@frontegg/redux-store 7.131.0-alpha.2 → 7.131.0

package/auth/LoginState/actions/hostedLoginAuthorize.actions.js

@@ -15,7 +15,7 @@ export default ((store, api, sharedActions) => {
   const __requestHostedLoginSilentAuthorize = async () => {
     var _response;
     let response;
-    restoreTabTenantUnlessSsoCallback(store);
+    await restoreTabTenantUnlessSsoCallback(store);
     if (FronteggNativeModule.isGetTokensAvailable()) {
       const authApi = api.auth;
       response = await refreshTokenWithRetry(async () => {
@@ -27,7 +27,7 @@ export default ((store, api, sharedActions) => {
         response = await api.auth.silentOAuthRefreshTokenV2();
       } catch (error) {
         var _store$auth$user, _error$errorContext;
-        // on the hosted login callback the page finishes the login with its code: fail as with the flag off
+        // on the hosted login callback the page finishes the login with its code: fail as without SSO enforcement
         if (isOnLoginCodeCallbackRoute(store)) {
           throw error;
         }
@@ -36,7 +36,7 @@ export default ((store, api, sharedActions) => {
           return;
         }
         const tenantId = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.tenantId;
-        if (!isEnforceSsoOnTenantAccessEnabled(store.root.appName) || !isSsoEnforcementError(error) || ((_error$errorContext = error.errorContext) == null ? void 0 : _error$errorContext.ssoRequired) !== false || !tenantId) {
+        if (!isSsoEnforcementError(error) || ((_error$errorContext = error.errorContext) == null ? void 0 : _error$errorContext.ssoRequired) !== false || !tenantId || !(await isEnforceSsoOnTenantAccessEnabled(store.root.appName))) {
           throw error;
         }
         // one retry for the tenant of the current token (a cold reload has no user yet: no retry)

package/auth/LoginState/actions/index.d.ts

@@ -33,20 +33,11 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
     requestHostedLoginAuthorize: (additionalParams?: Record<string, string>) => Promise<void>;
     requestHostedLoginAuthorizeV2: (payload?: {
         additionalParams?: Record<string, string>;
-        shouldRedirectToLogin
-        /**
-         * Handles a hosted (OAuth) token refresh refused because the tenant requires SSO.
-         * ssoRequired: true sends the user to SSO, like login. ssoRequired: false renews once more for the tenant of the
-         * current token, which keeps the session: OAuth doesn't use up the refresh token on this refusal.
-         * @returns true when handled, false when the caller should log out
-         * @private
-         */
-        ? /**
-         * Handles a hosted (OAuth) token refresh refused because the tenant requires SSO.
-         * ssoRequired: true sends the user to SSO, like login. ssoRequired: false renews once more for the tenant of the
-         * current token, which keeps the session: OAuth doesn't use up the refresh token on this refusal.
-         * @returns true when handled, false when the caller should log out
-         * @private
+        shouldRedirectToLogin? /**
+         * Sends the user to the tenant's SSO when a login or tenant switch is refused because that tenant requires it
+         * (e.g. an invitation into a tenant whose SSO covers the user's email). The SSO login lands in that tenant.
+         * @returns true when redirected, so the caller doesn't show the error
+         * @protected
          */: boolean;
         firstTime?: boolean;
         loginDirectAction?: import("../interfaces").LoginDirectAction;
@@ -91,10 +82,6 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
     resetBreachedPassword: (payload: IForgotPassword) => Promise<void>;
     refreshTokenForSocialLogins: () => Promise<void>;
     __refreshToken: () => Promise<void>;
-    __redirectToSsoForTenant: ({ tenantId, address }: {
-        tenantId: string;
-        address: string;
-    }) => Promise<void>;
     __redirectToSsoIfRequired: (e: unknown) => Promise<boolean>;
 };
 export default _default;

package/auth/LoginState/actions/index.js

@@ -25,8 +25,8 @@ import mfaWithWebAuthnActions from './mfaWithWebAuthn.actions';
 import { LoginFlow, LoginStep } from '../interfaces';
 import { base64urlDecode, deepResetState, delay, errorHandler, errorTraceId, GTMEventAction, isSsoEnforcementError, publicKeyCredentialToJSON, refreshTokenWithRetry, reportGTMEvent, retryIfNeeded, withRetryConfig } from '../../../helpers';
 import { initialState } from '../state';
-import { getSearchParam, isEmailPayload, isUsernamePayload, shouldShowPasswordRotationPromptFunc, TENANT_ID_PARAM_KEY } from '../helpers';
-import { AuthStrategyEnum, ContextHolder, isEnforceSsoOnTenantAccessEnabled, FeatureFlags, getTabTenantFromSessionStorage, removeTabTenantFromSessionStorage, setTabTenantInSessionStorage, WebAuthnDeviceType, PreLoginAddressType } from '@frontegg/rest-api';
+import { getSearchParam, isEmailPayload, isUsernamePayload, shouldShowPasswordRotationPromptFunc, TENANT_ID_PARAM_KEY, withOidcRedirectUri } from '../helpers';
+import { AuthStrategyEnum, ContextHolder, ENFORCE_SSO_ON_TENANT_ACCESS_FF, isEnforceSsoOnTenantAccessEnabled, FeatureFlags, clearTabTenantBeforeSsoSwitch, getTabTenantFromSessionStorage, removeTabTenantFromSessionStorage, setTabTenantInSessionStorage, WebAuthnDeviceType, PreLoginAddressType } from '@frontegg/rest-api';
 import hostedLoginAuthorizeActions from './hostedLoginAuthorize.actions';
 import { clearHostedOAuthState } from '../oauthStorage';
 import { SHOULD_STEP_UP_KEY } from '../../StepUpState/consts';
@@ -48,8 +48,10 @@ export default ((store, api, sharedActions) => {
    * @protected
    */
   // as preLogin (takeLeading): an SSO redirect started while another is in flight is dropped; the first one leaves the
-  // page, and a second hosted one would replace the PKCE verifier the first one's callback needs
+  // page, and a second hosted one would replace the PKCE verifier the first one's callback needs. Kept set after a
+  // redirect: the page is still there until the navigation commits.
   let ssoRedirectInFlight = false;
+  let ssoPageShowListenerRegistered = false;
   const __redirectToSsoForTenant = async ({
     tenantId,
     address
@@ -58,13 +60,25 @@ export default ((store, api, sharedActions) => {
       return;
     }
     ssoRedirectInFlight = true;
+    // Only an enabled SSO redirect needs bfcache recovery. Do not attach listeners to ordinary or preview stores.
+    if (!ssoPageShowListenerRegistered && typeof window !== 'undefined' && !store.root.previewMode) {
+      window.addEventListener('pageshow', event => {
+        const [enforceSsoOnTenantAccess] = FeatureFlags.getFeatureFlags([ENFORCE_SSO_ON_TENANT_ACCESS_FF], store.root.appName);
+        if (event.persisted && enforceSsoOnTenantAccess) {
+          ssoRedirectInFlight = false;
+          void restoreTabTenantUnlessSsoCallback(store);
+        }
+      });
+      ssoPageShowListenerRegistered = true;
+    }
     try {
       await __redirectToSsoForTenantNow({
         tenantId,
         address
       });
-    } finally {
+    } catch (e) {
       ssoRedirectInFlight = false;
+      throw e;
     }
   };
   const __redirectToSsoForTenantNow = async ({
@@ -98,12 +112,9 @@ export default ((store, api, sharedActions) => {
       });
       return;
     }
-    // as login does for an OIDC SSO page without redirect_uri; the refusal has no idpType, but an OIDC page asks for a code
-    let ssoRedirectUrl = address;
-    if (/[?&]response_type=code(&|$)/.test(address) && !address.includes('redirect_uri')) {
-      ssoRedirectUrl += `&redirect_uri=${window.location.origin}${store.auth.routes.oidcRedirectUrl}`;
-    }
-    redirectToFullPage(ssoRedirectUrl);
+    // as login does for an OIDC SSO page; the refusal has no idpType, but an OIDC page asks for a code
+    const isOidcPage = /[?&]response_type=code(&|$)/.test(address);
+    redirectToFullPage(isOidcPage ? withOidcRedirectUri(address, store.auth.routes.oidcRedirectUrl) : address);
   };
 
   /**
@@ -114,7 +125,8 @@ export default ((store, api, sharedActions) => {
    */
   const __redirectToSsoIfRequired = async e => {
     var _e$errorContext;
-    if (!isEnforceSsoOnTenantAccessEnabled(store.root.appName) || !isSsoEnforcementError(e) || !((_e$errorContext = e.errorContext) != null && _e$errorContext.ssoRequired)) {
+    // Ordinary failures keep their existing handling even while the flags request is pending.
+    if (!isSsoEnforcementError(e) || !((_e$errorContext = e.errorContext) != null && _e$errorContext.ssoRequired) || !(await isEnforceSsoOnTenantAccessEnabled(store.root.appName))) {
       return false;
     }
     await __redirectToSsoForTenant(e.errorContext);
@@ -128,14 +140,19 @@ export default ((store, api, sharedActions) => {
    * @private
    */
   const __handleSsoEnforcementRefreshError = async (e, isSsoEnforcementRetry, refreshForTenant) => {
-    var _store$auth$user;
-    // on a login callback the page finishes the login with its code: log out as with the flag off, no new SSO trip
-    if (!isEnforceSsoOnTenantAccessEnabled(store.root.appName) || !isSsoEnforcementError(e) || isOnLoginCodeCallbackRoute(store)) {
+    var _e$errorContext2, _store$auth$user;
+    // on a login callback the page finishes the login with its code: log out as without SSO enforcement, no new SSO
+    // trip
+    if (!isSsoEnforcementError(e) || isOnLoginCodeCallbackRoute(store) || !(await isEnforceSsoOnTenantAccessEnabled(store.root.appName))) {
       return false;
     }
     if (await __redirectToSsoIfRequired(e)) {
       return true;
     }
+    // Only an explicit refusal without SSO permits recovery; missing context follows ordinary logout handling.
+    if (((_e$errorContext2 = e.errorContext) == null ? void 0 : _e$errorContext2.ssoRequired) !== false) {
+      return false;
+    }
     const currentTenantId = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.tenantId;
     if (isSsoEnforcementRetry || !currentTenantId) {
       return false;
@@ -246,9 +263,10 @@ export default ((store, api, sharedActions) => {
         });
       }
     } catch (e) {
-      // a refused identity refresh has already used up the refresh token: no retry, only the SSO redirect, except on
-      // a login callback, where the page itself completes the login
-      if (isEnforceSsoOnTenantAccessEnabled(store.root.appName) && !isOnLoginCodeCallbackRoute(store) && (await __redirectToSsoIfRequired(e))) {
+      // no retry: identity already refreshes for the session's own tenant when it can, so a refusal without SSO means
+      // there is none to keep. Only the SSO redirect, except on a login callback, where the page itself completes the
+      // login
+      if (!isOnLoginCodeCallbackRoute(store) && (await __redirectToSsoIfRequired(e))) {
         return;
       }
       contextHolder.setAccessToken(null);
@@ -261,9 +279,7 @@ export default ((store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenWithNativeTokens = async ({
-    isSsoEnforcementRetry = false
-  } = {}) => {
+  const __refreshTokenWithNativeTokens = async () => {
     try {
       const authApi = api.auth;
       const response = await refreshTokenWithRetry(async () => {
@@ -277,13 +293,6 @@ export default ((store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
-      // native tokens can't name a tenant: the retry relies on the tab tenant only
-      const retry = () => __refreshTokenWithNativeTokens({
-        isSsoEnforcementRetry: true
-      });
-      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
-        return;
-      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -295,7 +304,7 @@ export default ((store, api, sharedActions) => {
 
   /** @protected */
   const __refreshToken = async () => {
-    restoreTabTenantUnlessSsoCallback(store);
+    await restoreTabTenantUnlessSsoCallback(store);
     if (FronteggNativeModule.isGetTokensAvailable()) {
       await __refreshTokenWithNativeTokens();
       return;
@@ -583,13 +592,7 @@ export default ((store, api, sharedActions) => {
           redirectToFullPage(address);
           return;
         }
-        let ssoRedirectUrl = address;
-        if (idpType === SamlVendors.Oidc && !ssoRedirectUrl.includes('redirect_uri')) {
-          const {
-            oidcRedirectUrl
-          } = store.auth.routes;
-          ssoRedirectUrl += `&redirect_uri=${window.location.origin}${oidcRedirectUrl}`;
-        }
+        const ssoRedirectUrl = idpType === SamlVendors.Oidc ? withOidcRedirectUri(address, store.auth.routes.oidcRedirectUrl) : address;
         if (FronteggNativeModule.isLoginWithSSOAvailable()) {
           var _ref4;
           FronteggNativeModule.loginWithSSO((_ref4 = email != null ? email : username) != null ? _ref4 : '');
@@ -808,11 +811,13 @@ export default ((store, api, sharedActions) => {
       });
     }
   };
-  const clearLogoutLocalState = ({
+  const clearLogoutLocalState = async ({
     keepHostedOAuthState = false
   } = {}) => {
     if (contextHolder.isSessionPerTenantEnabled()) {
       removeTabTenantFromSessionStorage();
+      // a pending SSO switch would put a tenant of the logged-out session back on the next page load
+      await clearTabTenantBeforeSsoSwitch(store.root.appName);
     }
     // Step-up re-login goes through silentLogout but still needs the hosted OAuth state to finish the client flow.
     if (!keepHostedOAuthState) {
@@ -833,7 +838,7 @@ export default ((store, api, sharedActions) => {
     } catch {
       /* empty */
     }
-    clearLogoutLocalState();
+    await clearLogoutLocalState();
     actions.resetAuthState();
     await actions.requestAuthorize(true);
     payload == null ? void 0 : payload();
@@ -846,7 +851,7 @@ export default ((store, api, sharedActions) => {
       /* empty */
     }
     const isStepUpInProgress = !!((_window2 = window) != null && _window2.localStorage.getItem(SHOULD_STEP_UP_KEY));
-    clearLogoutLocalState({
+    await clearLogoutLocalState({
       keepHostedOAuthState: isStepUpInProgress
     });
     setTimeout(() => {
@@ -1694,7 +1699,6 @@ export default ((store, api, sharedActions) => {
     refreshTokenForSocialLogins,
     // protected
     __refreshToken,
-    __redirectToSsoForTenant,
     __redirectToSsoIfRequired
   }, hostedLoginAuthorizeActions(store, api, sharedActions), afterAuthNavigationActions(store, api, sharedActions), handleVerifyMFAResponseActions(store, api, sharedActions), mfaRequiredStateActions(store, api, sharedActions), mfaWithAuthenticatorActions(store, api, sharedActions), mfaWithEmailCodeActions(store, api, sharedActions), mfaWithSMSActions(store, api, sharedActions), mfaWithWebAuthnActions(store, api, sharedActions));
 });

package/auth/LoginState/helpers.d.ts

@@ -18,6 +18,8 @@ export declare const getPathAndSearchParamsFromUrl: (url: string, preventRedirec
  */
 export declare const getSearchParam: (key: string) => string | undefined;
 export declare const TENANT_ID_PARAM_KEY = "tenantId";
+/** An OIDC SSO page without redirect_uri comes back to the OIDC callback, which completes the login with its code. */
+export declare const withOidcRedirectUri: (address: string, oidcRedirectUrl?: string) => string;
 export declare const getNumberOfMfaDevices: (mfaDevices: UserMFADevicesResponse) => {
     numberOfWebAuthnDevices: number;
     numberOfPhoneDevices: number;

package/auth/LoginState/helpers.js

@@ -75,6 +75,9 @@ export const getSearchParam = key => {
   return param != null ? param : undefined;
 };
 export const TENANT_ID_PARAM_KEY = 'tenantId';
+
+/** An OIDC SSO page without redirect_uri comes back to the OIDC callback, which completes the login with its code. */
+export const withOidcRedirectUri = (address, oidcRedirectUrl) => address.includes('redirect_uri') ? address : `${address}&redirect_uri=${window.location.origin}${oidcRedirectUrl}`;
 export const getNumberOfMfaDevices = mfaDevices => {
   // Count platform / cross-platform separately — matches the MFA picker options.
   const numberOfWebAuthnDevices = Number(mfaDevices.webauthn.some(device => device.deviceType === WebAuthnDeviceType.Platform)) + Number(mfaDevices.webauthn.some(device => device.deviceType === WebAuthnDeviceType.CrossPlatform));

package/auth/TenantsState/actions.js

@@ -1,6 +1,6 @@
 import { initialState } from './state';
 import { deepResetState } from '../../helpers';
-import { ContextHolder, getCurrentUserTenantsFunction, setTabTenantForSsoSwitch } from '@frontegg/rest-api';
+import { ContextHolder, getCurrentUserTenantsFunction, getTabTenantFromSessionStorage, setTabTenantForSsoSwitch } from '@frontegg/rest-api';
 export default ((store, api, sharedActions) => {
   const actions = sharedActions;
   const setTenantsState = state => {
@@ -46,6 +46,9 @@ export default ((store, api, sharedActions) => {
         });
       }
     } catch (e) {
+      // the tab tenant the switch was refused from, read before any await: a parallel switch that passes moves the tab
+      // while this one goes to SSO
+      const tabTenantId = getTabTenantFromSessionStorage(store.root.appName);
       silentReload ? actions.setTenantsState({
         switchingTenant: false
       }) : actions.setAuthState({
@@ -54,7 +57,7 @@ export default ((store, api, sharedActions) => {
       if (await actions.__redirectToSsoIfRequired(e)) {
         // the tab comes back from SSO in the target tenant, not the one the failed switch restored
         if (ContextHolder.for(store.root.appName).isSessionPerTenantEnabled()) {
-          setTabTenantForSsoSwitch(tenantId);
+          setTabTenantForSsoSwitch(tenantId, tabTenantId);
         }
         return;
       }

package/auth/helpers.d.ts

@@ -18,7 +18,7 @@ export declare const isOnLoginCodeCallbackRoute: (store: FronteggState) => boole
  * After a switch refused for SSO the tab points at the SSO tenant. Its SSO login comes back on a callback route and
  * keeps it; any other page load means the user didn't finish that login, so the tab goes back to its tenant.
  */
-export declare const restoreTabTenantUnlessSsoCallback: (store: FronteggState) => void;
+export declare const restoreTabTenantUnlessSsoCallback: (store: FronteggState) => Promise<void>;
 export declare const prepareIdentifiersForSignup: (payload: ISignUpUser) => ISignUpUser;
 /**
  * Whether the current route is an auth page (login, tenant chooser, social / magic link / SSO callback), not one to come

package/auth/helpers.js

@@ -85,10 +85,8 @@ export const isOnLoginCodeCallbackRoute = store => {
  * After a switch refused for SSO the tab points at the SSO tenant. Its SSO login comes back on a callback route and
  * keeps it; any other page load means the user didn't finish that login, so the tab goes back to its tenant.
  */
-export const restoreTabTenantUnlessSsoCallback = store => {
+export const restoreTabTenantUnlessSsoCallback = async store => {
   var _store$root$urlStrate2;
-  // Flags load in parallel with the first refresh. Recover an existing marker
-  // before choosing that refresh's tenant, even if flags are not available yet.
   if (!ContextHolder.for(store.root.appName).isSessionPerTenantEnabled()) {
     return;
   }
@@ -99,9 +97,13 @@ export const restoreTabTenantUnlessSsoCallback = store => {
   } = _extends({}, defaultFronteggRoutes, store.auth.routes);
   // matched like login matches its callback pages: endsWith, so a basename before the route still counts
   const currentRoutes = getCurrentRoutes((_store$root$urlStrate2 = store.root.urlStrategy) != null ? _store$root$urlStrate2 : 'path');
-  const isSsoCallback = [samlCallbackUrl, oidcRedirectUrl, hostedLoginRedirectUrl].some(route => !!route && currentRoutes.some(currentRoute => currentRoute.endsWith(route)));
+  // a refused login comes back on its callback too, not finished: SAML with samlerrors (as SamlLoginSuccess reads them),
+  // OIDC and hosted without a code (e.g. the IdP's error=access_denied), which their pages need to finish the login
+  const params = new URLSearchParams(window.location.search);
+  const callbackRoutes = [...(params.has('samlerrors') ? [] : [samlCallbackUrl]), ...(params.has('code') ? [oidcRedirectUrl, hostedLoginRedirectUrl] : [])];
+  const isSsoCallback = callbackRoutes.some(route => !!route && currentRoutes.some(currentRoute => currentRoute.endsWith(route)));
   if (!isSsoCallback) {
-    restoreTabTenantBeforeSsoSwitch();
+    await restoreTabTenantBeforeSsoSwitch(store.root.appName);
   }
 };
 export const prepareIdentifiersForSignup = payload => {

package/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.131.0-alpha.2
+/** @license Frontegg v7.131.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/mocks/auth-mocks/loginActions.mocks.d.ts

@@ -73,10 +73,6 @@ declare const _default: (store: FronteggState, api: RestApi, sharedActions: Shar
     resetBreachedPassword: (payload: import("dist/@frontegg/rest-api").IForgotPassword) => Promise<void>;
     refreshTokenForSocialLogins: () => Promise<void>;
     __refreshToken: () => Promise<void>;
-    __redirectToSsoForTenant: ({ tenantId, address }: {
-        tenantId: string;
-        address: string;
-    }) => Promise<void>;
     __redirectToSsoIfRequired: (e: unknown) => Promise<boolean>;
 };
 export default _default;

package/node/auth/LoginState/actions/hostedLoginAuthorize.actions.js

@@ -22,7 +22,7 @@ var _default = (store, api, sharedActions) => {
   const __requestHostedLoginSilentAuthorize = async () => {
     var _response;
     let response;
-    (0, _helpers3.restoreTabTenantUnlessSsoCallback)(store);
+    await (0, _helpers3.restoreTabTenantUnlessSsoCallback)(store);
     if (_toolkit.FronteggNativeModule.isGetTokensAvailable()) {
       const authApi = api.auth;
       response = await (0, _helpers.refreshTokenWithRetry)(async () => {
@@ -34,7 +34,7 @@ var _default = (store, api, sharedActions) => {
         response = await api.auth.silentOAuthRefreshTokenV2();
       } catch (error) {
         var _store$auth$user, _error$errorContext;
-        // on the hosted login callback the page finishes the login with its code: fail as with the flag off
+        // on the hosted login callback the page finishes the login with its code: fail as without SSO enforcement
         if ((0, _helpers3.isOnLoginCodeCallbackRoute)(store)) {
           throw error;
         }
@@ -43,7 +43,7 @@ var _default = (store, api, sharedActions) => {
           return;
         }
         const tenantId = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.tenantId;
-        if (!(0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) || !(0, _helpers.isSsoEnforcementError)(error) || ((_error$errorContext = error.errorContext) == null ? void 0 : _error$errorContext.ssoRequired) !== false || !tenantId) {
+        if (!(0, _helpers.isSsoEnforcementError)(error) || ((_error$errorContext = error.errorContext) == null ? void 0 : _error$errorContext.ssoRequired) !== false || !tenantId || !(await (0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName))) {
           throw error;
         }
         // one retry for the tenant of the current token (a cold reload has no user yet: no retry)

package/node/auth/LoginState/actions/index.js

@@ -55,8 +55,10 @@ var _default = (store, api, sharedActions) => {
    * @protected
    */
   // as preLogin (takeLeading): an SSO redirect started while another is in flight is dropped; the first one leaves the
-  // page, and a second hosted one would replace the PKCE verifier the first one's callback needs
+  // page, and a second hosted one would replace the PKCE verifier the first one's callback needs. Kept set after a
+  // redirect: the page is still there until the navigation commits.
   let ssoRedirectInFlight = false;
+  let ssoPageShowListenerRegistered = false;
   const __redirectToSsoForTenant = async ({
     tenantId,
     address
@@ -65,13 +67,25 @@ var _default = (store, api, sharedActions) => {
       return;
     }
     ssoRedirectInFlight = true;
+    // Only an enabled SSO redirect needs bfcache recovery. Do not attach listeners to ordinary or preview stores.
+    if (!ssoPageShowListenerRegistered && typeof window !== 'undefined' && !store.root.previewMode) {
+      window.addEventListener('pageshow', event => {
+        const [enforceSsoOnTenantAccess] = _restApi.FeatureFlags.getFeatureFlags([_restApi.ENFORCE_SSO_ON_TENANT_ACCESS_FF], store.root.appName);
+        if (event.persisted && enforceSsoOnTenantAccess) {
+          ssoRedirectInFlight = false;
+          void (0, _helpers3.restoreTabTenantUnlessSsoCallback)(store);
+        }
+      });
+      ssoPageShowListenerRegistered = true;
+    }
     try {
       await __redirectToSsoForTenantNow({
         tenantId,
         address
       });
-    } finally {
+    } catch (e) {
       ssoRedirectInFlight = false;
+      throw e;
     }
   };
   const __redirectToSsoForTenantNow = async ({
@@ -105,12 +119,9 @@ var _default = (store, api, sharedActions) => {
       });
       return;
     }
-    // as login does for an OIDC SSO page without redirect_uri; the refusal has no idpType, but an OIDC page asks for a code
-    let ssoRedirectUrl = address;
-    if (/[?&]response_type=code(&|$)/.test(address) && !address.includes('redirect_uri')) {
-      ssoRedirectUrl += `&redirect_uri=${window.location.origin}${store.auth.routes.oidcRedirectUrl}`;
-    }
-    redirectToFullPage(ssoRedirectUrl);
+    // as login does for an OIDC SSO page; the refusal has no idpType, but an OIDC page asks for a code
+    const isOidcPage = /[?&]response_type=code(&|$)/.test(address);
+    redirectToFullPage(isOidcPage ? (0, _helpers2.withOidcRedirectUri)(address, store.auth.routes.oidcRedirectUrl) : address);
   };
 
   /**
@@ -121,7 +132,8 @@ var _default = (store, api, sharedActions) => {
    */
   const __redirectToSsoIfRequired = async e => {
     var _e$errorContext;
-    if (!(0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) || !(0, _helpers.isSsoEnforcementError)(e) || !((_e$errorContext = e.errorContext) != null && _e$errorContext.ssoRequired)) {
+    // Ordinary failures keep their existing handling even while the flags request is pending.
+    if (!(0, _helpers.isSsoEnforcementError)(e) || !((_e$errorContext = e.errorContext) != null && _e$errorContext.ssoRequired) || !(await (0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName))) {
       return false;
     }
     await __redirectToSsoForTenant(e.errorContext);
@@ -135,14 +147,19 @@ var _default = (store, api, sharedActions) => {
    * @private
    */
   const __handleSsoEnforcementRefreshError = async (e, isSsoEnforcementRetry, refreshForTenant) => {
-    var _store$auth$user;
-    // on a login callback the page finishes the login with its code: log out as with the flag off, no new SSO trip
-    if (!(0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) || !(0, _helpers.isSsoEnforcementError)(e) || (0, _helpers3.isOnLoginCodeCallbackRoute)(store)) {
+    var _e$errorContext2, _store$auth$user;
+    // on a login callback the page finishes the login with its code: log out as without SSO enforcement, no new SSO
+    // trip
+    if (!(0, _helpers.isSsoEnforcementError)(e) || (0, _helpers3.isOnLoginCodeCallbackRoute)(store) || !(await (0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName))) {
       return false;
     }
     if (await __redirectToSsoIfRequired(e)) {
       return true;
     }
+    // Only an explicit refusal without SSO permits recovery; missing context follows ordinary logout handling.
+    if (((_e$errorContext2 = e.errorContext) == null ? void 0 : _e$errorContext2.ssoRequired) !== false) {
+      return false;
+    }
     const currentTenantId = (_store$auth$user = store.auth.user) == null ? void 0 : _store$auth$user.tenantId;
     if (isSsoEnforcementRetry || !currentTenantId) {
       return false;
@@ -253,9 +270,10 @@ var _default = (store, api, sharedActions) => {
         });
       }
     } catch (e) {
-      // a refused identity refresh has already used up the refresh token: no retry, only the SSO redirect, except on
-      // a login callback, where the page itself completes the login
-      if ((0, _restApi.isEnforceSsoOnTenantAccessEnabled)(store.root.appName) && !(0, _helpers3.isOnLoginCodeCallbackRoute)(store) && (await __redirectToSsoIfRequired(e))) {
+      // no retry: identity already refreshes for the session's own tenant when it can, so a refusal without SSO means
+      // there is none to keep. Only the SSO redirect, except on a login callback, where the page itself completes the
+      // login
+      if (!(0, _helpers3.isOnLoginCodeCallbackRoute)(store) && (await __redirectToSsoIfRequired(e))) {
         return;
       }
       contextHolder.setAccessToken(null);
@@ -268,9 +286,7 @@ var _default = (store, api, sharedActions) => {
   };
 
   /** @private */
-  const __refreshTokenWithNativeTokens = async ({
-    isSsoEnforcementRetry = false
-  } = {}) => {
+  const __refreshTokenWithNativeTokens = async () => {
     try {
       const authApi = api.auth;
       const response = await (0, _helpers.refreshTokenWithRetry)(async () => {
@@ -284,13 +300,6 @@ var _default = (store, api, sharedActions) => {
         isAuthenticated: true
       });
     } catch (e) {
-      // native tokens can't name a tenant: the retry relies on the tab tenant only
-      const retry = () => __refreshTokenWithNativeTokens({
-        isSsoEnforcementRetry: true
-      });
-      if (await __handleSsoEnforcementRefreshError(e, isSsoEnforcementRetry, retry)) {
-        return;
-      }
       contextHolder.setAccessToken(null);
       contextHolder.setUser(null);
       actions.setAuthState({
@@ -302,7 +311,7 @@ var _default = (store, api, sharedActions) => {
 
   /** @protected */
   const __refreshToken = async () => {
-    (0, _helpers3.restoreTabTenantUnlessSsoCallback)(store);
+    await (0, _helpers3.restoreTabTenantUnlessSsoCallback)(store);
     if (_toolkit.FronteggNativeModule.isGetTokensAvailable()) {
       await __refreshTokenWithNativeTokens();
       return;
@@ -590,13 +599,7 @@ var _default = (store, api, sharedActions) => {
           redirectToFullPage(address);
           return;
         }
-        let ssoRedirectUrl = address;
-        if (idpType === _interfaces4.SamlVendors.Oidc && !ssoRedirectUrl.includes('redirect_uri')) {
-          const {
-            oidcRedirectUrl
-          } = store.auth.routes;
-          ssoRedirectUrl += `&redirect_uri=${window.location.origin}${oidcRedirectUrl}`;
-        }
+        const ssoRedirectUrl = idpType === _interfaces4.SamlVendors.Oidc ? (0, _helpers2.withOidcRedirectUri)(address, store.auth.routes.oidcRedirectUrl) : address;
         if (_toolkit.FronteggNativeModule.isLoginWithSSOAvailable()) {
           var _ref4;
           _toolkit.FronteggNativeModule.loginWithSSO((_ref4 = email != null ? email : username) != null ? _ref4 : '');
@@ -815,11 +818,13 @@ var _default = (store, api, sharedActions) => {
       });
     }
   };
-  const clearLogoutLocalState = ({
+  const clearLogoutLocalState = async ({
     keepHostedOAuthState = false
   } = {}) => {
     if (contextHolder.isSessionPerTenantEnabled()) {
       (0, _restApi.removeTabTenantFromSessionStorage)();
+      // a pending SSO switch would put a tenant of the logged-out session back on the next page load
+      await (0, _restApi.clearTabTenantBeforeSsoSwitch)(store.root.appName);
     }
     // Step-up re-login goes through silentLogout but still needs the hosted OAuth state to finish the client flow.
     if (!keepHostedOAuthState) {
@@ -840,7 +845,7 @@ var _default = (store, api, sharedActions) => {
     } catch {
       /* empty */
     }
-    clearLogoutLocalState();
+    await clearLogoutLocalState();
     actions.resetAuthState();
     await actions.requestAuthorize(true);
     payload == null ? void 0 : payload();
@@ -853,7 +858,7 @@ var _default = (store, api, sharedActions) => {
       /* empty */
     }
     const isStepUpInProgress = !!((_window2 = window) != null && _window2.localStorage.getItem(_consts.SHOULD_STEP_UP_KEY));
-    clearLogoutLocalState({
+    await clearLogoutLocalState({
       keepHostedOAuthState: isStepUpInProgress
     });
     setTimeout(() => {
@@ -1701,7 +1706,6 @@ var _default = (store, api, sharedActions) => {
     refreshTokenForSocialLogins,
     // protected
     __refreshToken,
-    __redirectToSsoForTenant,
     __redirectToSsoIfRequired
   }, (0, _hostedLoginAuthorize.default)(store, api, sharedActions), (0, _afterAuthNavigation.default)(store, api, sharedActions), (0, _handleVerifyMFAResponse.default)(store, api, sharedActions), (0, _mfaRequiredState.default)(store, api, sharedActions), (0, _mfaWithAuthenticator.default)(store, api, sharedActions), (0, _mfaWithEmailCode.default)(store, api, sharedActions), (0, _mfaWithSMS.default)(store, api, sharedActions), (0, _mfaWithWebAuthn.default)(store, api, sharedActions));
 };

package/node/auth/LoginState/helpers.js

@@ -7,7 +7,7 @@ exports.isAbsoluteUrl = exports.getSearchParamsFromUrl = exports.getSearchParam
 exports.isEmailPayload = isEmailPayload;
 exports.isOauthCallbackRoute = void 0;
 exports.isUsernamePayload = isUsernamePayload;
-exports.shouldShowPasswordRotationPromptFunc = void 0;
+exports.withOidcRedirectUri = exports.shouldShowPasswordRotationPromptFunc = void 0;
 var _restApi = require("@frontegg/rest-api");
 var _interfaces = require("../MfaState/interfaces");
 const isAbsoluteUrl = path => {
@@ -90,7 +90,11 @@ const getSearchParam = key => {
 };
 exports.getSearchParam = getSearchParam;
 const TENANT_ID_PARAM_KEY = 'tenantId';
+
+/** An OIDC SSO page without redirect_uri comes back to the OIDC callback, which completes the login with its code. */
 exports.TENANT_ID_PARAM_KEY = TENANT_ID_PARAM_KEY;
+const withOidcRedirectUri = (address, oidcRedirectUrl) => address.includes('redirect_uri') ? address : `${address}&redirect_uri=${window.location.origin}${oidcRedirectUrl}`;
+exports.withOidcRedirectUri = withOidcRedirectUri;
 const getNumberOfMfaDevices = mfaDevices => {
   // Count platform / cross-platform separately — matches the MFA picker options.
   const numberOfWebAuthnDevices = Number(mfaDevices.webauthn.some(device => device.deviceType === _restApi.WebAuthnDeviceType.Platform)) + Number(mfaDevices.webauthn.some(device => device.deviceType === _restApi.WebAuthnDeviceType.CrossPlatform));

package/node/auth/TenantsState/actions.js

@@ -52,6 +52,9 @@ var _default = (store, api, sharedActions) => {
         });
       }
     } catch (e) {
+      // the tab tenant the switch was refused from, read before any await: a parallel switch that passes moves the tab
+      // while this one goes to SSO
+      const tabTenantId = (0, _restApi.getTabTenantFromSessionStorage)(store.root.appName);
       silentReload ? actions.setTenantsState({
         switchingTenant: false
       }) : actions.setAuthState({
@@ -60,7 +63,7 @@ var _default = (store, api, sharedActions) => {
       if (await actions.__redirectToSsoIfRequired(e)) {
         // the tab comes back from SSO in the target tenant, not the one the failed switch restored
         if (_restApi.ContextHolder.for(store.root.appName).isSessionPerTenantEnabled()) {
-          (0, _restApi.setTabTenantForSsoSwitch)(tenantId);
+          (0, _restApi.setTabTenantForSsoSwitch)(tenantId, tabTenantId);
         }
         return;
       }

package/node/auth/helpers.js

@@ -141,10 +141,8 @@ const isOnLoginCodeCallbackRoute = store => {
  * keeps it; any other page load means the user didn't finish that login, so the tab goes back to its tenant.
  */
 exports.isOnLoginCodeCallbackRoute = isOnLoginCodeCallbackRoute;
-const restoreTabTenantUnlessSsoCallback = store => {
+const restoreTabTenantUnlessSsoCallback = async store => {
   var _store$root$urlStrate2;
-  // Flags load in parallel with the first refresh. Recover an existing marker
-  // before choosing that refresh's tenant, even if flags are not available yet.
   if (!_restApi.ContextHolder.for(store.root.appName).isSessionPerTenantEnabled()) {
     return;
   }
@@ -155,9 +153,13 @@ const restoreTabTenantUnlessSsoCallback = store => {
   } = (0, _extends2.default)({}, _consts.defaultFronteggRoutes, store.auth.routes);
   // matched like login matches its callback pages: endsWith, so a basename before the route still counts
   const currentRoutes = getCurrentRoutes((_store$root$urlStrate2 = store.root.urlStrategy) != null ? _store$root$urlStrate2 : 'path');
-  const isSsoCallback = [samlCallbackUrl, oidcRedirectUrl, hostedLoginRedirectUrl].some(route => !!route && currentRoutes.some(currentRoute => currentRoute.endsWith(route)));
+  // a refused login comes back on its callback too, not finished: SAML with samlerrors (as SamlLoginSuccess reads them),
+  // OIDC and hosted without a code (e.g. the IdP's error=access_denied), which their pages need to finish the login
+  const params = new URLSearchParams(window.location.search);
+  const callbackRoutes = [...(params.has('samlerrors') ? [] : [samlCallbackUrl]), ...(params.has('code') ? [oidcRedirectUrl, hostedLoginRedirectUrl] : [])];
+  const isSsoCallback = callbackRoutes.some(route => !!route && currentRoutes.some(currentRoute => currentRoute.endsWith(route)));
   if (!isSsoCallback) {
-    (0, _restApi.restoreTabTenantBeforeSsoSwitch)();
+    await (0, _restApi.restoreTabTenantBeforeSsoSwitch)(store.root.appName);
   }
 };
 exports.restoreTabTenantUnlessSsoCallback = restoreTabTenantUnlessSsoCallback;

package/node/index.js

@@ -1,4 +1,4 @@
-/** @license Frontegg v7.131.0-alpha.2
+/** @license Frontegg v7.131.0
  *
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@frontegg/redux-store",
-  "version": "7.131.0-alpha.2",
+  "version": "7.131.0",
   "main": "./node/index.js",
   "license": "MIT",
   "author": "Frontegg LTD",
   "dependencies": {
     "@babel/runtime": "^7.18.6",
     "@frontegg/entitlements-javascript-commons": "1.1.2",
-    "@frontegg/rest-api": "7.131.0-alpha.2",
+    "@frontegg/rest-api": "7.131.0",
     "fast-deep-equal": "3.1.3",
     "get-value": "^3.0.1",
     "proxy-compare": "^3.0.0",