@frontegg/redux-store 7.121.0 → 7.123.0-alpha.0

package/auth/LoginState/actions/mfaRequiredState.actions.js

@@ -35,6 +35,7 @@ export default ((store, api, _sharedActions) => {
       Object.assign(mfaState, {
         step: getMfaStepForNotEnrolledUsers(user.mfaStrategies),
         qrCode: user.qrCode,
+        secret: user.secret,
         recoveryCode: user.recoveryCode,
         loading: false,
         mfaToken: user.mfaToken,

package/auth/LoginState/actions/mfaWithAuthenticator.actions.js

@@ -4,6 +4,7 @@ const _excluded = ["callback"];
 import { LoginFlow, LoginStep } from '../interfaces';
 import { errorHandler, GTMEventAction, reportGTMEvent } from '../../../helpers';
 import { isResetPasswordRequired, shouldShowPasswordRotationPromptFunc } from '../../helpers';
+import { persistPreferredMfaMethod } from '../helpers/persistPreferredMfaMethod';
 export default ((store, api, sharedActions) => {
   const actions = sharedActions;
 
@@ -113,6 +114,7 @@ export default ((store, api, sharedActions) => {
         tenants = [],
         activeTenant
       } = await api.auth.loginWithMfaV2(loginWithMfaPayload);
+      persistPreferredMfaMethod(store, 'authenticatorApp');
       const isAuthenticated = !!user.accessToken;
       const additionalUpdate = await __buildPostAuthStateUpdate(tenants, isAuthenticated, isStepUp);
       await actions.afterAuthenticationStateUpdate({

package/auth/LoginState/actions/mfaWithEmailCode.actions.js

@@ -3,6 +3,7 @@ const _excluded = ["callback"],
   _excluded2 = ["callback"];
 import { MFAStep } from '../../MfaState/interfaces';
 import { errorHandler } from '../../../helpers';
+import { persistPreferredMfaMethod } from '../helpers/persistPreferredMfaMethod';
 export default ((store, api, sharedActions) => {
   const actions = sharedActions;
   /**
@@ -59,6 +60,7 @@ export default ((store, api, sharedActions) => {
     });
     try {
       const data = await api.auth.verifyMFAEmailCodeV2(payload);
+      persistPreferredMfaMethod(store, 'email');
       await actions.handleVerifyMFAResponse(data);
       setLoadingAction({
         loading: false,

package/auth/LoginState/actions/mfaWithSMS.actions.js

@@ -3,6 +3,7 @@ const _excluded = ["callback", "deviceId"],
   _excluded2 = ["callback", "deviceId"];
 import { MFAStep } from '../../MfaState/interfaces';
 import { errorHandler } from '../../../helpers';
+import { persistPreferredMfaMethod } from '../helpers/persistPreferredMfaMethod';
 export default ((store, api, sharedActions) => {
   const actions = sharedActions;
 
@@ -64,6 +65,7 @@ export default ((store, api, sharedActions) => {
     });
     try {
       const data = await api.auth.verifyMFASMSForLoginV2(deviceId, payload);
+      persistPreferredMfaMethod(store, 'sms');
       await actions.handleVerifyMFAResponse(data, isStepUp);
       setLoadingAction({
         loading: false,

package/auth/LoginState/actions/mfaWithWebAuthn.actions.js

@@ -3,6 +3,8 @@ import _objectWithoutPropertiesLoose from "@babel/runtime/helpers/esm/objectWith
 const _excluded = ["callback", "deviceId"],
   _excluded2 = ["callback", "deviceId"];
 import { base64urlDecode, errorHandler, publicKeyCredentialToJSON } from '../../../helpers';
+import { findWebAuthnDeviceTypeById, getPreferredMfaMethodFromWebAuthnDeviceType } from '../preferredMfaMethod';
+import { persistPreferredMfaMethod } from '../helpers/persistPreferredMfaMethod';
 export default ((store, api, sharedActions) => {
   const actions = sharedActions;
 
@@ -73,6 +75,11 @@ export default ((store, api, sharedActions) => {
       const data = await api.auth.verifyMFAWebAuthnForLoginV2(deviceId, _extends({}, payload, {
         options: publicKey
       }));
+      const mfaDevices = isStepUp ? store.auth.stepUpState.mfaDevices : store.auth.mfaState.mfaDevices;
+      const deviceType = findWebAuthnDeviceTypeById(mfaDevices, deviceId);
+      if (deviceType) {
+        persistPreferredMfaMethod(store, getPreferredMfaMethodFromWebAuthnDeviceType(deviceType));
+      }
       await actions.handleVerifyMFAResponse(data, isStepUp);
       setLoadingAction({
         loading: false,

package/auth/LoginState/helpers/persistPreferredMfaMethod.d.ts

@@ -0,0 +1,12 @@
+import { FronteggState } from '../../../interfaces';
+import { PreferredMfaMethod } from '../preferredMfaMethod';
+/**
+ * Resolve a stable application key for preferred-MFA session storage.
+ * Prefers appId (multi-app), then clientId, then appName.
+ */
+export declare const getPreferredMfaAppKey: (store: FronteggState) => string;
+/**
+ * Persist preferred MFA method after a successful challenge.
+ * Always writes; themeOptions.rememberLastMfaFactor only gates whether it is applied.
+ */
+export declare const persistPreferredMfaMethod: (store: FronteggState, method: PreferredMfaMethod) => void;

package/auth/LoginState/helpers/persistPreferredMfaMethod.js

@@ -0,0 +1,20 @@
+import { ContextHolder } from '@frontegg/rest-api';
+import { setPreferredMfaMethod } from '../preferredMfaMethod';
+
+/**
+ * Resolve a stable application key for preferred-MFA session storage.
+ * Prefers appId (multi-app), then clientId, then appName.
+ */
+export const getPreferredMfaAppKey = store => {
+  const appName = store.root.appName;
+  const context = ContextHolder.for(appName).getContext();
+  return context.appId || context.clientId || appName || 'default';
+};
+
+/**
+ * Persist preferred MFA method after a successful challenge.
+ * Always writes; themeOptions.rememberLastMfaFactor only gates whether it is applied.
+ */
+export const persistPreferredMfaMethod = (store, method) => {
+  setPreferredMfaMethod(getPreferredMfaAppKey(store), method);
+};

package/auth/LoginState/helpers.js

@@ -1,4 +1,4 @@
-import { ContextHolder, MFAStrategyEnum } from '@frontegg/rest-api';
+import { ContextHolder, MFAStrategyEnum, WebAuthnDeviceType } from '@frontegg/rest-api';
 import { MFAStep } from '../MfaState/interfaces';
 export const isAbsoluteUrl = path => {
   try {
@@ -76,7 +76,8 @@ export const getSearchParam = key => {
 };
 export const TENANT_ID_PARAM_KEY = 'tenantId';
 export const getNumberOfMfaDevices = mfaDevices => {
-  const numberOfWebAuthnDevices = +Boolean(mfaDevices.webauthn.length);
+  // Count platform / cross-platform separately — matches the MFA picker options.
+  const numberOfWebAuthnDevices = Number(mfaDevices.webauthn.some(device => device.deviceType === WebAuthnDeviceType.Platform)) + Number(mfaDevices.webauthn.some(device => device.deviceType === WebAuthnDeviceType.CrossPlatform));
   const numberOfPhoneDevices = +Boolean(mfaDevices.phones.length);
   const numberOfAuthenticators = +Boolean(mfaDevices.authenticators.length);
   const numberOfEmails = +Boolean(mfaDevices.emails.length);

package/auth/LoginState/preferredMfaMethod.d.ts

@@ -0,0 +1,53 @@
+import { UserMFADevicesResponse, WebAuthnDeviceType } from '@frontegg/rest-api';
+import { MFAStep } from '../MfaState/interfaces';
+export type PreferredMfaMethod = 'sms' | 'email' | 'authenticatorApp' | 'webauthnPlatform' | 'webauthnCrossPlatform';
+export type PreferredMfaResolution = {
+    type: 'step';
+    step: MFAStep;
+} | {
+    type: 'webauthn';
+    deviceType: WebAuthnDeviceType;
+} | {
+    type: 'none';
+};
+export declare const getPreferredMfaStorageKey: (appKey: string) => string;
+export declare const isPreferredMfaMethod: (value: unknown) => value is PreferredMfaMethod;
+/**
+ * Persist the last successful MFA method for this browser session, keyed by application.
+ */
+export declare const setPreferredMfaMethod: (appKey: string, method: PreferredMfaMethod) => void;
+/**
+ * Read the remembered MFA method for this browser session, if any.
+ */
+export declare const getPreferredMfaMethod: (appKey: string) => PreferredMfaMethod | null;
+export declare const clearPreferredMfaMethod: (appKey: string) => void;
+/**
+ * Map a stored preferred MFA method to a concrete MFA step / WebAuthn action,
+ * only when that method is still enrolled and available.
+ */
+export declare const resolvePreferredMfa: (preferred: PreferredMfaMethod | null | undefined, mfaDevices?: UserMFADevicesResponse) => PreferredMfaResolution;
+export declare const getPreferredMfaMethodFromWebAuthnDeviceType: (deviceType: WebAuthnDeviceType) => PreferredMfaMethod;
+export declare const findWebAuthnDeviceTypeById: (mfaDevices: UserMFADevicesResponse | undefined, deviceId: string) => WebAuthnDeviceType | undefined;
+export type PreferredMfaApplyAction = {
+    action: 'setStep';
+    step: MFAStep;
+} | {
+    action: 'webauthn';
+    deviceId: string;
+} | {
+    action: 'none';
+};
+export interface ApplyPreferredMfaFactorInput {
+    rememberLastMfaFactor: boolean;
+    alreadyApplied: boolean;
+    step: MFAStep;
+    preferred: PreferredMfaMethod | null;
+    mfaDevices: UserMFADevicesResponse | undefined;
+    mfaWebAuthnPlatformDeviceId?: string;
+    mfaWebAuthnCrossPlatformDeviceId?: string;
+}
+/**
+ * Pure decision for whether / how to apply a stored preferred MFA factor.
+ * Used by the login-box MFAFlow when themeOptions.rememberLastMfaFactor is on.
+ */
+export declare const getPreferredMfaApplyAction: ({ rememberLastMfaFactor, alreadyApplied, step, preferred, mfaDevices, mfaWebAuthnPlatformDeviceId, mfaWebAuthnCrossPlatformDeviceId, }: ApplyPreferredMfaFactorInput) => PreferredMfaApplyAction;

package/auth/LoginState/preferredMfaMethod.js

@@ -0,0 +1,151 @@
+import { WebAuthnDeviceType } from '@frontegg/rest-api';
+import { MFAStep } from '../MfaState/interfaces';
+const STORAGE_KEY_PREFIX = 'frontegg-preferred-mfa-method';
+const PREFERRED_MFA_METHODS = new Set(['sms', 'email', 'authenticatorApp', 'webauthnPlatform', 'webauthnCrossPlatform']);
+export const getPreferredMfaStorageKey = appKey => `${STORAGE_KEY_PREFIX}:${appKey}`;
+export const isPreferredMfaMethod = value => typeof value === 'string' && PREFERRED_MFA_METHODS.has(value);
+
+/**
+ * Persist the last successful MFA method for this browser session, keyed by application.
+ */
+export const setPreferredMfaMethod = (appKey, method) => {
+  if (typeof window === 'undefined') {
+    return;
+  }
+  try {
+    window.sessionStorage.setItem(getPreferredMfaStorageKey(appKey), method);
+  } catch {
+    // sessionStorage may be unavailable (private mode / quota) — ignore
+  }
+};
+
+/**
+ * Read the remembered MFA method for this browser session, if any.
+ */
+export const getPreferredMfaMethod = appKey => {
+  if (typeof window === 'undefined') {
+    return null;
+  }
+  try {
+    const value = window.sessionStorage.getItem(getPreferredMfaStorageKey(appKey));
+    return isPreferredMfaMethod(value) ? value : null;
+  } catch {
+    return null;
+  }
+};
+export const clearPreferredMfaMethod = appKey => {
+  if (typeof window === 'undefined') {
+    return;
+  }
+  try {
+    window.sessionStorage.removeItem(getPreferredMfaStorageKey(appKey));
+  } catch {
+    // ignore
+  }
+};
+const hasPhoneDevices = mfaDevices => mfaDevices.phones.length > 0;
+const hasEmails = mfaDevices => mfaDevices.emails.length > 0;
+const hasAuthenticators = mfaDevices => mfaDevices.authenticators.length > 0;
+const hasWebAuthnDevice = (mfaDevices, deviceType) => mfaDevices.webauthn.some(device => device.deviceType === deviceType);
+
+/**
+ * Map a stored preferred MFA method to a concrete MFA step / WebAuthn action,
+ * only when that method is still enrolled and available.
+ */
+export const resolvePreferredMfa = (preferred, mfaDevices) => {
+  if (!preferred || !mfaDevices) {
+    return {
+      type: 'none'
+    };
+  }
+  switch (preferred) {
+    case 'sms':
+      return hasPhoneDevices(mfaDevices) ? {
+        type: 'step',
+        step: MFAStep.smsVerifyCode
+      } : {
+        type: 'none'
+      };
+    case 'email':
+      return hasEmails(mfaDevices) ? {
+        type: 'step',
+        step: MFAStep.emailVerifyCode
+      } : {
+        type: 'none'
+      };
+    case 'authenticatorApp':
+      return hasAuthenticators(mfaDevices) ? {
+        type: 'step',
+        step: MFAStep.authenticatorApp
+      } : {
+        type: 'none'
+      };
+    case 'webauthnPlatform':
+      return hasWebAuthnDevice(mfaDevices, WebAuthnDeviceType.Platform) ? {
+        type: 'webauthn',
+        deviceType: WebAuthnDeviceType.Platform
+      } : {
+        type: 'none'
+      };
+    case 'webauthnCrossPlatform':
+      return hasWebAuthnDevice(mfaDevices, WebAuthnDeviceType.CrossPlatform) ? {
+        type: 'webauthn',
+        deviceType: WebAuthnDeviceType.CrossPlatform
+      } : {
+        type: 'none'
+      };
+    default:
+      {
+        const _exhaustive = preferred;
+        return _exhaustive;
+      }
+  }
+};
+export const getPreferredMfaMethodFromWebAuthnDeviceType = deviceType => {
+  return deviceType === WebAuthnDeviceType.Platform ? 'webauthnPlatform' : 'webauthnCrossPlatform';
+};
+export const findWebAuthnDeviceTypeById = (mfaDevices, deviceId) => {
+  var _mfaDevices$webauthn$;
+  return mfaDevices == null ? void 0 : (_mfaDevices$webauthn$ = mfaDevices.webauthn.find(device => device.id === deviceId)) == null ? void 0 : _mfaDevices$webauthn$.deviceType;
+};
+/**
+ * Pure decision for whether / how to apply a stored preferred MFA factor.
+ * Used by the login-box MFAFlow when themeOptions.rememberLastMfaFactor is on.
+ */
+export const getPreferredMfaApplyAction = ({
+  rememberLastMfaFactor,
+  alreadyApplied,
+  step,
+  preferred,
+  mfaDevices,
+  mfaWebAuthnPlatformDeviceId,
+  mfaWebAuthnCrossPlatformDeviceId
+}) => {
+  if (!rememberLastMfaFactor || alreadyApplied || step !== MFAStep.verify) {
+    return {
+      action: 'none'
+    };
+  }
+  const resolution = resolvePreferredMfa(preferred, mfaDevices);
+  if (resolution.type === 'none') {
+    return {
+      action: 'none'
+    };
+  }
+  if (resolution.type === 'step') {
+    return {
+      action: 'setStep',
+      step: resolution.step
+    };
+  }
+  const deviceId = resolution.deviceType === WebAuthnDeviceType.Platform ? mfaWebAuthnPlatformDeviceId : mfaWebAuthnCrossPlatformDeviceId;
+  if (!deviceId) {
+    return {
+      action: 'none'
+    };
+  }
+  return {
+    action: 'webauthn',
+    deviceId
+  };
+};

package/auth/MfaState/actions.js

@@ -81,12 +81,14 @@ export default ((store, api, sharedActions) => {
     });
     try {
       const {
-        qrCode
+        qrCode,
+        secret
       } = await api.auth.enrollMfa();
       setMfaState({
         saving: false,
         error: undefined,
-        qrCode
+        qrCode,
+        secret
       });
     } catch (e) {
       setMfaState({

package/auth/MfaState/interfaces.d.ts

@@ -17,6 +17,8 @@ export interface MFAState {
     error?: any;
     recoveryCode?: string;
     qrCode?: string | null;
+    /** TOTP setup key for manual authenticator enrollment (same secret as in qrCode). */
+    secret?: string | null;
     mfaToken?: string;
     otcToken?: string;
     phoneNumber?: string;

package/auth/TeamState/actions/index.d.ts

@@ -23,6 +23,7 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
     loadUsersByGetUsersPhoneNumberV2: (payload: WithCallback<import("../../../interfaces").WithRetryConfig<import("../../../interfaces").WithSilentLoad<import("../interfaces").ILoadUsersByGetPhoneNumberV2Payload>>, import("@frontegg/rest-api").ITeamUser[]>) => Promise<void>;
     loadUsersByGetUsernamesV1: (payload: WithCallback<import("../../../interfaces").WithRetryConfig<import("../../../interfaces").WithSilentLoad<import("../interfaces").ILoadUsersByGetUsernamesV1Payload>>, import("@frontegg/rest-api").ITeamUser[]>) => Promise<void>;
     loadUsersByGetEmailsV1: (payload: WithCallback<import("../../../interfaces").WithRetryConfig<import("../../../interfaces").WithSilentLoad<import("../interfaces").ILoadUsersByGetEmailsV1Payload>>, import("@frontegg/rest-api").ITeamUser[]>) => Promise<void>;
+    loadUsersByRolesV1: (payload: WithCallback<import("../../../interfaces").WithRetryConfig<import("../../../interfaces").WithSilentLoad<import("../interfaces").ILoadUsersByRolesV1Payload>>, import("@frontegg/rest-api").ITeamUser[]>) => Promise<void>;
     addUser: (payload: WithCallback<import("../interfaces").AddUserPayload, import("@frontegg/rest-api").ITeamUser>) => Promise<void>;
     addUsersBulk: (payload: WithCallback<import("../interfaces").IAddUsers, import("../interfaces").BulkInvintationData>) => Promise<void>;
     updateUser: (payload: WithCallback<import("@frontegg/rest-api").IUpdateUser, import("@frontegg/rest-api").ITeamUser>) => Promise<void>;

package/auth/TeamState/actions/users.actions.d.ts

@@ -1,6 +1,6 @@
 import { IDeleteUser, ILoadUsers, ITeamUser, IUpdateUser, IUpdateUserExpiration } from '@frontegg/rest-api';
 import { FronteggState, RestApi, SharedActions, WithCallback, WithRetryConfig, WithSilentLoad } from '../../../interfaces';
-import { AddUserPayload, BulkInvintationData, IAddUsers, IGetUsersV2Payload, IGetUsersV3Payload, ILoadUsersByGetPhoneNumberV2Payload, ILoadUsersByGetUsernamesV1Payload, ILoadUsersByGetEmailsV1Payload, LoadRolesAndPermissionsPayload } from '../interfaces';
+import { AddUserPayload, BulkInvintationData, IAddUsers, IGetUsersV2Payload, IGetUsersV3Payload, ILoadUsersByGetPhoneNumberV2Payload, ILoadUsersByGetUsernamesV1Payload, ILoadUsersByGetEmailsV1Payload, ILoadUsersByRolesV1Payload, LoadRolesAndPermissionsPayload } from '../interfaces';
 declare const _default: (store: FronteggState, api: RestApi, sharedActions: SharedActions) => {
     loadRoles: (payload?: WithRetryConfig<LoadRolesAndPermissionsPayload>) => Promise<void>;
     loadUsers: (payload: WithCallback<WithSilentLoad<ILoadUsers>, ITeamUser[]>) => Promise<void>;
@@ -9,6 +9,7 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
     loadUsersByGetUsersPhoneNumberV2: (payload: WithCallback<WithRetryConfig<WithSilentLoad<ILoadUsersByGetPhoneNumberV2Payload>>, ITeamUser[]>) => Promise<void>;
     loadUsersByGetUsernamesV1: (payload: WithCallback<WithRetryConfig<WithSilentLoad<ILoadUsersByGetUsernamesV1Payload>>, ITeamUser[]>) => Promise<void>;
     loadUsersByGetEmailsV1: (payload: WithCallback<WithRetryConfig<WithSilentLoad<ILoadUsersByGetEmailsV1Payload>>, ITeamUser[]>) => Promise<void>;
+    loadUsersByRolesV1: (payload: WithCallback<WithRetryConfig<WithSilentLoad<ILoadUsersByRolesV1Payload>>, ITeamUser[]>) => Promise<void>;
     addUser: (payload: WithCallback<AddUserPayload, ITeamUser>) => Promise<void>;
     addUsersBulk: (payload: WithCallback<IAddUsers, BulkInvintationData>) => Promise<void>;
     updateUser: (payload: WithCallback<IUpdateUser, ITeamUser>) => Promise<void>;

package/auth/TeamState/actions/users.actions.js

@@ -900,6 +900,28 @@ export default ((store, api, sharedActions) => {
       _limit: pageSize
     }), shouldLoadRoles, shouldLoadApps);
   };
+  const loadUsersByRolesV1 = async payload => {
+    const {
+      _roleIds,
+      shouldLoadRoles = true,
+      shouldLoadApps
+    } = payload;
+    if (!(_roleIds != null && _roleIds.length)) {
+      var _payload$callback3;
+      sharedActions.setTeamState({
+        users: [],
+        totalPages: 0,
+        totalItems: 0
+      });
+      (_payload$callback3 = payload.callback) == null ? void 0 : _payload$callback3.call(payload, []);
+      return;
+    }
+    return __loadUsersBySearchCriteria(payload, (pageOffset, pageSize) => api.usersRoles.getUsersByRolesV1({
+      _roleIds,
+      _offset: pageOffset,
+      _limit: pageSize
+    }), shouldLoadRoles, shouldLoadApps);
+  };
   return {
     loadRoles,
     loadUsers,
@@ -908,6 +930,7 @@ export default ((store, api, sharedActions) => {
     loadUsersByGetUsersPhoneNumberV2,
     loadUsersByGetUsernamesV1,
     loadUsersByGetEmailsV1,
+    loadUsersByRolesV1,
     addUser,
     addUsersBulk,
     updateUser,

package/auth/TeamState/interfaces.d.ts

@@ -148,6 +148,9 @@ export interface ILoadUsersByGetUsernamesV1Payload extends IBaseUserSearchPayloa
 export interface ILoadUsersByGetEmailsV1Payload extends IBaseUserSearchPayload {
     _email: string;
 }
+export interface ILoadUsersByRolesV1Payload extends IBaseUserSearchPayload {
+    _roleIds: string[];
+}
 export interface ISearchUsersByAnyFieldPayload extends Partial<IGetUsersV3Payload> {
     callback?: (users: ITeamUser[] | null, error?: any) => void;
 }

package/auth/index.d.ts

@@ -77,6 +77,7 @@ export * from './UsersEmailsPolicyState/interfaces';
 export * from './interfaces';
 export { FORGOT_PASSWORD_ERROR_KEYS };
 export * from './LoginState/oauthStorage';
+export * from './LoginState/preferredMfaMethod';
 export * from './LoginState/helpers/tenantSelect';
 export declare const createAuthState: (_overrideState?: DeepPartial<AuthState>) => AuthState;
 export declare const buildAuthActions: (store: FronteggState, api: RestApi, actions: FronteggActions, snapshotAuthState: AuthState) => [AuthActions, AuthStateActions];

package/auth/index.js

@@ -81,6 +81,7 @@ export * from './UsersEmailsPolicyState/interfaces';
 export * from './interfaces';
 export { FORGOT_PASSWORD_ERROR_KEYS };
 export * from './LoginState/oauthStorage';
+export * from './LoginState/preferredMfaMethod';
 export * from './LoginState/helpers/tenantSelect';
 export const createAuthState = _overrideState => {
   const _ref = _overrideState != null ? _overrideState : {},

package/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.121.0
+/** @license Frontegg v7.123.0-alpha.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/mocks/auth-mocks/teamActions.mocks.d.ts

@@ -23,6 +23,7 @@ declare const _default: (store: FronteggState, api: RestApi, actions: SharedActi
     loadUsersByGetUsersPhoneNumberV2: (payload: WithCallback<import("../../interfaces").WithRetryConfig<WithSilentLoad<import("../../auth").ILoadUsersByGetPhoneNumberV2Payload>>, ITeamUser[]>) => Promise<void>;
     loadUsersByGetUsernamesV1: (payload: WithCallback<import("../../interfaces").WithRetryConfig<WithSilentLoad<import("../../auth").ILoadUsersByGetUsernamesV1Payload>>, ITeamUser[]>) => Promise<void>;
     loadUsersByGetEmailsV1: (payload: WithCallback<import("../../interfaces").WithRetryConfig<WithSilentLoad<import("../../auth").ILoadUsersByGetEmailsV1Payload>>, ITeamUser[]>) => Promise<void>;
+    loadUsersByRolesV1: (payload: WithCallback<import("../../interfaces").WithRetryConfig<WithSilentLoad<import("../../auth").ILoadUsersByRolesV1Payload>>, ITeamUser[]>) => Promise<void>;
     addUser: (payload: WithCallback<import("../../auth").AddUserPayload, ITeamUser>) => Promise<void>;
     addUsersBulk: (payload: WithCallback<import("../../auth").IAddUsers, import("../../auth").BulkInvintationData>) => Promise<void>;
     updateUser: (payload: WithCallback<IUpdateUser, ITeamUser>) => Promise<void>;

package/node/auth/LoginState/actions/mfaRequiredState.actions.js

@@ -42,6 +42,7 @@ var _default = (store, api, _sharedActions) => {
       Object.assign(mfaState, {
         step: (0, _helpers.getMfaStepForNotEnrolledUsers)(user.mfaStrategies),
         qrCode: user.qrCode,
+        secret: user.secret,
         recoveryCode: user.recoveryCode,
         loading: false,
         mfaToken: user.mfaToken,

package/node/auth/LoginState/actions/mfaWithAuthenticator.actions.js

@@ -10,6 +10,7 @@ var _extends2 = _interopRequireDefault(require("@babel/runtime/helpers/extends")
 var _interfaces = require("../interfaces");
 var _helpers = require("../../../helpers");
 var _helpers2 = require("../../helpers");
+var _persistPreferredMfaMethod = require("../helpers/persistPreferredMfaMethod");
 const _excluded = ["callback"];
 var _default = (store, api, sharedActions) => {
   const actions = sharedActions;
@@ -120,6 +121,7 @@ var _default = (store, api, sharedActions) => {
         tenants = [],
         activeTenant
       } = await api.auth.loginWithMfaV2(loginWithMfaPayload);
+      (0, _persistPreferredMfaMethod.persistPreferredMfaMethod)(store, 'authenticatorApp');
       const isAuthenticated = !!user.accessToken;
       const additionalUpdate = await __buildPostAuthStateUpdate(tenants, isAuthenticated, isStepUp);
       await actions.afterAuthenticationStateUpdate({

package/node/auth/LoginState/actions/mfaWithEmailCode.actions.js

@@ -8,6 +8,7 @@ exports.default = void 0;
 var _objectWithoutPropertiesLoose2 = _interopRequireDefault(require("@babel/runtime/helpers/objectWithoutPropertiesLoose"));
 var _interfaces = require("../../MfaState/interfaces");
 var _helpers = require("../../../helpers");
+var _persistPreferredMfaMethod = require("../helpers/persistPreferredMfaMethod");
 const _excluded = ["callback"],
   _excluded2 = ["callback"];
 var _default = (store, api, sharedActions) => {
@@ -66,6 +67,7 @@ var _default = (store, api, sharedActions) => {
     });
     try {
       const data = await api.auth.verifyMFAEmailCodeV2(payload);
+      (0, _persistPreferredMfaMethod.persistPreferredMfaMethod)(store, 'email');
       await actions.handleVerifyMFAResponse(data);
       setLoadingAction({
         loading: false,

package/node/auth/LoginState/actions/mfaWithSMS.actions.js

@@ -8,6 +8,7 @@ exports.default = void 0;
 var _objectWithoutPropertiesLoose2 = _interopRequireDefault(require("@babel/runtime/helpers/objectWithoutPropertiesLoose"));
 var _interfaces = require("../../MfaState/interfaces");
 var _helpers = require("../../../helpers");
+var _persistPreferredMfaMethod = require("../helpers/persistPreferredMfaMethod");
 const _excluded = ["callback", "deviceId"],
   _excluded2 = ["callback", "deviceId"];
 var _default = (store, api, sharedActions) => {
@@ -71,6 +72,7 @@ var _default = (store, api, sharedActions) => {
     });
     try {
       const data = await api.auth.verifyMFASMSForLoginV2(deviceId, payload);
+      (0, _persistPreferredMfaMethod.persistPreferredMfaMethod)(store, 'sms');
       await actions.handleVerifyMFAResponse(data, isStepUp);
       setLoadingAction({
         loading: false,

package/node/auth/LoginState/actions/mfaWithWebAuthn.actions.js

@@ -8,6 +8,8 @@ exports.default = void 0;
 var _extends2 = _interopRequireDefault(require("@babel/runtime/helpers/extends"));
 var _objectWithoutPropertiesLoose2 = _interopRequireDefault(require("@babel/runtime/helpers/objectWithoutPropertiesLoose"));
 var _helpers = require("../../../helpers");
+var _preferredMfaMethod = require("../preferredMfaMethod");
+var _persistPreferredMfaMethod = require("../helpers/persistPreferredMfaMethod");
 const _excluded = ["callback", "deviceId"],
   _excluded2 = ["callback", "deviceId"];
 var _default = (store, api, sharedActions) => {
@@ -80,6 +82,11 @@ var _default = (store, api, sharedActions) => {
       const data = await api.auth.verifyMFAWebAuthnForLoginV2(deviceId, (0, _extends2.default)({}, payload, {
         options: publicKey
       }));
+      const mfaDevices = isStepUp ? store.auth.stepUpState.mfaDevices : store.auth.mfaState.mfaDevices;
+      const deviceType = (0, _preferredMfaMethod.findWebAuthnDeviceTypeById)(mfaDevices, deviceId);
+      if (deviceType) {
+        (0, _persistPreferredMfaMethod.persistPreferredMfaMethod)(store, (0, _preferredMfaMethod.getPreferredMfaMethodFromWebAuthnDeviceType)(deviceType));
+      }
       await actions.handleVerifyMFAResponse(data, isStepUp);
       setLoadingAction({
         loading: false,

package/node/auth/LoginState/helpers/persistPreferredMfaMethod.js

@@ -0,0 +1,27 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.persistPreferredMfaMethod = exports.getPreferredMfaAppKey = void 0;
+var _restApi = require("@frontegg/rest-api");
+var _preferredMfaMethod = require("../preferredMfaMethod");
+/**
+ * Resolve a stable application key for preferred-MFA session storage.
+ * Prefers appId (multi-app), then clientId, then appName.
+ */
+const getPreferredMfaAppKey = store => {
+  const appName = store.root.appName;
+  const context = _restApi.ContextHolder.for(appName).getContext();
+  return context.appId || context.clientId || appName || 'default';
+};
+
+/**
+ * Persist preferred MFA method after a successful challenge.
+ * Always writes; themeOptions.rememberLastMfaFactor only gates whether it is applied.
+ */
+exports.getPreferredMfaAppKey = getPreferredMfaAppKey;
+const persistPreferredMfaMethod = (store, method) => {
+  (0, _preferredMfaMethod.setPreferredMfaMethod)(getPreferredMfaAppKey(store), method);
+};
+exports.persistPreferredMfaMethod = persistPreferredMfaMethod;

package/node/auth/LoginState/helpers.js

@@ -92,7 +92,8 @@ exports.getSearchParam = getSearchParam;
 const TENANT_ID_PARAM_KEY = 'tenantId';
 exports.TENANT_ID_PARAM_KEY = TENANT_ID_PARAM_KEY;
 const getNumberOfMfaDevices = mfaDevices => {
-  const numberOfWebAuthnDevices = +Boolean(mfaDevices.webauthn.length);
+  // Count platform / cross-platform separately — matches the MFA picker options.
+  const numberOfWebAuthnDevices = Number(mfaDevices.webauthn.some(device => device.deviceType === _restApi.WebAuthnDeviceType.Platform)) + Number(mfaDevices.webauthn.some(device => device.deviceType === _restApi.WebAuthnDeviceType.CrossPlatform));
   const numberOfPhoneDevices = +Boolean(mfaDevices.phones.length);
   const numberOfAuthenticators = +Boolean(mfaDevices.authenticators.length);
   const numberOfEmails = +Boolean(mfaDevices.emails.length);

package/node/auth/LoginState/preferredMfaMethod.js

@@ -0,0 +1,166 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.setPreferredMfaMethod = exports.resolvePreferredMfa = exports.isPreferredMfaMethod = exports.getPreferredMfaStorageKey = exports.getPreferredMfaMethodFromWebAuthnDeviceType = exports.getPreferredMfaMethod = exports.getPreferredMfaApplyAction = exports.findWebAuthnDeviceTypeById = exports.clearPreferredMfaMethod = void 0;
+var _restApi = require("@frontegg/rest-api");
+var _interfaces = require("../MfaState/interfaces");
+const STORAGE_KEY_PREFIX = 'frontegg-preferred-mfa-method';
+const PREFERRED_MFA_METHODS = new Set(['sms', 'email', 'authenticatorApp', 'webauthnPlatform', 'webauthnCrossPlatform']);
+const getPreferredMfaStorageKey = appKey => `${STORAGE_KEY_PREFIX}:${appKey}`;
+exports.getPreferredMfaStorageKey = getPreferredMfaStorageKey;
+const isPreferredMfaMethod = value => typeof value === 'string' && PREFERRED_MFA_METHODS.has(value);
+
+/**
+ * Persist the last successful MFA method for this browser session, keyed by application.
+ */
+exports.isPreferredMfaMethod = isPreferredMfaMethod;
+const setPreferredMfaMethod = (appKey, method) => {
+  if (typeof window === 'undefined') {
+    return;
+  }
+  try {
+    window.sessionStorage.setItem(getPreferredMfaStorageKey(appKey), method);
+  } catch {
+    // sessionStorage may be unavailable (private mode / quota) — ignore
+  }
+};
+
+/**
+ * Read the remembered MFA method for this browser session, if any.
+ */
+exports.setPreferredMfaMethod = setPreferredMfaMethod;
+const getPreferredMfaMethod = appKey => {
+  if (typeof window === 'undefined') {
+    return null;
+  }
+  try {
+    const value = window.sessionStorage.getItem(getPreferredMfaStorageKey(appKey));
+    return isPreferredMfaMethod(value) ? value : null;
+  } catch {
+    return null;
+  }
+};
+exports.getPreferredMfaMethod = getPreferredMfaMethod;
+const clearPreferredMfaMethod = appKey => {
+  if (typeof window === 'undefined') {
+    return;
+  }
+  try {
+    window.sessionStorage.removeItem(getPreferredMfaStorageKey(appKey));
+  } catch {
+    // ignore
+  }
+};
+exports.clearPreferredMfaMethod = clearPreferredMfaMethod;
+const hasPhoneDevices = mfaDevices => mfaDevices.phones.length > 0;
+const hasEmails = mfaDevices => mfaDevices.emails.length > 0;
+const hasAuthenticators = mfaDevices => mfaDevices.authenticators.length > 0;
+const hasWebAuthnDevice = (mfaDevices, deviceType) => mfaDevices.webauthn.some(device => device.deviceType === deviceType);
+
+/**
+ * Map a stored preferred MFA method to a concrete MFA step / WebAuthn action,
+ * only when that method is still enrolled and available.
+ */
+const resolvePreferredMfa = (preferred, mfaDevices) => {
+  if (!preferred || !mfaDevices) {
+    return {
+      type: 'none'
+    };
+  }
+  switch (preferred) {
+    case 'sms':
+      return hasPhoneDevices(mfaDevices) ? {
+        type: 'step',
+        step: _interfaces.MFAStep.smsVerifyCode
+      } : {
+        type: 'none'
+      };
+    case 'email':
+      return hasEmails(mfaDevices) ? {
+        type: 'step',
+        step: _interfaces.MFAStep.emailVerifyCode
+      } : {
+        type: 'none'
+      };
+    case 'authenticatorApp':
+      return hasAuthenticators(mfaDevices) ? {
+        type: 'step',
+        step: _interfaces.MFAStep.authenticatorApp
+      } : {
+        type: 'none'
+      };
+    case 'webauthnPlatform':
+      return hasWebAuthnDevice(mfaDevices, _restApi.WebAuthnDeviceType.Platform) ? {
+        type: 'webauthn',
+        deviceType: _restApi.WebAuthnDeviceType.Platform
+      } : {
+        type: 'none'
+      };
+    case 'webauthnCrossPlatform':
+      return hasWebAuthnDevice(mfaDevices, _restApi.WebAuthnDeviceType.CrossPlatform) ? {
+        type: 'webauthn',
+        deviceType: _restApi.WebAuthnDeviceType.CrossPlatform
+      } : {
+        type: 'none'
+      };
+    default:
+      {
+        const _exhaustive = preferred;
+        return _exhaustive;
+      }
+  }
+};
+exports.resolvePreferredMfa = resolvePreferredMfa;
+const getPreferredMfaMethodFromWebAuthnDeviceType = deviceType => {
+  return deviceType === _restApi.WebAuthnDeviceType.Platform ? 'webauthnPlatform' : 'webauthnCrossPlatform';
+};
+exports.getPreferredMfaMethodFromWebAuthnDeviceType = getPreferredMfaMethodFromWebAuthnDeviceType;
+const findWebAuthnDeviceTypeById = (mfaDevices, deviceId) => {
+  var _mfaDevices$webauthn$;
+  return mfaDevices == null ? void 0 : (_mfaDevices$webauthn$ = mfaDevices.webauthn.find(device => device.id === deviceId)) == null ? void 0 : _mfaDevices$webauthn$.deviceType;
+};
+exports.findWebAuthnDeviceTypeById = findWebAuthnDeviceTypeById;
+/**
+ * Pure decision for whether / how to apply a stored preferred MFA factor.
+ * Used by the login-box MFAFlow when themeOptions.rememberLastMfaFactor is on.
+ */
+const getPreferredMfaApplyAction = ({
+  rememberLastMfaFactor,
+  alreadyApplied,
+  step,
+  preferred,
+  mfaDevices,
+  mfaWebAuthnPlatformDeviceId,
+  mfaWebAuthnCrossPlatformDeviceId
+}) => {
+  if (!rememberLastMfaFactor || alreadyApplied || step !== _interfaces.MFAStep.verify) {
+    return {
+      action: 'none'
+    };
+  }
+  const resolution = resolvePreferredMfa(preferred, mfaDevices);
+  if (resolution.type === 'none') {
+    return {
+      action: 'none'
+    };
+  }
+  if (resolution.type === 'step') {
+    return {
+      action: 'setStep',
+      step: resolution.step
+    };
+  }
+  const deviceId = resolution.deviceType === _restApi.WebAuthnDeviceType.Platform ? mfaWebAuthnPlatformDeviceId : mfaWebAuthnCrossPlatformDeviceId;
+  if (!deviceId) {
+    return {
+      action: 'none'
+    };
+  }
+  return {
+    action: 'webauthn',
+    deviceId
+  };
+};
+exports.getPreferredMfaApplyAction = getPreferredMfaApplyAction;

package/node/auth/MfaState/actions.js

@@ -88,12 +88,14 @@ var _default = (store, api, sharedActions) => {
     });
     try {
       const {
-        qrCode
+        qrCode,
+        secret
       } = await api.auth.enrollMfa();
       setMfaState({
         saving: false,
         error: undefined,
-        qrCode
+        qrCode,
+        secret
       });
     } catch (e) {
       setMfaState({

package/node/auth/TeamState/actions/users.actions.js

@@ -907,6 +907,28 @@ var _default = (store, api, sharedActions) => {
       _limit: pageSize
     }), shouldLoadRoles, shouldLoadApps);
   };
+  const loadUsersByRolesV1 = async payload => {
+    const {
+      _roleIds,
+      shouldLoadRoles = true,
+      shouldLoadApps
+    } = payload;
+    if (!(_roleIds != null && _roleIds.length)) {
+      var _payload$callback3;
+      sharedActions.setTeamState({
+        users: [],
+        totalPages: 0,
+        totalItems: 0
+      });
+      (_payload$callback3 = payload.callback) == null ? void 0 : _payload$callback3.call(payload, []);
+      return;
+    }
+    return __loadUsersBySearchCriteria(payload, (pageOffset, pageSize) => api.usersRoles.getUsersByRolesV1({
+      _roleIds,
+      _offset: pageOffset,
+      _limit: pageSize
+    }), shouldLoadRoles, shouldLoadApps);
+  };
   return {
     loadRoles,
     loadUsers,
@@ -915,6 +937,7 @@ var _default = (store, api, sharedActions) => {
     loadUsersByGetUsersPhoneNumberV2,
     loadUsersByGetUsernamesV1,
     loadUsersByGetEmailsV1,
+    loadUsersByRolesV1,
     addUser,
     addUsersBulk,
     updateUser,

package/node/auth/index.js

@@ -525,6 +525,18 @@ Object.keys(_oauthStorage).forEach(function (key) {
     }
   });
 });
+var _preferredMfaMethod = require("./LoginState/preferredMfaMethod");
+Object.keys(_preferredMfaMethod).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
+  if (key in exports && exports[key] === _preferredMfaMethod[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _preferredMfaMethod[key];
+    }
+  });
+});
 var _tenantSelect = require("./LoginState/helpers/tenantSelect");
 Object.keys(_tenantSelect).forEach(function (key) {
   if (key === "default" || key === "__esModule") return;

package/node/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.121.0
+/** @license Frontegg v7.123.0-alpha.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@frontegg/redux-store",
-  "version": "7.121.0",
+  "version": "7.123.0-alpha.0",
   "main": "./node/index.js",
   "license": "MIT",
   "author": "Frontegg LTD",
   "dependencies": {
     "@babel/runtime": "^7.18.6",
     "@frontegg/entitlements-javascript-commons": "1.1.2",
-    "@frontegg/rest-api": "7.121.0",
+    "@frontegg/rest-api": "7.123.0-alpha.0",
     "fast-deep-equal": "3.1.3",
     "get-value": "^3.0.1",
     "proxy-compare": "^3.0.0",