@frontegg/redux-store 7.128.0 → 7.129.0-alpha.0

package/auth/LoginState/actions/afterAuthNavigation.actions.js

@@ -1,7 +1,8 @@
 import _extends from "@babel/runtime/helpers/esm/extends";
+import { ENFORCE_SSO_ON_TENANT_ACCESS_FF, FeatureFlags } from '@frontegg/rest-api';
 import { getPathAndSearchParamsFromUrl, getRedirectUrl, isAbsoluteUrl } from '../helpers';
 import { shouldPromptChooseTenant } from '../helpers/tenantSelect';
-import { FRONTEGG_AFTER_AUTH_REDIRECT_URL } from '../../../constants';
+import { FRONTEGG_AFTER_AUTH_REDIRECT_URL, FRONTEGG_PENDING_SWITCH_TENANT } from '../../../constants';
 import { LoginStep } from '../interfaces';
 import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
 import { delay } from '../../../helpers';
@@ -56,6 +57,33 @@ export default ((store, api, sharedActions) => {
     }, additionalUpdate));
   }
 
+  /**
+   * A switch that needed SSO saved its target tenant (in this tab) before sending the user to SSO.
+   * Once logged in again, switch to it once if the login landed in another tenant.
+   * @returns true when the switch left the user without a session (MFA step for the target tenant, or logout)
+   */
+  async function switchToPendingSsoTenant() {
+    var _store$auth$user, _store$auth$user2;
+    const [isEnforceSsoOnTenantAccessEnabled] = FeatureFlags.getFeatureFlags([ENFORCE_SSO_ON_TENANT_ACCESS_FF], store.root.appName);
+    const pendingTenantId = window.sessionStorage.getItem(FRONTEGG_PENDING_SWITCH_TENANT);
+    if (!isEnforceSsoOnTenantAccessEnabled || !pendingTenantId || !((_store$auth$user = store.auth.user) != null && _store$auth$user.accessToken)) {
+      return false;
+    }
+    if (store.auth.user.tenantId === pendingTenantId) {
+      window.sessionStorage.removeItem(FRONTEGG_PENDING_SWITCH_TENANT);
+      return false;
+    }
+    // silentReload keeps switchingTenant set, so the switch's own refresh doesn't re-run this navigation
+    await actions.switchTenant({
+      tenantId: pendingTenantId,
+      silentReload: true,
+      keepLoginState: true
+    });
+    // removed only after the switch: a refused re-run must not send the user to SSO again
+    window.sessionStorage.removeItem(FRONTEGG_PENDING_SWITCH_TENANT);
+    return !((_store$auth$user2 = store.auth.user) != null && _store$auth$user2.accessToken);
+  }
+
   /**
    * @param customLoginAuthenticatedUrl custom login authenticated url if exists
    * @returns the authenticated url to redirect to after auth navigation
@@ -159,7 +187,7 @@ export default ((store, api, sharedActions) => {
    * until the resolved-guard, the LD flag, and the option all pass.
    */
   const shouldRouteToChooseTenant = async () => {
-    var _store$auth$tenantSel, _store$auth$user, _store$auth$user$act, _store$auth$tenantsSt;
+    var _store$auth$tenantSel, _store$auth$user3, _store$auth$user3$act, _store$auth$tenantsSt;
     const loginState = store.auth.loginState;
     // Guard first so re-entry after the choice is resolved finalizes without re-reading the flag.
     if (loginState.tenantChoiceResolved) {
@@ -175,7 +203,7 @@ export default ((store, api, sharedActions) => {
       return false; // feature off — never read tenant data
     }
 
-    const isImpersonation = !!((_store$auth$user = store.auth.user) != null && (_store$auth$user$act = _store$auth$user.act) != null && _store$auth$user$act.sub);
+    const isImpersonation = !!((_store$auth$user3 = store.auth.user) != null && (_store$auth$user3$act = _store$auth$user3.act) != null && _store$auth$user3$act.sub);
     if (isImpersonation) {
       return false;
     }
@@ -253,6 +281,14 @@ export default ((store, api, sharedActions) => {
     }
     try {
       var _window4, _payload$preventRedir;
+      const isSessionLostInPendingSwitch = await switchToPendingSsoTenant();
+      if (isSessionLostInPendingSwitch) {
+        // MFA for the target tenant or a failed refresh: continue on the login page
+        store.auth.onRedirectTo(store.auth.routes.loginUrl, {
+          preserveQueryParams: true
+        });
+        return;
+      }
       const {
         customLoginAuthenticatedUrl,
         stepUpUrl

package/auth/LoginState/actions/hostedLoginAuthorize.actions.js

@@ -1,6 +1,7 @@
 import _extends from "@babel/runtime/helpers/esm/extends";
 import { createRandomString, generateCodeChallenge, GTMEventAction, refreshTokenWithRetry, reportGTMEvent } from '../../../helpers';
 import { HOSTED_LOGIN_VERIFIER_KEY } from '../../../constants';
+import { ENFORCE_SSO_ON_TENANT_ACCESS_FF, FeatureFlags } from '@frontegg/rest-api';
 import { getBaseNameWithoutSlashSuffix, getSearchParam, isOauthCallbackRoute, TENANT_ID_PARAM_KEY } from '../helpers';
 import { getUri, getUrlDerivedStepUp, isSteppedUp, redirectByStepUpUrl } from '../../helpers';
 import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
@@ -79,7 +80,10 @@ export default ((store, api, sharedActions) => {
       code_challenge_method: 'S256',
       nonce
     }, additionalParams);
-    if (context.tenantResolver) {
+    const [isEnforceSsoOnTenantAccessEnabled] = FeatureFlags.getFeatureFlags([ENFORCE_SSO_ON_TENANT_ACCESS_FF], store.root.appName);
+    // the tenant asked for (SSO for a refused switch or refresh) wins over the resolved and the page's tenant
+    const isTenantRequested = isEnforceSsoOnTenantAccessEnabled && !!(additionalParams != null && additionalParams.tenantId);
+    if (context.tenantResolver && !isTenantRequested) {
       var _context$tenantResolv;
       const resolvedTenantResult = await ((_context$tenantResolv = context.tenantResolver) == null ? void 0 : _context$tenantResolv.call(context));
       if (resolvedTenantResult != null && resolvedTenantResult.tenant) {
@@ -87,7 +91,7 @@ export default ((store, api, sharedActions) => {
       }
     }
     const tenantId = getSearchParam(TENANT_ID_PARAM_KEY);
-    if (tenantId) {
+    if (tenantId && !isTenantRequested) {
       params['tenantId'] = tenantId;
     }
     if (FronteggNativeModule.isAvailable('closeWindow')) {

package/auth/LoginState/actions/index.d.ts

@@ -75,5 +75,9 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
     resetBreachedPassword: (payload: IForgotPassword) => Promise<void>;
     refreshTokenForSocialLogins: () => Promise<void>;
     __refreshToken: () => Promise<void>;
+    __redirectToSsoForTenant: ({ tenantId, address }: {
+        tenantId: string;
+        address: string;
+    }) => Promise<void>;
 };
 export default _default;

package/auth/LoginState/actions/index.js

@@ -23,26 +23,85 @@ import mfaWithEmailCodeActions from './mfaWithEmailCode.actions';
 import mfaWithSMSActions from './mfaWithSMS.actions';
 import mfaWithWebAuthnActions from './mfaWithWebAuthn.actions';
 import { LoginFlow, LoginStep } from '../interfaces';
-import { base64urlDecode, deepResetState, delay, errorHandler, errorTraceId, GTMEventAction, publicKeyCredentialToJSON, refreshTokenWithRetry, reportGTMEvent, retryIfNeeded, withRetryConfig } from '../../../helpers';
+import { base64urlDecode, deepResetState, delay, errorHandler, errorTraceId, GTMEventAction, isSsoEnforcementError, publicKeyCredentialToJSON, refreshTokenWithRetry, reportGTMEvent, retryIfNeeded, withRetryConfig } from '../../../helpers';
 import { initialState } from '../state';
 import { getSearchParam, isEmailPayload, isUsernamePayload, shouldShowPasswordRotationPromptFunc, TENANT_ID_PARAM_KEY } from '../helpers';
-import { AuthStrategyEnum, ContextHolder, FeatureFlags, getTabTenantFromSessionStorage, removeTabTenantFromSessionStorage, WebAuthnDeviceType, PreLoginAddressType } from '@frontegg/rest-api';
+import { AuthStrategyEnum, ContextHolder, ENFORCE_SSO_ON_TENANT_ACCESS_FF, FeatureFlags, getTabTenantFromSessionStorage, removeTabTenantFromSessionStorage, setTabTenantInSessionStorage, WebAuthnDeviceType, PreLoginAddressType } from '@frontegg/rest-api';
 import hostedLoginAuthorizeActions from './hostedLoginAuthorize.actions';
 import { clearHostedOAuthState } from '../oauthStorage';
 import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
 import { FronteggNativeModule, isEntitlementsDeeplyEqual } from '../../../toolkit';
 import { REQUEST_NAME, UserVerifiedOriginTypes } from '../../interfaces';
 import { authStrategyLoginStepMap } from '../consts';
-import { isMfaRequired, isResetPasswordRequired } from '../../helpers';
+import { isMfaRequired, isResetPasswordRequired, setAfterAuthRedirectUrlForStepUp } from '../../helpers';
 import { MFAStep } from '../../MfaState/interfaces';
 import { SamlVendors } from '../../SSOState/interfaces';
-import { DEFAULT_RETRY_CONFIG } from '../../../constants';
+import { DEFAULT_RETRY_CONFIG, FRONTEGG_PENDING_SWITCH_TENANT } from '../../../constants';
 export default ((store, api, sharedActions) => {
   const actions = sharedActions;
   const contextHolder = ContextHolder.for(store.root.appName);
 
+  /**
+   * Sends the user to log in through the tenant's SSO and back to the current page afterwards.
+   * @protected
+   */
+  const __redirectToSsoForTenant = async ({
+    tenantId,
+    address
+  }) => {
+    // on the login page (tenant chooser) keep the destination the login already saved
+    if (!window.location.pathname.endsWith(store.auth.routes.loginUrl)) {
+      setAfterAuthRedirectUrlForStepUp();
+    }
+    if (store.auth.hostedLoginBox) {
+      await actions.requestHostedLoginAuthorize({
+        prompt: 'login',
+        tenantId
+      });
+      return;
+    }
+    store.auth.onRedirectTo(address, {
+      refresh: true
+    });
+  };
+  /**
+   * Handles a token refresh refused because the tenant requires SSO.
+   * ssoRequired: true sends the user to SSO. ssoRequired: false renews once more for the tenant of the
+   * current token, which keeps the session.
+   * @returns true when handled, false when the caller should log out
+   * @private
+   */
+  const __handleSsoEnforcementRefreshError = async (e, isSsoEnforcementRetry, refreshForTenant) => {
+    var _store$auth$user;
+    const [isEnforceSsoOnTenantAccessEnabled] = FeatureFlags.getFeatureFlags([ENFORCE_SSO_ON_TENANT_ACCESS_FF], store.root.appName);
+    if (!isEnforceSsoOnTenantAccessEnabled || !isSsoEnforcementError(e)) {
+      return false;
+    }
+    const {
+      errorContext
+    } = e;
+    // the switch re-run after coming back from SSO keeps the session instead of sending the user to SSO again
+    const isPendingSwitchRerun = !!window.sessionStorage.getItem(FRONTEGG_PENDING_SWITCH_TENANT);
+    if (errorContext.ssoRequired && !isPendingSwitchRerun) {
+      await __redirectToSsoForTenant(errorContext);
+      return true;
+    }
+    if (isSsoEnforcementRetry) {
+      return false;
+    }
+    const currentTenantId = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.tenantId;
+    if (currentTenantId && contextHolder.isSessionPerTenantEnabled()) {
+      setTabTenantInSessionStorage(currentTenantId);
+    }
+    await refreshForTenant(currentTenantId);
+    return true;
+  };
+
   /** @private */
-  const __refreshTokenHosted = async () => {
+  const __refreshTokenHosted = async ({
+    tenantId,
+    isSsoEnforcementRetry = false
+  } = {}) => {
     const user = store.auth.user;
     if (!(user != null && user.refreshToken)) {
       contextHolder.setAccessToken(null);
@@ -54,7 +113,7 @@ export default ((store, api, sharedActions) => {
       return;
     }
     try {
-      const tabTenantId = getTabTenantFromSessionStorage(store.root.appName);
+      const tabTenantId = tenantId != null ? tenantId : getTabTenantFromSessionStorage(store.root.appName);
       const body = _extends({
         grant_type: 'refresh_token',
         refresh_token: user == null ? void 0 : user.refreshToken
@@ -69,6 +128,13 @@ export default ((store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
+      const retry = tenantId => __refreshTokenHosted({
+        tenantId,
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -88,7 +154,10 @@ export default ((store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenEmbedded = async () => {
+  const __refreshTokenEmbedded = async ({
+    tenantId,
+    isSsoEnforcementRetry = false
+  } = {}) => {
     try {
       const {
         routes,
@@ -99,7 +168,7 @@ export default ((store, api, sharedActions) => {
         user,
         tenants = [],
         activeTenant
-      } = await refreshTokenWithRetry(() => api.auth.refreshTokenV3());
+      } = await refreshTokenWithRetry(() => api.auth.refreshTokenV3(tenantId));
       if (isMfaRequired(user, store.root.appName)) {
         const mfaRequiredState = await actions.getMfaRequiredState(user);
         actions.setAuthState(mfaRequiredState);
@@ -130,6 +199,13 @@ export default ((store, api, sharedActions) => {
         });
       }
     } catch (e) {
+      const retry = tenantId => __refreshTokenEmbedded({
+        tenantId,
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -140,7 +216,9 @@ export default ((store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenWithNativeTokens = async () => {
+  const __refreshTokenWithNativeTokens = async ({
+    isSsoEnforcementRetry = false
+  } = {}) => {
     try {
       const authApi = api.auth;
       const response = await refreshTokenWithRetry(async () => {
@@ -154,6 +232,13 @@ export default ((store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
+      // native tokens can't name a tenant: the retry relies on the tab tenant only
+      const retry = () => __refreshTokenWithNativeTokens({
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -187,9 +272,9 @@ export default ((store, api, sharedActions) => {
    * @private
    */
   const __handleUnnecessaryEntitlementsUpdate = async updatedUser => {
-    var _store$auth$user;
+    var _store$auth$user2;
     // @ts-ignore TODO: fix entitlements state type
-    const oldEntitlements = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.entitlements;
+    const oldEntitlements = (_store$auth$user2 = store.auth.user) == null ? void 0 : _store$auth$user2.entitlements;
     if (isEntitlementsDeeplyEqual(oldEntitlements, updatedUser == null ? void 0 : updatedUser.entitlements)) {
       // set the previous entitlements object
       return _extends({}, updatedUser, {
@@ -659,6 +744,7 @@ export default ((store, api, sharedActions) => {
     if (!keepHostedOAuthState) {
       clearHostedOAuthState();
     }
+    window.sessionStorage.removeItem(FRONTEGG_PENDING_SWITCH_TENANT);
   };
   const logout = async payload => {
     const hostedLoginBox = store.auth.hostedLoginBox;
@@ -1361,7 +1447,10 @@ export default ((store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenHostedSocialLogins = async () => {
+  const __refreshTokenHostedSocialLogins = async ({
+    tenantId,
+    isSsoEnforcementRetry = false
+  } = {}) => {
     const {
       user: currentUser
     } = store.auth;
@@ -1375,7 +1464,7 @@ export default ((store, api, sharedActions) => {
       return;
     }
     try {
-      const tabTenantId = getTabTenantFromSessionStorage(store.root.appName);
+      const tabTenantId = tenantId != null ? tenantId : getTabTenantFromSessionStorage(store.root.appName);
       const body = _extends({
         grant_type: 'refresh_token',
         refresh_token: currentUser == null ? void 0 : currentUser.refreshToken
@@ -1390,6 +1479,13 @@ export default ((store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
+      const retry = tenantId => __refreshTokenHostedSocialLogins({
+        tenantId,
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -1399,7 +1495,10 @@ export default ((store, api, sharedActions) => {
     }
   };
   /** @private */
-  const __refreshTokenEmbeddedSocialLogins = async () => {
+  const __refreshTokenEmbeddedSocialLogins = async ({
+    tenantId,
+    isSsoEnforcementRetry = false
+  } = {}) => {
     try {
       const {
         routes,
@@ -1410,7 +1509,7 @@ export default ((store, api, sharedActions) => {
         user,
         tenants = [],
         activeTenant
-      } = await refreshTokenWithRetry(() => api.auth.refreshTokenV3());
+      } = await refreshTokenWithRetry(() => api.auth.refreshTokenV3(tenantId));
       if (isMfaRequired(user, store.root.appName)) {
         const mfaRequiredState = await actions.getMfaRequiredState(user);
         actions.setAuthState(mfaRequiredState);
@@ -1460,6 +1559,13 @@ export default ((store, api, sharedActions) => {
         }
       }
     } catch (e) {
+      const retry = tenantId => __refreshTokenEmbeddedSocialLogins({
+        tenantId,
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -1506,6 +1612,7 @@ export default ((store, api, sharedActions) => {
     resetBreachedPassword,
     refreshTokenForSocialLogins,
     // protected
-    __refreshToken
+    __refreshToken,
+    __redirectToSsoForTenant
   }, hostedLoginAuthorizeActions(store, api, sharedActions), afterAuthNavigationActions(store, api, sharedActions), handleVerifyMFAResponseActions(store, api, sharedActions), mfaRequiredStateActions(store, api, sharedActions), mfaWithAuthenticatorActions(store, api, sharedActions), mfaWithEmailCodeActions(store, api, sharedActions), mfaWithSMSActions(store, api, sharedActions), mfaWithWebAuthnActions(store, api, sharedActions));
 });

package/auth/TenantsState/actions.js

@@ -1,6 +1,7 @@
 import { initialState } from './state';
-import { deepResetState } from '../../helpers';
-import { getCurrentUserTenantsFunction } from '@frontegg/rest-api';
+import { deepResetState, isSsoEnforcementError } from '../../helpers';
+import { ENFORCE_SSO_ON_TENANT_ACCESS_FF, FeatureFlags, getCurrentUserTenantsFunction } from '@frontegg/rest-api';
+import { FRONTEGG_PENDING_SWITCH_TENANT } from '../../constants';
 export default ((store, api, sharedActions) => {
   const actions = sharedActions;
   const setTenantsState = state => {
@@ -51,6 +52,15 @@ export default ((store, api, sharedActions) => {
       }) : actions.setAuthState({
         isLoading: false
       });
+      const [isEnforceSsoOnTenantAccessEnabled] = FeatureFlags.getFeatureFlags([ENFORCE_SSO_ON_TENANT_ACCESS_FF], store.root.appName);
+      // a switch re-run after coming back from SSO doesn't send the user to SSO again
+      const isPendingSwitchRerun = window.sessionStorage.getItem(FRONTEGG_PENDING_SWITCH_TENANT) === tenantId;
+      if (isEnforceSsoOnTenantAccessEnabled && isSsoEnforcementError(e) && e.errorContext.ssoRequired && !isPendingSwitchRerun) {
+        // saved to finish the switch after the SSO login, which may land in another tenant
+        window.sessionStorage.setItem(FRONTEGG_PENDING_SWITCH_TENANT, tenantId);
+        await actions.__redirectToSsoForTenant(e.errorContext);
+        return;
+      }
       callback == null ? void 0 : callback(false, e);
     }
   };

package/constants.d.ts

@@ -1,4 +1,5 @@
 export declare const FRONTEGG_AFTER_AUTH_REDIRECT_URL = "FRONTEGG_AFTER_AUTH_REDIRECT_URL";
+export declare const FRONTEGG_PENDING_SWITCH_TENANT = "FRONTEGG_PENDING_SWITCH_TENANT";
 export declare const HOSTED_LOGIN_VERIFIER_KEY = "HOSTED_LOGIN_VERIFIER_KEY";
 export declare const DEFAULT_RETRY_CONFIG: {
     retryCount: number;

package/constants.js

@@ -1,4 +1,5 @@
 export const FRONTEGG_AFTER_AUTH_REDIRECT_URL = 'FRONTEGG_AFTER_AUTH_REDIRECT_URL';
+export const FRONTEGG_PENDING_SWITCH_TENANT = 'FRONTEGG_PENDING_SWITCH_TENANT';
 export const HOSTED_LOGIN_VERIFIER_KEY = 'HOSTED_LOGIN_VERIFIER_KEY';
 export const DEFAULT_RETRY_CONFIG = {
   retryCount: 3

package/helpers/handlers.d.ts

@@ -1,4 +1,7 @@
-import { FronteggApiError } from '@frontegg/rest-api';
+import { FronteggApiError, SsoEnforcementErrorContext } from '@frontegg/rest-api';
 export declare const isFronteggApiError: (error: unknown | Error | FronteggApiError) => error is FronteggApiError;
+export declare const isSsoEnforcementError: (error: unknown) => error is FronteggApiError & {
+    errorContext: SsoEnforcementErrorContext;
+};
 export declare const isError: (error: any) => error is Error;
 export declare const errorHandler: <T>(error: unknown, fallback?: T) => FronteggApiError | T;

package/helpers/handlers.js

@@ -1,5 +1,8 @@
-import { FronteggApiError, GENERIC_ERROR_MESSAGE, GENERIC_ERROR_CODE } from '@frontegg/rest-api';
+import { FronteggApiError, GENERIC_ERROR_MESSAGE, GENERIC_ERROR_CODE, SSO_REQUIRED_FOR_TENANT_ERROR_CODE } from '@frontegg/rest-api';
 export const isFronteggApiError = error => Boolean(error == null ? void 0 : error.statusCode);
+
+// ER-01079 (disabled user / expired tenant) is not this: it still logs out
+export const isSsoEnforcementError = error => isFronteggApiError(error) && error.errorCode === SSO_REQUIRED_FOR_TENANT_ERROR_CODE;
 export const isError = error => {
   if (error instanceof Error) {
     return true;

package/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.128.0
+/** @license Frontegg v7.129.0-alpha.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/mocks/auth-mocks/loginActions.mocks.d.ts

@@ -71,5 +71,9 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
     resetBreachedPassword: (payload: import("dist/@frontegg/rest-api").IForgotPassword) => Promise<void>;
     refreshTokenForSocialLogins: () => Promise<void>;
     __refreshToken: () => Promise<void>;
+    __redirectToSsoForTenant: ({ tenantId, address }: {
+        tenantId: string;
+        address: string;
+    }) => Promise<void>;
 };
 export default _default;

package/node/auth/LoginState/actions/afterAuthNavigation.actions.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.default = void 0;
 var _extends2 = _interopRequireDefault(require("@babel/runtime/helpers/extends"));
+var _restApi = require("@frontegg/rest-api");
 var _helpers = require("../helpers");
 var _tenantSelect = require("../helpers/tenantSelect");
 var _constants = require("../../../constants");
@@ -63,6 +64,33 @@ var _default = (store, api, sharedActions) => {
     }, additionalUpdate));
   }
 
+  /**
+   * A switch that needed SSO saved its target tenant (in this tab) before sending the user to SSO.
+   * Once logged in again, switch to it once if the login landed in another tenant.
+   * @returns true when the switch left the user without a session (MFA step for the target tenant, or logout)
+   */
+  async function switchToPendingSsoTenant() {
+    var _store$auth$user, _store$auth$user2;
+    const [isEnforceSsoOnTenantAccessEnabled] = _restApi.FeatureFlags.getFeatureFlags([_restApi.ENFORCE_SSO_ON_TENANT_ACCESS_FF], store.root.appName);
+    const pendingTenantId = window.sessionStorage.getItem(_constants.FRONTEGG_PENDING_SWITCH_TENANT);
+    if (!isEnforceSsoOnTenantAccessEnabled || !pendingTenantId || !((_store$auth$user = store.auth.user) != null && _store$auth$user.accessToken)) {
+      return false;
+    }
+    if (store.auth.user.tenantId === pendingTenantId) {
+      window.sessionStorage.removeItem(_constants.FRONTEGG_PENDING_SWITCH_TENANT);
+      return false;
+    }
+    // silentReload keeps switchingTenant set, so the switch's own refresh doesn't re-run this navigation
+    await actions.switchTenant({
+      tenantId: pendingTenantId,
+      silentReload: true,
+      keepLoginState: true
+    });
+    // removed only after the switch: a refused re-run must not send the user to SSO again
+    window.sessionStorage.removeItem(_constants.FRONTEGG_PENDING_SWITCH_TENANT);
+    return !((_store$auth$user2 = store.auth.user) != null && _store$auth$user2.accessToken);
+  }
+
   /**
    * @param customLoginAuthenticatedUrl custom login authenticated url if exists
    * @returns the authenticated url to redirect to after auth navigation
@@ -166,7 +194,7 @@ var _default = (store, api, sharedActions) => {
    * until the resolved-guard, the LD flag, and the option all pass.
    */
   const shouldRouteToChooseTenant = async () => {
-    var _store$auth$tenantSel, _store$auth$user, _store$auth$user$act, _store$auth$tenantsSt;
+    var _store$auth$tenantSel, _store$auth$user3, _store$auth$user3$act, _store$auth$tenantsSt;
     const loginState = store.auth.loginState;
     // Guard first so re-entry after the choice is resolved finalizes without re-reading the flag.
     if (loginState.tenantChoiceResolved) {
@@ -182,7 +210,7 @@ var _default = (store, api, sharedActions) => {
       return false; // feature off — never read tenant data
     }
 
-    const isImpersonation = !!((_store$auth$user = store.auth.user) != null && (_store$auth$user$act = _store$auth$user.act) != null && _store$auth$user$act.sub);
+    const isImpersonation = !!((_store$auth$user3 = store.auth.user) != null && (_store$auth$user3$act = _store$auth$user3.act) != null && _store$auth$user3$act.sub);
     if (isImpersonation) {
       return false;
     }
@@ -260,6 +288,14 @@ var _default = (store, api, sharedActions) => {
     }
     try {
       var _window4, _payload$preventRedir;
+      const isSessionLostInPendingSwitch = await switchToPendingSsoTenant();
+      if (isSessionLostInPendingSwitch) {
+        // MFA for the target tenant or a failed refresh: continue on the login page
+        store.auth.onRedirectTo(store.auth.routes.loginUrl, {
+          preserveQueryParams: true
+        });
+        return;
+      }
       const {
         customLoginAuthenticatedUrl,
         stepUpUrl

package/node/auth/LoginState/actions/hostedLoginAuthorize.actions.js

@@ -8,6 +8,7 @@ exports.default = void 0;
 var _extends2 = _interopRequireDefault(require("@babel/runtime/helpers/extends"));
 var _helpers = require("../../../helpers");
 var _constants = require("../../../constants");
+var _restApi = require("@frontegg/rest-api");
 var _helpers2 = require("../helpers");
 var _helpers3 = require("../../helpers");
 var _consts = require("../../StepUpState/consts");
@@ -86,7 +87,10 @@ var _default = (store, api, sharedActions) => {
       code_challenge_method: 'S256',
       nonce
     }, additionalParams);
-    if (context.tenantResolver) {
+    const [isEnforceSsoOnTenantAccessEnabled] = _restApi.FeatureFlags.getFeatureFlags([_restApi.ENFORCE_SSO_ON_TENANT_ACCESS_FF], store.root.appName);
+    // the tenant asked for (SSO for a refused switch or refresh) wins over the resolved and the page's tenant
+    const isTenantRequested = isEnforceSsoOnTenantAccessEnabled && !!(additionalParams != null && additionalParams.tenantId);
+    if (context.tenantResolver && !isTenantRequested) {
       var _context$tenantResolv;
       const resolvedTenantResult = await ((_context$tenantResolv = context.tenantResolver) == null ? void 0 : _context$tenantResolv.call(context));
       if (resolvedTenantResult != null && resolvedTenantResult.tenant) {
@@ -94,7 +98,7 @@ var _default = (store, api, sharedActions) => {
       }
     }
     const tenantId = (0, _helpers2.getSearchParam)(_helpers2.TENANT_ID_PARAM_KEY);
-    if (tenantId) {
+    if (tenantId && !isTenantRequested) {
       params['tenantId'] = tenantId;
     }
     if (_toolkit.FronteggNativeModule.isAvailable('closeWindow')) {

package/node/auth/LoginState/actions/index.js

@@ -48,8 +48,67 @@ var _default = (store, api, sharedActions) => {
   const actions = sharedActions;
   const contextHolder = _restApi.ContextHolder.for(store.root.appName);
 
+  /**
+   * Sends the user to log in through the tenant's SSO and back to the current page afterwards.
+   * @protected
+   */
+  const __redirectToSsoForTenant = async ({
+    tenantId,
+    address
+  }) => {
+    // on the login page (tenant chooser) keep the destination the login already saved
+    if (!window.location.pathname.endsWith(store.auth.routes.loginUrl)) {
+      (0, _helpers3.setAfterAuthRedirectUrlForStepUp)();
+    }
+    if (store.auth.hostedLoginBox) {
+      await actions.requestHostedLoginAuthorize({
+        prompt: 'login',
+        tenantId
+      });
+      return;
+    }
+    store.auth.onRedirectTo(address, {
+      refresh: true
+    });
+  };
+  /**
+   * Handles a token refresh refused because the tenant requires SSO.
+   * ssoRequired: true sends the user to SSO. ssoRequired: false renews once more for the tenant of the
+   * current token, which keeps the session.
+   * @returns true when handled, false when the caller should log out
+   * @private
+   */
+  const __handleSsoEnforcementRefreshError = async (e, isSsoEnforcementRetry, refreshForTenant) => {
+    var _store$auth$user;
+    const [isEnforceSsoOnTenantAccessEnabled] = _restApi.FeatureFlags.getFeatureFlags([_restApi.ENFORCE_SSO_ON_TENANT_ACCESS_FF], store.root.appName);
+    if (!isEnforceSsoOnTenantAccessEnabled || !(0, _helpers.isSsoEnforcementError)(e)) {
+      return false;
+    }
+    const {
+      errorContext
+    } = e;
+    // the switch re-run after coming back from SSO keeps the session instead of sending the user to SSO again
+    const isPendingSwitchRerun = !!window.sessionStorage.getItem(_constants.FRONTEGG_PENDING_SWITCH_TENANT);
+    if (errorContext.ssoRequired && !isPendingSwitchRerun) {
+      await __redirectToSsoForTenant(errorContext);
+      return true;
+    }
+    if (isSsoEnforcementRetry) {
+      return false;
+    }
+    const currentTenantId = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.tenantId;
+    if (currentTenantId && contextHolder.isSessionPerTenantEnabled()) {
+      (0, _restApi.setTabTenantInSessionStorage)(currentTenantId);
+    }
+    await refreshForTenant(currentTenantId);
+    return true;
+  };
+
   /** @private */
-  const __refreshTokenHosted = async () => {
+  const __refreshTokenHosted = async ({
+    tenantId,
+    isSsoEnforcementRetry = false
+  } = {}) => {
     const user = store.auth.user;
     if (!(user != null && user.refreshToken)) {
       contextHolder.setAccessToken(null);
@@ -61,7 +120,7 @@ var _default = (store, api, sharedActions) => {
       return;
     }
     try {
-      const tabTenantId = (0, _restApi.getTabTenantFromSessionStorage)(store.root.appName);
+      const tabTenantId = tenantId != null ? tenantId : (0, _restApi.getTabTenantFromSessionStorage)(store.root.appName);
       const body = (0, _extends2.default)({
         grant_type: 'refresh_token',
         refresh_token: user == null ? void 0 : user.refreshToken
@@ -76,6 +135,13 @@ var _default = (store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
+      const retry = tenantId => __refreshTokenHosted({
+        tenantId,
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -95,7 +161,10 @@ var _default = (store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenEmbedded = async () => {
+  const __refreshTokenEmbedded = async ({
+    tenantId,
+    isSsoEnforcementRetry = false
+  } = {}) => {
     try {
       const {
         routes,
@@ -106,7 +175,7 @@ var _default = (store, api, sharedActions) => {
         user,
         tenants = [],
         activeTenant
-      } = await (0, _helpers.refreshTokenWithRetry)(() => api.auth.refreshTokenV3());
+      } = await (0, _helpers.refreshTokenWithRetry)(() => api.auth.refreshTokenV3(tenantId));
       if ((0, _helpers3.isMfaRequired)(user, store.root.appName)) {
         const mfaRequiredState = await actions.getMfaRequiredState(user);
         actions.setAuthState(mfaRequiredState);
@@ -137,6 +206,13 @@ var _default = (store, api, sharedActions) => {
         });
       }
     } catch (e) {
+      const retry = tenantId => __refreshTokenEmbedded({
+        tenantId,
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -147,7 +223,9 @@ var _default = (store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenWithNativeTokens = async () => {
+  const __refreshTokenWithNativeTokens = async ({
+    isSsoEnforcementRetry = false
+  } = {}) => {
     try {
       const authApi = api.auth;
       const response = await (0, _helpers.refreshTokenWithRetry)(async () => {
@@ -161,6 +239,13 @@ var _default = (store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
+      // native tokens can't name a tenant: the retry relies on the tab tenant only
+      const retry = () => __refreshTokenWithNativeTokens({
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -194,9 +279,9 @@ var _default = (store, api, sharedActions) => {
    * @private
    */
   const __handleUnnecessaryEntitlementsUpdate = async updatedUser => {
-    var _store$auth$user;
+    var _store$auth$user2;
     // @ts-ignore TODO: fix entitlements state type
-    const oldEntitlements = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.entitlements;
+    const oldEntitlements = (_store$auth$user2 = store.auth.user) == null ? void 0 : _store$auth$user2.entitlements;
     if ((0, _toolkit.isEntitlementsDeeplyEqual)(oldEntitlements, updatedUser == null ? void 0 : updatedUser.entitlements)) {
       // set the previous entitlements object
       return (0, _extends2.default)({}, updatedUser, {
@@ -666,6 +751,7 @@ var _default = (store, api, sharedActions) => {
     if (!keepHostedOAuthState) {
       (0, _oauthStorage.clearHostedOAuthState)();
     }
+    window.sessionStorage.removeItem(_constants.FRONTEGG_PENDING_SWITCH_TENANT);
   };
   const logout = async payload => {
     const hostedLoginBox = store.auth.hostedLoginBox;
@@ -1368,7 +1454,10 @@ var _default = (store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenHostedSocialLogins = async () => {
+  const __refreshTokenHostedSocialLogins = async ({
+    tenantId,
+    isSsoEnforcementRetry = false
+  } = {}) => {
     const {
       user: currentUser
     } = store.auth;
@@ -1382,7 +1471,7 @@ var _default = (store, api, sharedActions) => {
       return;
     }
     try {
-      const tabTenantId = (0, _restApi.getTabTenantFromSessionStorage)(store.root.appName);
+      const tabTenantId = tenantId != null ? tenantId : (0, _restApi.getTabTenantFromSessionStorage)(store.root.appName);
       const body = (0, _extends2.default)({
         grant_type: 'refresh_token',
         refresh_token: currentUser == null ? void 0 : currentUser.refreshToken
@@ -1397,6 +1486,13 @@ var _default = (store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
+      const retry = tenantId => __refreshTokenHostedSocialLogins({
+        tenantId,
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -1406,7 +1502,10 @@ var _default = (store, api, sharedActions) => {
     }
   };
   /** @private */
-  const __refreshTokenEmbeddedSocialLogins = async () => {
+  const __refreshTokenEmbeddedSocialLogins = async ({
+    tenantId,
+    isSsoEnforcementRetry = false
+  } = {}) => {
     try {
       const {
         routes,
@@ -1417,7 +1516,7 @@ var _default = (store, api, sharedActions) => {
         user,
         tenants = [],
         activeTenant
-      } = await (0, _helpers.refreshTokenWithRetry)(() => api.auth.refreshTokenV3());
+      } = await (0, _helpers.refreshTokenWithRetry)(() => api.auth.refreshTokenV3(tenantId));
       if ((0, _helpers3.isMfaRequired)(user, store.root.appName)) {
         const mfaRequiredState = await actions.getMfaRequiredState(user);
         actions.setAuthState(mfaRequiredState);
@@ -1467,6 +1566,13 @@ var _default = (store, api, sharedActions) => {
         }
       }
     } catch (e) {
+      const retry = tenantId => __refreshTokenEmbeddedSocialLogins({
+        tenantId,
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -1513,7 +1619,8 @@ var _default = (store, api, sharedActions) => {
     resetBreachedPassword,
     refreshTokenForSocialLogins,
     // protected
-    __refreshToken
+    __refreshToken,
+    __redirectToSsoForTenant
   }, (0, _hostedLoginAuthorize.default)(store, api, sharedActions), (0, _afterAuthNavigation.default)(store, api, sharedActions), (0, _handleVerifyMFAResponse.default)(store, api, sharedActions), (0, _mfaRequiredState.default)(store, api, sharedActions), (0, _mfaWithAuthenticator.default)(store, api, sharedActions), (0, _mfaWithEmailCode.default)(store, api, sharedActions), (0, _mfaWithSMS.default)(store, api, sharedActions), (0, _mfaWithWebAuthn.default)(store, api, sharedActions));
 };
 exports.default = _default;

package/node/auth/TenantsState/actions.js

@@ -7,6 +7,7 @@ exports.default = void 0;
 var _state = require("./state");
 var _helpers = require("../../helpers");
 var _restApi = require("@frontegg/rest-api");
+var _constants = require("../../constants");
 var _default = (store, api, sharedActions) => {
   const actions = sharedActions;
   const setTenantsState = state => {
@@ -57,6 +58,15 @@ var _default = (store, api, sharedActions) => {
       }) : actions.setAuthState({
         isLoading: false
       });
+      const [isEnforceSsoOnTenantAccessEnabled] = _restApi.FeatureFlags.getFeatureFlags([_restApi.ENFORCE_SSO_ON_TENANT_ACCESS_FF], store.root.appName);
+      // a switch re-run after coming back from SSO doesn't send the user to SSO again
+      const isPendingSwitchRerun = window.sessionStorage.getItem(_constants.FRONTEGG_PENDING_SWITCH_TENANT) === tenantId;
+      if (isEnforceSsoOnTenantAccessEnabled && (0, _helpers.isSsoEnforcementError)(e) && e.errorContext.ssoRequired && !isPendingSwitchRerun) {
+        // saved to finish the switch after the SSO login, which may land in another tenant
+        window.sessionStorage.setItem(_constants.FRONTEGG_PENDING_SWITCH_TENANT, tenantId);
+        await actions.__redirectToSsoForTenant(e.errorContext);
+        return;
+      }
       callback == null ? void 0 : callback(false, e);
     }
   };

package/node/constants.js

@@ -5,10 +5,11 @@ Object.defineProperty(exports, "__esModule", {
 });
 var _exportNames = {
   FRONTEGG_AFTER_AUTH_REDIRECT_URL: true,
+  FRONTEGG_PENDING_SWITCH_TENANT: true,
   HOSTED_LOGIN_VERIFIER_KEY: true,
   DEFAULT_RETRY_CONFIG: true
 };
-exports.HOSTED_LOGIN_VERIFIER_KEY = exports.FRONTEGG_AFTER_AUTH_REDIRECT_URL = exports.DEFAULT_RETRY_CONFIG = void 0;
+exports.HOSTED_LOGIN_VERIFIER_KEY = exports.FRONTEGG_PENDING_SWITCH_TENANT = exports.FRONTEGG_AFTER_AUTH_REDIRECT_URL = exports.DEFAULT_RETRY_CONFIG = void 0;
 var _consts = require("./auth/StepUpState/consts");
 Object.keys(_consts).forEach(function (key) {
   if (key === "default" || key === "__esModule") return;
@@ -35,6 +36,8 @@ Object.keys(_consts2).forEach(function (key) {
 });
 const FRONTEGG_AFTER_AUTH_REDIRECT_URL = 'FRONTEGG_AFTER_AUTH_REDIRECT_URL';
 exports.FRONTEGG_AFTER_AUTH_REDIRECT_URL = FRONTEGG_AFTER_AUTH_REDIRECT_URL;
+const FRONTEGG_PENDING_SWITCH_TENANT = 'FRONTEGG_PENDING_SWITCH_TENANT';
+exports.FRONTEGG_PENDING_SWITCH_TENANT = FRONTEGG_PENDING_SWITCH_TENANT;
 const HOSTED_LOGIN_VERIFIER_KEY = 'HOSTED_LOGIN_VERIFIER_KEY';
 exports.HOSTED_LOGIN_VERIFIER_KEY = HOSTED_LOGIN_VERIFIER_KEY;
 const DEFAULT_RETRY_CONFIG = {

package/node/helpers/handlers.js

@@ -3,10 +3,14 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.isFronteggApiError = exports.isError = exports.errorHandler = void 0;
+exports.isSsoEnforcementError = exports.isFronteggApiError = exports.isError = exports.errorHandler = void 0;
 var _restApi = require("@frontegg/rest-api");
 const isFronteggApiError = error => Boolean(error == null ? void 0 : error.statusCode);
+
+// ER-01079 (disabled user / expired tenant) is not this: it still logs out
 exports.isFronteggApiError = isFronteggApiError;
+const isSsoEnforcementError = error => isFronteggApiError(error) && error.errorCode === _restApi.SSO_REQUIRED_FOR_TENANT_ERROR_CODE;
+exports.isSsoEnforcementError = isSsoEnforcementError;
 const isError = error => {
   if (error instanceof Error) {
     return true;

package/node/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.128.0
+/** @license Frontegg v7.129.0-alpha.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@frontegg/redux-store",
-  "version": "7.128.0",
+  "version": "7.129.0-alpha.0",
   "main": "./node/index.js",
   "license": "MIT",
   "author": "Frontegg LTD",
   "dependencies": {
     "@babel/runtime": "^7.18.6",
     "@frontegg/entitlements-javascript-commons": "1.1.2",
-    "@frontegg/rest-api": "7.128.0",
+    "@frontegg/rest-api": "7.129.0-alpha.0",
     "fast-deep-equal": "3.1.3",
     "get-value": "^3.0.1",
     "proxy-compare": "^3.0.0",