       const updatedUser = await __handleUnnecessaryEntitlementsUpdate(response.user);
       actions.afterAuthenticationStateUpdate(_extends({}, response, {
         user: updatedUser
@@ -1391,7 +1395,7 @@ export default ((store, api, sharedActions) => {
         user,
         tenants = [],
         activeTenant
-      } = await api.auth.refreshTokenV3();
+      } = await refreshTokenWithRetry(() => api.auth.refreshTokenV3());
       if (isMfaRequired(user, store.root.appName)) {
         const mfaRequiredState = await actions.getMfaRequiredState(user);
         actions.setAuthState(mfaRequiredState);

package/auth/StepUpState/helpers.d.ts

@@ -15,6 +15,11 @@ export interface SteppedUpJWTValues {
  * @returns true when the user is stepped up, false otherwise
  */
 export declare const isSteppedUp: (user?: SteppedUpJWTValues | null, { maxAge }?: IsSteppedUpOptions) => boolean;
+export interface UrlDerivedStepUp {
+    isStepUpRequested: boolean;
+    maxAge?: number;
+}
+export declare const getUrlDerivedStepUp: () => UrlDerivedStepUp;
 /**
  * Set the url and query params in the local storage FRONTEGG_AFTER_AUTH_REDIRECT_URL value
  */

package/auth/StepUpState/helpers.js

@@ -16,16 +16,38 @@ export const isSteppedUp = (user, {
     acr = '',
     auth_time
   } = user;
-  if (maxAge && auth_time) {
-    // when user is logged in for a long time (more than maxAge, but jwt is still valid because it's not refreshed yet)
-    const isMaxAgeValid = Date.now() / 1000 - auth_time <= maxAge;
-    if (!isMaxAgeValid) return false;
+  if (maxAge) {
+    // max_age requires a verifiable, fresh auth_time; a missing or stale one is not stepped up.
+    if (!auth_time || Date.now() / 1000 - auth_time > maxAge) {
+      return false;
+    }
   }
   const isACRValid = acr === ACR_VALUE;
   const isAMRIncludesMFA = amr.indexOf(AMR_MFA_VALUE) !== -1;
   const isAMRIncludesMethod = AMR_ADDITIONAL_VALUE.find(method => amr.indexOf(method)) !== undefined;
   return isACRValid && isAMRIncludesMFA && isAMRIncludesMethod;
 };
+export const getUrlDerivedStepUp = () => {
+  if (typeof window === 'undefined') {
+    return {
+      isStepUpRequested: false
+    };
+  }
+  try {
+    const params = new URLSearchParams(window.location.search);
+    const acrValues = params.get('acr_values');
+    const maxAgeParam = params.get('max_age');
+    const maxAge = maxAgeParam !== null && maxAgeParam !== '' ? Number(maxAgeParam) : undefined;
+    return {
+      isStepUpRequested: acrValues === ACR_VALUE,
+      maxAge: maxAge !== undefined && Number.isFinite(maxAge) ? maxAge : undefined
+    };
+  } catch {
+    return {
+      isStepUpRequested: false
+    };
+  }
+};
 
 /**
  * Set the url and query params in the local storage FRONTEGG_AFTER_AUTH_REDIRECT_URL value

package/helpers/index.d.ts

@@ -5,3 +5,4 @@ export * from './encoders';
 export * from './random';
 export * from './gtm';
 export * from './sha256';
+export * from './refreshTokenRetry';

package/helpers/index.js

@@ -4,4 +4,5 @@ export * from './converters';
 export * from './encoders';
 export * from './random';
 export * from './gtm';
-export * from './sha256';
+export * from './sha256';
+export * from './refreshTokenRetry';

package/helpers/refreshTokenRetry.d.ts

@@ -0,0 +1,2 @@
+export declare const shouldRetryRefreshTokenError: (error: unknown) => boolean;
+export declare const refreshTokenWithRetry: <T>(refreshRequest: () => Promise<T>) => Promise<T>;

package/helpers/refreshTokenRetry.js

@@ -0,0 +1,36 @@
+import { delay } from './common';
+const REFRESH_TOKEN_RETRY_DELAYS = [1000, 2000];
+const getRefreshTokenErrorStatusCode = error => {
+  var _ref, _apiError$statusCode, _apiError$response;
+  const apiError = error;
+  return (_ref = (_apiError$statusCode = apiError.statusCode) != null ? _apiError$statusCode : apiError.status) != null ? _ref : (_apiError$response = apiError.response) == null ? void 0 : _apiError$response.status;
+};
+export const shouldRetryRefreshTokenError = error => {
+  var _message$toLowerCase, _message;
+  const statusCode = getRefreshTokenErrorStatusCode(error);
+  const errorName = error == null ? void 0 : error.name;
+  const errorMessage = (_message$toLowerCase = error == null ? void 0 : (_message = error.message) == null ? void 0 : _message.toLowerCase()) != null ? _message$toLowerCase : '';
+  if (statusCode === 401 || statusCode === 403) {
+    return false;
+  }
+  if (statusCode === 410) {
+    return true;
+  }
+  if (statusCode !== undefined) {
+    return statusCode === 0 || statusCode >= 500 && statusCode < 600;
+  }
+  return errorName === 'AbortError' || errorMessage.includes('network') || errorMessage.includes('failed to fetch') || errorMessage.includes('fetch failed') || errorMessage.includes('load failed') || errorMessage.includes('native_bridge_timeout');
+};
+export const refreshTokenWithRetry = async refreshRequest => {
+  for (let attempt = 0; attempt <= REFRESH_TOKEN_RETRY_DELAYS.length; attempt++) {
+    try {
+      return await refreshRequest();
+    } catch (error) {
+      if (attempt >= REFRESH_TOKEN_RETRY_DELAYS.length || !shouldRetryRefreshTokenError(error)) {
+        throw error;
+      }
+      await delay(REFRESH_TOKEN_RETRY_DELAYS[attempt]);
+    }
+  }
+  return await refreshRequest();
+};

package/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.114.0
+/** @license Frontegg v7.116.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/node/auth/LoginState/actions/hostedLoginAuthorize.actions.js

@@ -22,8 +22,11 @@ var _default = (store, api, sharedActions) => {
     var _response;
     let response;
     if (_toolkit.FronteggNativeModule.isGetTokensAvailable()) {
-      const tokens = await _toolkit.FronteggNativeModule.getTokens();
-      response = await api.auth.silentOAuthRefreshTokenV3(tokens);
+      const authApi = api.auth;
+      response = await (0, _helpers.refreshTokenWithRetry)(async () => {
+        const tokens = await _toolkit.FronteggNativeModule.getTokens();
+        return await authApi.silentOAuthRefreshTokenV3(tokens);
+      });
     } else {
       response = await api.auth.silentOAuthRefreshTokenV2();
     }
@@ -121,7 +124,7 @@ var _default = (store, api, sharedActions) => {
     }
   };
   const refreshOrRequestHostedLoginAuthorizeV2 = async payload => {
-    var _localStorage2, _additionalParams;
+    var _additionalParams;
     const {
       shouldRedirectToLogin,
       firstTime,
@@ -130,8 +133,12 @@ var _default = (store, api, sharedActions) => {
     let {
       additionalParams
     } = payload != null ? payload : {};
-    // when the user pause the step up flow we may still have the key in the local storage in hosted - Remove it
-    (_localStorage2 = localStorage) == null ? void 0 : _localStorage2.removeItem(_consts.SHOULD_STEP_UP_KEY);
+    const urlDerivedStepUp = (0, _helpers3.getUrlDerivedStepUp)();
+    const isNativeStepUp = _toolkit.FronteggNativeModule.isGetTokensAvailable() && urlDerivedStepUp.isStepUpRequested;
+    if (!isNativeStepUp) {
+      var _localStorage2;
+      (_localStorage2 = localStorage) == null ? void 0 : _localStorage2.removeItem(_consts.SHOULD_STEP_UP_KEY);
+    }
     if (firstTime) {
       const urlStrategy = store.root.urlStrategy;
       const activeUri = (0, _helpers3.getUri)(urlStrategy);
@@ -153,6 +160,22 @@ var _default = (store, api, sharedActions) => {
     if (((_additionalParams = additionalParams) == null ? void 0 : _additionalParams['prompt']) === 'login') {
       return await requestHostedLoginAuthorize(additionalParams);
     }
+    if (isNativeStepUp && !(0, _helpers3.isSteppedUp)(store.auth.user, {
+      maxAge: urlDerivedStepUp.maxAge
+    })) {
+      const {
+        routes,
+        onRedirectTo
+      } = store.auth;
+      if (routes.stepUpUrl && !window.location.href.includes(routes.stepUpUrl)) {
+        window.localStorage.setItem(_consts.SHOULD_STEP_UP_KEY, 'true');
+        actions.setAuthState({
+          isLoading: true
+        });
+        (0, _helpers3.redirectByStepUpUrl)(routes.stepUpUrl, onRedirectTo, urlDerivedStepUp.maxAge);
+        return;
+      }
+    }
     try {
       if (disableSilentRefresh) {
         throw new Error('silent refresh is disabled');

package/node/auth/LoginState/actions/index.js

@@ -47,6 +47,7 @@ const _excluded = ["callback", "error"],
 var _default = (store, api, sharedActions) => {
   const actions = sharedActions;
   const contextHolder = _restApi.ContextHolder.for(store.root.appName);
+
   /** @private */
   const __refreshTokenHosted = async () => {
     const user = store.auth.user;
@@ -105,7 +106,7 @@ var _default = (store, api, sharedActions) => {
         user,
         tenants = [],
         activeTenant
-      } = await api.auth.refreshTokenV3();
+      } = await (0, _helpers.refreshTokenWithRetry)(() => api.auth.refreshTokenV3());
       if ((0, _helpers3.isMfaRequired)(user, store.root.appName)) {
         const mfaRequiredState = await actions.getMfaRequiredState(user);
         actions.setAuthState(mfaRequiredState);
@@ -148,8 +149,11 @@ var _default = (store, api, sharedActions) => {
   /** @private */
   const __refreshTokenWithNativeTokens = async () => {
     try {
-      const tokens = await _toolkit.FronteggNativeModule.getTokens();
-      const response = await api.auth.silentOAuthRefreshTokenV3(tokens);
+      const authApi = api.auth;
+      const response = await (0, _helpers.refreshTokenWithRetry)(async () => {
+        const tokens = await _toolkit.FronteggNativeModule.getTokens();
+        return await authApi.silentOAuthRefreshTokenV3(tokens);
+      });
       const updatedUser = await __handleUnnecessaryEntitlementsUpdate(response.user);
       actions.afterAuthenticationStateUpdate((0, _extends2.default)({}, response, {
         user: updatedUser
@@ -1398,7 +1402,7 @@ var _default = (store, api, sharedActions) => {
         user,
         tenants = [],
         activeTenant
-      } = await api.auth.refreshTokenV3();
+      } = await (0, _helpers.refreshTokenWithRetry)(() => api.auth.refreshTokenV3());
       if ((0, _helpers3.isMfaRequired)(user, store.root.appName)) {
         const mfaRequiredState = await actions.getMfaRequiredState(user);
         actions.setAuthState(mfaRequiredState);

package/node/auth/StepUpState/helpers.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.redirectByStepUpUrl = exports.isSteppedUp = void 0;
+exports.redirectByStepUpUrl = exports.isSteppedUp = exports.getUrlDerivedStepUp = void 0;
 exports.setAfterAuthRedirectUrlForStepUp = setAfterAuthRedirectUrlForStepUp;
 var _constants = require("../../constants");
 var _consts = require("./consts");
@@ -23,21 +23,44 @@ const isSteppedUp = (user, {
     acr = '',
     auth_time
   } = user;
-  if (maxAge && auth_time) {
-    // when user is logged in for a long time (more than maxAge, but jwt is still valid because it's not refreshed yet)
-    const isMaxAgeValid = Date.now() / 1000 - auth_time <= maxAge;
-    if (!isMaxAgeValid) return false;
+  if (maxAge) {
+    // max_age requires a verifiable, fresh auth_time; a missing or stale one is not stepped up.
+    if (!auth_time || Date.now() / 1000 - auth_time > maxAge) {
+      return false;
+    }
   }
   const isACRValid = acr === _consts.ACR_VALUE;
   const isAMRIncludesMFA = amr.indexOf(_consts.AMR_MFA_VALUE) !== -1;
   const isAMRIncludesMethod = _consts.AMR_ADDITIONAL_VALUE.find(method => amr.indexOf(method)) !== undefined;
   return isACRValid && isAMRIncludesMFA && isAMRIncludesMethod;
 };
+exports.isSteppedUp = isSteppedUp;
+const getUrlDerivedStepUp = () => {
+  if (typeof window === 'undefined') {
+    return {
+      isStepUpRequested: false
+    };
+  }
+  try {
+    const params = new URLSearchParams(window.location.search);
+    const acrValues = params.get('acr_values');
+    const maxAgeParam = params.get('max_age');
+    const maxAge = maxAgeParam !== null && maxAgeParam !== '' ? Number(maxAgeParam) : undefined;
+    return {
+      isStepUpRequested: acrValues === _consts.ACR_VALUE,
+      maxAge: maxAge !== undefined && Number.isFinite(maxAge) ? maxAge : undefined
+    };
+  } catch {
+    return {
+      isStepUpRequested: false
+    };
+  }
+};
 
 /**
  * Set the url and query params in the local storage FRONTEGG_AFTER_AUTH_REDIRECT_URL value
  */
-exports.isSteppedUp = isSteppedUp;
+exports.getUrlDerivedStepUp = getUrlDerivedStepUp;
 function setAfterAuthRedirectUrlForStepUp() {
   const encodedRedirectUrl = window.location.pathname + window.location.search;
   window.localStorage.setItem(_constants.FRONTEGG_AFTER_AUTH_REDIRECT_URL, encodedRedirectUrl);

package/node/helpers/index.js

@@ -79,4 +79,15 @@ Object.keys(_sha).forEach(function (key) {
       return _sha[key];
     }
   });
+});
+var _refreshTokenRetry = require("./refreshTokenRetry");
+Object.keys(_refreshTokenRetry).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (key in exports && exports[key] === _refreshTokenRetry[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _refreshTokenRetry[key];
+    }
+  });
 });

package/node/helpers/refreshTokenRetry.js

@@ -0,0 +1,44 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.shouldRetryRefreshTokenError = exports.refreshTokenWithRetry = void 0;
+var _common = require("./common");
+const REFRESH_TOKEN_RETRY_DELAYS = [1000, 2000];
+const getRefreshTokenErrorStatusCode = error => {
+  var _ref, _apiError$statusCode, _apiError$response;
+  const apiError = error;
+  return (_ref = (_apiError$statusCode = apiError.statusCode) != null ? _apiError$statusCode : apiError.status) != null ? _ref : (_apiError$response = apiError.response) == null ? void 0 : _apiError$response.status;
+};
+const shouldRetryRefreshTokenError = error => {
+  var _message$toLowerCase, _message;
+  const statusCode = getRefreshTokenErrorStatusCode(error);
+  const errorName = error == null ? void 0 : error.name;
+  const errorMessage = (_message$toLowerCase = error == null ? void 0 : (_message = error.message) == null ? void 0 : _message.toLowerCase()) != null ? _message$toLowerCase : '';
+  if (statusCode === 401 || statusCode === 403) {
+    return false;
+  }
+  if (statusCode === 410) {
+    return true;
+  }
+  if (statusCode !== undefined) {
+    return statusCode === 0 || statusCode >= 500 && statusCode < 600;
+  }
+  return errorName === 'AbortError' || errorMessage.includes('network') || errorMessage.includes('failed to fetch') || errorMessage.includes('fetch failed') || errorMessage.includes('load failed') || errorMessage.includes('native_bridge_timeout');
+};
+exports.shouldRetryRefreshTokenError = shouldRetryRefreshTokenError;
+const refreshTokenWithRetry = async refreshRequest => {
+  for (let attempt = 0; attempt <= REFRESH_TOKEN_RETRY_DELAYS.length; attempt++) {
+    try {
+      return await refreshRequest();
+    } catch (error) {
+      if (attempt >= REFRESH_TOKEN_RETRY_DELAYS.length || !shouldRetryRefreshTokenError(error)) {
+        throw error;
+      }
+      await (0, _common.delay)(REFRESH_TOKEN_RETRY_DELAYS[attempt]);
+    }
+  }
+  return await refreshRequest();
+};
+exports.refreshTokenWithRetry = refreshTokenWithRetry;

package/node/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.114.0
+/** @license Frontegg v7.116.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@frontegg/redux-store",
-  "version": "7.114.0",
+  "version": "7.116.0",
   "main": "./node/index.js",
   "license": "MIT",
   "author": "Frontegg LTD",
   "dependencies": {
     "@babel/runtime": "^7.18.6",
     "@frontegg/entitlements-javascript-commons": "1.1.2",
-    "@frontegg/rest-api": "7.114.0",
+    "@frontegg/rest-api": "7.116.0",
     "fast-deep-equal": "3.1.3",
     "get-value": "^3.0.1",
     "proxy-compare": "^3.0.0",