@frontegg/redux-store 7.129.0-alpha.0 → 7.129.0

package/auth/LoginState/actions/afterAuthNavigation.actions.js

@@ -1,8 +1,7 @@
 import _extends from "@babel/runtime/helpers/esm/extends";
-import { ENFORCE_SSO_ON_TENANT_ACCESS_FF, FeatureFlags } from '@frontegg/rest-api';
 import { getPathAndSearchParamsFromUrl, getRedirectUrl, isAbsoluteUrl } from '../helpers';
 import { shouldPromptChooseTenant } from '../helpers/tenantSelect';
-import { FRONTEGG_AFTER_AUTH_REDIRECT_URL, FRONTEGG_PENDING_SWITCH_TENANT } from '../../../constants';
+import { FRONTEGG_AFTER_AUTH_REDIRECT_URL } from '../../../constants';
 import { LoginStep } from '../interfaces';
 import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
 import { delay } from '../../../helpers';
@@ -57,33 +56,6 @@ export default ((store, api, sharedActions) => {
     }, additionalUpdate));
   }
 
-  /**
-   * A switch that needed SSO saved its target tenant (in this tab) before sending the user to SSO.
-   * Once logged in again, switch to it once if the login landed in another tenant.
-   * @returns true when the switch left the user without a session (MFA step for the target tenant, or logout)
-   */
-  async function switchToPendingSsoTenant() {
-    var _store$auth$user, _store$auth$user2;
-    const [isEnforceSsoOnTenantAccessEnabled] = FeatureFlags.getFeatureFlags([ENFORCE_SSO_ON_TENANT_ACCESS_FF], store.root.appName);
-    const pendingTenantId = window.sessionStorage.getItem(FRONTEGG_PENDING_SWITCH_TENANT);
-    if (!isEnforceSsoOnTenantAccessEnabled || !pendingTenantId || !((_store$auth$user = store.auth.user) != null && _store$auth$user.accessToken)) {
-      return false;
-    }
-    if (store.auth.user.tenantId === pendingTenantId) {
-      window.sessionStorage.removeItem(FRONTEGG_PENDING_SWITCH_TENANT);
-      return false;
-    }
-    // silentReload keeps switchingTenant set, so the switch's own refresh doesn't re-run this navigation
-    await actions.switchTenant({
-      tenantId: pendingTenantId,
-      silentReload: true,
-      keepLoginState: true
-    });
-    // removed only after the switch: a refused re-run must not send the user to SSO again
-    window.sessionStorage.removeItem(FRONTEGG_PENDING_SWITCH_TENANT);
-    return !((_store$auth$user2 = store.auth.user) != null && _store$auth$user2.accessToken);
-  }
-
   /**
    * @param customLoginAuthenticatedUrl custom login authenticated url if exists
    * @returns the authenticated url to redirect to after auth navigation
@@ -108,15 +80,19 @@ export default ((store, api, sharedActions) => {
       logoutUrl,
       socialLoginCallbackUrl,
       activateUrl,
-      activateWithOTCUrl
+      activateWithOTCUrl,
+      oidcRedirectUrl
     } = routes;
     let finalUrl = urlFromLocalStorage;
     if (!finalUrl || [loginUrl, logoutUrl, socialLoginCallbackUrl, activateUrl, activateWithOTCUrl].includes(finalUrl)) {
       finalUrl = authenticatedUrl;
     }
+
+    // The OIDC callback's query is the IdP's code and state; the user's own query was saved with the URL.
+    const isOidcCallback = !!oidcRedirectUrl && window.location.pathname.endsWith(oidcRedirectUrl);
     const redirectUrl = getRedirectUrl({
       authenticatedUrl: finalUrl,
-      includeQueryParam,
+      includeQueryParam: includeQueryParam && !isOidcCallback,
       enforceRedirectToSameSite,
       allowedRedirectOrigins
     });
@@ -187,7 +163,7 @@ export default ((store, api, sharedActions) => {
    * until the resolved-guard, the LD flag, and the option all pass.
    */
   const shouldRouteToChooseTenant = async () => {
-    var _store$auth$tenantSel, _store$auth$user3, _store$auth$user3$act, _store$auth$tenantsSt;
+    var _store$auth$tenantSel, _store$auth$user, _store$auth$user$act, _store$auth$tenantsSt;
     const loginState = store.auth.loginState;
     // Guard first so re-entry after the choice is resolved finalizes without re-reading the flag.
     if (loginState.tenantChoiceResolved) {
@@ -203,7 +179,7 @@ export default ((store, api, sharedActions) => {
       return false; // feature off — never read tenant data
     }
 
-    const isImpersonation = !!((_store$auth$user3 = store.auth.user) != null && (_store$auth$user3$act = _store$auth$user3.act) != null && _store$auth$user3$act.sub);
+    const isImpersonation = !!((_store$auth$user = store.auth.user) != null && (_store$auth$user$act = _store$auth$user.act) != null && _store$auth$user$act.sub);
     if (isImpersonation) {
       return false;
     }
@@ -281,14 +257,6 @@ export default ((store, api, sharedActions) => {
     }
     try {
       var _window4, _payload$preventRedir;
-      const isSessionLostInPendingSwitch = await switchToPendingSsoTenant();
-      if (isSessionLostInPendingSwitch) {
-        // MFA for the target tenant or a failed refresh: continue on the login page
-        store.auth.onRedirectTo(store.auth.routes.loginUrl, {
-          preserveQueryParams: true
-        });
-        return;
-      }
       const {
         customLoginAuthenticatedUrl,
         stepUpUrl

package/auth/LoginState/actions/hostedLoginAuthorize.actions.js

@@ -1,7 +1,6 @@
 import _extends from "@babel/runtime/helpers/esm/extends";
 import { createRandomString, generateCodeChallenge, GTMEventAction, refreshTokenWithRetry, reportGTMEvent } from '../../../helpers';
 import { HOSTED_LOGIN_VERIFIER_KEY } from '../../../constants';
-import { ENFORCE_SSO_ON_TENANT_ACCESS_FF, FeatureFlags } from '@frontegg/rest-api';
 import { getBaseNameWithoutSlashSuffix, getSearchParam, isOauthCallbackRoute, TENANT_ID_PARAM_KEY } from '../helpers';
 import { getUri, getUrlDerivedStepUp, isSteppedUp, redirectByStepUpUrl } from '../../helpers';
 import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
@@ -80,10 +79,7 @@ export default ((store, api, sharedActions) => {
       code_challenge_method: 'S256',
       nonce
     }, additionalParams);
-    const [isEnforceSsoOnTenantAccessEnabled] = FeatureFlags.getFeatureFlags([ENFORCE_SSO_ON_TENANT_ACCESS_FF], store.root.appName);
-    // the tenant asked for (SSO for a refused switch or refresh) wins over the resolved and the page's tenant
-    const isTenantRequested = isEnforceSsoOnTenantAccessEnabled && !!(additionalParams != null && additionalParams.tenantId);
-    if (context.tenantResolver && !isTenantRequested) {
+    if (context.tenantResolver) {
       var _context$tenantResolv;
       const resolvedTenantResult = await ((_context$tenantResolv = context.tenantResolver) == null ? void 0 : _context$tenantResolv.call(context));
       if (resolvedTenantResult != null && resolvedTenantResult.tenant) {
@@ -91,7 +87,7 @@ export default ((store, api, sharedActions) => {
       }
     }
     const tenantId = getSearchParam(TENANT_ID_PARAM_KEY);
-    if (tenantId && !isTenantRequested) {
+    if (tenantId) {
       params['tenantId'] = tenantId;
     }
     if (FronteggNativeModule.isAvailable('closeWindow')) {

package/auth/LoginState/actions/index.d.ts

@@ -75,9 +75,5 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
     resetBreachedPassword: (payload: IForgotPassword) => Promise<void>;
     refreshTokenForSocialLogins: () => Promise<void>;
     __refreshToken: () => Promise<void>;
-    __redirectToSsoForTenant: ({ tenantId, address }: {
-        tenantId: string;
-        address: string;
-    }) => Promise<void>;
 };
 export default _default;

package/auth/LoginState/actions/index.js

@@ -23,85 +23,28 @@ import mfaWithEmailCodeActions from './mfaWithEmailCode.actions';
 import mfaWithSMSActions from './mfaWithSMS.actions';
 import mfaWithWebAuthnActions from './mfaWithWebAuthn.actions';
 import { LoginFlow, LoginStep } from '../interfaces';
-import { base64urlDecode, deepResetState, delay, errorHandler, errorTraceId, GTMEventAction, isSsoEnforcementError, publicKeyCredentialToJSON, refreshTokenWithRetry, reportGTMEvent, retryIfNeeded, withRetryConfig } from '../../../helpers';
+import { base64urlDecode, deepResetState, delay, errorHandler, errorTraceId, GTMEventAction, publicKeyCredentialToJSON, refreshTokenWithRetry, reportGTMEvent, retryIfNeeded, withRetryConfig } from '../../../helpers';
 import { initialState } from '../state';
 import { getSearchParam, isEmailPayload, isUsernamePayload, shouldShowPasswordRotationPromptFunc, TENANT_ID_PARAM_KEY } from '../helpers';
-import { AuthStrategyEnum, ContextHolder, ENFORCE_SSO_ON_TENANT_ACCESS_FF, FeatureFlags, getTabTenantFromSessionStorage, removeTabTenantFromSessionStorage, setTabTenantInSessionStorage, WebAuthnDeviceType, PreLoginAddressType } from '@frontegg/rest-api';
+import { AuthStrategyEnum, ContextHolder, FeatureFlags, getTabTenantFromSessionStorage, removeTabTenantFromSessionStorage, WebAuthnDeviceType, PreLoginAddressType } from '@frontegg/rest-api';
 import hostedLoginAuthorizeActions from './hostedLoginAuthorize.actions';
 import { clearHostedOAuthState } from '../oauthStorage';
 import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
 import { FronteggNativeModule, isEntitlementsDeeplyEqual } from '../../../toolkit';
 import { REQUEST_NAME, UserVerifiedOriginTypes } from '../../interfaces';
-import { authStrategyLoginStepMap } from '../consts';
-import { isMfaRequired, isResetPasswordRequired, setAfterAuthRedirectUrlForStepUp } from '../../helpers';
+import { authStrategyLoginStepMap, defaultOnRedirectTo } from '../consts';
+import { isMfaRequired, isResetPasswordRequired } from '../../helpers';
 import { MFAStep } from '../../MfaState/interfaces';
 import { SamlVendors } from '../../SSOState/interfaces';
-import { DEFAULT_RETRY_CONFIG, FRONTEGG_PENDING_SWITCH_TENANT } from '../../../constants';
+import { DEFAULT_RETRY_CONFIG } from '../../../constants';
+const SSO_REDIRECT_DELAY_MS = 2000;
+const isUsableRedirect = onRedirectTo => typeof onRedirectTo === 'function' && onRedirectTo !== defaultOnRedirectTo;
 export default ((store, api, sharedActions) => {
   const actions = sharedActions;
   const contextHolder = ContextHolder.for(store.root.appName);
 
-  /**
-   * Sends the user to log in through the tenant's SSO and back to the current page afterwards.
-   * @protected
-   */
-  const __redirectToSsoForTenant = async ({
-    tenantId,
-    address
-  }) => {
-    // on the login page (tenant chooser) keep the destination the login already saved
-    if (!window.location.pathname.endsWith(store.auth.routes.loginUrl)) {
-      setAfterAuthRedirectUrlForStepUp();
-    }
-    if (store.auth.hostedLoginBox) {
-      await actions.requestHostedLoginAuthorize({
-        prompt: 'login',
-        tenantId
-      });
-      return;
-    }
-    store.auth.onRedirectTo(address, {
-      refresh: true
-    });
-  };
-  /**
-   * Handles a token refresh refused because the tenant requires SSO.
-   * ssoRequired: true sends the user to SSO. ssoRequired: false renews once more for the tenant of the
-   * current token, which keeps the session.
-   * @returns true when handled, false when the caller should log out
-   * @private
-   */
-  const __handleSsoEnforcementRefreshError = async (e, isSsoEnforcementRetry, refreshForTenant) => {
-    var _store$auth$user;
-    const [isEnforceSsoOnTenantAccessEnabled] = FeatureFlags.getFeatureFlags([ENFORCE_SSO_ON_TENANT_ACCESS_FF], store.root.appName);
-    if (!isEnforceSsoOnTenantAccessEnabled || !isSsoEnforcementError(e)) {
-      return false;
-    }
-    const {
-      errorContext
-    } = e;
-    // the switch re-run after coming back from SSO keeps the session instead of sending the user to SSO again
-    const isPendingSwitchRerun = !!window.sessionStorage.getItem(FRONTEGG_PENDING_SWITCH_TENANT);
-    if (errorContext.ssoRequired && !isPendingSwitchRerun) {
-      await __redirectToSsoForTenant(errorContext);
-      return true;
-    }
-    if (isSsoEnforcementRetry) {
-      return false;
-    }
-    const currentTenantId = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.tenantId;
-    if (currentTenantId && contextHolder.isSessionPerTenantEnabled()) {
-      setTabTenantInSessionStorage(currentTenantId);
-    }
-    await refreshForTenant(currentTenantId);
-    return true;
-  };
-
   /** @private */
-  const __refreshTokenHosted = async ({
-    tenantId,
-    isSsoEnforcementRetry = false
-  } = {}) => {
+  const __refreshTokenHosted = async () => {
     const user = store.auth.user;
     if (!(user != null && user.refreshToken)) {
       contextHolder.setAccessToken(null);
@@ -113,7 +56,7 @@ export default ((store, api, sharedActions) => {
       return;
     }
     try {
-      const tabTenantId = tenantId != null ? tenantId : getTabTenantFromSessionStorage(store.root.appName);
+      const tabTenantId = getTabTenantFromSessionStorage(store.root.appName);
       const body = _extends({
         grant_type: 'refresh_token',
         refresh_token: user == null ? void 0 : user.refreshToken
@@ -128,13 +71,6 @@ export default ((store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
-      const retry = tenantId => __refreshTokenHosted({
-        tenantId,
-        isSsoEnforcementRetry: true
-      });
-      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
-        return;
-      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -154,10 +90,7 @@ export default ((store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenEmbedded = async ({
-    tenantId,
-    isSsoEnforcementRetry = false
-  } = {}) => {
+  const __refreshTokenEmbedded = async () => {
     try {
       const {
         routes,
@@ -168,7 +101,7 @@ export default ((store, api, sharedActions) => {
         user,
         tenants = [],
         activeTenant
-      } = await refreshTokenWithRetry(() => api.auth.refreshTokenV3(tenantId));
+      } = await refreshTokenWithRetry(() => api.auth.refreshTokenV3());
       if (isMfaRequired(user, store.root.appName)) {
         const mfaRequiredState = await actions.getMfaRequiredState(user);
         actions.setAuthState(mfaRequiredState);
@@ -199,13 +132,6 @@ export default ((store, api, sharedActions) => {
         });
       }
     } catch (e) {
-      const retry = tenantId => __refreshTokenEmbedded({
-        tenantId,
-        isSsoEnforcementRetry: true
-      });
-      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
-        return;
-      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -216,9 +142,7 @@ export default ((store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenWithNativeTokens = async ({
-    isSsoEnforcementRetry = false
-  } = {}) => {
+  const __refreshTokenWithNativeTokens = async () => {
     try {
       const authApi = api.auth;
       const response = await refreshTokenWithRetry(async () => {
@@ -232,13 +156,6 @@ export default ((store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
-      // native tokens can't name a tenant: the retry relies on the tab tenant only
-      const retry = () => __refreshTokenWithNativeTokens({
-        isSsoEnforcementRetry: true
-      });
-      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
-        return;
-      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -272,9 +189,9 @@ export default ((store, api, sharedActions) => {
    * @private
    */
   const __handleUnnecessaryEntitlementsUpdate = async updatedUser => {
-    var _store$auth$user2;
+    var _store$auth$user;
     // @ts-ignore TODO: fix entitlements state type
-    const oldEntitlements = (_store$auth$user2 = store.auth.user) == null ? void 0 : _store$auth$user2.entitlements;
+    const oldEntitlements = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.entitlements;
     if (isEntitlementsDeeplyEqual(oldEntitlements, updatedUser == null ? void 0 : updatedUser.entitlements)) {
       // set the previous entitlements object
       return _extends({}, updatedUser, {
@@ -472,6 +389,29 @@ export default ((store, api, sharedActions) => {
       callback == null ? void 0 : callback();
     }
   };
+
+  // v6 parity (takeLeading): a preLogin called while another is in flight is dropped.
+  let preLoginInFlight = false;
+  let latestPreLoginAttempt = 0;
+
+  // Read on use: the login box installs onRedirectTo lazily, logout() clears it and the store default is a no-op.
+  const redirectToFullPage = url => {
+    const onRedirectTo = [store.auth.onRedirectTo, contextHolder.onRedirectTo].find(isUsableRedirect);
+    if (onRedirectTo) {
+      onRedirectTo(url, {
+        refresh: true
+      });
+    } else {
+      window.location.href = url;
+    }
+  };
+  const scheduleSsoRedirect = (ssoRedirectUrl, attempt) => {
+    setTimeout(() => {
+      if (attempt === latestPreLoginAttempt && store.auth.loginState.step === LoginStep.redirectToSSO) {
+        redirectToFullPage(ssoRedirectUrl);
+      }
+    }, SSO_REDIRECT_DELAY_MS);
+  };
   const preLogin = async payload => {
     const {
       email,
@@ -480,11 +420,17 @@ export default ((store, api, sharedActions) => {
       invitationToken,
       callback
     } = payload;
+    if (preLoginInFlight) {
+      callback == null ? void 0 : callback();
+      return;
+    }
+    preLoginInFlight = true;
+    latestPreLoginAttempt += 1;
+    const attempt = latestPreLoginAttempt;
     setLoginState({
       loading: true
     });
     try {
-      const onRedirectTo = store.auth.onRedirectTo;
       const tenantId = getSearchParam(TENANT_ID_PARAM_KEY);
       const preLoginResult = await api.auth.preLoginV2(_extends({}, email ? {
         email
@@ -505,9 +451,7 @@ export default ((store, api, sharedActions) => {
           setLoginState({
             loading: false
           });
-          onRedirectTo(address, {
-            refresh: true
-          });
+          redirectToFullPage(address);
           return;
         }
         let ssoRedirectUrl = address;
@@ -530,11 +474,7 @@ export default ((store, api, sharedActions) => {
             loading: false,
             ssoRedirectUrl
           });
-          setTimeout(() => {
-            onRedirectTo(ssoRedirectUrl, {
-              refresh: true
-            });
-          }, 2000);
+          scheduleSsoRedirect(ssoRedirectUrl, attempt);
         }
       } else {
         await ssoPreloginFailed(_extends({}, username ? {
@@ -558,6 +498,8 @@ export default ((store, api, sharedActions) => {
         invitationToken,
         error: e
       }));
+    } finally {
+      preLoginInFlight = false;
     }
   };
   const postLogin = async payload => {
@@ -744,7 +686,6 @@ export default ((store, api, sharedActions) => {
     if (!keepHostedOAuthState) {
       clearHostedOAuthState();
     }
-    window.sessionStorage.removeItem(FRONTEGG_PENDING_SWITCH_TENANT);
   };
   const logout = async payload => {
     const hostedLoginBox = store.auth.hostedLoginBox;
@@ -1447,10 +1388,7 @@ export default ((store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenHostedSocialLogins = async ({
-    tenantId,
-    isSsoEnforcementRetry = false
-  } = {}) => {
+  const __refreshTokenHostedSocialLogins = async () => {
     const {
       user: currentUser
     } = store.auth;
@@ -1464,7 +1402,7 @@ export default ((store, api, sharedActions) => {
       return;
     }
     try {
-      const tabTenantId = tenantId != null ? tenantId : getTabTenantFromSessionStorage(store.root.appName);
+      const tabTenantId = getTabTenantFromSessionStorage(store.root.appName);
       const body = _extends({
         grant_type: 'refresh_token',
         refresh_token: currentUser == null ? void 0 : currentUser.refreshToken
@@ -1479,13 +1417,6 @@ export default ((store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
-      const retry = tenantId => __refreshTokenHostedSocialLogins({
-        tenantId,
-        isSsoEnforcementRetry: true
-      });
-      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
-        return;
-      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -1495,10 +1426,7 @@ export default ((store, api, sharedActions) => {
     }
   };
   /** @private */
-  const __refreshTokenEmbeddedSocialLogins = async ({
-    tenantId,
-    isSsoEnforcementRetry = false
-  } = {}) => {
+  const __refreshTokenEmbeddedSocialLogins = async () => {
     try {
       const {
         routes,
@@ -1509,7 +1437,7 @@ export default ((store, api, sharedActions) => {
         user,
         tenants = [],
         activeTenant
-      } = await refreshTokenWithRetry(() => api.auth.refreshTokenV3(tenantId));
+      } = await refreshTokenWithRetry(() => api.auth.refreshTokenV3());
       if (isMfaRequired(user, store.root.appName)) {
         const mfaRequiredState = await actions.getMfaRequiredState(user);
         actions.setAuthState(mfaRequiredState);
@@ -1559,13 +1487,6 @@ export default ((store, api, sharedActions) => {
         }
       }
     } catch (e) {
-      const retry = tenantId => __refreshTokenEmbeddedSocialLogins({
-        tenantId,
-        isSsoEnforcementRetry: true
-      });
-      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
-        return;
-      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -1612,7 +1533,6 @@ export default ((store, api, sharedActions) => {
     resetBreachedPassword,
     refreshTokenForSocialLogins,
     // protected
-    __refreshToken,
-    __redirectToSsoForTenant
+    __refreshToken
   }, hostedLoginAuthorizeActions(store, api, sharedActions), afterAuthNavigationActions(store, api, sharedActions), handleVerifyMFAResponseActions(store, api, sharedActions), mfaRequiredStateActions(store, api, sharedActions), mfaWithAuthenticatorActions(store, api, sharedActions), mfaWithEmailCodeActions(store, api, sharedActions), mfaWithSMSActions(store, api, sharedActions), mfaWithWebAuthnActions(store, api, sharedActions));
 });

package/auth/LoginState/consts.d.ts

@@ -6,5 +6,6 @@
 import { AuthStrategyEnum } from '@frontegg/rest-api';
 import { LoginStep } from './interfaces';
 import { AuthPageRoutes } from '../interfaces';
+export declare const defaultOnRedirectTo: () => undefined;
 export declare const authStrategyLoginStepMap: Record<Exclude<AuthStrategyEnum, AuthStrategyEnum.NoLocalAuthentication | AuthStrategyEnum.WebAuthN>, LoginStep>;
 export declare const defaultFronteggRoutes: AuthPageRoutes;

package/auth/LoginState/consts.js

@@ -5,6 +5,7 @@
  */
 import { AuthStrategyEnum } from '@frontegg/rest-api';
 import { LoginStep } from './interfaces';
+export const defaultOnRedirectTo = () => void 0;
 export const authStrategyLoginStepMap = {
   [AuthStrategyEnum.Code]: LoginStep.loginWithOtc,
   [AuthStrategyEnum.EmailAndPassword]: LoginStep.loginWithPassword,

package/auth/TenantsState/actions.js

@@ -1,7 +1,6 @@
 import { initialState } from './state';
-import { deepResetState, isSsoEnforcementError } from '../../helpers';
-import { ENFORCE_SSO_ON_TENANT_ACCESS_FF, FeatureFlags, getCurrentUserTenantsFunction } from '@frontegg/rest-api';
-import { FRONTEGG_PENDING_SWITCH_TENANT } from '../../constants';
+import { deepResetState } from '../../helpers';
+import { getCurrentUserTenantsFunction } from '@frontegg/rest-api';
 export default ((store, api, sharedActions) => {
   const actions = sharedActions;
   const setTenantsState = state => {
@@ -52,15 +51,6 @@ export default ((store, api, sharedActions) => {
       }) : actions.setAuthState({
         isLoading: false
       });
-      const [isEnforceSsoOnTenantAccessEnabled] = FeatureFlags.getFeatureFlags([ENFORCE_SSO_ON_TENANT_ACCESS_FF], store.root.appName);
-      // a switch re-run after coming back from SSO doesn't send the user to SSO again
-      const isPendingSwitchRerun = window.sessionStorage.getItem(FRONTEGG_PENDING_SWITCH_TENANT) === tenantId;
-      if (isEnforceSsoOnTenantAccessEnabled && isSsoEnforcementError(e) && e.errorContext.ssoRequired && !isPendingSwitchRerun) {
-        // saved to finish the switch after the SSO login, which may land in another tenant
-        window.sessionStorage.setItem(FRONTEGG_PENDING_SWITCH_TENANT, tenantId);
-        await actions.__redirectToSsoForTenant(e.errorContext);
-        return;
-      }
       callback == null ? void 0 : callback(false, e);
     }
   };

package/auth/index.js

@@ -37,7 +37,7 @@ import { buildTeamActions, createTeamState } from './TeamState';
 import { buildTenantsActions, createTenantsState } from './TenantsState';
 import { buildUsernamesActions, createUsernamesState } from './UsernamesState';
 import { buildUserEmailPolicyActions, createUserEmailPolicyState } from './UsersEmailsPolicyState';
-import { defaultFronteggRoutes } from './LoginState/consts';
+import { defaultFronteggRoutes, defaultOnRedirectTo } from './LoginState/consts';
 import { deepResetState, isProxy } from '../helpers';
 import { buildEntitlementsActions } from './Entitlements';
 import { createProxy } from '../toolkit/proxy';
@@ -91,7 +91,7 @@ export const createAuthState = _overrideState => {
     overrideState = _objectWithoutPropertiesLoose(_ref, _excluded);
   return createProxy(_extends({
     routes: _extends({}, defaultFronteggRoutes, routes),
-    onRedirectTo: () => void 0,
+    onRedirectTo: defaultOnRedirectTo,
     isAuthenticated: false,
     isLoading: true,
     isSSOAuth: false,

package/constants.d.ts

@@ -1,5 +1,4 @@
 export declare const FRONTEGG_AFTER_AUTH_REDIRECT_URL = "FRONTEGG_AFTER_AUTH_REDIRECT_URL";
-export declare const FRONTEGG_PENDING_SWITCH_TENANT = "FRONTEGG_PENDING_SWITCH_TENANT";
 export declare const HOSTED_LOGIN_VERIFIER_KEY = "HOSTED_LOGIN_VERIFIER_KEY";
 export declare const DEFAULT_RETRY_CONFIG: {
     retryCount: number;

package/constants.js

@@ -1,5 +1,4 @@
 export const FRONTEGG_AFTER_AUTH_REDIRECT_URL = 'FRONTEGG_AFTER_AUTH_REDIRECT_URL';
-export const FRONTEGG_PENDING_SWITCH_TENANT = 'FRONTEGG_PENDING_SWITCH_TENANT';
 export const HOSTED_LOGIN_VERIFIER_KEY = 'HOSTED_LOGIN_VERIFIER_KEY';
 export const DEFAULT_RETRY_CONFIG = {
   retryCount: 3

package/helpers/handlers.d.ts

@@ -1,7 +1,4 @@
-import { FronteggApiError, SsoEnforcementErrorContext } from '@frontegg/rest-api';
+import { FronteggApiError } from '@frontegg/rest-api';
 export declare const isFronteggApiError: (error: unknown | Error | FronteggApiError) => error is FronteggApiError;
-export declare const isSsoEnforcementError: (error: unknown) => error is FronteggApiError & {
-    errorContext: SsoEnforcementErrorContext;
-};
 export declare const isError: (error: any) => error is Error;
 export declare const errorHandler: <T>(error: unknown, fallback?: T) => FronteggApiError | T;

package/helpers/handlers.js

@@ -1,8 +1,5 @@
-import { FronteggApiError, GENERIC_ERROR_MESSAGE, GENERIC_ERROR_CODE, SSO_REQUIRED_FOR_TENANT_ERROR_CODE } from '@frontegg/rest-api';
+import { FronteggApiError, GENERIC_ERROR_MESSAGE, GENERIC_ERROR_CODE } from '@frontegg/rest-api';
 export const isFronteggApiError = error => Boolean(error == null ? void 0 : error.statusCode);
-
-// ER-01079 (disabled user / expired tenant) is not this: it still logs out
-export const isSsoEnforcementError = error => isFronteggApiError(error) && error.errorCode === SSO_REQUIRED_FOR_TENANT_ERROR_CODE;
 export const isError = error => {
   if (error instanceof Error) {
     return true;

package/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.129.0-alpha.0
+/** @license Frontegg v7.129.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/mocks/auth-mocks/loginActions.mocks.d.ts

@@ -71,9 +71,5 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
     resetBreachedPassword: (payload: import("dist/@frontegg/rest-api").IForgotPassword) => Promise<void>;
     refreshTokenForSocialLogins: () => Promise<void>;
     __refreshToken: () => Promise<void>;
-    __redirectToSsoForTenant: ({ tenantId, address }: {
-        tenantId: string;
-        address: string;
-    }) => Promise<void>;
 };
 export default _default;

package/node/auth/LoginState/actions/afterAuthNavigation.actions.js

@@ -6,7 +6,6 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.default = void 0;
 var _extends2 = _interopRequireDefault(require("@babel/runtime/helpers/extends"));
-var _restApi = require("@frontegg/rest-api");
 var _helpers = require("../helpers");
 var _tenantSelect = require("../helpers/tenantSelect");
 var _constants = require("../../../constants");
@@ -64,33 +63,6 @@ var _default = (store, api, sharedActions) => {
     }, additionalUpdate));
   }
 
-  /**
-   * A switch that needed SSO saved its target tenant (in this tab) before sending the user to SSO.
-   * Once logged in again, switch to it once if the login landed in another tenant.
-   * @returns true when the switch left the user without a session (MFA step for the target tenant, or logout)
-   */
-  async function switchToPendingSsoTenant() {
-    var _store$auth$user, _store$auth$user2;
-    const [isEnforceSsoOnTenantAccessEnabled] = _restApi.FeatureFlags.getFeatureFlags([_restApi.ENFORCE_SSO_ON_TENANT_ACCESS_FF], store.root.appName);
-    const pendingTenantId = window.sessionStorage.getItem(_constants.FRONTEGG_PENDING_SWITCH_TENANT);
-    if (!isEnforceSsoOnTenantAccessEnabled || !pendingTenantId || !((_store$auth$user = store.auth.user) != null && _store$auth$user.accessToken)) {
-      return false;
-    }
-    if (store.auth.user.tenantId === pendingTenantId) {
-      window.sessionStorage.removeItem(_constants.FRONTEGG_PENDING_SWITCH_TENANT);
-      return false;
-    }
-    // silentReload keeps switchingTenant set, so the switch's own refresh doesn't re-run this navigation
-    await actions.switchTenant({
-      tenantId: pendingTenantId,
-      silentReload: true,
-      keepLoginState: true
-    });
-    // removed only after the switch: a refused re-run must not send the user to SSO again
-    window.sessionStorage.removeItem(_constants.FRONTEGG_PENDING_SWITCH_TENANT);
-    return !((_store$auth$user2 = store.auth.user) != null && _store$auth$user2.accessToken);
-  }
-
   /**
    * @param customLoginAuthenticatedUrl custom login authenticated url if exists
    * @returns the authenticated url to redirect to after auth navigation
@@ -115,15 +87,19 @@ var _default = (store, api, sharedActions) => {
       logoutUrl,
       socialLoginCallbackUrl,
       activateUrl,
-      activateWithOTCUrl
+      activateWithOTCUrl,
+      oidcRedirectUrl
     } = routes;
     let finalUrl = urlFromLocalStorage;
     if (!finalUrl || [loginUrl, logoutUrl, socialLoginCallbackUrl, activateUrl, activateWithOTCUrl].includes(finalUrl)) {
       finalUrl = authenticatedUrl;
     }
+
+    // The OIDC callback's query is the IdP's code and state; the user's own query was saved with the URL.
+    const isOidcCallback = !!oidcRedirectUrl && window.location.pathname.endsWith(oidcRedirectUrl);
     const redirectUrl = (0, _helpers.getRedirectUrl)({
       authenticatedUrl: finalUrl,
-      includeQueryParam,
+      includeQueryParam: includeQueryParam && !isOidcCallback,
       enforceRedirectToSameSite,
       allowedRedirectOrigins
     });
@@ -194,7 +170,7 @@ var _default = (store, api, sharedActions) => {
    * until the resolved-guard, the LD flag, and the option all pass.
    */
   const shouldRouteToChooseTenant = async () => {
-    var _store$auth$tenantSel, _store$auth$user3, _store$auth$user3$act, _store$auth$tenantsSt;
+    var _store$auth$tenantSel, _store$auth$user, _store$auth$user$act, _store$auth$tenantsSt;
     const loginState = store.auth.loginState;
     // Guard first so re-entry after the choice is resolved finalizes without re-reading the flag.
     if (loginState.tenantChoiceResolved) {
@@ -210,7 +186,7 @@ var _default = (store, api, sharedActions) => {
       return false; // feature off — never read tenant data
     }
 
-    const isImpersonation = !!((_store$auth$user3 = store.auth.user) != null && (_store$auth$user3$act = _store$auth$user3.act) != null && _store$auth$user3$act.sub);
+    const isImpersonation = !!((_store$auth$user = store.auth.user) != null && (_store$auth$user$act = _store$auth$user.act) != null && _store$auth$user$act.sub);
     if (isImpersonation) {
       return false;
     }
@@ -288,14 +264,6 @@ var _default = (store, api, sharedActions) => {
     }
     try {
       var _window4, _payload$preventRedir;
-      const isSessionLostInPendingSwitch = await switchToPendingSsoTenant();
-      if (isSessionLostInPendingSwitch) {
-        // MFA for the target tenant or a failed refresh: continue on the login page
-        store.auth.onRedirectTo(store.auth.routes.loginUrl, {
-          preserveQueryParams: true
-        });
-        return;
-      }
       const {
         customLoginAuthenticatedUrl,
         stepUpUrl

package/node/auth/LoginState/actions/hostedLoginAuthorize.actions.js

@@ -8,7 +8,6 @@ exports.default = void 0;
 var _extends2 = _interopRequireDefault(require("@babel/runtime/helpers/extends"));
 var _helpers = require("../../../helpers");
 var _constants = require("../../../constants");
-var _restApi = require("@frontegg/rest-api");
 var _helpers2 = require("../helpers");
 var _helpers3 = require("../../helpers");
 var _consts = require("../../StepUpState/consts");
@@ -87,10 +86,7 @@ var _default = (store, api, sharedActions) => {
       code_challenge_method: 'S256',
       nonce
     }, additionalParams);
-    const [isEnforceSsoOnTenantAccessEnabled] = _restApi.FeatureFlags.getFeatureFlags([_restApi.ENFORCE_SSO_ON_TENANT_ACCESS_FF], store.root.appName);
-    // the tenant asked for (SSO for a refused switch or refresh) wins over the resolved and the page's tenant
-    const isTenantRequested = isEnforceSsoOnTenantAccessEnabled && !!(additionalParams != null && additionalParams.tenantId);
-    if (context.tenantResolver && !isTenantRequested) {
+    if (context.tenantResolver) {
       var _context$tenantResolv;
       const resolvedTenantResult = await ((_context$tenantResolv = context.tenantResolver) == null ? void 0 : _context$tenantResolv.call(context));
       if (resolvedTenantResult != null && resolvedTenantResult.tenant) {
@@ -98,7 +94,7 @@ var _default = (store, api, sharedActions) => {
       }
     }
     const tenantId = (0, _helpers2.getSearchParam)(_helpers2.TENANT_ID_PARAM_KEY);
-    if (tenantId && !isTenantRequested) {
+    if (tenantId) {
       params['tenantId'] = tenantId;
     }
     if (_toolkit.FronteggNativeModule.isAvailable('closeWindow')) {

package/node/auth/LoginState/actions/index.js

@@ -44,71 +44,14 @@ const _excluded = ["callback", "error"],
   _excluded13 = ["callback"],
   _excluded14 = ["callback"],
   _excluded15 = ["callback"];
+const SSO_REDIRECT_DELAY_MS = 2000;
+const isUsableRedirect = onRedirectTo => typeof onRedirectTo === 'function' && onRedirectTo !== _consts2.defaultOnRedirectTo;
 var _default = (store, api, sharedActions) => {
   const actions = sharedActions;
   const contextHolder = _restApi.ContextHolder.for(store.root.appName);
 
-  /**
-   * Sends the user to log in through the tenant's SSO and back to the current page afterwards.
-   * @protected
-   */
-  const __redirectToSsoForTenant = async ({
-    tenantId,
-    address
-  }) => {
-    // on the login page (tenant chooser) keep the destination the login already saved
-    if (!window.location.pathname.endsWith(store.auth.routes.loginUrl)) {
-      (0, _helpers3.setAfterAuthRedirectUrlForStepUp)();
-    }
-    if (store.auth.hostedLoginBox) {
-      await actions.requestHostedLoginAuthorize({
-        prompt: 'login',
-        tenantId
-      });
-      return;
-    }
-    store.auth.onRedirectTo(address, {
-      refresh: true
-    });
-  };
-  /**
-   * Handles a token refresh refused because the tenant requires SSO.
-   * ssoRequired: true sends the user to SSO. ssoRequired: false renews once more for the tenant of the
-   * current token, which keeps the session.
-   * @returns true when handled, false when the caller should log out
-   * @private
-   */
-  const __handleSsoEnforcementRefreshError = async (e, isSsoEnforcementRetry, refreshForTenant) => {
-    var _store$auth$user;
-    const [isEnforceSsoOnTenantAccessEnabled] = _restApi.FeatureFlags.getFeatureFlags([_restApi.ENFORCE_SSO_ON_TENANT_ACCESS_FF], store.root.appName);
-    if (!isEnforceSsoOnTenantAccessEnabled || !(0, _helpers.isSsoEnforcementError)(e)) {
-      return false;
-    }
-    const {
-      errorContext
-    } = e;
-    // the switch re-run after coming back from SSO keeps the session instead of sending the user to SSO again
-    const isPendingSwitchRerun = !!window.sessionStorage.getItem(_constants.FRONTEGG_PENDING_SWITCH_TENANT);
-    if (errorContext.ssoRequired && !isPendingSwitchRerun) {
-      await __redirectToSsoForTenant(errorContext);
-      return true;
-    }
-    if (isSsoEnforcementRetry) {
-      return false;
-    }
-    const currentTenantId = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.tenantId;
-    if (currentTenantId && contextHolder.isSessionPerTenantEnabled()) {
-      (0, _restApi.setTabTenantInSessionStorage)(currentTenantId);
-    }
-    await refreshForTenant(currentTenantId);
-    return true;
-  };
-
   /** @private */
-  const __refreshTokenHosted = async ({
-    tenantId,
-    isSsoEnforcementRetry = false
-  } = {}) => {
+  const __refreshTokenHosted = async () => {
     const user = store.auth.user;
     if (!(user != null && user.refreshToken)) {
       contextHolder.setAccessToken(null);
@@ -120,7 +63,7 @@ var _default = (store, api, sharedActions) => {
       return;
     }
     try {
-      const tabTenantId = tenantId != null ? tenantId : (0, _restApi.getTabTenantFromSessionStorage)(store.root.appName);
+      const tabTenantId = (0, _restApi.getTabTenantFromSessionStorage)(store.root.appName);
       const body = (0, _extends2.default)({
         grant_type: 'refresh_token',
         refresh_token: user == null ? void 0 : user.refreshToken
@@ -135,13 +78,6 @@ var _default = (store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
-      const retry = tenantId => __refreshTokenHosted({
-        tenantId,
-        isSsoEnforcementRetry: true
-      });
-      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
-        return;
-      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -161,10 +97,7 @@ var _default = (store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenEmbedded = async ({
-    tenantId,
-    isSsoEnforcementRetry = false
-  } = {}) => {
+  const __refreshTokenEmbedded = async () => {
     try {
       const {
         routes,
@@ -175,7 +108,7 @@ var _default = (store, api, sharedActions) => {
         user,
         tenants = [],
         activeTenant
-      } = await (0, _helpers.refreshTokenWithRetry)(() => api.auth.refreshTokenV3(tenantId));
+      } = await (0, _helpers.refreshTokenWithRetry)(() => api.auth.refreshTokenV3());
       if ((0, _helpers3.isMfaRequired)(user, store.root.appName)) {
         const mfaRequiredState = await actions.getMfaRequiredState(user);
         actions.setAuthState(mfaRequiredState);
@@ -206,13 +139,6 @@ var _default = (store, api, sharedActions) => {
         });
       }
     } catch (e) {
-      const retry = tenantId => __refreshTokenEmbedded({
-        tenantId,
-        isSsoEnforcementRetry: true
-      });
-      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
-        return;
-      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -223,9 +149,7 @@ var _default = (store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenWithNativeTokens = async ({
-    isSsoEnforcementRetry = false
-  } = {}) => {
+  const __refreshTokenWithNativeTokens = async () => {
     try {
       const authApi = api.auth;
       const response = await (0, _helpers.refreshTokenWithRetry)(async () => {
@@ -239,13 +163,6 @@ var _default = (store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
-      // native tokens can't name a tenant: the retry relies on the tab tenant only
-      const retry = () => __refreshTokenWithNativeTokens({
-        isSsoEnforcementRetry: true
-      });
-      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
-        return;
-      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -279,9 +196,9 @@ var _default = (store, api, sharedActions) => {
    * @private
    */
   const __handleUnnecessaryEntitlementsUpdate = async updatedUser => {
-    var _store$auth$user2;
+    var _store$auth$user;
     // @ts-ignore TODO: fix entitlements state type
-    const oldEntitlements = (_store$auth$user2 = store.auth.user) == null ? void 0 : _store$auth$user2.entitlements;
+    const oldEntitlements = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.entitlements;
     if ((0, _toolkit.isEntitlementsDeeplyEqual)(oldEntitlements, updatedUser == null ? void 0 : updatedUser.entitlements)) {
       // set the previous entitlements object
       return (0, _extends2.default)({}, updatedUser, {
@@ -479,6 +396,29 @@ var _default = (store, api, sharedActions) => {
       callback == null ? void 0 : callback();
     }
   };
+
+  // v6 parity (takeLeading): a preLogin called while another is in flight is dropped.
+  let preLoginInFlight = false;
+  let latestPreLoginAttempt = 0;
+
+  // Read on use: the login box installs onRedirectTo lazily, logout() clears it and the store default is a no-op.
+  const redirectToFullPage = url => {
+    const onRedirectTo = [store.auth.onRedirectTo, contextHolder.onRedirectTo].find(isUsableRedirect);
+    if (onRedirectTo) {
+      onRedirectTo(url, {
+        refresh: true
+      });
+    } else {
+      window.location.href = url;
+    }
+  };
+  const scheduleSsoRedirect = (ssoRedirectUrl, attempt) => {
+    setTimeout(() => {
+      if (attempt === latestPreLoginAttempt && store.auth.loginState.step === _interfaces.LoginStep.redirectToSSO) {
+        redirectToFullPage(ssoRedirectUrl);
+      }
+    }, SSO_REDIRECT_DELAY_MS);
+  };
   const preLogin = async payload => {
     const {
       email,
@@ -487,11 +427,17 @@ var _default = (store, api, sharedActions) => {
       invitationToken,
       callback
     } = payload;
+    if (preLoginInFlight) {
+      callback == null ? void 0 : callback();
+      return;
+    }
+    preLoginInFlight = true;
+    latestPreLoginAttempt += 1;
+    const attempt = latestPreLoginAttempt;
     setLoginState({
       loading: true
     });
     try {
-      const onRedirectTo = store.auth.onRedirectTo;
       const tenantId = (0, _helpers2.getSearchParam)(_helpers2.TENANT_ID_PARAM_KEY);
       const preLoginResult = await api.auth.preLoginV2((0, _extends2.default)({}, email ? {
         email
@@ -512,9 +458,7 @@ var _default = (store, api, sharedActions) => {
           setLoginState({
             loading: false
           });
-          onRedirectTo(address, {
-            refresh: true
-          });
+          redirectToFullPage(address);
           return;
         }
         let ssoRedirectUrl = address;
@@ -537,11 +481,7 @@ var _default = (store, api, sharedActions) => {
             loading: false,
             ssoRedirectUrl
           });
-          setTimeout(() => {
-            onRedirectTo(ssoRedirectUrl, {
-              refresh: true
-            });
-          }, 2000);
+          scheduleSsoRedirect(ssoRedirectUrl, attempt);
         }
       } else {
         await ssoPreloginFailed((0, _extends2.default)({}, username ? {
@@ -565,6 +505,8 @@ var _default = (store, api, sharedActions) => {
         invitationToken,
         error: e
       }));
+    } finally {
+      preLoginInFlight = false;
     }
   };
   const postLogin = async payload => {
@@ -751,7 +693,6 @@ var _default = (store, api, sharedActions) => {
     if (!keepHostedOAuthState) {
       (0, _oauthStorage.clearHostedOAuthState)();
     }
-    window.sessionStorage.removeItem(_constants.FRONTEGG_PENDING_SWITCH_TENANT);
   };
   const logout = async payload => {
     const hostedLoginBox = store.auth.hostedLoginBox;
@@ -1454,10 +1395,7 @@ var _default = (store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenHostedSocialLogins = async ({
-    tenantId,
-    isSsoEnforcementRetry = false
-  } = {}) => {
+  const __refreshTokenHostedSocialLogins = async () => {
     const {
       user: currentUser
     } = store.auth;
@@ -1471,7 +1409,7 @@ var _default = (store, api, sharedActions) => {
       return;
     }
     try {
-      const tabTenantId = tenantId != null ? tenantId : (0, _restApi.getTabTenantFromSessionStorage)(store.root.appName);
+      const tabTenantId = (0, _restApi.getTabTenantFromSessionStorage)(store.root.appName);
       const body = (0, _extends2.default)({
         grant_type: 'refresh_token',
         refresh_token: currentUser == null ? void 0 : currentUser.refreshToken
@@ -1486,13 +1424,6 @@ var _default = (store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
-      const retry = tenantId => __refreshTokenHostedSocialLogins({
-        tenantId,
-        isSsoEnforcementRetry: true
-      });
-      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
-        return;
-      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -1502,10 +1433,7 @@ var _default = (store, api, sharedActions) => {
     }
   };
   /** @private */
-  const __refreshTokenEmbeddedSocialLogins = async ({
-    tenantId,
-    isSsoEnforcementRetry = false
-  } = {}) => {
+  const __refreshTokenEmbeddedSocialLogins = async () => {
     try {
       const {
         routes,
@@ -1516,7 +1444,7 @@ var _default = (store, api, sharedActions) => {
         user,
         tenants = [],
         activeTenant
-      } = await (0, _helpers.refreshTokenWithRetry)(() => api.auth.refreshTokenV3(tenantId));
+      } = await (0, _helpers.refreshTokenWithRetry)(() => api.auth.refreshTokenV3());
       if ((0, _helpers3.isMfaRequired)(user, store.root.appName)) {
         const mfaRequiredState = await actions.getMfaRequiredState(user);
         actions.setAuthState(mfaRequiredState);
@@ -1566,13 +1494,6 @@ var _default = (store, api, sharedActions) => {
         }
       }
     } catch (e) {
-      const retry = tenantId => __refreshTokenEmbeddedSocialLogins({
-        tenantId,
-        isSsoEnforcementRetry: true
-      });
-      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
-        return;
-      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -1619,8 +1540,7 @@ var _default = (store, api, sharedActions) => {
     resetBreachedPassword,
     refreshTokenForSocialLogins,
     // protected
-    __refreshToken,
-    __redirectToSsoForTenant
+    __refreshToken
   }, (0, _hostedLoginAuthorize.default)(store, api, sharedActions), (0, _afterAuthNavigation.default)(store, api, sharedActions), (0, _handleVerifyMFAResponse.default)(store, api, sharedActions), (0, _mfaRequiredState.default)(store, api, sharedActions), (0, _mfaWithAuthenticator.default)(store, api, sharedActions), (0, _mfaWithEmailCode.default)(store, api, sharedActions), (0, _mfaWithSMS.default)(store, api, sharedActions), (0, _mfaWithWebAuthn.default)(store, api, sharedActions));
 };
 exports.default = _default;

package/node/auth/LoginState/consts.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.defaultFronteggRoutes = exports.authStrategyLoginStepMap = void 0;
+exports.defaultOnRedirectTo = exports.defaultFronteggRoutes = exports.authStrategyLoginStepMap = void 0;
 var _restApi = require("@frontegg/rest-api");
 var _interfaces = require("./interfaces");
 /**
@@ -12,6 +12,8 @@ var _interfaces = require("./interfaces");
  * please don't import from redux or from other files that import from redux
  */
 
+const defaultOnRedirectTo = () => void 0;
+exports.defaultOnRedirectTo = defaultOnRedirectTo;
 const authStrategyLoginStepMap = {
   [_restApi.AuthStrategyEnum.Code]: _interfaces.LoginStep.loginWithOtc,
   [_restApi.AuthStrategyEnum.EmailAndPassword]: _interfaces.LoginStep.loginWithPassword,

package/node/auth/TenantsState/actions.js

@@ -7,7 +7,6 @@ exports.default = void 0;
 var _state = require("./state");
 var _helpers = require("../../helpers");
 var _restApi = require("@frontegg/rest-api");
-var _constants = require("../../constants");
 var _default = (store, api, sharedActions) => {
   const actions = sharedActions;
   const setTenantsState = state => {
@@ -58,15 +57,6 @@ var _default = (store, api, sharedActions) => {
       }) : actions.setAuthState({
         isLoading: false
       });
-      const [isEnforceSsoOnTenantAccessEnabled] = _restApi.FeatureFlags.getFeatureFlags([_restApi.ENFORCE_SSO_ON_TENANT_ACCESS_FF], store.root.appName);
-      // a switch re-run after coming back from SSO doesn't send the user to SSO again
-      const isPendingSwitchRerun = window.sessionStorage.getItem(_constants.FRONTEGG_PENDING_SWITCH_TENANT) === tenantId;
-      if (isEnforceSsoOnTenantAccessEnabled && (0, _helpers.isSsoEnforcementError)(e) && e.errorContext.ssoRequired && !isPendingSwitchRerun) {
-        // saved to finish the switch after the SSO login, which may land in another tenant
-        window.sessionStorage.setItem(_constants.FRONTEGG_PENDING_SWITCH_TENANT, tenantId);
-        await actions.__redirectToSsoForTenant(e.errorContext);
-        return;
-      }
       callback == null ? void 0 : callback(false, e);
     }
   };

package/node/auth/index.js

@@ -559,7 +559,7 @@ const createAuthState = _overrideState => {
     overrideState = (0, _objectWithoutPropertiesLoose2.default)(_ref, _excluded);
   return (0, _proxy.createProxy)((0, _extends2.default)({
     routes: (0, _extends2.default)({}, _consts.defaultFronteggRoutes, routes),
-    onRedirectTo: () => void 0,
+    onRedirectTo: _consts.defaultOnRedirectTo,
     isAuthenticated: false,
     isLoading: true,
     isSSOAuth: false,

package/node/constants.js

@@ -5,11 +5,10 @@ Object.defineProperty(exports, "__esModule", {
 });
 var _exportNames = {
   FRONTEGG_AFTER_AUTH_REDIRECT_URL: true,
-  FRONTEGG_PENDING_SWITCH_TENANT: true,
   HOSTED_LOGIN_VERIFIER_KEY: true,
   DEFAULT_RETRY_CONFIG: true
 };
-exports.HOSTED_LOGIN_VERIFIER_KEY = exports.FRONTEGG_PENDING_SWITCH_TENANT = exports.FRONTEGG_AFTER_AUTH_REDIRECT_URL = exports.DEFAULT_RETRY_CONFIG = void 0;
+exports.HOSTED_LOGIN_VERIFIER_KEY = exports.FRONTEGG_AFTER_AUTH_REDIRECT_URL = exports.DEFAULT_RETRY_CONFIG = void 0;
 var _consts = require("./auth/StepUpState/consts");
 Object.keys(_consts).forEach(function (key) {
   if (key === "default" || key === "__esModule") return;
@@ -36,8 +35,6 @@ Object.keys(_consts2).forEach(function (key) {
 });
 const FRONTEGG_AFTER_AUTH_REDIRECT_URL = 'FRONTEGG_AFTER_AUTH_REDIRECT_URL';
 exports.FRONTEGG_AFTER_AUTH_REDIRECT_URL = FRONTEGG_AFTER_AUTH_REDIRECT_URL;
-const FRONTEGG_PENDING_SWITCH_TENANT = 'FRONTEGG_PENDING_SWITCH_TENANT';
-exports.FRONTEGG_PENDING_SWITCH_TENANT = FRONTEGG_PENDING_SWITCH_TENANT;
 const HOSTED_LOGIN_VERIFIER_KEY = 'HOSTED_LOGIN_VERIFIER_KEY';
 exports.HOSTED_LOGIN_VERIFIER_KEY = HOSTED_LOGIN_VERIFIER_KEY;
 const DEFAULT_RETRY_CONFIG = {

package/node/helpers/handlers.js

@@ -3,14 +3,10 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.isSsoEnforcementError = exports.isFronteggApiError = exports.isError = exports.errorHandler = void 0;
+exports.isFronteggApiError = exports.isError = exports.errorHandler = void 0;
 var _restApi = require("@frontegg/rest-api");
 const isFronteggApiError = error => Boolean(error == null ? void 0 : error.statusCode);
-
-// ER-01079 (disabled user / expired tenant) is not this: it still logs out
 exports.isFronteggApiError = isFronteggApiError;
-const isSsoEnforcementError = error => isFronteggApiError(error) && error.errorCode === _restApi.SSO_REQUIRED_FOR_TENANT_ERROR_CODE;
-exports.isSsoEnforcementError = isSsoEnforcementError;
 const isError = error => {
   if (error instanceof Error) {
     return true;

package/node/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.129.0-alpha.0
+/** @license Frontegg v7.129.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@frontegg/redux-store",
-  "version": "7.129.0-alpha.0",
+  "version": "7.129.0",
   "main": "./node/index.js",
   "license": "MIT",
   "author": "Frontegg LTD",
   "dependencies": {
     "@babel/runtime": "^7.18.6",
     "@frontegg/entitlements-javascript-commons": "1.1.2",
-    "@frontegg/rest-api": "7.129.0-alpha.0",
+    "@frontegg/rest-api": "7.129.0",
     "fast-deep-equal": "3.1.3",
     "get-value": "^3.0.1",
     "proxy-compare": "^3.0.0",