@frontegg/redux-store 7.130.0 → 7.131.0-alpha.0

package/auth/LoginState/actions/hostedLoginAuthorize.actions.d.ts

@@ -8,7 +8,9 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
         firstTime?: boolean;
         loginDirectAction?: LoginDirectAction;
     }) => Promise<void>;
-    __requestHostedLoginAuthorize: (additionalParams?: Record<string, string>) => Promise<void>;
+    __requestHostedLoginAuthorize: (additionalParams?: Record<string, string>, { forceTenantId }?: {
+        forceTenantId?: boolean;
+    }) => Promise<void>;
     __requestHostedLoginSilentAuthorize: () => Promise<void>;
     handleHostedLoginCallback: (payload: HostedLoginCallback) => Promise<void>;
 };

package/auth/LoginState/actions/hostedLoginAuthorize.actions.js

@@ -1,6 +1,7 @@
 import _extends from "@babel/runtime/helpers/esm/extends";
-import { createRandomString, generateCodeChallenge, GTMEventAction, refreshTokenWithRetry, reportGTMEvent } from '../../../helpers';
+import { createRandomString, generateCodeChallenge, GTMEventAction, isSsoEnforcementError, refreshTokenWithRetry, reportGTMEvent } from '../../../helpers';
 import { HOSTED_LOGIN_VERIFIER_KEY } from '../../../constants';
+import { isEnforceSsoOnTenantAccessEnabled } from '@frontegg/rest-api';
 import { getBaseNameWithoutSlashSuffix, getSearchParam, isOauthCallbackRoute, TENANT_ID_PARAM_KEY } from '../helpers';
 import { getUri, getUrlDerivedStepUp, isSteppedUp, redirectByStepUpUrl } from '../../helpers';
 import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
@@ -21,7 +22,17 @@ export default ((store, api, sharedActions) => {
         return await authApi.silentOAuthRefreshTokenV3(tokens);
       });
     } else {
-      response = await api.auth.silentOAuthRefreshTokenV2();
+      try {
+        response = await api.auth.silentOAuthRefreshTokenV2();
+      } catch (error) {
+        var _store$auth$user, _error$errorContext;
+        const tenantId = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.tenantId;
+        if (!isEnforceSsoOnTenantAccessEnabled(store.root.appName) || !isSsoEnforcementError(error) || ((_error$errorContext = error.errorContext) == null ? void 0 : _error$errorContext.ssoRequired) !== false || !tenantId) {
+          throw error;
+        }
+        // one retry for the tenant of the current token (a cold reload has no user yet: no retry)
+        response = await api.auth.silentOAuthRefreshTokenV2(tenantId);
+      }
     }
     if ((_response = response) != null && _response.user) {
       await actions.afterAuthenticationStateUpdate(response, {
@@ -32,7 +43,14 @@ export default ((store, api, sharedActions) => {
       throw new Error(`couldn't refresh user token with oauth service`);
     }
   };
-  const requestHostedLoginAuthorize = async additionalParams => {
+
+  /**
+   * @param options.forceTenantId the tenantId in additionalParams wins over the resolved and the page's tenant
+   * (sending the user to that tenant's SSO); other callers keep their custom login tenant
+   */
+  const requestHostedLoginAuthorize = async (additionalParams, {
+    forceTenantId = false
+  } = {}) => {
     var _store$auth$customLog;
     const {
       routes,
@@ -79,7 +97,7 @@ export default ((store, api, sharedActions) => {
       code_challenge_method: 'S256',
       nonce
     }, additionalParams);
-    if (context.tenantResolver) {
+    if (context.tenantResolver && !forceTenantId) {
       var _context$tenantResolv;
       const resolvedTenantResult = await ((_context$tenantResolv = context.tenantResolver) == null ? void 0 : _context$tenantResolv.call(context));
       if (resolvedTenantResult != null && resolvedTenantResult.tenant) {
@@ -87,7 +105,7 @@ export default ((store, api, sharedActions) => {
       }
     }
     const tenantId = getSearchParam(TENANT_ID_PARAM_KEY);
-    if (tenantId) {
+    if (tenantId && !forceTenantId) {
       params['tenantId'] = tenantId;
     }
     if (FronteggNativeModule.isAvailable('closeWindow')) {

package/auth/LoginState/actions/index.d.ts

@@ -37,7 +37,9 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
         firstTime?: boolean;
         loginDirectAction?: import("../interfaces").LoginDirectAction;
     }) => Promise<void>;
-    __requestHostedLoginAuthorize: (additionalParams?: Record<string, string>) => Promise<void>;
+    __requestHostedLoginAuthorize: (additionalParams?: Record<string, string>, { forceTenantId }?: {
+        forceTenantId?: boolean;
+    }) => Promise<void>;
     __requestHostedLoginSilentAuthorize: () => Promise<void>;
     handleHostedLoginCallback: (payload: import("../interfaces").HostedLoginCallback) => Promise<void>;
     setLoginState: (state: Partial<LoginState>) => void;
@@ -75,5 +77,10 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
     resetBreachedPassword: (payload: IForgotPassword) => Promise<void>;
     refreshTokenForSocialLogins: () => Promise<void>;
     __refreshToken: () => Promise<void>;
+    __redirectToSsoForTenant: ({ tenantId, address }: {
+        tenantId: string;
+        address: string;
+    }) => Promise<void>;
+    __redirectToSsoIfRequired: (e: unknown) => Promise<boolean>;
 };
 export default _default;

package/auth/LoginState/actions/index.js

@@ -1,20 +1,21 @@
-import _objectWithoutPropertiesLoose from "@babel/runtime/helpers/esm/objectWithoutPropertiesLoose";
 import _extends from "@babel/runtime/helpers/esm/extends";
-const _excluded = ["callback", "error"],
-  _excluded2 = ["callback"],
+import _objectWithoutPropertiesLoose from "@babel/runtime/helpers/esm/objectWithoutPropertiesLoose";
+const _excluded = ["authenticatedUrl"],
+  _excluded2 = ["callback", "error"],
   _excluded3 = ["callback"],
   _excluded4 = ["callback"],
   _excluded5 = ["callback"],
-  _excluded6 = ["callback", "events"],
-  _excluded7 = ["callback"],
+  _excluded6 = ["callback"],
+  _excluded7 = ["callback", "events"],
   _excluded8 = ["callback"],
-  _excluded9 = ["user"],
-  _excluded10 = ["callback"],
+  _excluded9 = ["callback"],
+  _excluded10 = ["user"],
   _excluded11 = ["callback"],
   _excluded12 = ["callback"],
   _excluded13 = ["callback"],
   _excluded14 = ["callback"],
-  _excluded15 = ["callback"];
+  _excluded15 = ["callback"],
+  _excluded16 = ["callback"];
 import afterAuthNavigationActions from './afterAuthNavigation.actions';
 import handleVerifyMFAResponseActions from './handleVerifyMFAResponse.actions';
 import mfaRequiredStateActions from './mfaRequiredState.actions';
@@ -23,17 +24,17 @@ import mfaWithEmailCodeActions from './mfaWithEmailCode.actions';
 import mfaWithSMSActions from './mfaWithSMS.actions';
 import mfaWithWebAuthnActions from './mfaWithWebAuthn.actions';
 import { LoginFlow, LoginStep } from '../interfaces';
-import { base64urlDecode, deepResetState, delay, errorHandler, errorTraceId, GTMEventAction, publicKeyCredentialToJSON, refreshTokenWithRetry, reportGTMEvent, retryIfNeeded, withRetryConfig } from '../../../helpers';
+import { base64urlDecode, deepResetState, delay, errorHandler, errorTraceId, GTMEventAction, isSsoEnforcementError, publicKeyCredentialToJSON, refreshTokenWithRetry, reportGTMEvent, retryIfNeeded, withRetryConfig } from '../../../helpers';
 import { initialState } from '../state';
 import { getSearchParam, isEmailPayload, isUsernamePayload, shouldShowPasswordRotationPromptFunc, TENANT_ID_PARAM_KEY } from '../helpers';
-import { AuthStrategyEnum, ContextHolder, FeatureFlags, getTabTenantFromSessionStorage, removeTabTenantFromSessionStorage, WebAuthnDeviceType, PreLoginAddressType } from '@frontegg/rest-api';
+import { AuthStrategyEnum, ContextHolder, isEnforceSsoOnTenantAccessEnabled, FeatureFlags, getTabTenantFromSessionStorage, removeTabTenantFromSessionStorage, setTabTenantInSessionStorage, WebAuthnDeviceType, PreLoginAddressType } from '@frontegg/rest-api';
 import hostedLoginAuthorizeActions from './hostedLoginAuthorize.actions';
 import { clearHostedOAuthState } from '../oauthStorage';
 import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
 import { FronteggNativeModule, isEntitlementsDeeplyEqual } from '../../../toolkit';
 import { REQUEST_NAME, UserVerifiedOriginTypes } from '../../interfaces';
-import { authStrategyLoginStepMap, defaultOnRedirectTo } from '../consts';
-import { isMfaRequired, isResetPasswordRequired } from '../../helpers';
+import { authStrategyLoginStepMap, defaultFronteggRoutes, defaultOnRedirectTo } from '../consts';
+import { isMfaRequired, isResetPasswordRequired, setAfterAuthRedirectUrlForStepUp } from '../../helpers';
 import { MFAStep } from '../../MfaState/interfaces';
 import { SamlVendors } from '../../SSOState/interfaces';
 import { DEFAULT_RETRY_CONFIG } from '../../../constants';
@@ -43,8 +44,83 @@ export default ((store, api, sharedActions) => {
   const actions = sharedActions;
   const contextHolder = ContextHolder.for(store.root.appName);
 
+  /**
+   * Sends the user to log in through the tenant's SSO and back to the current page afterwards.
+   * @protected
+   */
+  const __redirectToSsoForTenant = async ({
+    tenantId,
+    address
+  }) => {
+    // on an auth page (login, tenant chooser, social / magic link / SSO callback) keep the destination the login
+    // already saved: the page itself is not one to come back to
+    const _defaultFronteggRoute = _extends({}, defaultFronteggRoutes, store.auth.routes),
+      authRoutes = _objectWithoutPropertiesLoose(_defaultFronteggRoute, _excluded);
+    const isOnAuthPage = Object.values(authRoutes).some(route => typeof route === 'string' && !!route && window.location.pathname.endsWith(route));
+    if (!isOnAuthPage) {
+      setAfterAuthRedirectUrlForStepUp();
+    }
+    if (store.auth.hostedLoginBox) {
+      var _window$localStorage;
+      // as loginWithRedirect does, but the SSO tenant wins over the custom login tenant
+      (_window$localStorage = window.localStorage) == null ? void 0 : _window$localStorage.removeItem(SHOULD_STEP_UP_KEY);
+      await actions.__requestHostedLoginAuthorize({
+        prompt: 'login',
+        tenantId
+      }, {
+        forceTenantId: true
+      });
+      return;
+    }
+    store.auth.onRedirectTo(address, {
+      refresh: true
+    });
+  };
+
+  /**
+   * Sends the user to the tenant's SSO when a login or tenant switch is refused because that tenant requires it
+   * (e.g. an invitation into a tenant whose SSO covers the user's email). The SSO login lands in that tenant.
+   * @returns true when redirected, so the caller doesn't show the error
+   * @protected
+   */
+  const __redirectToSsoIfRequired = async e => {
+    if (!isEnforceSsoOnTenantAccessEnabled(store.root.appName) || !isSsoEnforcementError(e) || !e.errorContext.ssoRequired) {
+      return false;
+    }
+    await __redirectToSsoForTenant(e.errorContext);
+    return true;
+  };
+  /**
+   * Handles a hosted (OAuth) token refresh refused because the tenant requires SSO.
+   * ssoRequired: true sends the user to SSO, like login. ssoRequired: false renews once more for the tenant of the
+   * current token, which keeps the session: OAuth doesn't use up the refresh token on this refusal.
+   * @returns true when handled, false when the caller should log out
+   * @private
+   */
+  const __handleSsoEnforcementRefreshError = async (e, isSsoEnforcementRetry, refreshForTenant) => {
+    var _store$auth$user;
+    if (!isEnforceSsoOnTenantAccessEnabled(store.root.appName) || !isSsoEnforcementError(e)) {
+      return false;
+    }
+    if (await __redirectToSsoIfRequired(e)) {
+      return true;
+    }
+    const currentTenantId = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.tenantId;
+    if (isSsoEnforcementRetry || !currentTenantId) {
+      return false;
+    }
+    if (contextHolder.isSessionPerTenantEnabled()) {
+      setTabTenantInSessionStorage(currentTenantId);
+    }
+    await refreshForTenant(currentTenantId);
+    return true;
+  };
+
   /** @private */
-  const __refreshTokenHosted = async () => {
+  const __refreshTokenHosted = async ({
+    tenantId,
+    isSsoEnforcementRetry = false
+  } = {}) => {
     const user = store.auth.user;
     if (!(user != null && user.refreshToken)) {
       contextHolder.setAccessToken(null);
@@ -56,7 +132,7 @@ export default ((store, api, sharedActions) => {
       return;
     }
     try {
-      const tabTenantId = getTabTenantFromSessionStorage(store.root.appName);
+      const tabTenantId = tenantId != null ? tenantId : getTabTenantFromSessionStorage(store.root.appName);
       const body = _extends({
         grant_type: 'refresh_token',
         refresh_token: user == null ? void 0 : user.refreshToken
@@ -71,6 +147,13 @@ export default ((store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
+      const retry = tenantId => __refreshTokenHosted({
+        tenantId,
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -132,6 +215,10 @@ export default ((store, api, sharedActions) => {
         });
       }
     } catch (e) {
+      // a refused identity refresh has already used up the refresh token: no retry, only the SSO redirect
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -142,7 +229,9 @@ export default ((store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenWithNativeTokens = async () => {
+  const __refreshTokenWithNativeTokens = async ({
+    isSsoEnforcementRetry = false
+  } = {}) => {
     try {
       const authApi = api.auth;
       const response = await refreshTokenWithRetry(async () => {
@@ -156,6 +245,13 @@ export default ((store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
+      // native tokens can't name a tenant: the retry relies on the tab tenant only
+      const retry = () => __refreshTokenWithNativeTokens({
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -189,9 +285,9 @@ export default ((store, api, sharedActions) => {
    * @private
    */
   const __handleUnnecessaryEntitlementsUpdate = async updatedUser => {
-    var _store$auth$user;
+    var _store$auth$user2;
     // @ts-ignore TODO: fix entitlements state type
-    const oldEntitlements = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.entitlements;
+    const oldEntitlements = (_store$auth$user2 = store.auth.user) == null ? void 0 : _store$auth$user2.entitlements;
     if (isEntitlementsDeeplyEqual(oldEntitlements, updatedUser == null ? void 0 : updatedUser.entitlements)) {
       // set the previous entitlements object
       return _extends({}, updatedUser, {
@@ -359,7 +455,7 @@ export default ((store, api, sharedActions) => {
         callback,
         error
       } = _ref3,
-      body = _objectWithoutPropertiesLoose(_ref3, _excluded);
+      body = _objectWithoutPropertiesLoose(_ref3, _excluded2);
     const publicPolicy = store.auth.securityPolicyState.publicPolicy.policy;
     if (!(publicPolicy != null && publicPolicy.authStrategy)) {
       actions.setLoginState({
@@ -668,6 +764,9 @@ export default ((store, api, sharedActions) => {
     } catch (e) {
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       callback == null ? void 0 : callback(false, e);
       setLoginState({
         email,
@@ -752,7 +851,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = _objectWithoutPropertiesLoose(_payload, _excluded2);
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded3);
     try {
       setLoginState({
         loading: true
@@ -782,7 +881,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = _objectWithoutPropertiesLoose(_payload, _excluded3);
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded4);
     try {
       setLoginState({
         loading: true
@@ -807,7 +906,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = _objectWithoutPropertiesLoose(_payload, _excluded4);
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded5);
     try {
       setLoginState({
         loading: true
@@ -828,7 +927,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = _objectWithoutPropertiesLoose(_payload, _excluded5);
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded6);
     try {
       var _username;
       setLoginState({
@@ -872,7 +971,7 @@ export default ((store, api, sharedActions) => {
         callback,
         events
       } = _payload,
-      payload = _objectWithoutPropertiesLoose(_payload, _excluded6);
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded7);
     try {
       setLoginState({
         loading: true
@@ -963,6 +1062,9 @@ export default ((store, api, sharedActions) => {
         callback == null ? void 0 : callback(true);
       }
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoginState({
         error: errorHandler(e, 'Failed to authenticate')
       });
@@ -1000,7 +1102,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = payload,
-      body = _objectWithoutPropertiesLoose(payload, _excluded7);
+      body = _objectWithoutPropertiesLoose(payload, _excluded8);
     try {
       var _options$allowCredent;
       actions.setPasskeysState({
@@ -1040,7 +1142,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = payload,
-      body = _objectWithoutPropertiesLoose(payload, _excluded8);
+      body = _objectWithoutPropertiesLoose(payload, _excluded9);
     try {
       var _publicKey$response$u;
       actions.setPasskeysState({
@@ -1060,7 +1162,7 @@ export default ((store, api, sharedActions) => {
         {
           user
         } = _await$api$auth$webAu,
-        rest = _objectWithoutPropertiesLoose(_await$api$auth$webAu, _excluded9);
+        rest = _objectWithoutPropertiesLoose(_await$api$auth$webAu, _excluded10);
       if (isMfaRequired(user, store.root.appName)) {
         const {
           routes,
@@ -1099,6 +1201,9 @@ export default ((store, api, sharedActions) => {
       }
       // callback?.(true);
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoginState({
         error: errorHandler(e)
       });
@@ -1144,7 +1249,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = payload,
-      body = _objectWithoutPropertiesLoose(payload, _excluded10);
+      body = _objectWithoutPropertiesLoose(payload, _excluded11);
     try {
       setLoginState({
         loading: true
@@ -1209,7 +1314,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = _objectWithoutPropertiesLoose(_payload, _excluded11);
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded12);
     setLoginState({
       loading: true
     });
@@ -1244,7 +1349,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = _objectWithoutPropertiesLoose(_payload, _excluded12);
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded13);
     setLoginState({
       loading: true
     });
@@ -1270,7 +1375,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = _objectWithoutPropertiesLoose(_payload, _excluded13);
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded14);
     setLoginState({
       loading: true
     });
@@ -1293,7 +1398,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = _objectWithoutPropertiesLoose(_payload, _excluded14);
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded15);
     setLoginState({
       loading: true
     });
@@ -1320,7 +1425,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = _objectWithoutPropertiesLoose(_payload, _excluded15);
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded16);
     setLoginState({
       loading: true
     });
@@ -1388,7 +1493,10 @@ export default ((store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenHostedSocialLogins = async () => {
+  const __refreshTokenHostedSocialLogins = async ({
+    tenantId,
+    isSsoEnforcementRetry = false
+  } = {}) => {
     const {
       user: currentUser
     } = store.auth;
@@ -1402,7 +1510,7 @@ export default ((store, api, sharedActions) => {
       return;
     }
     try {
-      const tabTenantId = getTabTenantFromSessionStorage(store.root.appName);
+      const tabTenantId = tenantId != null ? tenantId : getTabTenantFromSessionStorage(store.root.appName);
       const body = _extends({
         grant_type: 'refresh_token',
         refresh_token: currentUser == null ? void 0 : currentUser.refreshToken
@@ -1417,6 +1525,13 @@ export default ((store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
+      const retry = tenantId => __refreshTokenHostedSocialLogins({
+        tenantId,
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -1487,6 +1602,9 @@ export default ((store, api, sharedActions) => {
         }
       }
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -1533,6 +1651,8 @@ export default ((store, api, sharedActions) => {
     resetBreachedPassword,
     refreshTokenForSocialLogins,
     // protected
-    __refreshToken
+    __refreshToken,
+    __redirectToSsoForTenant,
+    __redirectToSsoIfRequired
   }, hostedLoginAuthorizeActions(store, api, sharedActions), afterAuthNavigationActions(store, api, sharedActions), handleVerifyMFAResponseActions(store, api, sharedActions), mfaRequiredStateActions(store, api, sharedActions), mfaWithAuthenticatorActions(store, api, sharedActions), mfaWithEmailCodeActions(store, api, sharedActions), mfaWithSMSActions(store, api, sharedActions), mfaWithWebAuthnActions(store, api, sharedActions));
 });

package/auth/LoginState/actions/mfaWithAuthenticator.actions.js

@@ -145,6 +145,9 @@ export default ((store, api, sharedActions) => {
       }
       return await __postLoginMfaAuthenticator(isAuthenticated, user, callback);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoadingAction({
         loading: false,
         error: errorHandler(e)

package/auth/LoginState/actions/mfaWithEmailCode.actions.js

@@ -68,6 +68,9 @@ export default ((store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoadingAction({
         loading: false,
         error: errorHandler(e)

package/auth/LoginState/actions/mfaWithSMS.actions.js

@@ -73,6 +73,9 @@ export default ((store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoadingAction({
         loading: false,
         error: errorHandler(e)

package/auth/LoginState/actions/mfaWithWebAuthn.actions.js

@@ -87,6 +87,9 @@ export default ((store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoadingAction({
         loading: false,
         error: errorHandler(e)

package/auth/SocialLoginState/actions.js

@@ -157,6 +157,9 @@ export default ((store, api, sharedActions) => {
         loading: false
       });
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setSocialLoginsState({
         loading: false,
         error: errorHandler(e, 'Failed to authenticate'),

package/auth/TenantsState/actions.js

@@ -1,6 +1,6 @@
 import { initialState } from './state';
 import { deepResetState } from '../../helpers';
-import { getCurrentUserTenantsFunction } from '@frontegg/rest-api';
+import { ContextHolder, getCurrentUserTenantsFunction, setTabTenantInSessionStorage } from '@frontegg/rest-api';
 export default ((store, api, sharedActions) => {
   const actions = sharedActions;
   const setTenantsState = state => {
@@ -51,6 +51,13 @@ export default ((store, api, sharedActions) => {
       }) : actions.setAuthState({
         isLoading: false
       });
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        // the tab comes back from SSO in the target tenant, not the one the failed switch restored
+        if (ContextHolder.for(store.root.appName).isSessionPerTenantEnabled()) {
+          setTabTenantInSessionStorage(tenantId);
+        }
+        return;
+      }
       callback == null ? void 0 : callback(false, e);
     }
   };

package/helpers/handlers.d.ts

@@ -1,4 +1,7 @@
-import { FronteggApiError } from '@frontegg/rest-api';
+import { FronteggApiError, SsoEnforcementErrorContext } from '@frontegg/rest-api';
 export declare const isFronteggApiError: (error: unknown | Error | FronteggApiError) => error is FronteggApiError;
+export declare const isSsoEnforcementError: (error: unknown) => error is FronteggApiError & {
+    errorContext: SsoEnforcementErrorContext;
+};
 export declare const isError: (error: any) => error is Error;
 export declare const errorHandler: <T>(error: unknown, fallback?: T) => FronteggApiError | T;

package/helpers/handlers.js

@@ -1,5 +1,8 @@
-import { FronteggApiError, GENERIC_ERROR_MESSAGE, GENERIC_ERROR_CODE } from '@frontegg/rest-api';
+import { FronteggApiError, GENERIC_ERROR_MESSAGE, GENERIC_ERROR_CODE, SSO_REQUIRED_FOR_TENANT_ERROR_CODE } from '@frontegg/rest-api';
 export const isFronteggApiError = error => Boolean(error == null ? void 0 : error.statusCode);
+
+// ER-01079 (disabled user / expired tenant) is not this: it still logs out
+export const isSsoEnforcementError = error => isFronteggApiError(error) && error.errorCode === SSO_REQUIRED_FOR_TENANT_ERROR_CODE;
 export const isError = error => {
   if (error instanceof Error) {
     return true;

package/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.130.0
+/** @license Frontegg v7.131.0-alpha.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/mocks/auth-mocks/loginActions.mocks.d.ts

@@ -33,7 +33,9 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
         firstTime?: boolean;
         loginDirectAction?: import("../..").LoginDirectAction;
     }) => Promise<void>;
-    __requestHostedLoginAuthorize: (additionalParams?: Record<string, string>) => Promise<void>;
+    __requestHostedLoginAuthorize: (additionalParams?: Record<string, string>, { forceTenantId }?: {
+        forceTenantId?: boolean;
+    }) => Promise<void>;
     __requestHostedLoginSilentAuthorize: () => Promise<void>;
     handleHostedLoginCallback: (payload: import("../..").HostedLoginCallback) => Promise<void>;
     setLoginState: (state: Partial<import("../..").LoginState>) => void;
@@ -71,5 +73,10 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
     resetBreachedPassword: (payload: import("dist/@frontegg/rest-api").IForgotPassword) => Promise<void>;
     refreshTokenForSocialLogins: () => Promise<void>;
     __refreshToken: () => Promise<void>;
+    __redirectToSsoForTenant: ({ tenantId, address }: {
+        tenantId: string;
+        address: string;
+    }) => Promise<void>;
+    __redirectToSsoIfRequired: (e: unknown) => Promise<boolean>;
 };
 export default _default;

package/node/auth/LoginState/actions/hostedLoginAuthorize.actions.js

@@ -8,6 +8,7 @@ exports.default = void 0;
 var _extends2 = _interopRequireDefault(require("@babel/runtime/helpers/extends"));
 var _helpers = require("../../../helpers");
 var _constants = require("../../../constants");
+var _restApi = require("@frontegg/rest-api");
 var _helpers2 = require("../helpers");
 var _helpers3 = require("../../helpers");
 var _consts = require("../../StepUpState/consts");
@@ -28,7 +29,17 @@ var _default = (store, api, sharedActions) => {
         return await authApi.silentOAuthRefreshTokenV3(tokens);
       });
     } else {
-      response = await api.auth.silentOAuthRefreshTokenV2();
+      try {
+        response = await api.auth.silentOAuthRefreshTokenV2();
+      } catch (error) {
+        var _store$auth$user, _error$errorContext;
+        const tenantId = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.tenantId;
+        if (!(0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) || !(0, _helpers.isSsoEnforcementError)(error) || ((_error$errorContext = error.errorContext) == null ? void 0 : _error$errorContext.ssoRequired) !== false || !tenantId) {
+          throw error;
+        }
+        // one retry for the tenant of the current token (a cold reload has no user yet: no retry)
+        response = await api.auth.silentOAuthRefreshTokenV2(tenantId);
+      }
     }
     if ((_response = response) != null && _response.user) {
       await actions.afterAuthenticationStateUpdate(response, {
@@ -39,7 +50,14 @@ var _default = (store, api, sharedActions) => {
       throw new Error(`couldn't refresh user token with oauth service`);
     }
   };
-  const requestHostedLoginAuthorize = async additionalParams => {
+
+  /**
+   * @param options.forceTenantId the tenantId in additionalParams wins over the resolved and the page's tenant
+   * (sending the user to that tenant's SSO); other callers keep their custom login tenant
+   */
+  const requestHostedLoginAuthorize = async (additionalParams, {
+    forceTenantId = false
+  } = {}) => {
     var _store$auth$customLog;
     const {
       routes,
@@ -86,7 +104,7 @@ var _default = (store, api, sharedActions) => {
       code_challenge_method: 'S256',
       nonce
     }, additionalParams);
-    if (context.tenantResolver) {
+    if (context.tenantResolver && !forceTenantId) {
       var _context$tenantResolv;
       const resolvedTenantResult = await ((_context$tenantResolv = context.tenantResolver) == null ? void 0 : _context$tenantResolv.call(context));
       if (resolvedTenantResult != null && resolvedTenantResult.tenant) {
@@ -94,7 +112,7 @@ var _default = (store, api, sharedActions) => {
       }
     }
     const tenantId = (0, _helpers2.getSearchParam)(_helpers2.TENANT_ID_PARAM_KEY);
-    if (tenantId) {
+    if (tenantId && !forceTenantId) {
       params['tenantId'] = tenantId;
     }
     if (_toolkit.FronteggNativeModule.isAvailable('closeWindow')) {

package/node/auth/LoginState/actions/index.js

@@ -5,8 +5,8 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.default = void 0;
-var _objectWithoutPropertiesLoose2 = _interopRequireDefault(require("@babel/runtime/helpers/objectWithoutPropertiesLoose"));
 var _extends2 = _interopRequireDefault(require("@babel/runtime/helpers/extends"));
+var _objectWithoutPropertiesLoose2 = _interopRequireDefault(require("@babel/runtime/helpers/objectWithoutPropertiesLoose"));
 var _afterAuthNavigation = _interopRequireDefault(require("./afterAuthNavigation.actions"));
 var _handleVerifyMFAResponse = _interopRequireDefault(require("./handleVerifyMFAResponse.actions"));
 var _mfaRequiredState = _interopRequireDefault(require("./mfaRequiredState.actions"));
@@ -29,29 +29,105 @@ var _helpers3 = require("../../helpers");
 var _interfaces3 = require("../../MfaState/interfaces");
 var _interfaces4 = require("../../SSOState/interfaces");
 var _constants = require("../../../constants");
-const _excluded = ["callback", "error"],
-  _excluded2 = ["callback"],
+const _excluded = ["authenticatedUrl"],
+  _excluded2 = ["callback", "error"],
   _excluded3 = ["callback"],
   _excluded4 = ["callback"],
   _excluded5 = ["callback"],
-  _excluded6 = ["callback", "events"],
-  _excluded7 = ["callback"],
+  _excluded6 = ["callback"],
+  _excluded7 = ["callback", "events"],
   _excluded8 = ["callback"],
-  _excluded9 = ["user"],
-  _excluded10 = ["callback"],
+  _excluded9 = ["callback"],
+  _excluded10 = ["user"],
   _excluded11 = ["callback"],
   _excluded12 = ["callback"],
   _excluded13 = ["callback"],
   _excluded14 = ["callback"],
-  _excluded15 = ["callback"];
+  _excluded15 = ["callback"],
+  _excluded16 = ["callback"];
 const SSO_REDIRECT_DELAY_MS = 2000;
 const isUsableRedirect = onRedirectTo => typeof onRedirectTo === 'function' && onRedirectTo !== _consts2.defaultOnRedirectTo;
 var _default = (store, api, sharedActions) => {
   const actions = sharedActions;
   const contextHolder = _restApi.ContextHolder.for(store.root.appName);
 
+  /**
+   * Sends the user to log in through the tenant's SSO and back to the current page afterwards.
+   * @protected
+   */
+  const __redirectToSsoForTenant = async ({
+    tenantId,
+    address
+  }) => {
+    // on an auth page (login, tenant chooser, social / magic link / SSO callback) keep the destination the login
+    // already saved: the page itself is not one to come back to
+    const _defaultFronteggRoute = (0, _extends2.default)({}, _consts2.defaultFronteggRoutes, store.auth.routes),
+      authRoutes = (0, _objectWithoutPropertiesLoose2.default)(_defaultFronteggRoute, _excluded);
+    const isOnAuthPage = Object.values(authRoutes).some(route => typeof route === 'string' && !!route && window.location.pathname.endsWith(route));
+    if (!isOnAuthPage) {
+      (0, _helpers3.setAfterAuthRedirectUrlForStepUp)();
+    }
+    if (store.auth.hostedLoginBox) {
+      var _window$localStorage;
+      // as loginWithRedirect does, but the SSO tenant wins over the custom login tenant
+      (_window$localStorage = window.localStorage) == null ? void 0 : _window$localStorage.removeItem(_consts.SHOULD_STEP_UP_KEY);
+      await actions.__requestHostedLoginAuthorize({
+        prompt: 'login',
+        tenantId
+      }, {
+        forceTenantId: true
+      });
+      return;
+    }
+    store.auth.onRedirectTo(address, {
+      refresh: true
+    });
+  };
+
+  /**
+   * Sends the user to the tenant's SSO when a login or tenant switch is refused because that tenant requires it
+   * (e.g. an invitation into a tenant whose SSO covers the user's email). The SSO login lands in that tenant.
+   * @returns true when redirected, so the caller doesn't show the error
+   * @protected
+   */
+  const __redirectToSsoIfRequired = async e => {
+    if (!(0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) || !(0, _helpers.isSsoEnforcementError)(e) || !e.errorContext.ssoRequired) {
+      return false;
+    }
+    await __redirectToSsoForTenant(e.errorContext);
+    return true;
+  };
+  /**
+   * Handles a hosted (OAuth) token refresh refused because the tenant requires SSO.
+   * ssoRequired: true sends the user to SSO, like login. ssoRequired: false renews once more for the tenant of the
+   * current token, which keeps the session: OAuth doesn't use up the refresh token on this refusal.
+   * @returns true when handled, false when the caller should log out
+   * @private
+   */
+  const __handleSsoEnforcementRefreshError = async (e, isSsoEnforcementRetry, refreshForTenant) => {
+    var _store$auth$user;
+    if (!(0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) || !(0, _helpers.isSsoEnforcementError)(e)) {
+      return false;
+    }
+    if (await __redirectToSsoIfRequired(e)) {
+      return true;
+    }
+    const currentTenantId = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.tenantId;
+    if (isSsoEnforcementRetry || !currentTenantId) {
+      return false;
+    }
+    if (contextHolder.isSessionPerTenantEnabled()) {
+      (0, _restApi.setTabTenantInSessionStorage)(currentTenantId);
+    }
+    await refreshForTenant(currentTenantId);
+    return true;
+  };
+
   /** @private */
-  const __refreshTokenHosted = async () => {
+  const __refreshTokenHosted = async ({
+    tenantId,
+    isSsoEnforcementRetry = false
+  } = {}) => {
     const user = store.auth.user;
     if (!(user != null && user.refreshToken)) {
       contextHolder.setAccessToken(null);
@@ -63,7 +139,7 @@ var _default = (store, api, sharedActions) => {
       return;
     }
     try {
-      const tabTenantId = (0, _restApi.getTabTenantFromSessionStorage)(store.root.appName);
+      const tabTenantId = tenantId != null ? tenantId : (0, _restApi.getTabTenantFromSessionStorage)(store.root.appName);
       const body = (0, _extends2.default)({
         grant_type: 'refresh_token',
         refresh_token: user == null ? void 0 : user.refreshToken
@@ -78,6 +154,13 @@ var _default = (store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
+      const retry = tenantId => __refreshTokenHosted({
+        tenantId,
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -139,6 +222,10 @@ var _default = (store, api, sharedActions) => {
         });
       }
     } catch (e) {
+      // a refused identity refresh has already used up the refresh token: no retry, only the SSO redirect
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -149,7 +236,9 @@ var _default = (store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenWithNativeTokens = async () => {
+  const __refreshTokenWithNativeTokens = async ({
+    isSsoEnforcementRetry = false
+  } = {}) => {
     try {
       const authApi = api.auth;
       const response = await (0, _helpers.refreshTokenWithRetry)(async () => {
@@ -163,6 +252,13 @@ var _default = (store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
+      // native tokens can't name a tenant: the retry relies on the tab tenant only
+      const retry = () => __refreshTokenWithNativeTokens({
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -196,9 +292,9 @@ var _default = (store, api, sharedActions) => {
    * @private
    */
   const __handleUnnecessaryEntitlementsUpdate = async updatedUser => {
-    var _store$auth$user;
+    var _store$auth$user2;
     // @ts-ignore TODO: fix entitlements state type
-    const oldEntitlements = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.entitlements;
+    const oldEntitlements = (_store$auth$user2 = store.auth.user) == null ? void 0 : _store$auth$user2.entitlements;
     if ((0, _toolkit.isEntitlementsDeeplyEqual)(oldEntitlements, updatedUser == null ? void 0 : updatedUser.entitlements)) {
       // set the previous entitlements object
       return (0, _extends2.default)({}, updatedUser, {
@@ -366,7 +462,7 @@ var _default = (store, api, sharedActions) => {
         callback,
         error
       } = _ref3,
-      body = (0, _objectWithoutPropertiesLoose2.default)(_ref3, _excluded);
+      body = (0, _objectWithoutPropertiesLoose2.default)(_ref3, _excluded2);
     const publicPolicy = store.auth.securityPolicyState.publicPolicy.policy;
     if (!(publicPolicy != null && publicPolicy.authStrategy)) {
       actions.setLoginState({
@@ -675,6 +771,9 @@ var _default = (store, api, sharedActions) => {
     } catch (e) {
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       callback == null ? void 0 : callback(false, e);
       setLoginState({
         email,
@@ -759,7 +858,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded2);
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded3);
     try {
       setLoginState({
         loading: true
@@ -789,7 +888,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded3);
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded4);
     try {
       setLoginState({
         loading: true
@@ -814,7 +913,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded4);
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded5);
     try {
       setLoginState({
         loading: true
@@ -835,7 +934,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded5);
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded6);
     try {
       var _username;
       setLoginState({
@@ -879,7 +978,7 @@ var _default = (store, api, sharedActions) => {
         callback,
         events
       } = _payload,
-      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded6);
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded7);
     try {
       setLoginState({
         loading: true
@@ -970,6 +1069,9 @@ var _default = (store, api, sharedActions) => {
         callback == null ? void 0 : callback(true);
       }
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoginState({
         error: (0, _helpers.errorHandler)(e, 'Failed to authenticate')
       });
@@ -1007,7 +1109,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = payload,
-      body = (0, _objectWithoutPropertiesLoose2.default)(payload, _excluded7);
+      body = (0, _objectWithoutPropertiesLoose2.default)(payload, _excluded8);
     try {
       var _options$allowCredent;
       actions.setPasskeysState({
@@ -1047,7 +1149,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = payload,
-      body = (0, _objectWithoutPropertiesLoose2.default)(payload, _excluded8);
+      body = (0, _objectWithoutPropertiesLoose2.default)(payload, _excluded9);
     try {
       var _publicKey$response$u;
       actions.setPasskeysState({
@@ -1067,7 +1169,7 @@ var _default = (store, api, sharedActions) => {
         {
           user
         } = _await$api$auth$webAu,
-        rest = (0, _objectWithoutPropertiesLoose2.default)(_await$api$auth$webAu, _excluded9);
+        rest = (0, _objectWithoutPropertiesLoose2.default)(_await$api$auth$webAu, _excluded10);
       if ((0, _helpers3.isMfaRequired)(user, store.root.appName)) {
         const {
           routes,
@@ -1106,6 +1208,9 @@ var _default = (store, api, sharedActions) => {
       }
       // callback?.(true);
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoginState({
         error: (0, _helpers.errorHandler)(e)
       });
@@ -1151,7 +1256,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = payload,
-      body = (0, _objectWithoutPropertiesLoose2.default)(payload, _excluded10);
+      body = (0, _objectWithoutPropertiesLoose2.default)(payload, _excluded11);
     try {
       setLoginState({
         loading: true
@@ -1216,7 +1321,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded11);
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded12);
     setLoginState({
       loading: true
     });
@@ -1251,7 +1356,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded12);
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded13);
     setLoginState({
       loading: true
     });
@@ -1277,7 +1382,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded13);
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded14);
     setLoginState({
       loading: true
     });
@@ -1300,7 +1405,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded14);
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded15);
     setLoginState({
       loading: true
     });
@@ -1327,7 +1432,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded15);
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded16);
     setLoginState({
       loading: true
     });
@@ -1395,7 +1500,10 @@ var _default = (store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenHostedSocialLogins = async () => {
+  const __refreshTokenHostedSocialLogins = async ({
+    tenantId,
+    isSsoEnforcementRetry = false
+  } = {}) => {
     const {
       user: currentUser
     } = store.auth;
@@ -1409,7 +1517,7 @@ var _default = (store, api, sharedActions) => {
       return;
     }
     try {
-      const tabTenantId = (0, _restApi.getTabTenantFromSessionStorage)(store.root.appName);
+      const tabTenantId = tenantId != null ? tenantId : (0, _restApi.getTabTenantFromSessionStorage)(store.root.appName);
       const body = (0, _extends2.default)({
         grant_type: 'refresh_token',
         refresh_token: currentUser == null ? void 0 : currentUser.refreshToken
@@ -1424,6 +1532,13 @@ var _default = (store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
+      const retry = tenantId => __refreshTokenHostedSocialLogins({
+        tenantId,
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -1494,6 +1609,9 @@ var _default = (store, api, sharedActions) => {
         }
       }
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -1540,7 +1658,9 @@ var _default = (store, api, sharedActions) => {
     resetBreachedPassword,
     refreshTokenForSocialLogins,
     // protected
-    __refreshToken
+    __refreshToken,
+    __redirectToSsoForTenant,
+    __redirectToSsoIfRequired
   }, (0, _hostedLoginAuthorize.default)(store, api, sharedActions), (0, _afterAuthNavigation.default)(store, api, sharedActions), (0, _handleVerifyMFAResponse.default)(store, api, sharedActions), (0, _mfaRequiredState.default)(store, api, sharedActions), (0, _mfaWithAuthenticator.default)(store, api, sharedActions), (0, _mfaWithEmailCode.default)(store, api, sharedActions), (0, _mfaWithSMS.default)(store, api, sharedActions), (0, _mfaWithWebAuthn.default)(store, api, sharedActions));
 };
 exports.default = _default;

package/node/auth/LoginState/actions/mfaWithAuthenticator.actions.js

@@ -152,6 +152,9 @@ var _default = (store, api, sharedActions) => {
       }
       return await __postLoginMfaAuthenticator(isAuthenticated, user, callback);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoadingAction({
         loading: false,
         error: (0, _helpers.errorHandler)(e)

package/node/auth/LoginState/actions/mfaWithEmailCode.actions.js

@@ -75,6 +75,9 @@ var _default = (store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoadingAction({
         loading: false,
         error: (0, _helpers.errorHandler)(e)

package/node/auth/LoginState/actions/mfaWithSMS.actions.js

@@ -80,6 +80,9 @@ var _default = (store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoadingAction({
         loading: false,
         error: (0, _helpers.errorHandler)(e)

package/node/auth/LoginState/actions/mfaWithWebAuthn.actions.js

@@ -94,6 +94,9 @@ var _default = (store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoadingAction({
         loading: false,
         error: (0, _helpers.errorHandler)(e)

package/node/auth/SocialLoginState/actions.js

@@ -164,6 +164,9 @@ var _default = (store, api, sharedActions) => {
         loading: false
       });
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setSocialLoginsState({
         loading: false,
         error: (0, _helpers.errorHandler)(e, 'Failed to authenticate'),

package/node/auth/TenantsState/actions.js

@@ -57,6 +57,13 @@ var _default = (store, api, sharedActions) => {
       }) : actions.setAuthState({
         isLoading: false
       });
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        // the tab comes back from SSO in the target tenant, not the one the failed switch restored
+        if (_restApi.ContextHolder.for(store.root.appName).isSessionPerTenantEnabled()) {
+          (0, _restApi.setTabTenantInSessionStorage)(tenantId);
+        }
+        return;
+      }
       callback == null ? void 0 : callback(false, e);
     }
   };

package/node/helpers/handlers.js

@@ -3,10 +3,14 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.isFronteggApiError = exports.isError = exports.errorHandler = void 0;
+exports.isSsoEnforcementError = exports.isFronteggApiError = exports.isError = exports.errorHandler = void 0;
 var _restApi = require("@frontegg/rest-api");
 const isFronteggApiError = error => Boolean(error == null ? void 0 : error.statusCode);
+
+// ER-01079 (disabled user / expired tenant) is not this: it still logs out
 exports.isFronteggApiError = isFronteggApiError;
+const isSsoEnforcementError = error => isFronteggApiError(error) && error.errorCode === _restApi.SSO_REQUIRED_FOR_TENANT_ERROR_CODE;
+exports.isSsoEnforcementError = isSsoEnforcementError;
 const isError = error => {
   if (error instanceof Error) {
     return true;

package/node/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.130.0
+/** @license Frontegg v7.131.0-alpha.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@frontegg/redux-store",
-  "version": "7.130.0",
+  "version": "7.131.0-alpha.0",
   "main": "./node/index.js",
   "license": "MIT",
   "author": "Frontegg LTD",
   "dependencies": {
     "@babel/runtime": "^7.18.6",
     "@frontegg/entitlements-javascript-commons": "1.1.2",
-    "@frontegg/rest-api": "7.130.0",
+    "@frontegg/rest-api": "7.131.0-alpha.0",
     "fast-deep-equal": "3.1.3",
     "get-value": "^3.0.1",
     "proxy-compare": "^3.0.0",