@frontegg/redux-store 7.131.0-alpha.0 → 7.131.0-alpha.2

package/auth/ActivateAccountState/actions.js

@@ -151,6 +151,9 @@ export default ((store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setActivateState({
         loading: false,
         error: errorHandler(e)
@@ -188,6 +191,9 @@ export default ((store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setActivateState({
         submitting: false,
         loading: false,

package/auth/LoginState/actions/hostedLoginAuthorize.actions.js

@@ -3,7 +3,7 @@ import { createRandomString, generateCodeChallenge, GTMEventAction, isSsoEnforce
 import { HOSTED_LOGIN_VERIFIER_KEY } from '../../../constants';
 import { isEnforceSsoOnTenantAccessEnabled } from '@frontegg/rest-api';
 import { getBaseNameWithoutSlashSuffix, getSearchParam, isOauthCallbackRoute, TENANT_ID_PARAM_KEY } from '../helpers';
-import { getUri, getUrlDerivedStepUp, isSteppedUp, redirectByStepUpUrl } from '../../helpers';
+import { getUri, getUrlDerivedStepUp, isSteppedUp, isOnLoginCodeCallbackRoute, redirectByStepUpUrl, restoreTabTenantUnlessSsoCallback } from '../../helpers';
 import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
 import { FronteggNativeModule } from '../../../toolkit';
 export default ((store, api, sharedActions) => {
@@ -15,6 +15,7 @@ export default ((store, api, sharedActions) => {
   const __requestHostedLoginSilentAuthorize = async () => {
     var _response;
     let response;
+    restoreTabTenantUnlessSsoCallback(store);
     if (FronteggNativeModule.isGetTokensAvailable()) {
       const authApi = api.auth;
       response = await refreshTokenWithRetry(async () => {
@@ -26,6 +27,14 @@ export default ((store, api, sharedActions) => {
         response = await api.auth.silentOAuthRefreshTokenV2();
       } catch (error) {
         var _store$auth$user, _error$errorContext;
+        // on the hosted login callback the page finishes the login with its code: fail as with the flag off
+        if (isOnLoginCodeCallbackRoute(store)) {
+          throw error;
+        }
+        // the tenant requires SSO: hosted login for that tenant, not the plain one the caller falls back to
+        if (await actions.__redirectToSsoIfRequired(error)) {
+          return;
+        }
         const tenantId = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.tenantId;
         if (!isEnforceSsoOnTenantAccessEnabled(store.root.appName) || !isSsoEnforcementError(error) || ((_error$errorContext = error.errorContext) == null ? void 0 : _error$errorContext.ssoRequired) !== false || !tenantId) {
           throw error;

package/auth/LoginState/actions/index.d.ts

@@ -33,7 +33,21 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
     requestHostedLoginAuthorize: (additionalParams?: Record<string, string>) => Promise<void>;
     requestHostedLoginAuthorizeV2: (payload?: {
         additionalParams?: Record<string, string>;
-        shouldRedirectToLogin?: boolean;
+        shouldRedirectToLogin
+        /**
+         * Handles a hosted (OAuth) token refresh refused because the tenant requires SSO.
+         * ssoRequired: true sends the user to SSO, like login. ssoRequired: false renews once more for the tenant of the
+         * current token, which keeps the session: OAuth doesn't use up the refresh token on this refusal.
+         * @returns true when handled, false when the caller should log out
+         * @private
+         */
+        ? /**
+         * Handles a hosted (OAuth) token refresh refused because the tenant requires SSO.
+         * ssoRequired: true sends the user to SSO, like login. ssoRequired: false renews once more for the tenant of the
+         * current token, which keeps the session: OAuth doesn't use up the refresh token on this refusal.
+         * @returns true when handled, false when the caller should log out
+         * @private
+         */: boolean;
         firstTime?: boolean;
         loginDirectAction?: import("../interfaces").LoginDirectAction;
     }) => Promise<void>;

package/auth/LoginState/actions/index.js

@@ -1,21 +1,20 @@
-import _extends from "@babel/runtime/helpers/esm/extends";
 import _objectWithoutPropertiesLoose from "@babel/runtime/helpers/esm/objectWithoutPropertiesLoose";
-const _excluded = ["authenticatedUrl"],
-  _excluded2 = ["callback", "error"],
+import _extends from "@babel/runtime/helpers/esm/extends";
+const _excluded = ["callback", "error"],
+  _excluded2 = ["callback"],
   _excluded3 = ["callback"],
   _excluded4 = ["callback"],
   _excluded5 = ["callback"],
-  _excluded6 = ["callback"],
-  _excluded7 = ["callback", "events"],
+  _excluded6 = ["callback", "events"],
+  _excluded7 = ["callback"],
   _excluded8 = ["callback"],
-  _excluded9 = ["callback"],
-  _excluded10 = ["user"],
+  _excluded9 = ["user"],
+  _excluded10 = ["callback"],
   _excluded11 = ["callback"],
   _excluded12 = ["callback"],
   _excluded13 = ["callback"],
   _excluded14 = ["callback"],
-  _excluded15 = ["callback"],
-  _excluded16 = ["callback"];
+  _excluded15 = ["callback"];
 import afterAuthNavigationActions from './afterAuthNavigation.actions';
 import handleVerifyMFAResponseActions from './handleVerifyMFAResponse.actions';
 import mfaRequiredStateActions from './mfaRequiredState.actions';
@@ -33,8 +32,8 @@ import { clearHostedOAuthState } from '../oauthStorage';
 import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
 import { FronteggNativeModule, isEntitlementsDeeplyEqual } from '../../../toolkit';
 import { REQUEST_NAME, UserVerifiedOriginTypes } from '../../interfaces';
-import { authStrategyLoginStepMap, defaultFronteggRoutes, defaultOnRedirectTo } from '../consts';
-import { isMfaRequired, isResetPasswordRequired, setAfterAuthRedirectUrlForStepUp } from '../../helpers';
+import { authStrategyLoginStepMap, defaultOnRedirectTo } from '../consts';
+import { isMfaRequired, isOnAuthPageRoute, isOnLoginCodeCallbackRoute, isResetPasswordRequired, restoreTabTenantUnlessSsoCallback, setAfterAuthRedirectUrlForStepUp } from '../../helpers';
 import { MFAStep } from '../../MfaState/interfaces';
 import { SamlVendors } from '../../SSOState/interfaces';
 import { DEFAULT_RETRY_CONFIG } from '../../../constants';
@@ -48,17 +47,44 @@ export default ((store, api, sharedActions) => {
    * Sends the user to log in through the tenant's SSO and back to the current page afterwards.
    * @protected
    */
+  // as preLogin (takeLeading): an SSO redirect started while another is in flight is dropped; the first one leaves the
+  // page, and a second hosted one would replace the PKCE verifier the first one's callback needs
+  let ssoRedirectInFlight = false;
   const __redirectToSsoForTenant = async ({
     tenantId,
     address
   }) => {
+    if (ssoRedirectInFlight) {
+      return;
+    }
+    ssoRedirectInFlight = true;
+    try {
+      await __redirectToSsoForTenantNow({
+        tenantId,
+        address
+      });
+    } finally {
+      ssoRedirectInFlight = false;
+    }
+  };
+  const __redirectToSsoForTenantNow = async ({
+    tenantId,
+    address
+  }) => {
+    var _store$root$urlStrate;
+    // the login box shows login's "redirecting to SSO" step instead of the screen that was refused (its spinner and
+    // a previous error)
+    setLoginState({
+      step: LoginStep.redirectToSSO,
+      loading: false,
+      error: undefined
+    });
     // on an auth page (login, tenant chooser, social / magic link / SSO callback) keep the destination the login
     // already saved: the page itself is not one to come back to
-    const _defaultFronteggRoute = _extends({}, defaultFronteggRoutes, store.auth.routes),
-      authRoutes = _objectWithoutPropertiesLoose(_defaultFronteggRoute, _excluded);
-    const isOnAuthPage = Object.values(authRoutes).some(route => typeof route === 'string' && !!route && window.location.pathname.endsWith(route));
+    const urlStrategy = (_store$root$urlStrate = store.root.urlStrategy) != null ? _store$root$urlStrate : 'path';
+    const isOnAuthPage = isOnAuthPageRoute(urlStrategy, store.auth.routes);
     if (!isOnAuthPage) {
-      setAfterAuthRedirectUrlForStepUp();
+      setAfterAuthRedirectUrlForStepUp(urlStrategy);
     }
     if (store.auth.hostedLoginBox) {
       var _window$localStorage;
@@ -72,9 +98,12 @@ export default ((store, api, sharedActions) => {
       });
       return;
     }
-    store.auth.onRedirectTo(address, {
-      refresh: true
-    });
+    // as login does for an OIDC SSO page without redirect_uri; the refusal has no idpType, but an OIDC page asks for a code
+    let ssoRedirectUrl = address;
+    if (/[?&]response_type=code(&|$)/.test(address) && !address.includes('redirect_uri')) {
+      ssoRedirectUrl += `&redirect_uri=${window.location.origin}${store.auth.routes.oidcRedirectUrl}`;
+    }
+    redirectToFullPage(ssoRedirectUrl);
   };
 
   /**
@@ -84,7 +113,8 @@ export default ((store, api, sharedActions) => {
    * @protected
    */
   const __redirectToSsoIfRequired = async e => {
-    if (!isEnforceSsoOnTenantAccessEnabled(store.root.appName) || !isSsoEnforcementError(e) || !e.errorContext.ssoRequired) {
+    var _e$errorContext;
+    if (!isEnforceSsoOnTenantAccessEnabled(store.root.appName) || !isSsoEnforcementError(e) || !((_e$errorContext = e.errorContext) != null && _e$errorContext.ssoRequired)) {
       return false;
     }
     await __redirectToSsoForTenant(e.errorContext);
@@ -99,7 +129,8 @@ export default ((store, api, sharedActions) => {
    */
   const __handleSsoEnforcementRefreshError = async (e, isSsoEnforcementRetry, refreshForTenant) => {
     var _store$auth$user;
-    if (!isEnforceSsoOnTenantAccessEnabled(store.root.appName) || !isSsoEnforcementError(e)) {
+    // on a login callback the page finishes the login with its code: log out as with the flag off, no new SSO trip
+    if (!isEnforceSsoOnTenantAccessEnabled(store.root.appName) || !isSsoEnforcementError(e) || isOnLoginCodeCallbackRoute(store)) {
       return false;
     }
     if (await __redirectToSsoIfRequired(e)) {
@@ -215,8 +246,9 @@ export default ((store, api, sharedActions) => {
         });
       }
     } catch (e) {
-      // a refused identity refresh has already used up the refresh token: no retry, only the SSO redirect
-      if (await __redirectToSsoIfRequired(e)) {
+      // a refused identity refresh has already used up the refresh token: no retry, only the SSO redirect, except on
+      // a login callback, where the page itself completes the login
+      if (isEnforceSsoOnTenantAccessEnabled(store.root.appName) && !isOnLoginCodeCallbackRoute(store) && (await __redirectToSsoIfRequired(e))) {
         return;
       }
       contextHolder.setAccessToken(null);
@@ -263,6 +295,7 @@ export default ((store, api, sharedActions) => {
 
   /** @protected */
   const __refreshToken = async () => {
+    restoreTabTenantUnlessSsoCallback(store);
     if (FronteggNativeModule.isGetTokensAvailable()) {
       await __refreshTokenWithNativeTokens();
       return;
@@ -455,7 +488,7 @@ export default ((store, api, sharedActions) => {
         callback,
         error
       } = _ref3,
-      body = _objectWithoutPropertiesLoose(_ref3, _excluded2);
+      body = _objectWithoutPropertiesLoose(_ref3, _excluded);
     const publicPolicy = store.auth.securityPolicyState.publicPolicy.policy;
     if (!(publicPolicy != null && publicPolicy.authStrategy)) {
       actions.setLoginState({
@@ -851,7 +884,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = _objectWithoutPropertiesLoose(_payload, _excluded3);
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded2);
     try {
       setLoginState({
         loading: true
@@ -881,7 +914,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = _objectWithoutPropertiesLoose(_payload, _excluded4);
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded3);
     try {
       setLoginState({
         loading: true
@@ -906,7 +939,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = _objectWithoutPropertiesLoose(_payload, _excluded5);
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded4);
     try {
       setLoginState({
         loading: true
@@ -927,7 +960,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = _objectWithoutPropertiesLoose(_payload, _excluded6);
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded5);
     try {
       var _username;
       setLoginState({
@@ -971,7 +1004,7 @@ export default ((store, api, sharedActions) => {
         callback,
         events
       } = _payload,
-      payload = _objectWithoutPropertiesLoose(_payload, _excluded7);
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded6);
     try {
       setLoginState({
         loading: true
@@ -1102,7 +1135,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = payload,
-      body = _objectWithoutPropertiesLoose(payload, _excluded8);
+      body = _objectWithoutPropertiesLoose(payload, _excluded7);
     try {
       var _options$allowCredent;
       actions.setPasskeysState({
@@ -1142,7 +1175,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = payload,
-      body = _objectWithoutPropertiesLoose(payload, _excluded9);
+      body = _objectWithoutPropertiesLoose(payload, _excluded8);
     try {
       var _publicKey$response$u;
       actions.setPasskeysState({
@@ -1162,7 +1195,7 @@ export default ((store, api, sharedActions) => {
         {
           user
         } = _await$api$auth$webAu,
-        rest = _objectWithoutPropertiesLoose(_await$api$auth$webAu, _excluded10);
+        rest = _objectWithoutPropertiesLoose(_await$api$auth$webAu, _excluded9);
       if (isMfaRequired(user, store.root.appName)) {
         const {
           routes,
@@ -1249,7 +1282,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = payload,
-      body = _objectWithoutPropertiesLoose(payload, _excluded11);
+      body = _objectWithoutPropertiesLoose(payload, _excluded10);
     try {
       setLoginState({
         loading: true
@@ -1314,7 +1347,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = _objectWithoutPropertiesLoose(_payload, _excluded12);
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded11);
     setLoginState({
       loading: true
     });
@@ -1349,7 +1382,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = _objectWithoutPropertiesLoose(_payload, _excluded13);
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded12);
     setLoginState({
       loading: true
     });
@@ -1364,6 +1397,9 @@ export default ((store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoginState({
         loading: false,
         error: errorHandler(e)
@@ -1375,7 +1411,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = _objectWithoutPropertiesLoose(_payload, _excluded14);
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded13);
     setLoginState({
       loading: true
     });
@@ -1387,6 +1423,9 @@ export default ((store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoginState({
         loading: false,
         error: errorHandler(e)
@@ -1398,7 +1437,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = _objectWithoutPropertiesLoose(_payload, _excluded15);
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded14);
     setLoginState({
       loading: true
     });
@@ -1425,7 +1464,7 @@ export default ((store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = _objectWithoutPropertiesLoose(_payload, _excluded16);
+      payload = _objectWithoutPropertiesLoose(_payload, _excluded15);
     setLoginState({
       loading: true
     });
@@ -1437,6 +1476,9 @@ export default ((store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoginState({
         loading: false,
         error: errorHandler(e)

package/auth/MfaState/actions.js

@@ -169,6 +169,9 @@ export default ((store, api, sharedActions) => {
       }
       callback == null ? void 0 : callback(mfaState.recoveryCode);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setMfaState({
         loading: false,
         error: errorHandler(e)

package/auth/StepUpState/actions/generateStepUpSession.actions.js

@@ -94,6 +94,10 @@ export default ((store, api, sharedActions) => {
       }
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      // the session's tenant requires SSO: its SSO login steps the user up, instead of logging them out
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       callback == null ? void 0 : callback(false);
       await __handleStepUpError(e);
     }

package/auth/StepUpState/helpers.d.ts

@@ -22,8 +22,9 @@ export interface UrlDerivedStepUp {
 export declare const getUrlDerivedStepUp: () => UrlDerivedStepUp;
 /**
  * Set the url and query params in the local storage FRONTEGG_AFTER_AUTH_REDIRECT_URL value
+ * @param urlStrategy 'hash' saves the route in the hash, which is the page the app shows
  */
-export declare function setAfterAuthRedirectUrlForStepUp(): void;
+export declare function setAfterAuthRedirectUrlForStepUp(urlStrategy?: 'path' | 'hash'): void;
 /**
  * Redirects to the step up url with the max age param and set the redirect url in the local storage
  * The redirect url will be used after the step up flow is done

package/auth/StepUpState/helpers.js

@@ -51,9 +51,10 @@ export const getUrlDerivedStepUp = () => {
 
 /**
  * Set the url and query params in the local storage FRONTEGG_AFTER_AUTH_REDIRECT_URL value
+ * @param urlStrategy 'hash' saves the route in the hash, which is the page the app shows
  */
-export function setAfterAuthRedirectUrlForStepUp() {
-  const encodedRedirectUrl = window.location.pathname + window.location.search;
+export function setAfterAuthRedirectUrlForStepUp(urlStrategy = 'path') {
+  const encodedRedirectUrl = urlStrategy === 'hash' ? window.location.hash.substring(1) || '/' : window.location.pathname + window.location.search;
   window.localStorage.setItem(FRONTEGG_AFTER_AUTH_REDIRECT_URL, encodedRedirectUrl);
 }
 

package/auth/TenantsState/actions.js

@@ -1,6 +1,6 @@
 import { initialState } from './state';
 import { deepResetState } from '../../helpers';
-import { ContextHolder, getCurrentUserTenantsFunction, setTabTenantInSessionStorage } from '@frontegg/rest-api';
+import { ContextHolder, getCurrentUserTenantsFunction, setTabTenantForSsoSwitch } from '@frontegg/rest-api';
 export default ((store, api, sharedActions) => {
   const actions = sharedActions;
   const setTenantsState = state => {
@@ -54,7 +54,7 @@ export default ((store, api, sharedActions) => {
       if (await actions.__redirectToSsoIfRequired(e)) {
         // the tab comes back from SSO in the target tenant, not the one the failed switch restored
         if (ContextHolder.for(store.root.appName).isSessionPerTenantEnabled()) {
-          setTabTenantInSessionStorage(tenantId);
+          setTabTenantForSsoSwitch(tenantId);
         }
         return;
       }

package/auth/helpers.d.ts

@@ -8,5 +8,21 @@ export declare const isMfaRequired: (user: ILoginResponse, appName: string) => b
 export declare const isResetPasswordRequired: (user: ILoginResponse, appName: string) => boolean;
 export declare const mapMetaDataObjectToActions: (obj: any, path?: string[]) => CommitChangeDto[];
 export declare const getUri: (urlStrategy: FronteggState["root"]["urlStrategy"]) => string;
+/**
+ * On the OIDC or hosted login callback the page still has to finish the login with its code: a refresh refused before
+ * that is not a reason to go to SSO again. On the OIDC callback the IdP would send the user straight back here, forever;
+ * on the hosted callback a new hosted login would replace the PKCE verifier the code exchange needs.
+ */
+export declare const isOnLoginCodeCallbackRoute: (store: FronteggState) => boolean;
+/**
+ * After a switch refused for SSO the tab points at the SSO tenant. Its SSO login comes back on a callback route and
+ * keeps it; any other page load means the user didn't finish that login, so the tab goes back to its tenant.
+ */
+export declare const restoreTabTenantUnlessSsoCallback: (store: FronteggState) => void;
 export declare const prepareIdentifiersForSignup: (payload: ISignUpUser) => ISignUpUser;
+/**
+ * Whether the current route is an auth page (login, tenant chooser, social / magic link / SSO callback), not one to come
+ * back to. Unlike isAuthRoute: after-login / sign-up destinations don't count, and endsWith lets a basename prefix it.
+ */
+export declare const isOnAuthPageRoute: (urlStrategy: FronteggState["root"]["urlStrategy"], routes?: Partial<AuthPageRoutes>) => boolean;
 export declare const isAuthRoute: (path: string, routes?: Partial<AuthPageRoutes>) => boolean;

package/auth/helpers.js

@@ -1,8 +1,8 @@
-import _extends from "@babel/runtime/helpers/esm/extends";
 import _objectWithoutPropertiesLoose from "@babel/runtime/helpers/esm/objectWithoutPropertiesLoose";
+import _extends from "@babel/runtime/helpers/esm/extends";
 const _excluded = ["phoneNumber", "email", "username"],
   _excluded2 = ["authenticatedUrl"];
-import { ContextHolder } from '@frontegg/rest-api';
+import { ContextHolder, restoreTabTenantBeforeSsoSwitch } from '@frontegg/rest-api';
 import { defaultFronteggRoutes } from './LoginState/consts';
 export * from './Entitlements/helpers';
 export * from './LoginState/helpers';
@@ -53,6 +53,57 @@ export const getUri = urlStrategy => {
     }
   }
 };
+
+/**
+ * The route the app shows and the page's path. With hash routing they differ: the app's pages live in the hash, but
+ * SAML, OIDC, social and magic link callbacks come back on the path, which is where login matches them.
+ */
+const getCurrentRoutes = urlStrategy => {
+  const hashOrPathRoute = getUri(urlStrategy);
+  const {
+    pathname
+  } = window.location;
+  return hashOrPathRoute === pathname ? [pathname] : [hashOrPathRoute, pathname];
+};
+
+/**
+ * On the OIDC or hosted login callback the page still has to finish the login with its code: a refresh refused before
+ * that is not a reason to go to SSO again. On the OIDC callback the IdP would send the user straight back here, forever;
+ * on the hosted callback a new hosted login would replace the PKCE verifier the code exchange needs.
+ */
+export const isOnLoginCodeCallbackRoute = store => {
+  var _store$root$urlStrate;
+  const {
+    oidcRedirectUrl,
+    hostedLoginRedirectUrl
+  } = _extends({}, defaultFronteggRoutes, store.auth.routes);
+  const currentRoutes = getCurrentRoutes((_store$root$urlStrate = store.root.urlStrategy) != null ? _store$root$urlStrate : 'path');
+  return [oidcRedirectUrl, hostedLoginRedirectUrl].some(route => !!route && currentRoutes.some(currentRoute => currentRoute.endsWith(route)));
+};
+
+/**
+ * After a switch refused for SSO the tab points at the SSO tenant. Its SSO login comes back on a callback route and
+ * keeps it; any other page load means the user didn't finish that login, so the tab goes back to its tenant.
+ */
+export const restoreTabTenantUnlessSsoCallback = store => {
+  var _store$root$urlStrate2;
+  // Flags load in parallel with the first refresh. Recover an existing marker
+  // before choosing that refresh's tenant, even if flags are not available yet.
+  if (!ContextHolder.for(store.root.appName).isSessionPerTenantEnabled()) {
+    return;
+  }
+  const {
+    samlCallbackUrl,
+    oidcRedirectUrl,
+    hostedLoginRedirectUrl
+  } = _extends({}, defaultFronteggRoutes, store.auth.routes);
+  // matched like login matches its callback pages: endsWith, so a basename before the route still counts
+  const currentRoutes = getCurrentRoutes((_store$root$urlStrate2 = store.root.urlStrategy) != null ? _store$root$urlStrate2 : 'path');
+  const isSsoCallback = [samlCallbackUrl, oidcRedirectUrl, hostedLoginRedirectUrl].some(route => !!route && currentRoutes.some(currentRoute => currentRoute.endsWith(route)));
+  if (!isSsoCallback) {
+    restoreTabTenantBeforeSsoSwitch();
+  }
+};
 export const prepareIdentifiersForSignup = payload => {
   const {
       phoneNumber,
@@ -77,6 +128,18 @@ export const prepareIdentifiersForSignup = payload => {
   }
   return finalDto;
 };
+
+// Pages the user lands on after login or sign-up: destinations, not auth pages.
+const AFTER_AUTH_DESTINATION_ROUTES = ['authenticatedUrl', 'signUpSuccessUrl', 'accountSignUpSuccessUrl', 'userSignUpSuccessUrl', 'customLoginAuthenticatedUrl'];
+
+/**
+ * Whether the current route is an auth page (login, tenant chooser, social / magic link / SSO callback), not one to come
+ * back to. Unlike isAuthRoute: after-login / sign-up destinations don't count, and endsWith lets a basename prefix it.
+ */
+export const isOnAuthPageRoute = (urlStrategy, routes) => {
+  const currentRoutes = getCurrentRoutes(urlStrategy);
+  return Object.entries(_extends({}, defaultFronteggRoutes, routes)).some(([name, route]) => !AFTER_AUTH_DESTINATION_ROUTES.includes(name) && typeof route === 'string' && !!route && currentRoutes.some(currentRoute => currentRoute.endsWith(route)));
+};
 export const isAuthRoute = (path, routes) => {
   const _defaultFronteggRoute = _extends({}, defaultFronteggRoutes, routes),
     authRoutes = _objectWithoutPropertiesLoose(_defaultFronteggRoute, _excluded2);

package/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.131.0-alpha.0
+/** @license Frontegg v7.131.0-alpha.2
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/node/auth/ActivateAccountState/actions.js

@@ -158,6 +158,9 @@ var _default = (store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setActivateState({
         loading: false,
         error: (0, _helpers.errorHandler)(e)
@@ -195,6 +198,9 @@ var _default = (store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setActivateState({
         submitting: false,
         loading: false,

package/node/auth/LoginState/actions/hostedLoginAuthorize.actions.js

@@ -22,6 +22,7 @@ var _default = (store, api, sharedActions) => {
   const __requestHostedLoginSilentAuthorize = async () => {
     var _response;
     let response;
+    (0, _helpers3.restoreTabTenantUnlessSsoCallback)(store);
     if (_toolkit.FronteggNativeModule.isGetTokensAvailable()) {
       const authApi = api.auth;
       response = await (0, _helpers.refreshTokenWithRetry)(async () => {
@@ -33,6 +34,14 @@ var _default = (store, api, sharedActions) => {
         response = await api.auth.silentOAuthRefreshTokenV2();
       } catch (error) {
         var _store$auth$user, _error$errorContext;
+        // on the hosted login callback the page finishes the login with its code: fail as with the flag off
+        if ((0, _helpers3.isOnLoginCodeCallbackRoute)(store)) {
+          throw error;
+        }
+        // the tenant requires SSO: hosted login for that tenant, not the plain one the caller falls back to
+        if (await actions.__redirectToSsoIfRequired(error)) {
+          return;
+        }
         const tenantId = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.tenantId;
         if (!(0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) || !(0, _helpers.isSsoEnforcementError)(error) || ((_error$errorContext = error.errorContext) == null ? void 0 : _error$errorContext.ssoRequired) !== false || !tenantId) {
           throw error;

package/node/auth/LoginState/actions/index.js

@@ -5,8 +5,8 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.default = void 0;
-var _extends2 = _interopRequireDefault(require("@babel/runtime/helpers/extends"));
 var _objectWithoutPropertiesLoose2 = _interopRequireDefault(require("@babel/runtime/helpers/objectWithoutPropertiesLoose"));
+var _extends2 = _interopRequireDefault(require("@babel/runtime/helpers/extends"));
 var _afterAuthNavigation = _interopRequireDefault(require("./afterAuthNavigation.actions"));
 var _handleVerifyMFAResponse = _interopRequireDefault(require("./handleVerifyMFAResponse.actions"));
 var _mfaRequiredState = _interopRequireDefault(require("./mfaRequiredState.actions"));
@@ -29,22 +29,21 @@ var _helpers3 = require("../../helpers");
 var _interfaces3 = require("../../MfaState/interfaces");
 var _interfaces4 = require("../../SSOState/interfaces");
 var _constants = require("../../../constants");
-const _excluded = ["authenticatedUrl"],
-  _excluded2 = ["callback", "error"],
+const _excluded = ["callback", "error"],
+  _excluded2 = ["callback"],
   _excluded3 = ["callback"],
   _excluded4 = ["callback"],
   _excluded5 = ["callback"],
-  _excluded6 = ["callback"],
-  _excluded7 = ["callback", "events"],
+  _excluded6 = ["callback", "events"],
+  _excluded7 = ["callback"],
   _excluded8 = ["callback"],
-  _excluded9 = ["callback"],
-  _excluded10 = ["user"],
+  _excluded9 = ["user"],
+  _excluded10 = ["callback"],
   _excluded11 = ["callback"],
   _excluded12 = ["callback"],
   _excluded13 = ["callback"],
   _excluded14 = ["callback"],
-  _excluded15 = ["callback"],
-  _excluded16 = ["callback"];
+  _excluded15 = ["callback"];
 const SSO_REDIRECT_DELAY_MS = 2000;
 const isUsableRedirect = onRedirectTo => typeof onRedirectTo === 'function' && onRedirectTo !== _consts2.defaultOnRedirectTo;
 var _default = (store, api, sharedActions) => {
@@ -55,17 +54,44 @@ var _default = (store, api, sharedActions) => {
    * Sends the user to log in through the tenant's SSO and back to the current page afterwards.
    * @protected
    */
+  // as preLogin (takeLeading): an SSO redirect started while another is in flight is dropped; the first one leaves the
+  // page, and a second hosted one would replace the PKCE verifier the first one's callback needs
+  let ssoRedirectInFlight = false;
   const __redirectToSsoForTenant = async ({
     tenantId,
     address
   }) => {
+    if (ssoRedirectInFlight) {
+      return;
+    }
+    ssoRedirectInFlight = true;
+    try {
+      await __redirectToSsoForTenantNow({
+        tenantId,
+        address
+      });
+    } finally {
+      ssoRedirectInFlight = false;
+    }
+  };
+  const __redirectToSsoForTenantNow = async ({
+    tenantId,
+    address
+  }) => {
+    var _store$root$urlStrate;
+    // the login box shows login's "redirecting to SSO" step instead of the screen that was refused (its spinner and
+    // a previous error)
+    setLoginState({
+      step: _interfaces.LoginStep.redirectToSSO,
+      loading: false,
+      error: undefined
+    });
     // on an auth page (login, tenant chooser, social / magic link / SSO callback) keep the destination the login
     // already saved: the page itself is not one to come back to
-    const _defaultFronteggRoute = (0, _extends2.default)({}, _consts2.defaultFronteggRoutes, store.auth.routes),
-      authRoutes = (0, _objectWithoutPropertiesLoose2.default)(_defaultFronteggRoute, _excluded);
-    const isOnAuthPage = Object.values(authRoutes).some(route => typeof route === 'string' && !!route && window.location.pathname.endsWith(route));
+    const urlStrategy = (_store$root$urlStrate = store.root.urlStrategy) != null ? _store$root$urlStrate : 'path';
+    const isOnAuthPage = (0, _helpers3.isOnAuthPageRoute)(urlStrategy, store.auth.routes);
     if (!isOnAuthPage) {
-      (0, _helpers3.setAfterAuthRedirectUrlForStepUp)();
+      (0, _helpers3.setAfterAuthRedirectUrlForStepUp)(urlStrategy);
     }
     if (store.auth.hostedLoginBox) {
       var _window$localStorage;
@@ -79,9 +105,12 @@ var _default = (store, api, sharedActions) => {
       });
       return;
     }
-    store.auth.onRedirectTo(address, {
-      refresh: true
-    });
+    // as login does for an OIDC SSO page without redirect_uri; the refusal has no idpType, but an OIDC page asks for a code
+    let ssoRedirectUrl = address;
+    if (/[?&]response_type=code(&|$)/.test(address) && !address.includes('redirect_uri')) {
+      ssoRedirectUrl += `&redirect_uri=${window.location.origin}${store.auth.routes.oidcRedirectUrl}`;
+    }
+    redirectToFullPage(ssoRedirectUrl);
   };
 
   /**
@@ -91,7 +120,8 @@ var _default = (store, api, sharedActions) => {
    * @protected
    */
   const __redirectToSsoIfRequired = async e => {
-    if (!(0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) || !(0, _helpers.isSsoEnforcementError)(e) || !e.errorContext.ssoRequired) {
+    var _e$errorContext;
+    if (!(0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) || !(0, _helpers.isSsoEnforcementError)(e) || !((_e$errorContext = e.errorContext) != null && _e$errorContext.ssoRequired)) {
       return false;
     }
     await __redirectToSsoForTenant(e.errorContext);
@@ -106,7 +136,8 @@ var _default = (store, api, sharedActions) => {
    */
   const __handleSsoEnforcementRefreshError = async (e, isSsoEnforcementRetry, refreshForTenant) => {
     var _store$auth$user;
-    if (!(0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) || !(0, _helpers.isSsoEnforcementError)(e)) {
+    // on a login callback the page finishes the login with its code: log out as with the flag off, no new SSO trip
+    if (!(0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) || !(0, _helpers.isSsoEnforcementError)(e) || (0, _helpers3.isOnLoginCodeCallbackRoute)(store)) {
       return false;
     }
     if (await __redirectToSsoIfRequired(e)) {
@@ -222,8 +253,9 @@ var _default = (store, api, sharedActions) => {
         });
       }
     } catch (e) {
-      // a refused identity refresh has already used up the refresh token: no retry, only the SSO redirect
-      if (await __redirectToSsoIfRequired(e)) {
+      // a refused identity refresh has already used up the refresh token: no retry, only the SSO redirect, except on
+      // a login callback, where the page itself completes the login
+      if ((0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) && !(0, _helpers3.isOnLoginCodeCallbackRoute)(store) && (await __redirectToSsoIfRequired(e))) {
         return;
       }
       contextHolder.setAccessToken(null);
@@ -270,6 +302,7 @@ var _default = (store, api, sharedActions) => {
 
   /** @protected */
   const __refreshToken = async () => {
+    (0, _helpers3.restoreTabTenantUnlessSsoCallback)(store);
     if (_toolkit.FronteggNativeModule.isGetTokensAvailable()) {
       await __refreshTokenWithNativeTokens();
       return;
@@ -462,7 +495,7 @@ var _default = (store, api, sharedActions) => {
         callback,
         error
       } = _ref3,
-      body = (0, _objectWithoutPropertiesLoose2.default)(_ref3, _excluded2);
+      body = (0, _objectWithoutPropertiesLoose2.default)(_ref3, _excluded);
     const publicPolicy = store.auth.securityPolicyState.publicPolicy.policy;
     if (!(publicPolicy != null && publicPolicy.authStrategy)) {
       actions.setLoginState({
@@ -858,7 +891,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded3);
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded2);
     try {
       setLoginState({
         loading: true
@@ -888,7 +921,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded4);
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded3);
     try {
       setLoginState({
         loading: true
@@ -913,7 +946,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded5);
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded4);
     try {
       setLoginState({
         loading: true
@@ -934,7 +967,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded6);
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded5);
     try {
       var _username;
       setLoginState({
@@ -978,7 +1011,7 @@ var _default = (store, api, sharedActions) => {
         callback,
         events
       } = _payload,
-      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded7);
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded6);
     try {
       setLoginState({
         loading: true
@@ -1109,7 +1142,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = payload,
-      body = (0, _objectWithoutPropertiesLoose2.default)(payload, _excluded8);
+      body = (0, _objectWithoutPropertiesLoose2.default)(payload, _excluded7);
     try {
       var _options$allowCredent;
       actions.setPasskeysState({
@@ -1149,7 +1182,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = payload,
-      body = (0, _objectWithoutPropertiesLoose2.default)(payload, _excluded9);
+      body = (0, _objectWithoutPropertiesLoose2.default)(payload, _excluded8);
     try {
       var _publicKey$response$u;
       actions.setPasskeysState({
@@ -1169,7 +1202,7 @@ var _default = (store, api, sharedActions) => {
         {
           user
         } = _await$api$auth$webAu,
-        rest = (0, _objectWithoutPropertiesLoose2.default)(_await$api$auth$webAu, _excluded10);
+        rest = (0, _objectWithoutPropertiesLoose2.default)(_await$api$auth$webAu, _excluded9);
       if ((0, _helpers3.isMfaRequired)(user, store.root.appName)) {
         const {
           routes,
@@ -1256,7 +1289,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = payload,
-      body = (0, _objectWithoutPropertiesLoose2.default)(payload, _excluded11);
+      body = (0, _objectWithoutPropertiesLoose2.default)(payload, _excluded10);
     try {
       setLoginState({
         loading: true
@@ -1321,7 +1354,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded12);
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded11);
     setLoginState({
       loading: true
     });
@@ -1356,7 +1389,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded13);
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded12);
     setLoginState({
       loading: true
     });
@@ -1371,6 +1404,9 @@ var _default = (store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoginState({
         loading: false,
         error: (0, _helpers.errorHandler)(e)
@@ -1382,7 +1418,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded14);
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded13);
     setLoginState({
       loading: true
     });
@@ -1394,6 +1430,9 @@ var _default = (store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoginState({
         loading: false,
         error: (0, _helpers.errorHandler)(e)
@@ -1405,7 +1444,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded15);
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded14);
     setLoginState({
       loading: true
     });
@@ -1432,7 +1471,7 @@ var _default = (store, api, sharedActions) => {
     const {
         callback
       } = _payload,
-      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded16);
+      payload = (0, _objectWithoutPropertiesLoose2.default)(_payload, _excluded15);
     setLoginState({
       loading: true
     });
@@ -1444,6 +1483,9 @@ var _default = (store, api, sharedActions) => {
       });
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      if (await __redirectToSsoIfRequired(e)) {
+        return;
+      }
       setLoginState({
         loading: false,
         error: (0, _helpers.errorHandler)(e)

package/node/auth/MfaState/actions.js

@@ -176,6 +176,9 @@ var _default = (store, api, sharedActions) => {
       }
       callback == null ? void 0 : callback(mfaState.recoveryCode);
     } catch (e) {
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       setMfaState({
         loading: false,
         error: (0, _helpers.errorHandler)(e)

package/node/auth/StepUpState/actions/generateStepUpSession.actions.js

@@ -100,6 +100,10 @@ var _default = (store, api, sharedActions) => {
       }
       callback == null ? void 0 : callback(true);
     } catch (e) {
+      // the session's tenant requires SSO: its SSO login steps the user up, instead of logging them out
+      if (await actions.__redirectToSsoIfRequired(e)) {
+        return;
+      }
       callback == null ? void 0 : callback(false);
       await __handleStepUpError(e);
     }

package/node/auth/StepUpState/helpers.js

@@ -59,10 +59,11 @@ const getUrlDerivedStepUp = () => {
 
 /**
  * Set the url and query params in the local storage FRONTEGG_AFTER_AUTH_REDIRECT_URL value
+ * @param urlStrategy 'hash' saves the route in the hash, which is the page the app shows
  */
 exports.getUrlDerivedStepUp = getUrlDerivedStepUp;
-function setAfterAuthRedirectUrlForStepUp() {
-  const encodedRedirectUrl = window.location.pathname + window.location.search;
+function setAfterAuthRedirectUrlForStepUp(urlStrategy = 'path') {
+  const encodedRedirectUrl = urlStrategy === 'hash' ? window.location.hash.substring(1) || '/' : window.location.pathname + window.location.search;
   window.localStorage.setItem(_constants.FRONTEGG_AFTER_AUTH_REDIRECT_URL, encodedRedirectUrl);
 }
 

package/node/auth/TenantsState/actions.js

@@ -60,7 +60,7 @@ var _default = (store, api, sharedActions) => {
       if (await actions.__redirectToSsoIfRequired(e)) {
         // the tab comes back from SSO in the target tenant, not the one the failed switch restored
         if (_restApi.ContextHolder.for(store.root.appName).isSessionPerTenantEnabled()) {
-          (0, _restApi.setTabTenantInSessionStorage)(tenantId);
+          (0, _restApi.setTabTenantForSsoSwitch)(tenantId);
         }
         return;
       }

package/node/auth/helpers.js

@@ -9,12 +9,15 @@ var _exportNames = {
   isResetPasswordRequired: true,
   mapMetaDataObjectToActions: true,
   getUri: true,
+  isOnLoginCodeCallbackRoute: true,
+  restoreTabTenantUnlessSsoCallback: true,
   prepareIdentifiersForSignup: true,
+  isOnAuthPageRoute: true,
   isAuthRoute: true
 };
-exports.prepareIdentifiersForSignup = exports.mapMetaDataObjectToActions = exports.isResetPasswordRequired = exports.isMfaRequired = exports.isAuthRoute = exports.getUri = void 0;
-var _extends2 = _interopRequireDefault(require("@babel/runtime/helpers/extends"));
+exports.restoreTabTenantUnlessSsoCallback = exports.prepareIdentifiersForSignup = exports.mapMetaDataObjectToActions = exports.isResetPasswordRequired = exports.isOnLoginCodeCallbackRoute = exports.isOnAuthPageRoute = exports.isMfaRequired = exports.isAuthRoute = exports.getUri = void 0;
 var _objectWithoutPropertiesLoose2 = _interopRequireDefault(require("@babel/runtime/helpers/objectWithoutPropertiesLoose"));
+var _extends2 = _interopRequireDefault(require("@babel/runtime/helpers/extends"));
 var _restApi = require("@frontegg/rest-api");
 var _consts = require("./LoginState/consts");
 var _helpers = require("./Entitlements/helpers");
@@ -104,7 +107,60 @@ const getUri = urlStrategy => {
     }
   }
 };
+
+/**
+ * The route the app shows and the page's path. With hash routing they differ: the app's pages live in the hash, but
+ * SAML, OIDC, social and magic link callbacks come back on the path, which is where login matches them.
+ */
 exports.getUri = getUri;
+const getCurrentRoutes = urlStrategy => {
+  const hashOrPathRoute = getUri(urlStrategy);
+  const {
+    pathname
+  } = window.location;
+  return hashOrPathRoute === pathname ? [pathname] : [hashOrPathRoute, pathname];
+};
+
+/**
+ * On the OIDC or hosted login callback the page still has to finish the login with its code: a refresh refused before
+ * that is not a reason to go to SSO again. On the OIDC callback the IdP would send the user straight back here, forever;
+ * on the hosted callback a new hosted login would replace the PKCE verifier the code exchange needs.
+ */
+const isOnLoginCodeCallbackRoute = store => {
+  var _store$root$urlStrate;
+  const {
+    oidcRedirectUrl,
+    hostedLoginRedirectUrl
+  } = (0, _extends2.default)({}, _consts.defaultFronteggRoutes, store.auth.routes);
+  const currentRoutes = getCurrentRoutes((_store$root$urlStrate = store.root.urlStrategy) != null ? _store$root$urlStrate : 'path');
+  return [oidcRedirectUrl, hostedLoginRedirectUrl].some(route => !!route && currentRoutes.some(currentRoute => currentRoute.endsWith(route)));
+};
+
+/**
+ * After a switch refused for SSO the tab points at the SSO tenant. Its SSO login comes back on a callback route and
+ * keeps it; any other page load means the user didn't finish that login, so the tab goes back to its tenant.
+ */
+exports.isOnLoginCodeCallbackRoute = isOnLoginCodeCallbackRoute;
+const restoreTabTenantUnlessSsoCallback = store => {
+  var _store$root$urlStrate2;
+  // Flags load in parallel with the first refresh. Recover an existing marker
+  // before choosing that refresh's tenant, even if flags are not available yet.
+  if (!_restApi.ContextHolder.for(store.root.appName).isSessionPerTenantEnabled()) {
+    return;
+  }
+  const {
+    samlCallbackUrl,
+    oidcRedirectUrl,
+    hostedLoginRedirectUrl
+  } = (0, _extends2.default)({}, _consts.defaultFronteggRoutes, store.auth.routes);
+  // matched like login matches its callback pages: endsWith, so a basename before the route still counts
+  const currentRoutes = getCurrentRoutes((_store$root$urlStrate2 = store.root.urlStrategy) != null ? _store$root$urlStrate2 : 'path');
+  const isSsoCallback = [samlCallbackUrl, oidcRedirectUrl, hostedLoginRedirectUrl].some(route => !!route && currentRoutes.some(currentRoute => currentRoute.endsWith(route)));
+  if (!isSsoCallback) {
+    (0, _restApi.restoreTabTenantBeforeSsoSwitch)();
+  }
+};
+exports.restoreTabTenantUnlessSsoCallback = restoreTabTenantUnlessSsoCallback;
 const prepareIdentifiersForSignup = payload => {
   const {
       phoneNumber,
@@ -129,7 +185,20 @@ const prepareIdentifiersForSignup = payload => {
   }
   return finalDto;
 };
+
+// Pages the user lands on after login or sign-up: destinations, not auth pages.
 exports.prepareIdentifiersForSignup = prepareIdentifiersForSignup;
+const AFTER_AUTH_DESTINATION_ROUTES = ['authenticatedUrl', 'signUpSuccessUrl', 'accountSignUpSuccessUrl', 'userSignUpSuccessUrl', 'customLoginAuthenticatedUrl'];
+
+/**
+ * Whether the current route is an auth page (login, tenant chooser, social / magic link / SSO callback), not one to come
+ * back to. Unlike isAuthRoute: after-login / sign-up destinations don't count, and endsWith lets a basename prefix it.
+ */
+const isOnAuthPageRoute = (urlStrategy, routes) => {
+  const currentRoutes = getCurrentRoutes(urlStrategy);
+  return Object.entries((0, _extends2.default)({}, _consts.defaultFronteggRoutes, routes)).some(([name, route]) => !AFTER_AUTH_DESTINATION_ROUTES.includes(name) && typeof route === 'string' && !!route && currentRoutes.some(currentRoute => currentRoute.endsWith(route)));
+};
+exports.isOnAuthPageRoute = isOnAuthPageRoute;
 const isAuthRoute = (path, routes) => {
   const _defaultFronteggRoute = (0, _extends2.default)({}, _consts.defaultFronteggRoutes, routes),
     authRoutes = (0, _objectWithoutPropertiesLoose2.default)(_defaultFronteggRoute, _excluded2);

package/node/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.131.0-alpha.0
+/** @license Frontegg v7.131.0-alpha.2
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@frontegg/redux-store",
-  "version": "7.131.0-alpha.0",
+  "version": "7.131.0-alpha.2",
   "main": "./node/index.js",
   "license": "MIT",
   "author": "Frontegg LTD",
   "dependencies": {
     "@babel/runtime": "^7.18.6",
     "@frontegg/entitlements-javascript-commons": "1.1.2",
-    "@frontegg/rest-api": "7.131.0-alpha.0",
+    "@frontegg/rest-api": "7.131.0-alpha.2",
     "fast-deep-equal": "3.1.3",
     "get-value": "^3.0.1",
     "proxy-compare": "^3.0.0",