@frontegg/redux-store 7.130.0 → 7.131.0-alpha.1

package/auth/helpers.js

@@ -1,8 +1,8 @@
-import _extends from "@babel/runtime/helpers/esm/extends";
 import _objectWithoutPropertiesLoose from "@babel/runtime/helpers/esm/objectWithoutPropertiesLoose";
+import _extends from "@babel/runtime/helpers/esm/extends";
 const _excluded = ["phoneNumber", "email", "username"],
   _excluded2 = ["authenticatedUrl"];
-import { ContextHolder } from '@frontegg/rest-api';
+import { ContextHolder, restoreTabTenantBeforeSsoSwitch, isEnforceSsoOnTenantAccessEnabled } from '@frontegg/rest-api';
 import { defaultFronteggRoutes } from './LoginState/consts';
 export * from './Entitlements/helpers';
 export * from './LoginState/helpers';
@@ -53,6 +53,52 @@ export const getUri = urlStrategy => {
     }
   }
 };
+
+/**
+ * The route the app shows and the page's path. With hash routing they differ: the app's pages live in the hash, but
+ * SAML, OIDC, social and magic link callbacks come back on the path, which is where login matches them.
+ */
+const getCurrentRoutes = urlStrategy => {
+  const hashOrPathRoute = getUri(urlStrategy);
+  const {
+    pathname
+  } = window.location;
+  return hashOrPathRoute === pathname ? [pathname] : [hashOrPathRoute, pathname];
+};
+
+/**
+ * On the OIDC callback the page still has to finish the OIDC login with its code: a refresh refused before that is not
+ * a reason to go back to the IdP, which would send the user straight back here, forever.
+ */
+export const isOnOidcCallbackRoute = store => {
+  var _store$root$urlStrate;
+  const {
+    oidcRedirectUrl
+  } = _extends({}, defaultFronteggRoutes, store.auth.routes);
+  return !!oidcRedirectUrl && getCurrentRoutes((_store$root$urlStrate = store.root.urlStrategy) != null ? _store$root$urlStrate : 'path').some(currentRoute => currentRoute.endsWith(oidcRedirectUrl));
+};
+
+/**
+ * After a switch refused for SSO the tab points at the SSO tenant. Its SSO login comes back on a callback route and
+ * keeps it; any other page load means the user didn't finish that login, so the tab goes back to its tenant.
+ */
+export const restoreTabTenantUnlessSsoCallback = store => {
+  var _store$root$urlStrate2;
+  if (!isEnforceSsoOnTenantAccessEnabled(store.root.appName) || !ContextHolder.for(store.root.appName).isSessionPerTenantEnabled()) {
+    return;
+  }
+  const {
+    samlCallbackUrl,
+    oidcRedirectUrl,
+    hostedLoginRedirectUrl
+  } = _extends({}, defaultFronteggRoutes, store.auth.routes);
+  // matched like login matches its callback pages: endsWith, so a basename before the route still counts
+  const currentRoutes = getCurrentRoutes((_store$root$urlStrate2 = store.root.urlStrategy) != null ? _store$root$urlStrate2 : 'path');
+  const isSsoCallback = [samlCallbackUrl, oidcRedirectUrl, hostedLoginRedirectUrl].some(route => !!route && currentRoutes.some(currentRoute => currentRoute.endsWith(route)));
+  if (!isSsoCallback) {
+    restoreTabTenantBeforeSsoSwitch();
+  }
+};
 export const prepareIdentifiersForSignup = payload => {
   const {
       phoneNumber,
@@ -77,6 +123,18 @@ export const prepareIdentifiersForSignup = payload => {
   }
   return finalDto;
 };
+
+// Pages the user lands on after login or sign-up: destinations, not auth pages.
+const AFTER_AUTH_DESTINATION_ROUTES = ['authenticatedUrl', 'signUpSuccessUrl', 'accountSignUpSuccessUrl', 'userSignUpSuccessUrl', 'customLoginAuthenticatedUrl'];
+
+/**
+ * Whether the current route is an auth page (login, tenant chooser, social / magic link / SSO callback), not one to come
+ * back to. Unlike isAuthRoute: after-login / sign-up destinations don't count, and endsWith lets a basename prefix it.
+ */
+export const isOnAuthPageRoute = (urlStrategy, routes) => {
+  const currentRoutes = getCurrentRoutes(urlStrategy);
+  return Object.entries(_extends({}, defaultFronteggRoutes, routes)).some(([name, route]) => !AFTER_AUTH_DESTINATION_ROUTES.includes(name) && typeof route === 'string' && !!route && currentRoutes.some(currentRoute => currentRoute.endsWith(route)));
+};
 export const isAuthRoute = (path, routes) => {
   const _defaultFronteggRoute = _extends({}, defaultFronteggRoutes, routes),
     authRoutes = _objectWithoutPropertiesLoose(_defaultFronteggRoute, _excluded2);

package/helpers/handlers.d.ts

@@ -1,4 +1,7 @@
-import { FronteggApiError } from '@frontegg/rest-api';
+import { FronteggApiError, SsoEnforcementErrorContext } from '@frontegg/rest-api';
 export declare const isFronteggApiError: (error: unknown | Error | FronteggApiError) => error is FronteggApiError;
+export declare const isSsoEnforcementError: (error: unknown) => error is FronteggApiError & {
+    errorContext: SsoEnforcementErrorContext;
+};
 export declare const isError: (error: any) => error is Error;
 export declare const errorHandler: <T>(error: unknown, fallback?: T) => FronteggApiError | T;

package/helpers/handlers.js

@@ -1,5 +1,8 @@
-import { FronteggApiError, GENERIC_ERROR_MESSAGE, GENERIC_ERROR_CODE } from '@frontegg/rest-api';
+import { FronteggApiError, GENERIC_ERROR_MESSAGE, GENERIC_ERROR_CODE, SSO_REQUIRED_FOR_TENANT_ERROR_CODE } from '@frontegg/rest-api';
 export const isFronteggApiError = error => Boolean(error == null ? void 0 : error.statusCode);
+
+// ER-01079 (disabled user / expired tenant) is not this: it still logs out
+export const isSsoEnforcementError = error => isFronteggApiError(error) && error.errorCode === SSO_REQUIRED_FOR_TENANT_ERROR_CODE;
 export const isError = error => {
   if (error instanceof Error) {
     return true;

package/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.130.0
+/** @license Frontegg v7.131.0-alpha.1
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/mocks/auth-mocks/loginActions.mocks.d.ts

@@ -33,7 +33,9 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
         firstTime?: boolean;
         loginDirectAction?: import("../..").LoginDirectAction;
     }) => Promise<void>;
-    __requestHostedLoginAuthorize: (additionalParams?: Record<string, string>) => Promise<void>;
+    __requestHostedLoginAuthorize: (additionalParams?: Record<string, string>, { forceTenantId }?: {
+        forceTenantId?: boolean;
+    }) => Promise<void>;
     __requestHostedLoginSilentAuthorize: () => Promise<void>;
     handleHostedLoginCallback: (payload: import("../..").HostedLoginCallback) => Promise<void>;
     setLoginState: (state: Partial<import("../..").LoginState>) => void;
@@ -71,5 +73,10 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
     resetBreachedPassword: (payload: import("dist/@frontegg/rest-api").IForgotPassword) => Promise<void>;
     refreshTokenForSocialLogins: () => Promise<void>;
     __refreshToken: () => Promise<void>;
+    __redirectToSsoForTenant: ({ tenantId, address }: {
+        tenantId: string;
+        address: string;
+    }) => Promise<void>;
+    __redirectToSsoIfRequired: (e: unknown) => Promise<boolean>;
 };
 export default _default;

package/node/auth/ActivateAccountState/actions.js

@@ -158,6 +158,9 @@ var _default = (store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setActivateState({
         loading: false,
         error: (0, _helpers.errorHandler)(e)
@@ -195,6 +198,9 @@ var _default = (store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setActivateState({
         submitting: false,
         loading: false,

package/node/auth/LoginState/actions/hostedLoginAuthorize.actions.js

@@ -8,6 +8,7 @@ exports.default = void 0;
 var _extends2 = _interopRequireDefault(require("@babel/runtime/helpers/extends"));
 var _helpers = require("../../../helpers");
 var _constants = require("../../../constants");
+var _restApi = require("@frontegg/rest-api");
 var _helpers2 = require("../helpers");
 var _helpers3 = require("../../helpers");
 var _consts = require("../../StepUpState/consts");
@@ -21,6 +22,7 @@ var _default = (store, api, sharedActions) => {
   const __requestHostedLoginSilentAuthorize = async () => {
     var _response;
     let response;
+    (0, _helpers3.restoreTabTenantUnlessSsoCallback)(store);
     if (_toolkit.FronteggNativeModule.isGetTokensAvailable()) {
       const authApi = api.auth;
       response = await (0, _helpers.refreshTokenWithRetry)(async () => {
@@ -28,7 +30,21 @@ var _default = (store, api, sharedActions) => {
         return await authApi.silentOAuthRefreshTokenV3(tokens);
       });
     } else {
-      response = await api.auth.silentOAuthRefreshTokenV2();
+      try {
+        response = await api.auth.silentOAuthRefreshTokenV2();
+      } catch (error) {
+        var _store$auth$user, _error$errorContext;
+        // the tenant requires SSO: hosted login for that tenant, not the plain one the caller falls back to
+        if (await actions.__redirectToSsoIfRequired(error)) {
+          return;
+        }
+        const tenantId = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.tenantId;
+        if (!(0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) || !(0, _helpers.isSsoEnforcementError)(error) || ((_error$errorContext = error.errorContext) == null ? void 0 : _error$errorContext.ssoRequired) !== false || !tenantId) {
+          throw error;
+        }
+        // one retry for the tenant of the current token (a cold reload has no user yet: no retry)
+        response = await api.auth.silentOAuthRefreshTokenV2(tenantId);
+      }
     }
     if ((_response = response) != null && _response.user) {
       await actions.afterAuthenticationStateUpdate(response, {
@@ -39,7 +55,14 @@ var _default = (store, api, sharedActions) => {
       throw new Error(`couldn't refresh user token with oauth service`);
     }
   };
-  const requestHostedLoginAuthorize = async additionalParams => {
+
+  /**
+   * @param options.forceTenantId the tenantId in additionalParams wins over the resolved and the page's tenant
+   * (sending the user to that tenant's SSO); other callers keep their custom login tenant
+   */
+  const requestHostedLoginAuthorize = async (additionalParams, {
+    forceTenantId = false
+  } = {}) => {
     var _store$auth$customLog;
     const {
       routes,
@@ -86,7 +109,7 @@ var _default = (store, api, sharedActions) => {
       code_challenge_method: 'S256',
       nonce
     }, additionalParams);
-    if (context.tenantResolver) {
+    if (context.tenantResolver && !forceTenantId) {
       var _context$tenantResolv;
       const resolvedTenantResult = await ((_context$tenantResolv = context.tenantResolver) == null ? void 0 : _context$tenantResolv.call(context));
       if (resolvedTenantResult != null && resolvedTenantResult.tenant) {
@@ -94,7 +117,7 @@ var _default = (store, api, sharedActions) => {
       }
     }
     const tenantId = (0, _helpers2.getSearchParam)(_helpers2.TENANT_ID_PARAM_KEY);
-    if (tenantId) {
+    if (tenantId && !forceTenantId) {
       params['tenantId'] = tenantId;
     }
     if (_toolkit.FronteggNativeModule.isAvailable('closeWindow')) {

package/node/auth/LoginState/actions/index.js

@@ -50,8 +50,114 @@ var _default = (store, api, sharedActions) => {
   const actions = sharedActions;
   const contextHolder = _restApi.ContextHolder.for(store.root.appName);
 
+  /**
+   * Sends the user to log in through the tenant's SSO and back to the current page afterwards.
+   * @protected
+   */
+  // as preLogin (takeLeading): an SSO redirect started while another is in flight is dropped; the first one leaves the
+  // page, and a second hosted one would replace the PKCE verifier the first one's callback needs
+  let ssoRedirectInFlight = false;
+  const __redirectToSsoForTenant = async ({
+    tenantId,
+    address
+  }) => {
+    if (ssoRedirectInFlight) {
+      return;
+    }
+    ssoRedirectInFlight = true;
+    try {
+      await __redirectToSsoForTenantNow({
+        tenantId,
+        address
+      });
+    } finally {
+      ssoRedirectInFlight = false;
+    }
+  };
+  const __redirectToSsoForTenantNow = async ({
+    tenantId,
+    address
+  }) => {
+    var _store$root$urlStrate;
+    // the login box shows login's "redirecting to SSO" step instead of the screen that was refused (its spinner and
+    // a previous error)
+    setLoginState({
+      step: _interfaces.LoginStep.redirectToSSO,
+      loading: false,
+      error: undefined
+    });
+    // on an auth page (login, tenant chooser, social / magic link / SSO callback) keep the destination the login
+    // already saved: the page itself is not one to come back to
+    const urlStrategy = (_store$root$urlStrate = store.root.urlStrategy) != null ? _store$root$urlStrate : 'path';
+    const isOnAuthPage = (0, _helpers3.isOnAuthPageRoute)(urlStrategy, store.auth.routes);
+    if (!isOnAuthPage) {
+      (0, _helpers3.setAfterAuthRedirectUrlForStepUp)(urlStrategy);
+    }
+    if (store.auth.hostedLoginBox) {
+      var _window$localStorage;
+      // as loginWithRedirect does, but the SSO tenant wins over the custom login tenant
+      (_window$localStorage = window.localStorage) == null ? void 0 : _window$localStorage.removeItem(_consts.SHOULD_STEP_UP_KEY);
+      await actions.__requestHostedLoginAuthorize({
+        prompt: 'login',
+        tenantId
+      }, {
+        forceTenantId: true
+      });
+      return;
+    }
+    // as login does for an OIDC SSO page without redirect_uri; the refusal has no idpType, but an OIDC page asks for a code
+    let ssoRedirectUrl = address;
+    if (/[?&]response_type=code(&|$)/.test(address) && !address.includes('redirect_uri')) {
+      ssoRedirectUrl += `&redirect_uri=${window.location.origin}${store.auth.routes.oidcRedirectUrl}`;
+    }
+    redirectToFullPage(ssoRedirectUrl);
+  };
+
+  /**
+   * Sends the user to the tenant's SSO when a login or tenant switch is refused because that tenant requires it
+   * (e.g. an invitation into a tenant whose SSO covers the user's email). The SSO login lands in that tenant.
+   * @returns true when redirected, so the caller doesn't show the error
+   * @protected
+   */
+  const __redirectToSsoIfRequired = async e => {
+    var _e$errorContext;
+    if (!(0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) || !(0, _helpers.isSsoEnforcementError)(e) || !((_e$errorContext = e.errorContext) != null && _e$errorContext.ssoRequired)) {
+      return false;
+    }
+    await __redirectToSsoForTenant(e.errorContext);
+    return true;
+  };
+  /**
+   * Handles a hosted (OAuth) token refresh refused because the tenant requires SSO.
+   * ssoRequired: true sends the user to SSO, like login. ssoRequired: false renews once more for the tenant of the
+   * current token, which keeps the session: OAuth doesn't use up the refresh token on this refusal.
+   * @returns true when handled, false when the caller should log out
+   * @private
+   */
+  const __handleSsoEnforcementRefreshError = async (e, isSsoEnforcementRetry, refreshForTenant) => {
+    var _store$auth$user;
+    if (!(0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) || !(0, _helpers.isSsoEnforcementError)(e)) {
+      return false;
+    }
+    if (await __redirectToSsoIfRequired(e)) {
+      return true;
+    }
+    const currentTenantId = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.tenantId;
+    if (isSsoEnforcementRetry || !currentTenantId) {
+      return false;
+    }
+    if (contextHolder.isSessionPerTenantEnabled()) {
+      (0, _restApi.setTabTenantInSessionStorage)(currentTenantId);
+    }
+    await refreshForTenant(currentTenantId);
+    return true;
+  };
+
   /** @private */
-  const __refreshTokenHosted = async () => {
+  const __refreshTokenHosted = async ({
+    tenantId,
+    isSsoEnforcementRetry = false
+  } = {}) => {
     const user = store.auth.user;
     if (!(user != null && user.refreshToken)) {
       contextHolder.setAccessToken(null);
@@ -63,7 +169,7 @@ var _default = (store, api, sharedActions) => {
       return;
     }
     try {
-      const tabTenantId = (0, _restApi.getTabTenantFromSessionStorage)(store.root.appName);
+      const tabTenantId = tenantId != null ? tenantId : (0, _restApi.getTabTenantFromSessionStorage)(store.root.appName);
       const body = (0, _extends2.default)({
         grant_type: 'refresh_token',
         refresh_token: user == null ? void 0 : user.refreshToken
@@ -78,6 +184,13 @@ var _default = (store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
+      const retry = tenantId => __refreshTokenHosted({
+        tenantId,
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -139,6 +252,11 @@ var _default = (store, api, sharedActions) => {
         });
       }
     } catch (e) {
+      // a refused identity refresh has already used up the refresh token: no retry, only the SSO redirect, except on
+      // the OIDC callback, where the page itself completes the OIDC login
+      if ((0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) && !(0, _helpers3.isOnOidcCallbackRoute)(store) && (await __redirectToSsoIfRequired(e))) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -149,7 +267,9 @@ var _default = (store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenWithNativeTokens = async () => {
+  const __refreshTokenWithNativeTokens = async ({
+    isSsoEnforcementRetry = false
+  } = {}) => {
     try {
       const authApi = api.auth;
       const response = await (0, _helpers.refreshTokenWithRetry)(async () => {
@@ -163,6 +283,13 @@ var _default = (store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
+      // native tokens can't name a tenant: the retry relies on the tab tenant only
+      const retry = () => __refreshTokenWithNativeTokens({
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -174,6 +301,7 @@ var _default = (store, api, sharedActions) => {
 
   /** @protected */
   const __refreshToken = async () => {
+    (0, _helpers3.restoreTabTenantUnlessSsoCallback)(store);
     if (_toolkit.FronteggNativeModule.isGetTokensAvailable()) {
       await __refreshTokenWithNativeTokens();
       return;
@@ -196,9 +324,9 @@ var _default = (store, api, sharedActions) => {
    * @private
    */
   const __handleUnnecessaryEntitlementsUpdate = async updatedUser => {
-    var _store$auth$user;
+    var _store$auth$user2;
     // @ts-ignore TODO: fix entitlements state type
-    const oldEntitlements = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.entitlements;
+    const oldEntitlements = (_store$auth$user2 = store.auth.user) == null ? void 0 : _store$auth$user2.entitlements;
     if ((0, _toolkit.isEntitlementsDeeplyEqual)(oldEntitlements, updatedUser == null ? void 0 : updatedUser.entitlements)) {
       // set the previous entitlements object
       return (0, _extends2.default)({}, updatedUser, {
@@ -675,6 +803,9 @@ var _default = (store, api, sharedActions) => {
     } catch (e) {
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       callback == null ? void 0 : callback(false, e);
       setLoginState({
         email,
@@ -970,6 +1101,9 @@ var _default = (store, api, sharedActions) => {
         callback == null ? void 0 : callback(true);
       }
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoginState({
         error: (0, _helpers.errorHandler)(e, 'Failed to authenticate')
       });
@@ -1106,6 +1240,9 @@ var _default = (store, api, sharedActions) => {
       }
       // callback?.(true);
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoginState({
         error: (0, _helpers.errorHandler)(e)
       });
@@ -1266,6 +1403,9 @@ var _default = (store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoginState({
         loading: false,
         error: (0, _helpers.errorHandler)(e)
@@ -1289,6 +1429,9 @@ var _default = (store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoginState({
         loading: false,
         error: (0, _helpers.errorHandler)(e)
@@ -1339,6 +1482,9 @@ var _default = (store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoginState({
         loading: false,
         error: (0, _helpers.errorHandler)(e)
@@ -1395,7 +1541,10 @@ var _default = (store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenHostedSocialLogins = async () => {
+  const __refreshTokenHostedSocialLogins = async ({
+    tenantId,
+    isSsoEnforcementRetry = false
+  } = {}) => {
     const {
       user: currentUser
     } = store.auth;
@@ -1409,7 +1558,7 @@ var _default = (store, api, sharedActions) => {
       return;
     }
     try {
-      const tabTenantId = (0, _restApi.getTabTenantFromSessionStorage)(store.root.appName);
+      const tabTenantId = tenantId != null ? tenantId : (0, _restApi.getTabTenantFromSessionStorage)(store.root.appName);
       const body = (0, _extends2.default)({
         grant_type: 'refresh_token',
         refresh_token: currentUser == null ? void 0 : currentUser.refreshToken
@@ -1424,6 +1573,13 @@ var _default = (store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
+      const retry = tenantId => __refreshTokenHostedSocialLogins({
+        tenantId,
+        isSsoEnforcementRetry: true
+      });
+      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -1494,6 +1650,9 @@ var _default = (store, api, sharedActions) => {
         }
       }
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -1540,7 +1699,9 @@ var _default = (store, api, sharedActions) => {
     resetBreachedPassword,
     refreshTokenForSocialLogins,
     // protected
-    __refreshToken
+    __refreshToken,
+    __redirectToSsoForTenant,
+    __redirectToSsoIfRequired
   }, (0, _hostedLoginAuthorize.default)(store, api, sharedActions), (0, _afterAuthNavigation.default)(store, api, sharedActions), (0, _handleVerifyMFAResponse.default)(store, api, sharedActions), (0, _mfaRequiredState.default)(store, api, sharedActions), (0, _mfaWithAuthenticator.default)(store, api, sharedActions), (0, _mfaWithEmailCode.default)(store, api, sharedActions), (0, _mfaWithSMS.default)(store, api, sharedActions), (0, _mfaWithWebAuthn.default)(store, api, sharedActions));
 };
 exports.default = _default;

package/node/auth/LoginState/actions/mfaWithAuthenticator.actions.js

@@ -152,6 +152,9 @@ var _default = (store, api, sharedActions) => {
       }
       return await __postLoginMfaAuthenticator(isAuthenticated, user, callback);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoadingAction({
         loading: false,
         error: (0, _helpers.errorHandler)(e)

package/node/auth/LoginState/actions/mfaWithEmailCode.actions.js

@@ -75,6 +75,9 @@ var _default = (store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoadingAction({
         loading: false,
         error: (0, _helpers.errorHandler)(e)

package/node/auth/LoginState/actions/mfaWithSMS.actions.js

@@ -80,6 +80,9 @@ var _default = (store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoadingAction({
         loading: false,
         error: (0, _helpers.errorHandler)(e)

package/node/auth/LoginState/actions/mfaWithWebAuthn.actions.js

@@ -94,6 +94,9 @@ var _default = (store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoadingAction({
         loading: false,
         error: (0, _helpers.errorHandler)(e)

package/node/auth/MfaState/actions.js

@@ -176,6 +176,9 @@ var _default = (store, api, sharedActions) => {
       }
       callback == null ? void 0 : callback(mfaState.recoveryCode);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setMfaState({
         loading: false,
         error: (0, _helpers.errorHandler)(e)

package/node/auth/SocialLoginState/actions.js

@@ -164,6 +164,9 @@ var _default = (store, api, sharedActions) => {
         loading: false
       });
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setSocialLoginsState({
         loading: false,
         error: (0, _helpers.errorHandler)(e, 'Failed to authenticate'),

package/node/auth/StepUpState/actions/generateStepUpSession.actions.js

@@ -101,6 +101,11 @@ var _default = (store, api, sharedActions) => {
       callback == null ? void 0 : callback(true);
     } catch (e) {
       callback == null ? void 0 : callback(false);
+
+      // the session's tenant requires SSO: its SSO login steps the user up, instead of logging them out
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       await __handleStepUpError(e);
     }
   };

package/node/auth/StepUpState/helpers.js

@@ -59,10 +59,11 @@ const getUrlDerivedStepUp = () => {
 
 /**
  * Set the url and query params in the local storage FRONTEGG_AFTER_AUTH_REDIRECT_URL value
+ * @param urlStrategy 'hash' saves the route in the hash, which is the page the app shows
  */
 exports.getUrlDerivedStepUp = getUrlDerivedStepUp;
-function setAfterAuthRedirectUrlForStepUp() {
-  const encodedRedirectUrl = window.location.pathname + window.location.search;
+function setAfterAuthRedirectUrlForStepUp(urlStrategy = 'path') {
+  const encodedRedirectUrl = urlStrategy === 'hash' ? window.location.hash.substring(1) || '/' : window.location.pathname + window.location.search;
   window.localStorage.setItem(_constants.FRONTEGG_AFTER_AUTH_REDIRECT_URL, encodedRedirectUrl);
 }
 

package/node/auth/TenantsState/actions.js

@@ -57,6 +57,13 @@ var _default = (store, api, sharedActions) => {
       }) : actions.setAuthState({
         isLoading: false
       });
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        // the tab comes back from SSO in the target tenant, not the one the failed switch restored
+        if (_restApi.ContextHolder.for(store.root.appName).isSessionPerTenantEnabled()) {
+          (0, _restApi.setTabTenantForSsoSwitch)(tenantId);
+        }
+        return;
+      }
       callback == null ? void 0 : callback(false, e);
     }
   };