@frontegg/redux-store 7.131.0-alpha.1 → 7.131.0-alpha.2

package/auth/LoginState/actions/hostedLoginAuthorize.actions.js

@@ -3,7 +3,7 @@ import { createRandomString, generateCodeChallenge, GTMEventAction, isSsoEnforce
 import { HOSTED_LOGIN_VERIFIER_KEY } from '../../../constants';
 import { isEnforceSsoOnTenantAccessEnabled } from '@frontegg/rest-api';
 import { getBaseNameWithoutSlashSuffix, getSearchParam, isOauthCallbackRoute, TENANT_ID_PARAM_KEY } from '../helpers';
-import { getUri, getUrlDerivedStepUp, isSteppedUp, redirectByStepUpUrl, restoreTabTenantUnlessSsoCallback } from '../../helpers';
+import { getUri, getUrlDerivedStepUp, isSteppedUp, isOnLoginCodeCallbackRoute, redirectByStepUpUrl, restoreTabTenantUnlessSsoCallback } from '../../helpers';
 import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
 import { FronteggNativeModule } from '../../../toolkit';
 export default ((store, api, sharedActions) => {
@@ -27,6 +27,10 @@ export default ((store, api, sharedActions) => {
         response = await api.auth.silentOAuthRefreshTokenV2();
       } catch (error) {
         var _store$auth$user, _error$errorContext;
+        // on the hosted login callback the page finishes the login with its code: fail as with the flag off
+        if (isOnLoginCodeCallbackRoute(store)) {
+          throw error;
+        }
         // the tenant requires SSO: hosted login for that tenant, not the plain one the caller falls back to
         if (await actions.__redirectToSsoIfRequired(error)) {
           return;

package/auth/LoginState/actions/index.d.ts

@@ -33,7 +33,21 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
     requestHostedLoginAuthorize: (additionalParams?: Record<string, string>) => Promise<void>;
     requestHostedLoginAuthorizeV2: (payload?: {
         additionalParams?: Record<string, string>;
-        shouldRedirectToLogin?: boolean;
+        shouldRedirectToLogin
+        /**
+         * Handles a hosted (OAuth) token refresh refused because the tenant requires SSO.
+         * ssoRequired: true sends the user to SSO, like login. ssoRequired: false renews once more for the tenant of the
+         * current token, which keeps the session: OAuth doesn't use up the refresh token on this refusal.
+         * @returns true when handled, false when the caller should log out
+         * @private
+         */
+        ? /**
+         * Handles a hosted (OAuth) token refresh refused because the tenant requires SSO.
+         * ssoRequired: true sends the user to SSO, like login. ssoRequired: false renews once more for the tenant of the
+         * current token, which keeps the session: OAuth doesn't use up the refresh token on this refusal.
+         * @returns true when handled, false when the caller should log out
+         * @private
+         */: boolean;
         firstTime?: boolean;
         loginDirectAction?: import("../interfaces").LoginDirectAction;
     }) => Promise<void>;

package/auth/LoginState/actions/index.js

@@ -33,7 +33,7 @@ import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
 import { FronteggNativeModule, isEntitlementsDeeplyEqual } from '../../../toolkit';
 import { REQUEST_NAME, UserVerifiedOriginTypes } from '../../interfaces';
 import { authStrategyLoginStepMap, defaultOnRedirectTo } from '../consts';
-import { isMfaRequired, isOnAuthPageRoute, isOnOidcCallbackRoute, isResetPasswordRequired, restoreTabTenantUnlessSsoCallback, setAfterAuthRedirectUrlForStepUp } from '../../helpers';
+import { isMfaRequired, isOnAuthPageRoute, isOnLoginCodeCallbackRoute, isResetPasswordRequired, restoreTabTenantUnlessSsoCallback, setAfterAuthRedirectUrlForStepUp } from '../../helpers';
 import { MFAStep } from '../../MfaState/interfaces';
 import { SamlVendors } from '../../SSOState/interfaces';
 import { DEFAULT_RETRY_CONFIG } from '../../../constants';
@@ -129,7 +129,8 @@ export default ((store, api, sharedActions) => {
    */
   const __handleSsoEnforcementRefreshError = async (e, isSsoEnforcementRetry, refreshForTenant) => {
     var _store$auth$user;
-    if (!isEnforceSsoOnTenantAccessEnabled(store.root.appName) || !isSsoEnforcementError(e)) {
+    // on a login callback the page finishes the login with its code: log out as with the flag off, no new SSO trip
+    if (!isEnforceSsoOnTenantAccessEnabled(store.root.appName) || !isSsoEnforcementError(e) || isOnLoginCodeCallbackRoute(store)) {
       return false;
     }
     if (await __redirectToSsoIfRequired(e)) {
@@ -246,8 +247,8 @@ export default ((store, api, sharedActions) => {
       }
     } catch (e) {
       // a refused identity refresh has already used up the refresh token: no retry, only the SSO redirect, except on
-      // the OIDC callback, where the page itself completes the OIDC login
-      if (isEnforceSsoOnTenantAccessEnabled(store.root.appName) && !isOnOidcCallbackRoute(store) && (await __redirectToSsoIfRequired(e))) {
+      // a login callback, where the page itself completes the login
+      if (isEnforceSsoOnTenantAccessEnabled(store.root.appName) && !isOnLoginCodeCallbackRoute(store) && (await __redirectToSsoIfRequired(e))) {
         return;
       }
       contextHolder.setAccessToken(null);

package/auth/StepUpState/actions/generateStepUpSession.actions.js

@@ -94,12 +94,11 @@ export default ((store, api, sharedActions) => {
       }
       callback == null ? void 0 : callback(true);
     } catch (e) {
-      callback == null ? void 0 : callback(false);
-
       // the session's tenant requires SSO: its SSO login steps the user up, instead of logging them out
       if (await actions.__redirectToSsoIfRequired(e)) {
         return;
       }
+      callback == null ? void 0 : callback(false);
       await __handleStepUpError(e);
     }
   };

package/auth/helpers.d.ts

@@ -9,10 +9,11 @@ export declare const isResetPasswordRequired: (user: ILoginResponse, appName: st
 export declare const mapMetaDataObjectToActions: (obj: any, path?: string[]) => CommitChangeDto[];
 export declare const getUri: (urlStrategy: FronteggState["root"]["urlStrategy"]) => string;
 /**
- * On the OIDC callback the page still has to finish the OIDC login with its code: a refresh refused before that is not
- * a reason to go back to the IdP, which would send the user straight back here, forever.
+ * On the OIDC or hosted login callback the page still has to finish the login with its code: a refresh refused before
+ * that is not a reason to go to SSO again. On the OIDC callback the IdP would send the user straight back here, forever;
+ * on the hosted callback a new hosted login would replace the PKCE verifier the code exchange needs.
  */
-export declare const isOnOidcCallbackRoute: (store: FronteggState) => boolean;
+export declare const isOnLoginCodeCallbackRoute: (store: FronteggState) => boolean;
 /**
  * After a switch refused for SSO the tab points at the SSO tenant. Its SSO login comes back on a callback route and
  * keeps it; any other page load means the user didn't finish that login, so the tab goes back to its tenant.

package/auth/helpers.js

@@ -2,7 +2,7 @@ import _objectWithoutPropertiesLoose from "@babel/runtime/helpers/esm/objectWith
 import _extends from "@babel/runtime/helpers/esm/extends";
 const _excluded = ["phoneNumber", "email", "username"],
   _excluded2 = ["authenticatedUrl"];
-import { ContextHolder, restoreTabTenantBeforeSsoSwitch, isEnforceSsoOnTenantAccessEnabled } from '@frontegg/rest-api';
+import { ContextHolder, restoreTabTenantBeforeSsoSwitch } from '@frontegg/rest-api';
 import { defaultFronteggRoutes } from './LoginState/consts';
 export * from './Entitlements/helpers';
 export * from './LoginState/helpers';
@@ -67,15 +67,18 @@ const getCurrentRoutes = urlStrategy => {
 };
 
 /**
- * On the OIDC callback the page still has to finish the OIDC login with its code: a refresh refused before that is not
- * a reason to go back to the IdP, which would send the user straight back here, forever.
+ * On the OIDC or hosted login callback the page still has to finish the login with its code: a refresh refused before
+ * that is not a reason to go to SSO again. On the OIDC callback the IdP would send the user straight back here, forever;
+ * on the hosted callback a new hosted login would replace the PKCE verifier the code exchange needs.
  */
-export const isOnOidcCallbackRoute = store => {
+export const isOnLoginCodeCallbackRoute = store => {
   var _store$root$urlStrate;
   const {
-    oidcRedirectUrl
+    oidcRedirectUrl,
+    hostedLoginRedirectUrl
   } = _extends({}, defaultFronteggRoutes, store.auth.routes);
-  return !!oidcRedirectUrl && getCurrentRoutes((_store$root$urlStrate = store.root.urlStrategy) != null ? _store$root$urlStrate : 'path').some(currentRoute => currentRoute.endsWith(oidcRedirectUrl));
+  const currentRoutes = getCurrentRoutes((_store$root$urlStrate = store.root.urlStrategy) != null ? _store$root$urlStrate : 'path');
+  return [oidcRedirectUrl, hostedLoginRedirectUrl].some(route => !!route && currentRoutes.some(currentRoute => currentRoute.endsWith(route)));
 };
 
 /**
@@ -84,7 +87,9 @@ export const isOnOidcCallbackRoute = store => {
  */
 export const restoreTabTenantUnlessSsoCallback = store => {
   var _store$root$urlStrate2;
-  if (!isEnforceSsoOnTenantAccessEnabled(store.root.appName) || !ContextHolder.for(store.root.appName).isSessionPerTenantEnabled()) {
+  // Flags load in parallel with the first refresh. Recover an existing marker
+  // before choosing that refresh's tenant, even if flags are not available yet.
+  if (!ContextHolder.for(store.root.appName).isSessionPerTenantEnabled()) {
     return;
   }
   const {

package/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.131.0-alpha.1
+/** @license Frontegg v7.131.0-alpha.2
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/node/auth/LoginState/actions/hostedLoginAuthorize.actions.js

@@ -34,6 +34,10 @@ var _default = (store, api, sharedActions) => {
         response = await api.auth.silentOAuthRefreshTokenV2();
       } catch (error) {
         var _store$auth$user, _error$errorContext;
+        // on the hosted login callback the page finishes the login with its code: fail as with the flag off
+        if ((0, _helpers3.isOnLoginCodeCallbackRoute)(store)) {
+          throw error;
+        }
         // the tenant requires SSO: hosted login for that tenant, not the plain one the caller falls back to
         if (await actions.__redirectToSsoIfRequired(error)) {
           return;

package/node/auth/LoginState/actions/index.js

@@ -136,7 +136,8 @@ var _default = (store, api, sharedActions) => {
    */
   const __handleSsoEnforcementRefreshError = async (e, isSsoEnforcementRetry, refreshForTenant) => {
     var _store$auth$user;
-    if (!(0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) || !(0, _helpers.isSsoEnforcementError)(e)) {
+    // on a login callback the page finishes the login with its code: log out as with the flag off, no new SSO trip
+    if (!(0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) || !(0, _helpers.isSsoEnforcementError)(e) || (0, _helpers3.isOnLoginCodeCallbackRoute)(store)) {
       return false;
     }
     if (await __redirectToSsoIfRequired(e)) {
@@ -253,8 +254,8 @@ var _default = (store, api, sharedActions) => {
       }
     } catch (e) {
       // a refused identity refresh has already used up the refresh token: no retry, only the SSO redirect, except on
-      // the OIDC callback, where the page itself completes the OIDC login
-      if ((0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) && !(0, _helpers3.isOnOidcCallbackRoute)(store) && (await __redirectToSsoIfRequired(e))) {
+      // a login callback, where the page itself completes the login
+      if ((0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) && !(0, _helpers3.isOnLoginCodeCallbackRoute)(store) && (await __redirectToSsoIfRequired(e))) {
         return;
       }
       contextHolder.setAccessToken(null);

package/node/auth/StepUpState/actions/generateStepUpSession.actions.js

@@ -100,12 +100,11 @@ var _default = (store, api, sharedActions) => {
       }
       callback == null ? void 0 : callback(true);
     } catch (e) {
-      callback == null ? void 0 : callback(false);
-
       // the session's tenant requires SSO: its SSO login steps the user up, instead of logging them out
       if (await actions.__redirectToSsoIfRequired(e)) {
         return;
       }
+      callback == null ? void 0 : callback(false);
       await __handleStepUpError(e);
     }
   };

package/node/auth/helpers.js

@@ -9,13 +9,13 @@ var _exportNames = {
   isResetPasswordRequired: true,
   mapMetaDataObjectToActions: true,
   getUri: true,
-  isOnOidcCallbackRoute: true,
+  isOnLoginCodeCallbackRoute: true,
   restoreTabTenantUnlessSsoCallback: true,
   prepareIdentifiersForSignup: true,
   isOnAuthPageRoute: true,
   isAuthRoute: true
 };
-exports.restoreTabTenantUnlessSsoCallback = exports.prepareIdentifiersForSignup = exports.mapMetaDataObjectToActions = exports.isResetPasswordRequired = exports.isOnOidcCallbackRoute = exports.isOnAuthPageRoute = exports.isMfaRequired = exports.isAuthRoute = exports.getUri = void 0;
+exports.restoreTabTenantUnlessSsoCallback = exports.prepareIdentifiersForSignup = exports.mapMetaDataObjectToActions = exports.isResetPasswordRequired = exports.isOnLoginCodeCallbackRoute = exports.isOnAuthPageRoute = exports.isMfaRequired = exports.isAuthRoute = exports.getUri = void 0;
 var _objectWithoutPropertiesLoose2 = _interopRequireDefault(require("@babel/runtime/helpers/objectWithoutPropertiesLoose"));
 var _extends2 = _interopRequireDefault(require("@babel/runtime/helpers/extends"));
 var _restApi = require("@frontegg/rest-api");
@@ -122,25 +122,30 @@ const getCurrentRoutes = urlStrategy => {
 };
 
 /**
- * On the OIDC callback the page still has to finish the OIDC login with its code: a refresh refused before that is not
- * a reason to go back to the IdP, which would send the user straight back here, forever.
+ * On the OIDC or hosted login callback the page still has to finish the login with its code: a refresh refused before
+ * that is not a reason to go to SSO again. On the OIDC callback the IdP would send the user straight back here, forever;
+ * on the hosted callback a new hosted login would replace the PKCE verifier the code exchange needs.
  */
-const isOnOidcCallbackRoute = store => {
+const isOnLoginCodeCallbackRoute = store => {
   var _store$root$urlStrate;
   const {
-    oidcRedirectUrl
+    oidcRedirectUrl,
+    hostedLoginRedirectUrl
   } = (0, _extends2.default)({}, _consts.defaultFronteggRoutes, store.auth.routes);
-  return !!oidcRedirectUrl && getCurrentRoutes((_store$root$urlStrate = store.root.urlStrategy) != null ? _store$root$urlStrate : 'path').some(currentRoute => currentRoute.endsWith(oidcRedirectUrl));
+  const currentRoutes = getCurrentRoutes((_store$root$urlStrate = store.root.urlStrategy) != null ? _store$root$urlStrate : 'path');
+  return [oidcRedirectUrl, hostedLoginRedirectUrl].some(route => !!route && currentRoutes.some(currentRoute => currentRoute.endsWith(route)));
 };
 
 /**
  * After a switch refused for SSO the tab points at the SSO tenant. Its SSO login comes back on a callback route and
  * keeps it; any other page load means the user didn't finish that login, so the tab goes back to its tenant.
  */
-exports.isOnOidcCallbackRoute = isOnOidcCallbackRoute;
+exports.isOnLoginCodeCallbackRoute = isOnLoginCodeCallbackRoute;
 const restoreTabTenantUnlessSsoCallback = store => {
   var _store$root$urlStrate2;
-  if (!(0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) || !_restApi.ContextHolder.for(store.root.appName).isSessionPerTenantEnabled()) {
+  // Flags load in parallel with the first refresh. Recover an existing marker
+  // before choosing that refresh's tenant, even if flags are not available yet.
+  if (!_restApi.ContextHolder.for(store.root.appName).isSessionPerTenantEnabled()) {
     return;
   }
   const {

package/node/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.131.0-alpha.1
+/** @license Frontegg v7.131.0-alpha.2
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@frontegg/redux-store",
-  "version": "7.131.0-alpha.1",
+  "version": "7.131.0-alpha.2",
   "main": "./node/index.js",
   "license": "MIT",
   "author": "Frontegg LTD",
   "dependencies": {
     "@babel/runtime": "^7.18.6",
     "@frontegg/entitlements-javascript-commons": "1.1.2",
-    "@frontegg/rest-api": "7.131.0-alpha.1",
+    "@frontegg/rest-api": "7.131.0-alpha.2",
     "fast-deep-equal": "3.1.3",
     "get-value": "^3.0.1",
     "proxy-compare": "^3.0.0",