@frontegg/redux-store 7.130.0 → 7.131.0-alpha.1

package/auth/ActivateAccountState/actions.js

@@ -151,6 +151,9 @@ export default ((store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setActivateState({
         loading: false,
         error: errorHandler(e)
@@ -188,6 +191,9 @@ export default ((store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setActivateState({
         submitting: false,
         loading: false,

package/auth/LoginState/actions/hostedLoginAuthorize.actions.d.ts

@@ -8,7 +8,9 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
         firstTime?: boolean;
         loginDirectAction?: LoginDirectAction;
     }) => Promise<void>;
-    __requestHostedLoginAuthorize: (additionalParams?: Record<string, string>) => Promise<void>;
+    __requestHostedLoginAuthorize: (additionalParams?: Record<string, string>, { forceTenantId }?: {
+        forceTenantId?: boolean;
+    }) => Promise<void>;
     __requestHostedLoginSilentAuthorize: () => Promise<void>;
     handleHostedLoginCallback: (payload: HostedLoginCallback) => Promise<void>;
 };

package/auth/LoginState/actions/hostedLoginAuthorize.actions.js

@@ -1,8 +1,9 @@
 import _extends from "@babel/runtime/helpers/esm/extends";
-import { createRandomString, generateCodeChallenge, GTMEventAction, refreshTokenWithRetry, reportGTMEvent } from '../../../helpers';
+import { createRandomString, generateCodeChallenge, GTMEventAction, isSsoEnforcementError, refreshTokenWithRetry, reportGTMEvent } from '../../../helpers';
 import { HOSTED_LOGIN_VERIFIER_KEY } from '../../../constants';
+import { isEnforceSsoOnTenantAccessEnabled } from '@frontegg/rest-api';
 import { getBaseNameWithoutSlashSuffix, getSearchParam, isOauthCallbackRoute, TENANT_ID_PARAM_KEY } from '../helpers';
-import { getUri, getUrlDerivedStepUp, isSteppedUp, redirectByStepUpUrl } from '../../helpers';
+import { getUri, getUrlDerivedStepUp, isSteppedUp, redirectByStepUpUrl, restoreTabTenantUnlessSsoCallback } from '../../helpers';
 import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
 import { FronteggNativeModule } from '../../../toolkit';
 export default ((store, api, sharedActions) => {
@@ -14,6 +15,7 @@ export default ((store, api, sharedActions) => {
   const __requestHostedLoginSilentAuthorize = async () => {
     var _response;
     let response;
+    restoreTabTenantUnlessSsoCallback(store);
     if (FronteggNativeModule.isGetTokensAvailable()) {
       const authApi = api.auth;
       response = await refreshTokenWithRetry(async () => {
@@ -21,7 +23,21 @@ export default ((store, api, sharedActions) => {
         return await authApi.silentOAuthRefreshTokenV3(tokens);
       });
     } else {
-      response = await api.auth.silentOAuthRefreshTokenV2();
+      try {
+        response = await api.auth.silentOAuthRefreshTokenV2();
+      } catch (error) {
+        var _store$auth$user, _error$errorContext;
+        // the tenant requires SSO: hosted login for that tenant, not the plain one the caller falls back to
+        if (await actions.__redirectToSsoIfRequired(error)) {
+          return;
+        }
+        const tenantId = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.tenantId;
+        if (!isEnforceSsoOnTenantAccessEnabled(store.root.appName) || !isSsoEnforcementError(error) || ((_error$errorContext = error.errorContext) == null ? void 0 : _error$errorContext.ssoRequired) !== false || !tenantId) {
+          throw error;
+        }
+        // one retry for the tenant of the current token (a cold reload has no user yet: no retry)
+        response = await api.auth.silentOAuthRefreshTokenV2(tenantId);
+      }
     }
     if ((_response = response) != null && _response.user) {
       await actions.afterAuthenticationStateUpdate(response, {
@@ -32,7 +48,14 @@ export default ((store, api, sharedActions) => {
       throw new Error(`couldn't refresh user token with oauth service`);
     }
   };
-  const requestHostedLoginAuthorize = async additionalParams => {
+
+  /**
+   * @param options.forceTenantId the tenantId in additionalParams wins over the resolved and the page's tenant
+   * (sending the user to that tenant's SSO); other callers keep their custom login tenant
+   */
+  const requestHostedLoginAuthorize = async (additionalParams, {
+    forceTenantId = false
+  } = {}) => {
     var _store$auth$customLog;
     const {
       routes,
@@ -79,7 +102,7 @@ export default ((store, api, sharedActions) => {
       code_challenge_method: 'S256',
       nonce
     }, additionalParams);
-    if (context.tenantResolver) {
+    if (context.tenantResolver && !forceTenantId) {
       var _context$tenantResolv;
       const resolvedTenantResult = await ((_context$tenantResolv = context.tenantResolver) == null ? void 0 : _context$tenantResolv.call(context));
       if (resolvedTenantResult != null && resolvedTenantResult.tenant) {
@@ -87,7 +110,7 @@ export default ((store, api, sharedActions) => {
       }
     }
     const tenantId = getSearchParam(TENANT_ID_PARAM_KEY);
-    if (tenantId) {
+    if (tenantId && !forceTenantId) {
       params['tenantId'] = tenantId;
     }
     if (FronteggNativeModule.isAvailable('closeWindow')) {

package/auth/LoginState/actions/index.d.ts

@@ -37,7 +37,9 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
         firstTime?: boolean;
         loginDirectAction?: import("../interfaces").LoginDirectAction;
     }) => Promise<void>;
-    __requestHostedLoginAuthorize: (additionalParams?: Record<string, string>) => Promise<void>;
+    __requestHostedLoginAuthorize: (additionalParams?: Record<string, string>, { forceTenantId }?: {
+        forceTenantId?: boolean;
+    }) => Promise<void>;
     __requestHostedLoginSilentAuthorize: () => Promise<void>;
     handleHostedLoginCallback: (payload: import("../interfaces").HostedLoginCallback) => Promise<void>;
     setLoginState: (state: Partial<LoginState>) => void;
@@ -75,5 +77,10 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
     resetBreachedPassword: (payload: IForgotPassword) => Promise<void>;
     refreshTokenForSocialLogins: () => Promise<void>;
     __refreshToken: () => Promise<void>;
+    __redirectToSsoForTenant: ({ tenantId, address }: {
+        tenantId: string;
+        address: string;
+    }) => Promise<void>;
+    __redirectToSsoIfRequired: (e: unknown) => Promise<boolean>;
 };
 export default _default;

package/auth/LoginState/actions/index.js

@@ -23,17 +23,17 @@ import mfaWithEmailCodeActions from './mfaWithEmailCode.actions';
 import mfaWithSMSActions from './mfaWithSMS.actions';
 import mfaWithWebAuthnActions from './mfaWithWebAuthn.actions';
 import { LoginFlow, LoginStep } from '../interfaces';
-import { base64urlDecode, deepResetState, delay, errorHandler, errorTraceId, GTMEventAction, publicKeyCredentialToJSON, refreshTokenWithRetry, reportGTMEvent, retryIfNeeded, withRetryConfig } from '../../../helpers';
+import { base64urlDecode, deepResetState, delay, errorHandler, errorTraceId, GTMEventAction, isSsoEnforcementError, publicKeyCredentialToJSON, refreshTokenWithRetry, reportGTMEvent, retryIfNeeded, withRetryConfig } from '../../../helpers';
 import { initialState } from '../state';
 import { getSearchParam, isEmailPayload, isUsernamePayload, shouldShowPasswordRotationPromptFunc, TENANT_ID_PARAM_KEY } from '../helpers';
-import { AuthStrategyEnum, ContextHolder, FeatureFlags, getTabTenantFromSessionStorage, removeTabTenantFromSessionStorage, WebAuthnDeviceType, PreLoginAddressType } from '@frontegg/rest-api';
+import { AuthStrategyEnum, ContextHolder, isEnforceSsoOnTenantAccessEnabled, FeatureFlags, getTabTenantFromSessionStorage, removeTabTenantFromSessionStorage, setTabTenantInSessionStorage, WebAuthnDeviceType, PreLoginAddressType } from '@frontegg/rest-api';
 import hostedLoginAuthorizeActions from './hostedLoginAuthorize.actions';
 import { clearHostedOAuthState } from '../oauthStorage';
 import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
 import { FronteggNativeModule, isEntitlementsDeeplyEqual } from '../../../toolkit';
 import { REQUEST_NAME, UserVerifiedOriginTypes } from '../../interfaces';
 import { authStrategyLoginStepMap, defaultOnRedirectTo } from '../consts';
-import { isMfaRequired, isResetPasswordRequired } from '../../helpers';
+import { isMfaRequired, isOnAuthPageRoute, isOnOidcCallbackRoute, isResetPasswordRequired, restoreTabTenantUnlessSsoCallback, setAfterAuthRedirectUrlForStepUp } from '../../helpers';
 import { MFAStep } from '../../MfaState/interfaces';
 import { SamlVendors } from '../../SSOState/interfaces';
 import { DEFAULT_RETRY_CONFIG } from '../../../constants';
@@ -43,8 +43,114 @@ export default ((store, api, sharedActions) => {
   const actions = sharedActions;
   const contextHolder = ContextHolder.for(store.root.appName);
 
+  /**
+   * Sends the user to log in through the tenant's SSO and back to the current page afterwards.
+   * @protected
+   */
+  // as preLogin (takeLeading): an SSO redirect started while another is in flight is dropped; the first one leaves the
+  // page, and a second hosted one would replace the PKCE verifier the first one's callback needs
+  let ssoRedirectInFlight = false;
+  const __redirectToSsoForTenant = async ({
+    tenantId,
+    address
+  }) => {
+    if (ssoRedirectInFlight) {
+      return;
+    }
+    ssoRedirectInFlight = true;
+    try {
+      await __redirectToSsoForTenantNow({
+        tenantId,
+        address
+      });
+    } finally {
+      ssoRedirectInFlight = false;
+    }
+  };
+  const __redirectToSsoForTenantNow = async ({
+    tenantId,
+    address
+  }) => {
+    var _store$root$urlStrate;
+    // the login box shows login's "redirecting to SSO" step instead of the screen that was refused (its spinner and
+    // a previous error)
+    setLoginState({
+      step: LoginStep.redirectToSSO,
+      loading: false,
+      error: undefined
+    });
+    // on an auth page (login, tenant chooser, social / magic link / SSO callback) keep the destination the login
+    // already saved: the page itself is not one to come back to
+    const urlStrategy = (_store$root$urlStrate = store.root.urlStrategy) != null ? _store$root$urlStrate : 'path';
+    const isOnAuthPage = isOnAuthPageRoute(urlStrategy, store.auth.routes);
+    if (!isOnAuthPage) {
+      setAfterAuthRedirectUrlForStepUp(urlStrategy);
+    }
+    if (store.auth.hostedLoginBox) {
+      var _window$localStorage;
+      // as loginWithRedirect does, but the SSO tenant wins over the custom login tenant
+      (_window$localStorage = window.localStorage) == null ? void 0 : _window$localStorage.removeItem(SHOULD_STEP_UP_KEY);
+      await actions.__requestHostedLoginAuthorize({
+        prompt: 'login',
+        tenantId
+      }, {
+        forceTenantId: true
+      });
+      return;
+    }
+    // as login does for an OIDC SSO page without redirect_uri; the refusal has no idpType, but an OIDC page asks for a code
+    let ssoRedirectUrl = address;
+    if (/[?&]response_type=code(&|$)/.test(address) && !address.includes('redirect_uri')) {
+      ssoRedirectUrl += `&redirect_uri=${window.location.origin}${store.auth.routes.oidcRedirectUrl}`;
+    }
+    redirectToFullPage(ssoRedirectUrl);
+  };
+
+  /**
+   * Sends the user to the tenant's SSO when a login or tenant switch is refused because that tenant requires it
+   * (e.g. an invitation into a tenant whose SSO covers the user's email). The SSO login lands in that tenant.
+   * @returns true when redirected, so the caller doesn't show the error
+   * @protected
+   */
+  const __redirectToSsoIfRequired = async e => {
+    var _e$errorContext;
+    if (!isEnforceSsoOnTenantAccessEnabled(store.root.appName) || !isSsoEnforcementError(e) || !((_e$errorContext = e.errorContext) != null && _e$errorContext.ssoRequired)) {
+      return false;
+    }
+    await __redirectToSsoForTenant(e.errorContext);
+    return true;
+  };
+  /**
+   * Handles a hosted (OAuth) token refresh refused because the tenant requires SSO.
+   * ssoRequired: true sends the user to SSO, like login. ssoRequired: false renews once more for the tenant of the
+   * current token, which keeps the session: OAuth doesn't use up the refresh token on this refusal.
+   * @returns true when handled, false when the caller should log out
+   * @private
+   */
+  const __handleSsoEnforcementRefreshError = async (e, isSsoEnforcementRetry, refreshForTenant) => {
+    var _store$auth$user;
+    if (!isEnforceSsoOnTenantAccessEnabled(store.root.appName) || !isSsoEnforcementError(e)) {
+      return false;
+    }
+    if (await __redirectToSsoIfRequired(e)) {
+      return true;
+    }
+    const currentTenantId = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.tenantId;
+    if (isSsoEnforcementRetry || !currentTenantId) {
+      return false;
+    }
+    if (contextHolder.isSessionPerTenantEnabled()) {
+      setTabTenantInSessionStorage(currentTenantId);
+    }
+    await refreshForTenant(currentTenantId);
+    return true;
+  };
+
   /** @private */
-  const __refreshTokenHosted = async () => {
+  const __refreshTokenHosted = async ({
+    tenantId,
+    isSsoEnforcementRetry = false
+  } = {}) => {
     const user = store.auth.user;
     if (!(user != null && user.refreshToken)) {
       contextHolder.setAccessToken(null);
@@ -56,7 +162,7 @@ export default ((store, api, sharedActions) => {
       return;
     }
     try {
-      const tabTenantId = getTabTenantFromSessionStorage(store.root.appName);
+      const tabTenantId = tenantId != null ? tenantId : getTabTenantFromSessionStorage(store.root.appName);
       const body = _extends({
         grant_type: 'refresh_token',
         refresh_token: user == null ? void 0 : user.refreshToken
@@ -71,6 +177,13 @@ export default ((store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
+      const retry = tenantId => __refreshTokenHosted({
+        tenantId,
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -132,6 +245,11 @@ export default ((store, api, sharedActions) => {
         });
       }
     } catch (e) {
+      // a refused identity refresh has already used up the refresh token: no retry, only the SSO redirect, except on
+      // the OIDC callback, where the page itself completes the OIDC login
+      if (isEnforceSsoOnTenantAccessEnabled(store.root.appName) && !isOnOidcCallbackRoute(store) && (await __redirectToSsoIfRequired(e))) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -142,7 +260,9 @@ export default ((store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenWithNativeTokens = async () => {
+  const __refreshTokenWithNativeTokens = async ({
+    isSsoEnforcementRetry = false
+  } = {}) => {
     try {
       const authApi = api.auth;
       const response = await refreshTokenWithRetry(async () => {
@@ -156,6 +276,13 @@ export default ((store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
+      // native tokens can't name a tenant: the retry relies on the tab tenant only
+      const retry = () => __refreshTokenWithNativeTokens({
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -167,6 +294,7 @@ export default ((store, api, sharedActions) => {
 
   /** @protected */
   const __refreshToken = async () => {
+    restoreTabTenantUnlessSsoCallback(store);
     if (FronteggNativeModule.isGetTokensAvailable()) {
       await __refreshTokenWithNativeTokens();
       return;
@@ -189,9 +317,9 @@ export default ((store, api, sharedActions) => {
    * @private
    */
   const __handleUnnecessaryEntitlementsUpdate = async updatedUser => {
-    var _store$auth$user;
+    var _store$auth$user2;
     // @ts-ignore TODO: fix entitlements state type
-    const oldEntitlements = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.entitlements;
+    const oldEntitlements = (_store$auth$user2 = store.auth.user) == null ? void 0 : _store$auth$user2.entitlements;
     if (isEntitlementsDeeplyEqual(oldEntitlements, updatedUser == null ? void 0 : updatedUser.entitlements)) {
       // set the previous entitlements object
       return _extends({}, updatedUser, {
@@ -668,6 +796,9 @@ export default ((store, api, sharedActions) => {
     } catch (e) {
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       callback == null ? void 0 : callback(false, e);
       setLoginState({
         email,
@@ -963,6 +1094,9 @@ export default ((store, api, sharedActions) => {
         callback == null ? void 0 : callback(true);
       }
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoginState({
         error: errorHandler(e, 'Failed to authenticate')
       });
@@ -1099,6 +1233,9 @@ export default ((store, api, sharedActions) => {
       }
       // callback?.(true);
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoginState({
         error: errorHandler(e)
       });
@@ -1259,6 +1396,9 @@ export default ((store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoginState({
         loading: false,
         error: errorHandler(e)
@@ -1282,6 +1422,9 @@ export default ((store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoginState({
         loading: false,
         error: errorHandler(e)
@@ -1332,6 +1475,9 @@ export default ((store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoginState({
         loading: false,
         error: errorHandler(e)
@@ -1388,7 +1534,10 @@ export default ((store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenHostedSocialLogins = async () => {
+  const __refreshTokenHostedSocialLogins = async ({
+    tenantId,
+    isSsoEnforcementRetry = false
+  } = {}) => {
     const {
       user: currentUser
     } = store.auth;
@@ -1402,7 +1551,7 @@ export default ((store, api, sharedActions) => {
       return;
     }
     try {
-      const tabTenantId = getTabTenantFromSessionStorage(store.root.appName);
+      const tabTenantId = tenantId != null ? tenantId : getTabTenantFromSessionStorage(store.root.appName);
       const body = _extends({
         grant_type: 'refresh_token',
         refresh_token: currentUser == null ? void 0 : currentUser.refreshToken
@@ -1417,6 +1566,13 @@ export default ((store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
+      const retry = tenantId => __refreshTokenHostedSocialLogins({
+        tenantId,
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -1487,6 +1643,9 @@ export default ((store, api, sharedActions) => {
         }
       }
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -1533,6 +1692,8 @@ export default ((store, api, sharedActions) => {
     resetBreachedPassword,
     refreshTokenForSocialLogins,
     // protected
-    __refreshToken
+    __refreshToken,
+    __redirectToSsoForTenant,
+    __redirectToSsoIfRequired
   }, hostedLoginAuthorizeActions(store, api, sharedActions), afterAuthNavigationActions(store, api, sharedActions), handleVerifyMFAResponseActions(store, api, sharedActions), mfaRequiredStateActions(store, api, sharedActions), mfaWithAuthenticatorActions(store, api, sharedActions), mfaWithEmailCodeActions(store, api, sharedActions), mfaWithSMSActions(store, api, sharedActions), mfaWithWebAuthnActions(store, api, sharedActions));
 });

package/auth/LoginState/actions/mfaWithAuthenticator.actions.js

@@ -145,6 +145,9 @@ export default ((store, api, sharedActions) => {
       }
       return await __postLoginMfaAuthenticator(isAuthenticated, user, callback);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoadingAction({
         loading: false,
         error: errorHandler(e)

package/auth/LoginState/actions/mfaWithEmailCode.actions.js

@@ -68,6 +68,9 @@ export default ((store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoadingAction({
         loading: false,
         error: errorHandler(e)

package/auth/LoginState/actions/mfaWithSMS.actions.js

@@ -73,6 +73,9 @@ export default ((store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoadingAction({
         loading: false,
         error: errorHandler(e)

package/auth/LoginState/actions/mfaWithWebAuthn.actions.js

@@ -87,6 +87,9 @@ export default ((store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoadingAction({
         loading: false,
         error: errorHandler(e)

package/auth/MfaState/actions.js

@@ -169,6 +169,9 @@ export default ((store, api, sharedActions) => {
       }
       callback == null ? void 0 : callback(mfaState.recoveryCode);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setMfaState({
         loading: false,
         error: errorHandler(e)

package/auth/SocialLoginState/actions.js

@@ -157,6 +157,9 @@ export default ((store, api, sharedActions) => {
         loading: false
       });
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setSocialLoginsState({
         loading: false,
         error: errorHandler(e, 'Failed to authenticate'),

package/auth/StepUpState/actions/generateStepUpSession.actions.js

@@ -95,6 +95,11 @@ export default ((store, api, sharedActions) => {
       callback == null ? void 0 : callback(true);
     } catch (e) {
       callback == null ? void 0 : callback(false);
+
+      // the session's tenant requires SSO: its SSO login steps the user up, instead of logging them out
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       await __handleStepUpError(e);
     }
   };

package/auth/StepUpState/helpers.d.ts

@@ -22,8 +22,9 @@ export interface UrlDerivedStepUp {
 export declare const getUrlDerivedStepUp: () => UrlDerivedStepUp;
 /**
  * Set the url and query params in the local storage FRONTEGG_AFTER_AUTH_REDIRECT_URL value
+ * @param urlStrategy 'hash' saves the route in the hash, which is the page the app shows
  */
-export declare function setAfterAuthRedirectUrlForStepUp(): void;
+export declare function setAfterAuthRedirectUrlForStepUp(urlStrategy?: 'path' | 'hash'): void;
 /**
  * Redirects to the step up url with the max age param and set the redirect url in the local storage
  * The redirect url will be used after the step up flow is done

package/auth/StepUpState/helpers.js

@@ -51,9 +51,10 @@ export const getUrlDerivedStepUp = () => {
 
 /**
  * Set the url and query params in the local storage FRONTEGG_AFTER_AUTH_REDIRECT_URL value
+ * @param urlStrategy 'hash' saves the route in the hash, which is the page the app shows
  */
-export function setAfterAuthRedirectUrlForStepUp() {
-  const encodedRedirectUrl = window.location.pathname + window.location.search;
+export function setAfterAuthRedirectUrlForStepUp(urlStrategy = 'path') {
+  const encodedRedirectUrl = urlStrategy === 'hash' ? window.location.hash.substring(1) || '/' : window.location.pathname + window.location.search;
   window.localStorage.setItem(FRONTEGG_AFTER_AUTH_REDIRECT_URL, encodedRedirectUrl);
 }
 

package/auth/TenantsState/actions.js

@@ -1,6 +1,6 @@
 import { initialState } from './state';
 import { deepResetState } from '../../helpers';
-import { getCurrentUserTenantsFunction } from '@frontegg/rest-api';
+import { ContextHolder, getCurrentUserTenantsFunction, setTabTenantForSsoSwitch } from '@frontegg/rest-api';
 export default ((store, api, sharedActions) => {
   const actions = sharedActions;
   const setTenantsState = state => {
@@ -51,6 +51,13 @@ export default ((store, api, sharedActions) => {
       }) : actions.setAuthState({
         isLoading: false
       });
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        // the tab comes back from SSO in the target tenant, not the one the failed switch restored
+        if (ContextHolder.for(store.root.appName).isSessionPerTenantEnabled()) {
+          setTabTenantForSsoSwitch(tenantId);
+        }
+        return;
+      }
       callback == null ? void 0 : callback(false, e);
     }
   };

package/auth/helpers.d.ts

@@ -8,5 +8,20 @@ export declare const isMfaRequired: (user: ILoginResponse, appName: string) => b
 export declare const isResetPasswordRequired: (user: ILoginResponse, appName: string) => boolean;
 export declare const mapMetaDataObjectToActions: (obj: any, path?: string[]) => CommitChangeDto[];
 export declare const getUri: (urlStrategy: FronteggState["root"]["urlStrategy"]) => string;
+/**
+ * On the OIDC callback the page still has to finish the OIDC login with its code: a refresh refused before that is not
+ * a reason to go back to the IdP, which would send the user straight back here, forever.
+ */
+export declare const isOnOidcCallbackRoute: (store: FronteggState) => boolean;
+/**
+ * After a switch refused for SSO the tab points at the SSO tenant. Its SSO login comes back on a callback route and
+ * keeps it; any other page load means the user didn't finish that login, so the tab goes back to its tenant.
+ */
+export declare const restoreTabTenantUnlessSsoCallback: (store: FronteggState) => void;
 export declare const prepareIdentifiersForSignup: (payload: ISignUpUser) => ISignUpUser;
+/**
+ * Whether the current route is an auth page (login, tenant chooser, social / magic link / SSO callback), not one to come
+ * back to. Unlike isAuthRoute: after-login / sign-up destinations don't count, and endsWith lets a basename prefix it.
+ */
+export declare const isOnAuthPageRoute: (urlStrategy: FronteggState["root"]["urlStrategy"], routes?: Partial<AuthPageRoutes>) => boolean;
 export declare const isAuthRoute: (path: string, routes?: Partial<AuthPageRoutes>) => boolean;