@frontegg/redux-store 7.123.0-alpha.2 → 7.123.0

package/auth/LoginState/actions/afterAuthNavigation.actions.js

@@ -212,7 +212,7 @@ export default ((store, api, sharedActions) => {
    */
 
   const afterAuthNavigation = async payload => {
-    var _window4, _payload$preventRedir;
+    var _store$auth$tenantSel2;
     // Once the choose-tenant step starts a switch the chooser owns navigation. Every re-entry here
     // (the switch's token refresh, and — critically — a late or timed-out switch completing AFTER the
     // user hit the escape hatch) must be a no-op, so navigation can't run twice or jump into the wrong
@@ -239,52 +239,73 @@ export default ((store, api, sharedActions) => {
       }); // consume: later re-entries stay suppressed
     }
 
-    const {
-      customLoginAuthenticatedUrl,
-      stepUpUrl
-    } = store.auth.routes;
-
-    // Step-up on the CURRENT tenant resolves before the org chooser: a user who needs both
-    // authenticates + steps up first, then picks an org. switchTenant handles any MFA the chosen
-    // org requires on its own, and the isSteppedUp guard below means an already-stepped-up user is
-    // never re-prompted.
-    // login with magic code, try to step up, no other mfa, invalid max age, force_enroll -> logout, login with first factor, not-stepped up jwt -> navigate to step up
-    const shouldStepUp = (_window4 = window) == null ? void 0 : _window4.localStorage.getItem(SHOULD_STEP_UP_KEY);
-    const user = store.auth.user;
-    if (shouldStepUp) {
-      var _window5;
-      (_window5 = window) == null ? void 0 : _window5.localStorage.removeItem(SHOULD_STEP_UP_KEY);
-    }
-    if (stepUpUrl && shouldStepUp && !isSteppedUp(user)) {
-      return afterAuthNavigationUtil(actions.resetLoginState, {
-        forceStepUpUrl: stepUpUrl
-      });
-    }
-    if (await shouldRouteToChooseTenant()) {
+    // Callers expose the authenticated user in the store BEFORE this function's async gates resolve,
+    // so a host app that redirects on `user != null` (e.g. the hosted-login postlogin) would complete
+    // the flow before the choose-organization step can render. Raise `tenantChoicePending` in the same
+    // synchronous block (same store batch as the user set) so such hosts can hold, and always lower it
+    // once the gate has decided: by then either `step` is chooseTenant (the chooser now covers the
+    // hold) or the flow finalized. Written only when the integrator opted into tenant selection.
+    const tenantSelectionEnabled = ((_store$auth$tenantSel2 = store.auth.tenantSelection) == null ? void 0 : _store$auth$tenantSel2.enabled) === true;
+    if (tenantSelectionEnabled) {
       actions.setLoginState({
-        step: LoginStep.chooseTenant,
-        loading: false
-      });
-      // Mirror the other post-auth interstitials (e.g. promptPasskeys): navigate to the login URL
-      // so the ChooseTenant step actually renders even when afterAuthNavigation is invoked from an
-      // OAuth/social callback route.
-      store.auth.onRedirectTo(store.auth.routes.loginUrl, {
-        preserveQueryParams: true
+        tenantChoicePending: true
       });
-      return; // do NOT finalize; ChooseTenant confirm re-enters afterAuthNavigation
     }
+    try {
+      var _window4, _payload$preventRedir;
+      const {
+        customLoginAuthenticatedUrl,
+        stepUpUrl
+      } = store.auth.routes;
+
+      // Step-up on the CURRENT tenant resolves before the org chooser: a user who needs both
+      // authenticates + steps up first, then picks an org. switchTenant handles any MFA the chosen
+      // org requires on its own, and the isSteppedUp guard below means an already-stepped-up user is
+      // never re-prompted.
+      // login with magic code, try to step up, no other mfa, invalid max age, force_enroll -> logout, login with first factor, not-stepped up jwt -> navigate to step up
+      const shouldStepUp = (_window4 = window) == null ? void 0 : _window4.localStorage.getItem(SHOULD_STEP_UP_KEY);
+      const user = store.auth.user;
+      if (shouldStepUp) {
+        var _window5;
+        (_window5 = window) == null ? void 0 : _window5.localStorage.removeItem(SHOULD_STEP_UP_KEY);
+      }
+      if (stepUpUrl && shouldStepUp && !isSteppedUp(user)) {
+        return await afterAuthNavigationUtil(actions.resetLoginState, {
+          forceStepUpUrl: stepUpUrl
+        });
+      }
+      if (await shouldRouteToChooseTenant()) {
+        actions.setLoginState({
+          step: LoginStep.chooseTenant,
+          loading: false
+        });
+        // Mirror the other post-auth interstitials (e.g. promptPasskeys): navigate to the login URL
+        // so the ChooseTenant step actually renders even when afterAuthNavigation is invoked from an
+        // OAuth/social callback route.
+        store.auth.onRedirectTo(store.auth.routes.loginUrl, {
+          preserveQueryParams: true
+        });
+        return; // do NOT finalize; ChooseTenant confirm re-enters afterAuthNavigation
+      }
 
-    let customLoginURL = customLoginAuthenticatedUrl;
-    if (!customLoginAuthenticatedUrl) {
-      var _store$auth$routes;
-      await actions.loadCustomLoginRoutes();
-      customLoginURL = (_store$auth$routes = store.auth.routes) == null ? void 0 : _store$auth$routes.customLoginAuthenticatedUrl;
+      let customLoginURL = customLoginAuthenticatedUrl;
+      if (!customLoginAuthenticatedUrl) {
+        var _store$auth$routes;
+        await actions.loadCustomLoginRoutes();
+        customLoginURL = (_store$auth$routes = store.auth.routes) == null ? void 0 : _store$auth$routes.customLoginAuthenticatedUrl;
+      }
+      return await afterAuthNavigationUtil(actions.resetLoginState, {
+        customLoginAuthenticatedUrl: customLoginURL,
+        shouldStepUpDuringLogin: !!shouldStepUp,
+        preventRedirectUrlOriginCleaning: (_payload$preventRedir = payload == null ? void 0 : payload.preventRedirectUrlOriginCleaning) != null ? _payload$preventRedir : false
+      });
+    } finally {
+      if (tenantSelectionEnabled) {
+        actions.setLoginState({
+          tenantChoicePending: false
+        });
+      }
     }
-    return afterAuthNavigationUtil(actions.resetLoginState, {
-      customLoginAuthenticatedUrl: customLoginURL,
-      shouldStepUpDuringLogin: !!shouldStepUp,
-      preventRedirectUrlOriginCleaning: (_payload$preventRedir = payload == null ? void 0 : payload.preventRedirectUrlOriginCleaning) != null ? _payload$preventRedir : false
-    });
   };
 
   /**

package/auth/LoginState/interfaces.d.ts

@@ -63,6 +63,13 @@ export interface LoginState {
      * so re-entry into afterAuthNavigation finalizes without re-prompting.
      */
     tenantChoiceResolved: boolean;
+    /**
+     * True from afterAuthNavigation entry until the choose-organization gate decides (choose-organization
+     * feature, only when `tenantSelection.enabled`). The authenticated user is exposed in the store BEFORE
+     * the gate's async work resolves, so host apps that redirect on `user != null` (e.g. the hosted-login
+     * postlogin) must hold while this is set or they complete the flow before the chooser can render.
+     */
+    tenantChoicePending?: boolean;
     /**
      * True while the choose-organization step is performing switchTenant + showing its success
      * interstitial. switchTenant refreshes the token, which re-enters afterAuthNavigation; this flag

package/auth/LoginState/state.js

@@ -7,6 +7,7 @@ export const initialState = {
   email: '',
   tenants: [],
   tenantChoiceResolved: false,
+  tenantChoicePending: false,
   chooseTenantSwitching: false,
   chooseTenantFinalizing: false
 };

package/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.123.0-alpha.2
+/** @license Frontegg v7.123.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/node/auth/LoginState/actions/afterAuthNavigation.actions.js

@@ -219,7 +219,7 @@ var _default = (store, api, sharedActions) => {
    */
 
   const afterAuthNavigation = async payload => {
-    var _window4, _payload$preventRedir;
+    var _store$auth$tenantSel2;
     // Once the choose-tenant step starts a switch the chooser owns navigation. Every re-entry here
     // (the switch's token refresh, and — critically — a late or timed-out switch completing AFTER the
     // user hit the escape hatch) must be a no-op, so navigation can't run twice or jump into the wrong
@@ -246,52 +246,73 @@ var _default = (store, api, sharedActions) => {
       }); // consume: later re-entries stay suppressed
     }
 
-    const {
-      customLoginAuthenticatedUrl,
-      stepUpUrl
-    } = store.auth.routes;
-
-    // Step-up on the CURRENT tenant resolves before the org chooser: a user who needs both
-    // authenticates + steps up first, then picks an org. switchTenant handles any MFA the chosen
-    // org requires on its own, and the isSteppedUp guard below means an already-stepped-up user is
-    // never re-prompted.
-    // login with magic code, try to step up, no other mfa, invalid max age, force_enroll -> logout, login with first factor, not-stepped up jwt -> navigate to step up
-    const shouldStepUp = (_window4 = window) == null ? void 0 : _window4.localStorage.getItem(_consts.SHOULD_STEP_UP_KEY);
-    const user = store.auth.user;
-    if (shouldStepUp) {
-      var _window5;
-      (_window5 = window) == null ? void 0 : _window5.localStorage.removeItem(_consts.SHOULD_STEP_UP_KEY);
-    }
-    if (stepUpUrl && shouldStepUp && !(0, _helpers3.isSteppedUp)(user)) {
-      return afterAuthNavigationUtil(actions.resetLoginState, {
-        forceStepUpUrl: stepUpUrl
-      });
-    }
-    if (await shouldRouteToChooseTenant()) {
+    // Callers expose the authenticated user in the store BEFORE this function's async gates resolve,
+    // so a host app that redirects on `user != null` (e.g. the hosted-login postlogin) would complete
+    // the flow before the choose-organization step can render. Raise `tenantChoicePending` in the same
+    // synchronous block (same store batch as the user set) so such hosts can hold, and always lower it
+    // once the gate has decided: by then either `step` is chooseTenant (the chooser now covers the
+    // hold) or the flow finalized. Written only when the integrator opted into tenant selection.
+    const tenantSelectionEnabled = ((_store$auth$tenantSel2 = store.auth.tenantSelection) == null ? void 0 : _store$auth$tenantSel2.enabled) === true;
+    if (tenantSelectionEnabled) {
       actions.setLoginState({
-        step: _interfaces.LoginStep.chooseTenant,
-        loading: false
-      });
-      // Mirror the other post-auth interstitials (e.g. promptPasskeys): navigate to the login URL
-      // so the ChooseTenant step actually renders even when afterAuthNavigation is invoked from an
-      // OAuth/social callback route.
-      store.auth.onRedirectTo(store.auth.routes.loginUrl, {
-        preserveQueryParams: true
+        tenantChoicePending: true
       });
-      return; // do NOT finalize; ChooseTenant confirm re-enters afterAuthNavigation
     }
+    try {
+      var _window4, _payload$preventRedir;
+      const {
+        customLoginAuthenticatedUrl,
+        stepUpUrl
+      } = store.auth.routes;
+
+      // Step-up on the CURRENT tenant resolves before the org chooser: a user who needs both
+      // authenticates + steps up first, then picks an org. switchTenant handles any MFA the chosen
+      // org requires on its own, and the isSteppedUp guard below means an already-stepped-up user is
+      // never re-prompted.
+      // login with magic code, try to step up, no other mfa, invalid max age, force_enroll -> logout, login with first factor, not-stepped up jwt -> navigate to step up
+      const shouldStepUp = (_window4 = window) == null ? void 0 : _window4.localStorage.getItem(_consts.SHOULD_STEP_UP_KEY);
+      const user = store.auth.user;
+      if (shouldStepUp) {
+        var _window5;
+        (_window5 = window) == null ? void 0 : _window5.localStorage.removeItem(_consts.SHOULD_STEP_UP_KEY);
+      }
+      if (stepUpUrl && shouldStepUp && !(0, _helpers3.isSteppedUp)(user)) {
+        return await afterAuthNavigationUtil(actions.resetLoginState, {
+          forceStepUpUrl: stepUpUrl
+        });
+      }
+      if (await shouldRouteToChooseTenant()) {
+        actions.setLoginState({
+          step: _interfaces.LoginStep.chooseTenant,
+          loading: false
+        });
+        // Mirror the other post-auth interstitials (e.g. promptPasskeys): navigate to the login URL
+        // so the ChooseTenant step actually renders even when afterAuthNavigation is invoked from an
+        // OAuth/social callback route.
+        store.auth.onRedirectTo(store.auth.routes.loginUrl, {
+          preserveQueryParams: true
+        });
+        return; // do NOT finalize; ChooseTenant confirm re-enters afterAuthNavigation
+      }
 
-    let customLoginURL = customLoginAuthenticatedUrl;
-    if (!customLoginAuthenticatedUrl) {
-      var _store$auth$routes;
-      await actions.loadCustomLoginRoutes();
-      customLoginURL = (_store$auth$routes = store.auth.routes) == null ? void 0 : _store$auth$routes.customLoginAuthenticatedUrl;
+      let customLoginURL = customLoginAuthenticatedUrl;
+      if (!customLoginAuthenticatedUrl) {
+        var _store$auth$routes;
+        await actions.loadCustomLoginRoutes();
+        customLoginURL = (_store$auth$routes = store.auth.routes) == null ? void 0 : _store$auth$routes.customLoginAuthenticatedUrl;
+      }
+      return await afterAuthNavigationUtil(actions.resetLoginState, {
+        customLoginAuthenticatedUrl: customLoginURL,
+        shouldStepUpDuringLogin: !!shouldStepUp,
+        preventRedirectUrlOriginCleaning: (_payload$preventRedir = payload == null ? void 0 : payload.preventRedirectUrlOriginCleaning) != null ? _payload$preventRedir : false
+      });
+    } finally {
+      if (tenantSelectionEnabled) {
+        actions.setLoginState({
+          tenantChoicePending: false
+        });
+      }
     }
-    return afterAuthNavigationUtil(actions.resetLoginState, {
-      customLoginAuthenticatedUrl: customLoginURL,
-      shouldStepUpDuringLogin: !!shouldStepUp,
-      preventRedirectUrlOriginCleaning: (_payload$preventRedir = payload == null ? void 0 : payload.preventRedirectUrlOriginCleaning) != null ? _payload$preventRedir : false
-    });
   };
 
   /**

package/node/auth/LoginState/state.js

@@ -13,6 +13,7 @@ const initialState = {
   email: '',
   tenants: [],
   tenantChoiceResolved: false,
+  tenantChoicePending: false,
   chooseTenantSwitching: false,
   chooseTenantFinalizing: false
 };

package/node/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.123.0-alpha.2
+/** @license Frontegg v7.123.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@frontegg/redux-store",
-  "version": "7.123.0-alpha.2",
+  "version": "7.123.0",
   "main": "./node/index.js",
   "license": "MIT",
   "author": "Frontegg LTD",
   "dependencies": {
     "@babel/runtime": "^7.18.6",
     "@frontegg/entitlements-javascript-commons": "1.1.2",
-    "@frontegg/rest-api": "7.123.0-alpha.2",
+    "@frontegg/rest-api": "7.123.0",
     "fast-deep-equal": "3.1.3",
     "get-value": "^3.0.1",
     "proxy-compare": "^3.0.0",