@frontegg/redux-store 7.130.0 → 7.131.0-alpha.1

package/node/auth/helpers.js

@@ -9,12 +9,15 @@ var _exportNames = {
   isResetPasswordRequired: true,
   mapMetaDataObjectToActions: true,
   getUri: true,
+  isOnOidcCallbackRoute: true,
+  restoreTabTenantUnlessSsoCallback: true,
   prepareIdentifiersForSignup: true,
+  isOnAuthPageRoute: true,
   isAuthRoute: true
 };
-exports.prepareIdentifiersForSignup = exports.mapMetaDataObjectToActions = exports.isResetPasswordRequired = exports.isMfaRequired = exports.isAuthRoute = exports.getUri = void 0;
-var _extends2 = _interopRequireDefault(require("@babel/runtime/helpers/extends"));
+exports.restoreTabTenantUnlessSsoCallback = exports.prepareIdentifiersForSignup = exports.mapMetaDataObjectToActions = exports.isResetPasswordRequired = exports.isOnOidcCallbackRoute = exports.isOnAuthPageRoute = exports.isMfaRequired = exports.isAuthRoute = exports.getUri = void 0;
 var _objectWithoutPropertiesLoose2 = _interopRequireDefault(require("@babel/runtime/helpers/objectWithoutPropertiesLoose"));
+var _extends2 = _interopRequireDefault(require("@babel/runtime/helpers/extends"));
 var _restApi = require("@frontegg/rest-api");
 var _consts = require("./LoginState/consts");
 var _helpers = require("./Entitlements/helpers");
@@ -104,7 +107,55 @@ const getUri = urlStrategy => {
     }
   }
 };
+
+/**
+ * The route the app shows and the page's path. With hash routing they differ: the app's pages live in the hash, but
+ * SAML, OIDC, social and magic link callbacks come back on the path, which is where login matches them.
+ */
 exports.getUri = getUri;
+const getCurrentRoutes = urlStrategy => {
+  const hashOrPathRoute = getUri(urlStrategy);
+  const {
+    pathname
+  } = window.location;
+  return hashOrPathRoute === pathname ? [pathname] : [hashOrPathRoute, pathname];
+};
+
+/**
+ * On the OIDC callback the page still has to finish the OIDC login with its code: a refresh refused before that is not
+ * a reason to go back to the IdP, which would send the user straight back here, forever.
+ */
+const isOnOidcCallbackRoute = store => {
+  var _store$root$urlStrate;
+  const {
+    oidcRedirectUrl
+  } = (0, _extends2.default)({}, _consts.defaultFronteggRoutes, store.auth.routes);
+  return !!oidcRedirectUrl && getCurrentRoutes((_store$root$urlStrate = store.root.urlStrategy) != null ? _store$root$urlStrate : 'path').some(currentRoute => currentRoute.endsWith(oidcRedirectUrl));
+};
+
+/**
+ * After a switch refused for SSO the tab points at the SSO tenant. Its SSO login comes back on a callback route and
+ * keeps it; any other page load means the user didn't finish that login, so the tab goes back to its tenant.
+ */
+exports.isOnOidcCallbackRoute = isOnOidcCallbackRoute;
+const restoreTabTenantUnlessSsoCallback = store => {
+  var _store$root$urlStrate2;
+  if (!(0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) || !_restApi.ContextHolder.for(store.root.appName).isSessionPerTenantEnabled()) {
+    return;
+  }
+  const {
+    samlCallbackUrl,
+    oidcRedirectUrl,
+    hostedLoginRedirectUrl
+  } = (0, _extends2.default)({}, _consts.defaultFronteggRoutes, store.auth.routes);
+  // matched like login matches its callback pages: endsWith, so a basename before the route still counts
+  const currentRoutes = getCurrentRoutes((_store$root$urlStrate2 = store.root.urlStrategy) != null ? _store$root$urlStrate2 : 'path');
+  const isSsoCallback = [samlCallbackUrl, oidcRedirectUrl, hostedLoginRedirectUrl].some(route => !!route && currentRoutes.some(currentRoute => currentRoute.endsWith(route)));
+  if (!isSsoCallback) {
+    (0, _restApi.restoreTabTenantBeforeSsoSwitch)();
+  }
+};
+exports.restoreTabTenantUnlessSsoCallback = restoreTabTenantUnlessSsoCallback;
 const prepareIdentifiersForSignup = payload => {
   const {
       phoneNumber,
@@ -129,7 +180,20 @@ const prepareIdentifiersForSignup = payload => {
   }
   return finalDto;
 };
+
+// Pages the user lands on after login or sign-up: destinations, not auth pages.
 exports.prepareIdentifiersForSignup = prepareIdentifiersForSignup;
+const AFTER_AUTH_DESTINATION_ROUTES = ['authenticatedUrl', 'signUpSuccessUrl', 'accountSignUpSuccessUrl', 'userSignUpSuccessUrl', 'customLoginAuthenticatedUrl'];
+
+/**
+ * Whether the current route is an auth page (login, tenant chooser, social / magic link / SSO callback), not one to come
+ * back to. Unlike isAuthRoute: after-login / sign-up destinations don't count, and endsWith lets a basename prefix it.
+ */
+const isOnAuthPageRoute = (urlStrategy, routes) => {
+  const currentRoutes = getCurrentRoutes(urlStrategy);
+  return Object.entries((0, _extends2.default)({}, _consts.defaultFronteggRoutes, routes)).some(([name, route]) => !AFTER_AUTH_DESTINATION_ROUTES.includes(name) && typeof route === 'string' && !!route && currentRoutes.some(currentRoute => currentRoute.endsWith(route)));
+};
+exports.isOnAuthPageRoute = isOnAuthPageRoute;
 const isAuthRoute = (path, routes) => {
   const _defaultFronteggRoute = (0, _extends2.default)({}, _consts.defaultFronteggRoutes, routes),
     authRoutes = (0, _objectWithoutPropertiesLoose2.default)(_defaultFronteggRoute, _excluded2);

package/node/helpers/handlers.js

@@ -3,10 +3,14 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.isFronteggApiError = exports.isError = exports.errorHandler = void 0;
+exports.isSsoEnforcementError = exports.isFronteggApiError = exports.isError = exports.errorHandler = void 0;
 var _restApi = require("@frontegg/rest-api");
 const isFronteggApiError = error => Boolean(error == null ? void 0 : error.statusCode);
+
+// ER-01079 (disabled user / expired tenant) is not this: it still logs out
 exports.isFronteggApiError = isFronteggApiError;
+const isSsoEnforcementError = error => isFronteggApiError(error) && error.errorCode === _restApi.SSO_REQUIRED_FOR_TENANT_ERROR_CODE;
+exports.isSsoEnforcementError = isSsoEnforcementError;
 const isError = error => {
   if (error instanceof Error) {
     return true;

package/node/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.130.0
+/** @license Frontegg v7.131.0-alpha.1
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@frontegg/redux-store",
-  "version": "7.130.0",
+  "version": "7.131.0-alpha.1",
   "main": "./node/index.js",
   "license": "MIT",
   "author": "Frontegg LTD",
   "dependencies": {
     "@babel/runtime": "^7.18.6",
     "@frontegg/entitlements-javascript-commons": "1.1.2",
-    "@frontegg/rest-api": "7.130.0",
+    "@frontegg/rest-api": "7.131.0-alpha.1",
     "fast-deep-equal": "3.1.3",
     "get-value": "^3.0.1",
     "proxy-compare": "^3.0.0",