@frontegg/redux-store 7.118.0 → 7.120.0

package/auth/LoginState/actions/afterAuthNavigation.actions.js

@@ -1,6 +1,8 @@
 import _extends from "@babel/runtime/helpers/esm/extends";
 import { getPathAndSearchParamsFromUrl, getRedirectUrl, isAbsoluteUrl } from '../helpers';
+import { shouldPromptChooseTenant } from '../helpers/tenantSelect';
 import { FRONTEGG_AFTER_AUTH_REDIRECT_URL } from '../../../constants';
+import { LoginStep } from '../interfaces';
 import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
 import { delay } from '../../../helpers';
 import { isSteppedUp } from '../../StepUpState/helpers';
@@ -146,17 +148,106 @@ export default ((store, api, sharedActions) => {
     });
   };
 
+  /**
+   * Choose-tenant gate — the single chokepoint all auth methods (password/MFA/SSO/passwordless/
+   * passkey) and interstitials converge on. The trigger is the `authOptions.tenantSelection.enabled`
+   * SDK option, so it fires identically for embedded and hosted integrators (in hosted mode
+   * oauth-service is responsible for setting the option). When the option is on, the LD flag is on,
+   * and the user has >1 switchable tenant, route to the ChooseTenant step instead of finalizing.
+   * The ChooseTenant confirm handler sets `tenantChoiceResolved` and re-enters
+   * afterAuthNavigation, which then falls through here. Runs only post-auth; no tenant data is read
+   * until the resolved-guard, the LD flag, and the option all pass.
+   */
+  const shouldRouteToChooseTenant = async () => {
+    var _store$auth$tenantSel, _store$auth$user, _store$auth$user$act, _store$auth$tenantsSt;
+    const loginState = store.auth.loginState;
+    // Guard first so re-entry after the choice is resolved finalizes without re-reading the flag.
+    if (loginState.tenantChoiceResolved) {
+      return false;
+    }
+    // Cheap option guard before any flag/tenant work — never act when the integrator didn't opt in.
+    const enabledByOption = ((_store$auth$tenantSel = store.auth.tenantSelection) == null ? void 0 : _store$auth$tenantSel.enabled) === true;
+    if (!enabledByOption) {
+      return false;
+    }
+    const [ldEnabled] = await actions.getFeatureFlags(['login-box-choose-tenant']);
+    if (!ldEnabled) {
+      return false; // feature off — never read tenant data
+    }
+
+    const isImpersonation = !!((_store$auth$user = store.auth.user) != null && (_store$auth$user$act = _store$auth$user.act) != null && _store$auth$user$act.sub);
+    if (isImpersonation) {
+      return false;
+    }
+    // SSO/social postLogin authenticates without populating tenantsState — load it here so the
+    // chooser also opens on those paths (password/MFA already have tenants from the login response).
+    if (!((_store$auth$tenantsSt = store.auth.tenantsState.tenants) != null && _store$auth$tenantsSt.length)) {
+      var _store$auth$tenantsSt2;
+      let loadFailed = false;
+      await actions.loadTenants({
+        callback: (_tenants, error) => loadFailed = !!error
+      });
+      // Do NOT fail-open: if the tenant set could not be loaded while the feature is on, route to the
+      // chooser (which shows a load error + retry / continue-with-current) instead of finalizing on
+      // the default tenant and silently skipping the required org choice.
+      if (loadFailed && !((_store$auth$tenantsSt2 = store.auth.tenantsState.tenants) != null && _store$auth$tenantsSt2.length)) {
+        return true;
+      }
+    }
+    const {
+      tenants
+    } = store.auth.tenantsState;
+    return shouldPromptChooseTenant({
+      ldEnabled,
+      enabledByOption,
+      tenants,
+      isImpersonation,
+      tenantChoiceResolved: loginState.tenantChoiceResolved
+    });
+  };
+
   /**
    * After auth navigation for login flow
    * Handling also step up scenario when user silently logout to continue to step up
    */
+
   const afterAuthNavigation = async payload => {
     var _window4, _payload$preventRedir;
+    // Once the choose-tenant step starts a switch the chooser owns navigation. Every re-entry here
+    // (the switch's token refresh, and — critically — a late or timed-out switch completing AFTER the
+    // user hit the escape hatch) must be a no-op, so navigation can't run twice or jump into the wrong
+    // org. Two latches guard it: `chooseTenantSwitching` covers the in-login window, but it lives in
+    // loginState and is wiped by the finalize's resetLoginState — so a late switch would slip through.
+    // `tenantsState.switchingTenant` stays set for the WHOLE switchTenant call and survives that reset,
+    // so it suppresses the late re-entry too. The confirm handler performs the ONE finalize via the
+    // one-shot `chooseTenantFinalizing` flag, which passes through both latches and is consumed here.
+    // (An in-app tenant switch never reaches this function — its refresh only calls afterAuthNavigation
+    // from a login/callback URL, not from an authenticated app page — so this cannot over-suppress.)
+    const {
+      chooseTenantSwitching,
+      chooseTenantFinalizing
+    } = store.auth.loginState;
+    const {
+      switchingTenant
+    } = store.auth.tenantsState;
+    if ((chooseTenantSwitching || switchingTenant) && !chooseTenantFinalizing) {
+      return;
+    }
+    if (chooseTenantFinalizing) {
+      actions.setLoginState({
+        chooseTenantFinalizing: false
+      }); // consume: later re-entries stay suppressed
+    }
+
     const {
       customLoginAuthenticatedUrl,
       stepUpUrl
     } = store.auth.routes;
 
+    // Step-up on the CURRENT tenant resolves before the org chooser: a user who needs both
+    // authenticates + steps up first, then picks an org. switchTenant handles any MFA the chosen
+    // org requires on its own, and the isSteppedUp guard below means an already-stepped-up user is
+    // never re-prompted.
     // login with magic code, try to step up, no other mfa, invalid max age, force_enroll -> logout, login with first factor, not-stepped up jwt -> navigate to step up
     const shouldStepUp = (_window4 = window) == null ? void 0 : _window4.localStorage.getItem(SHOULD_STEP_UP_KEY);
     const user = store.auth.user;
@@ -169,6 +260,20 @@ export default ((store, api, sharedActions) => {
         forceStepUpUrl: stepUpUrl
       });
     }
+    if (await shouldRouteToChooseTenant()) {
+      actions.setLoginState({
+        step: LoginStep.chooseTenant,
+        loading: false
+      });
+      // Mirror the other post-auth interstitials (e.g. promptPasskeys): navigate to the login URL
+      // so the ChooseTenant step actually renders even when afterAuthNavigation is invoked from an
+      // OAuth/social callback route.
+      store.auth.onRedirectTo(store.auth.routes.loginUrl, {
+        preserveQueryParams: true
+      });
+      return; // do NOT finalize; ChooseTenant confirm re-enters afterAuthNavigation
+    }
+
     let customLoginURL = customLoginAuthenticatedUrl;
     if (!customLoginAuthenticatedUrl) {
       var _store$auth$routes;

package/auth/LoginState/actions/index.js

@@ -26,7 +26,7 @@ import { LoginFlow, LoginStep } from '../interfaces';
 import { base64urlDecode, deepResetState, delay, errorHandler, errorTraceId, GTMEventAction, publicKeyCredentialToJSON, refreshTokenWithRetry, reportGTMEvent, retryIfNeeded, withRetryConfig } from '../../../helpers';
 import { initialState } from '../state';
 import { getSearchParam, isEmailPayload, isUsernamePayload, shouldShowPasswordRotationPromptFunc, TENANT_ID_PARAM_KEY } from '../helpers';
-import { AuthStrategyEnum, ContextHolder, FeatureFlags, getTabTenantFromSessionStorage, removeTabTenantFromSessionStorage, WebAuthnDeviceType } from '@frontegg/rest-api';
+import { AuthStrategyEnum, ContextHolder, FeatureFlags, getTabTenantFromSessionStorage, removeTabTenantFromSessionStorage, WebAuthnDeviceType, PreLoginAddressType } from '@frontegg/rest-api';
 import hostedLoginAuthorizeActions from './hostedLoginAuthorize.actions';
 import { clearHostedOAuthState } from '../oauthStorage';
 import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
@@ -410,9 +410,21 @@ export default ((store, api, sharedActions) => {
       }));
       const {
         address,
-        idpType
+        idpType,
+        addressType
       } = preLoginResult != null ? preLoginResult : {};
       if (address) {
+        if (addressType === PreLoginAddressType.External) {
+          // Domain-based routing: navigate to the vendor legacy login URL immediately,
+          // skipping the SSO interstitial and the SSO/OIDC-specific handling.
+          setLoginState({
+            loading: false
+          });
+          onRedirectTo(address, {
+            refresh: true
+          });
+          return;
+        }
         let ssoRedirectUrl = address;
         if (idpType === SamlVendors.Oidc && !ssoRedirectUrl.includes('redirect_uri')) {
           const {
@@ -567,7 +579,10 @@ export default ((store, api, sharedActions) => {
               step: loginState.flow === LoginFlow.Login ? LoginStep.success : loginState.step,
               tenants,
               tenantsLoading: true,
-              isBreachedPassword: user.isBreachedPassword
+              isBreachedPassword: user.isBreachedPassword,
+              // Preserve the choose-tenant guard across this post-login state rebuild so a
+              // resolved choice is not re-prompted (choose-organization).
+              tenantChoiceResolved: loginState.tenantChoiceResolved
             },
             isAuthenticated
           });

package/auth/LoginState/helpers/tenantSelect.d.ts

@@ -0,0 +1,20 @@
+import { ITenantsResponseV2 } from '@frontegg/rest-api';
+/**
+ * The set of tenants the user can actually switch into — the same set `switchActiveTenant`
+ * accepts server-side, so the chooser never lists a tenant that would be rejected at confirm time.
+ * Excludes: pending invites (invitationToken), locked/disabled tenants, and expired temporary access.
+ */
+export declare function getSwitchableTenants(tenants?: ITenantsResponseV2[]): ITenantsResponseV2[];
+/**
+ * The single gate for the post-auth "choose organization" dialog. The trigger is the
+ * `authOptions.tenantSelection.enabled` SDK option (`enabledByOption`) — the same signal for embedded
+ * and hosted (in hosted mode oauth-service is responsible for setting the option). The `>1` gate is
+ * over the SWITCHABLE set; undefined/empty tenants collapse to 0 and fall through (fail-safe).
+ */
+export declare function shouldPromptChooseTenant(args: {
+    ldEnabled: boolean;
+    enabledByOption: boolean;
+    tenants?: ITenantsResponseV2[];
+    isImpersonation: boolean;
+    tenantChoiceResolved: boolean;
+}): boolean;

package/auth/LoginState/helpers/tenantSelect.js

@@ -0,0 +1,54 @@
+/**
+ * A switchable tenant membership carries fields returned by GET /me/tenants that are not
+ * part of the base ITenantsResponseV2 shape (pending invite / disabled / temporary access).
+ */
+
+/**
+ * The set of tenants the user can actually switch into — the same set `switchActiveTenant`
+ * accepts server-side, so the chooser never lists a tenant that would be rejected at confirm time.
+ * Excludes: pending invites (invitationToken), locked/disabled tenants, and expired temporary access.
+ */
+export function getSwitchableTenants(tenants) {
+  if (!tenants) {
+    return [];
+  }
+  const now = Date.now();
+  return tenants.filter(tenant => {
+    const t = tenant;
+    if (t.invitationToken) {
+      return false; // invited, not yet a member
+    }
+
+    if (t.isDisabled) {
+      return false; // locked/disabled tenant
+    }
+
+    if (t.temporaryExpirationDate && new Date(t.temporaryExpirationDate).getTime() < now) {
+      return false; // temporary access expired
+    }
+
+    return true;
+  });
+}
+
+/**
+ * The single gate for the post-auth "choose organization" dialog. The trigger is the
+ * `authOptions.tenantSelection.enabled` SDK option (`enabledByOption`) — the same signal for embedded
+ * and hosted (in hosted mode oauth-service is responsible for setting the option). The `>1` gate is
+ * over the SWITCHABLE set; undefined/empty tenants collapse to 0 and fall through (fail-safe).
+ */
+export function shouldPromptChooseTenant(args) {
+  if (!args.ldEnabled) {
+    return false;
+  }
+  if (args.tenantChoiceResolved) {
+    return false;
+  }
+  if (args.isImpersonation) {
+    return false;
+  }
+  if (!args.enabledByOption) {
+    return false;
+  }
+  return getSwitchableTenants(args.tenants).length > 1;
+}

package/auth/LoginState/interfaces.d.ts

@@ -19,7 +19,8 @@ export declare enum LoginStep {
     'breachedPasswordSuccess' = "breachedPasswordSuccess",
     'passwordRotationExpired' = "passwordRotationExpired",
     'passwordRotationNotification' = "passwordRotationNotification",
-    'magicLinkPostLoginSuccess' = "magicLinkPostLoginSuccess"
+    'magicLinkPostLoginSuccess' = "magicLinkPostLoginSuccess",
+    'chooseTenant' = "chooseTenant"
 }
 export declare enum LoginFlow {
     Login = "login",
@@ -56,6 +57,26 @@ export interface LoginState {
     passwordExpiresIn?: number;
     notificationPeriod?: number;
     userId?: string;
+    /**
+     * Guard for the post-auth "choose organization" gate (choose-organization feature).
+     * Set to true once the user has resolved the tenant choice (or the escape hatch was used),
+     * so re-entry into afterAuthNavigation finalizes without re-prompting.
+     */
+    tenantChoiceResolved: boolean;
+    /**
+     * True while the choose-organization step is performing switchTenant + showing its success
+     * interstitial. switchTenant refreshes the token, which re-enters afterAuthNavigation; this flag
+     * makes that re-entry a no-op so the chooser controls navigation itself (no flicker / lost success).
+     * Once set it latches on for the rest of the flow so a late/timed-out switch completion can't
+     * navigate after the user already finalized.
+     */
+    chooseTenantSwitching?: boolean;
+    /**
+     * One-shot flag the choose-organization confirm handler sets to let its single finalize navigation
+     * through the `chooseTenantSwitching` latch; afterAuthNavigation consumes it on the next call so
+     * subsequent (late switch) re-entries remain suppressed.
+     */
+    chooseTenantFinalizing?: boolean;
 }
 export interface HostedLoginCallback {
     code: string;

package/auth/LoginState/interfaces.js

@@ -19,6 +19,7 @@ export let LoginStep;
   LoginStep["passwordRotationExpired"] = "passwordRotationExpired";
   LoginStep["passwordRotationNotification"] = "passwordRotationNotification";
   LoginStep["magicLinkPostLoginSuccess"] = "magicLinkPostLoginSuccess";
+  LoginStep["chooseTenant"] = "chooseTenant";
 })(LoginStep || (LoginStep = {}));
 export let LoginFlow;
 (function (LoginFlow) {

package/auth/LoginState/state.js

@@ -5,6 +5,9 @@ export const initialState = {
   step: LoginStep.preLogin,
   loading: false,
   email: '',
-  tenants: []
+  tenants: [],
+  tenantChoiceResolved: false,
+  chooseTenantSwitching: false,
+  chooseTenantFinalizing: false
 };
 export default (overrideState => createProxy(initialState, overrideState));

package/auth/TenantsState/actions.js

@@ -13,6 +13,7 @@ export default ((store, api, sharedActions) => {
     const {
       tenantId,
       silentReload,
+      keepLoginState,
       callback
     } = payload;
     silentReload ? actions.setTenantsState({
@@ -24,7 +25,11 @@ export default ((store, api, sharedActions) => {
       await api.tenants.switchTenant({
         tenantId
       });
-      if (silentReload) {
+
+      // keepLoginState skips the auth-state reset (which would clobber the in-flight loginState —
+      // step, choose-tenant guards). __refreshToken below re-establishes user/isAuthenticated, so the
+      // reset is only needed to clear stale state for the standard tab-switch use case.
+      if (silentReload && !keepLoginState) {
         actions.resetAuthState({
           isLoading: false,
           isAuthenticated: true,

package/auth/TenantsState/interfaces.d.ts

@@ -10,4 +10,11 @@ export interface TenantsState {
     tenantTree: ISubTenantTree | null;
     activeTenant?: ITenantsResponseV2;
 }
-export type SwitchTenantOptions = WithCallback<ISwitchTenant>;
+export type SwitchTenantOptions = WithCallback<ISwitchTenant & {
+    /**
+     * Client-only (not sent to the API). With `silentReload`, skip the auth-state reset so the
+     * in-flight login/loginState (step, choose-tenant guards) is preserved. Used by the login-box
+     * choose-organization step, which switches tenant mid-login and must keep rendering its own step.
+     */
+    keepLoginState?: boolean;
+}>;

package/auth/index.d.ts

@@ -77,6 +77,7 @@ export * from './UsersEmailsPolicyState/interfaces';
 export * from './interfaces';
 export { FORGOT_PASSWORD_ERROR_KEYS };
 export * from './LoginState/oauthStorage';
+export * from './LoginState/helpers/tenantSelect';
 export declare const createAuthState: (_overrideState?: DeepPartial<AuthState>) => AuthState;
 export declare const buildAuthActions: (store: FronteggState, api: RestApi, actions: FronteggActions, snapshotAuthState: AuthState) => [AuthActions, AuthStateActions];
 export type AcceptInvitationActions = ReturnType<typeof buildAcceptInvitationActions>;

package/auth/index.js

@@ -81,6 +81,7 @@ export * from './UsersEmailsPolicyState/interfaces';
 export * from './interfaces';
 export { FORGOT_PASSWORD_ERROR_KEYS };
 export * from './LoginState/oauthStorage';
+export * from './LoginState/helpers/tenantSelect';
 export const createAuthState = _overrideState => {
   const _ref = _overrideState != null ? _overrideState : {},
     {

package/auth/interfaces.d.ts

@@ -69,6 +69,13 @@ export interface AuthState extends Routes, PluginOptions {
     socialLoginOptions?: {
         promptConsent?: boolean;
     };
+    /**
+     * Post-login "choose your organization" step. Set via `authOptions.tenantSelection`; read by the
+     * afterAuthNavigation choose-tenant gate. Also gated by the `login-box-choose-tenant` feature flag.
+     */
+    tenantSelection?: {
+        enabled?: boolean;
+    };
     user?: User | null;
     isSSOAuth: boolean;
     ssoACS?: string;

package/helpers/converters.js

@@ -44,6 +44,8 @@ export const publicKeyCredentialToJSON = pubKeyCred => {
       arr.push(publicKeyCredentialToJSON(i));
     }
     return arr;
+  } else if (typeof ArrayBuffer !== 'undefined' && ArrayBuffer.isView(pubKeyCred)) {
+    return base64urlEncode(pubKeyCred);
   } else if (pubKeyCred instanceof ArrayBuffer) {
     return base64urlEncode(pubKeyCred);
   } else if (pubKeyCred instanceof Object) {

package/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.118.0
+/** @license Frontegg v7.120.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/node/auth/LoginState/actions/afterAuthNavigation.actions.js

@@ -7,7 +7,9 @@ Object.defineProperty(exports, "__esModule", {
 exports.default = void 0;
 var _extends2 = _interopRequireDefault(require("@babel/runtime/helpers/extends"));
 var _helpers = require("../helpers");
+var _tenantSelect = require("../helpers/tenantSelect");
 var _constants = require("../../../constants");
+var _interfaces = require("../interfaces");
 var _consts = require("../../StepUpState/consts");
 var _helpers2 = require("../../../helpers");
 var _helpers3 = require("../../StepUpState/helpers");
@@ -153,17 +155,106 @@ var _default = (store, api, sharedActions) => {
     });
   };
 
+  /**
+   * Choose-tenant gate — the single chokepoint all auth methods (password/MFA/SSO/passwordless/
+   * passkey) and interstitials converge on. The trigger is the `authOptions.tenantSelection.enabled`
+   * SDK option, so it fires identically for embedded and hosted integrators (in hosted mode
+   * oauth-service is responsible for setting the option). When the option is on, the LD flag is on,
+   * and the user has >1 switchable tenant, route to the ChooseTenant step instead of finalizing.
+   * The ChooseTenant confirm handler sets `tenantChoiceResolved` and re-enters
+   * afterAuthNavigation, which then falls through here. Runs only post-auth; no tenant data is read
+   * until the resolved-guard, the LD flag, and the option all pass.
+   */
+  const shouldRouteToChooseTenant = async () => {
+    var _store$auth$tenantSel, _store$auth$user, _store$auth$user$act, _store$auth$tenantsSt;
+    const loginState = store.auth.loginState;
+    // Guard first so re-entry after the choice is resolved finalizes without re-reading the flag.
+    if (loginState.tenantChoiceResolved) {
+      return false;
+    }
+    // Cheap option guard before any flag/tenant work — never act when the integrator didn't opt in.
+    const enabledByOption = ((_store$auth$tenantSel = store.auth.tenantSelection) == null ? void 0 : _store$auth$tenantSel.enabled) === true;
+    if (!enabledByOption) {
+      return false;
+    }
+    const [ldEnabled] = await actions.getFeatureFlags(['login-box-choose-tenant']);
+    if (!ldEnabled) {
+      return false; // feature off — never read tenant data
+    }
+
+    const isImpersonation = !!((_store$auth$user = store.auth.user) != null && (_store$auth$user$act = _store$auth$user.act) != null && _store$auth$user$act.sub);
+    if (isImpersonation) {
+      return false;
+    }
+    // SSO/social postLogin authenticates without populating tenantsState — load it here so the
+    // chooser also opens on those paths (password/MFA already have tenants from the login response).
+    if (!((_store$auth$tenantsSt = store.auth.tenantsState.tenants) != null && _store$auth$tenantsSt.length)) {
+      var _store$auth$tenantsSt2;
+      let loadFailed = false;
+      await actions.loadTenants({
+        callback: (_tenants, error) => loadFailed = !!error
+      });
+      // Do NOT fail-open: if the tenant set could not be loaded while the feature is on, route to the
+      // chooser (which shows a load error + retry / continue-with-current) instead of finalizing on
+      // the default tenant and silently skipping the required org choice.
+      if (loadFailed && !((_store$auth$tenantsSt2 = store.auth.tenantsState.tenants) != null && _store$auth$tenantsSt2.length)) {
+        return true;
+      }
+    }
+    const {
+      tenants
+    } = store.auth.tenantsState;
+    return (0, _tenantSelect.shouldPromptChooseTenant)({
+      ldEnabled,
+      enabledByOption,
+      tenants,
+      isImpersonation,
+      tenantChoiceResolved: loginState.tenantChoiceResolved
+    });
+  };
+
   /**
    * After auth navigation for login flow
    * Handling also step up scenario when user silently logout to continue to step up
    */
+
   const afterAuthNavigation = async payload => {
     var _window4, _payload$preventRedir;
+    // Once the choose-tenant step starts a switch the chooser owns navigation. Every re-entry here
+    // (the switch's token refresh, and — critically — a late or timed-out switch completing AFTER the
+    // user hit the escape hatch) must be a no-op, so navigation can't run twice or jump into the wrong
+    // org. Two latches guard it: `chooseTenantSwitching` covers the in-login window, but it lives in
+    // loginState and is wiped by the finalize's resetLoginState — so a late switch would slip through.
+    // `tenantsState.switchingTenant` stays set for the WHOLE switchTenant call and survives that reset,
+    // so it suppresses the late re-entry too. The confirm handler performs the ONE finalize via the
+    // one-shot `chooseTenantFinalizing` flag, which passes through both latches and is consumed here.
+    // (An in-app tenant switch never reaches this function — its refresh only calls afterAuthNavigation
+    // from a login/callback URL, not from an authenticated app page — so this cannot over-suppress.)
+    const {
+      chooseTenantSwitching,
+      chooseTenantFinalizing
+    } = store.auth.loginState;
+    const {
+      switchingTenant
+    } = store.auth.tenantsState;
+    if ((chooseTenantSwitching || switchingTenant) && !chooseTenantFinalizing) {
+      return;
+    }
+    if (chooseTenantFinalizing) {
+      actions.setLoginState({
+        chooseTenantFinalizing: false
+      }); // consume: later re-entries stay suppressed
+    }
+
     const {
       customLoginAuthenticatedUrl,
       stepUpUrl
     } = store.auth.routes;
 
+    // Step-up on the CURRENT tenant resolves before the org chooser: a user who needs both
+    // authenticates + steps up first, then picks an org. switchTenant handles any MFA the chosen
+    // org requires on its own, and the isSteppedUp guard below means an already-stepped-up user is
+    // never re-prompted.
     // login with magic code, try to step up, no other mfa, invalid max age, force_enroll -> logout, login with first factor, not-stepped up jwt -> navigate to step up
     const shouldStepUp = (_window4 = window) == null ? void 0 : _window4.localStorage.getItem(_consts.SHOULD_STEP_UP_KEY);
     const user = store.auth.user;
@@ -176,6 +267,20 @@ var _default = (store, api, sharedActions) => {
         forceStepUpUrl: stepUpUrl
       });
     }
+    if (await shouldRouteToChooseTenant()) {
+      actions.setLoginState({
+        step: _interfaces.LoginStep.chooseTenant,
+        loading: false
+      });
+      // Mirror the other post-auth interstitials (e.g. promptPasskeys): navigate to the login URL
+      // so the ChooseTenant step actually renders even when afterAuthNavigation is invoked from an
+      // OAuth/social callback route.
+      store.auth.onRedirectTo(store.auth.routes.loginUrl, {
+        preserveQueryParams: true
+      });
+      return; // do NOT finalize; ChooseTenant confirm re-enters afterAuthNavigation
+    }
+
     let customLoginURL = customLoginAuthenticatedUrl;
     if (!customLoginAuthenticatedUrl) {
       var _store$auth$routes;

package/node/auth/LoginState/actions/index.js

@@ -417,9 +417,21 @@ var _default = (store, api, sharedActions) => {
       }));
       const {
         address,
-        idpType
+        idpType,
+        addressType
       } = preLoginResult != null ? preLoginResult : {};
       if (address) {
+        if (addressType === _restApi.PreLoginAddressType.External) {
+          // Domain-based routing: navigate to the vendor legacy login URL immediately,
+          // skipping the SSO interstitial and the SSO/OIDC-specific handling.
+          setLoginState({
+            loading: false
+          });
+          onRedirectTo(address, {
+            refresh: true
+          });
+          return;
+        }
         let ssoRedirectUrl = address;
         if (idpType === _interfaces4.SamlVendors.Oidc && !ssoRedirectUrl.includes('redirect_uri')) {
           const {
@@ -574,7 +586,10 @@ var _default = (store, api, sharedActions) => {
               step: loginState.flow === _interfaces.LoginFlow.Login ? _interfaces.LoginStep.success : loginState.step,
               tenants,
               tenantsLoading: true,
-              isBreachedPassword: user.isBreachedPassword
+              isBreachedPassword: user.isBreachedPassword,
+              // Preserve the choose-tenant guard across this post-login state rebuild so a
+              // resolved choice is not re-prompted (choose-organization).
+              tenantChoiceResolved: loginState.tenantChoiceResolved
             },
             isAuthenticated
           });

package/node/auth/LoginState/helpers/tenantSelect.js

@@ -0,0 +1,61 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.getSwitchableTenants = getSwitchableTenants;
+exports.shouldPromptChooseTenant = shouldPromptChooseTenant;
+/**
+ * A switchable tenant membership carries fields returned by GET /me/tenants that are not
+ * part of the base ITenantsResponseV2 shape (pending invite / disabled / temporary access).
+ */
+
+/**
+ * The set of tenants the user can actually switch into — the same set `switchActiveTenant`
+ * accepts server-side, so the chooser never lists a tenant that would be rejected at confirm time.
+ * Excludes: pending invites (invitationToken), locked/disabled tenants, and expired temporary access.
+ */
+function getSwitchableTenants(tenants) {
+  if (!tenants) {
+    return [];
+  }
+  const now = Date.now();
+  return tenants.filter(tenant => {
+    const t = tenant;
+    if (t.invitationToken) {
+      return false; // invited, not yet a member
+    }
+
+    if (t.isDisabled) {
+      return false; // locked/disabled tenant
+    }
+
+    if (t.temporaryExpirationDate && new Date(t.temporaryExpirationDate).getTime() < now) {
+      return false; // temporary access expired
+    }
+
+    return true;
+  });
+}
+
+/**
+ * The single gate for the post-auth "choose organization" dialog. The trigger is the
+ * `authOptions.tenantSelection.enabled` SDK option (`enabledByOption`) — the same signal for embedded
+ * and hosted (in hosted mode oauth-service is responsible for setting the option). The `>1` gate is
+ * over the SWITCHABLE set; undefined/empty tenants collapse to 0 and fall through (fail-safe).
+ */
+function shouldPromptChooseTenant(args) {
+  if (!args.ldEnabled) {
+    return false;
+  }
+  if (args.tenantChoiceResolved) {
+    return false;
+  }
+  if (args.isImpersonation) {
+    return false;
+  }
+  if (!args.enabledByOption) {
+    return false;
+  }
+  return getSwitchableTenants(args.tenants).length > 1;
+}

package/node/auth/LoginState/interfaces.js

@@ -32,6 +32,7 @@ exports.LoginStep = LoginStep;
   LoginStep["passwordRotationExpired"] = "passwordRotationExpired";
   LoginStep["passwordRotationNotification"] = "passwordRotationNotification";
   LoginStep["magicLinkPostLoginSuccess"] = "magicLinkPostLoginSuccess";
+  LoginStep["chooseTenant"] = "chooseTenant";
 })(LoginStep || (exports.LoginStep = LoginStep = {}));
 let LoginFlow;
 exports.LoginFlow = LoginFlow;

package/node/auth/LoginState/state.js

@@ -11,7 +11,10 @@ const initialState = {
   step: _interfaces.LoginStep.preLogin,
   loading: false,
   email: '',
-  tenants: []
+  tenants: [],
+  tenantChoiceResolved: false,
+  chooseTenantSwitching: false,
+  chooseTenantFinalizing: false
 };
 exports.initialState = initialState;
 var _default = overrideState => (0, _proxy.createProxy)(initialState, overrideState);

package/node/auth/TenantsState/actions.js

@@ -19,6 +19,7 @@ var _default = (store, api, sharedActions) => {
     const {
       tenantId,
       silentReload,
+      keepLoginState,
       callback
     } = payload;
     silentReload ? actions.setTenantsState({
@@ -30,7 +31,11 @@ var _default = (store, api, sharedActions) => {
       await api.tenants.switchTenant({
         tenantId
       });
-      if (silentReload) {
+
+      // keepLoginState skips the auth-state reset (which would clobber the in-flight loginState —
+      // step, choose-tenant guards). __refreshToken below re-establishes user/isAuthenticated, so the
+      // reset is only needed to clear stale state for the standard tab-switch use case.
+      if (silentReload && !keepLoginState) {
         actions.resetAuthState({
           isLoading: false,
           isAuthenticated: true,

package/node/auth/index.js

@@ -525,6 +525,18 @@ Object.keys(_oauthStorage).forEach(function (key) {
     }
   });
 });
+var _tenantSelect = require("./LoginState/helpers/tenantSelect");
+Object.keys(_tenantSelect).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
+  if (key in exports && exports[key] === _tenantSelect[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _tenantSelect[key];
+    }
+  });
+});
 const _excluded = ["routes"],
   _excluded2 = ["requestName"];
 const createAuthState = _overrideState => {

package/node/helpers/converters.js

@@ -51,6 +51,8 @@ const publicKeyCredentialToJSON = pubKeyCred => {
       arr.push(publicKeyCredentialToJSON(i));
     }
     return arr;
+  } else if (typeof ArrayBuffer !== 'undefined' && ArrayBuffer.isView(pubKeyCred)) {
+    return (0, _encoders.base64urlEncode)(pubKeyCred);
   } else if (pubKeyCred instanceof ArrayBuffer) {
     return (0, _encoders.base64urlEncode)(pubKeyCred);
   } else if (pubKeyCred instanceof Object) {

package/node/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.118.0
+/** @license Frontegg v7.120.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@frontegg/redux-store",
-  "version": "7.118.0",
+  "version": "7.120.0",
   "main": "./node/index.js",
   "license": "MIT",
   "author": "Frontegg LTD",
   "dependencies": {
     "@babel/runtime": "^7.18.6",
     "@frontegg/entitlements-javascript-commons": "1.1.2",
-    "@frontegg/rest-api": "7.118.0",
+    "@frontegg/rest-api": "7.120.0",
     "fast-deep-equal": "3.1.3",
     "get-value": "^3.0.1",
     "proxy-compare": "^3.0.0",