@genesislcap/foundation-auth 15.80.0 → 15.81.0

package/dist/dts/machine/machine.d.ts

@@ -32,6 +32,11 @@ export declare class DefaultAuthMachine extends AbstractMachine<AuthMachineConte
      */
     getFromContainer(): this;
     protected captureAuthQueryParams(): QueryParams;
+    /**
+     * Whether the opener opened this window for SSO and is waiting for its token. Override if the app opens its own
+     * SSO popups.
+     */
+    protected isSSOPopup(): boolean;
     protected convertQueryParamsToLoginParams(params: QueryParams): LoginParams;
     protected createFetchMachineEvent(url: string, msg?: {}): FetchMachineEvent;
     protected onIdleEvents: () => {

package/dist/dts/machine/machine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../src/machine/machine.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EAEf,YAAY,EACZ,iBAAiB,EAMjB,OAAO,EACR,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EACL,IAAI,EASL,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AAEjD,OAAO,EAAE,UAAU,EAAqB,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAEL,iBAAiB,EAIlB,MAAM,eAAe,CAAC;AAIvB,OAAO,EACL,iBAAiB,EAQlB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIhD,OAAO,KAAK,EAEV,kBAAkB,EAClB,gBAAgB,EAGhB,WAAW,EACX,WAAW,EAEZ,MAAM,SAAS,CAAC;AAGjB;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,OAAO,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;CAAG;AAErF;;;GAGG;AACH,qBAAa,kBACX,SAAQ,eAAe,CAAC,kBAAkB,EAAE,gBAAgB,CAC5D,YAAW,WAAW;IAGd,OAAO,CAAC,IAAI;IACJ,OAAO,CAAC,YAAY;IACf,OAAO,CAAC,EAAE;IACvB,OAAO,CAAC,IAAI;IACC,OAAO,CAAC,aAAa;IAC5B,OAAO,CAAC,MAAM;IACb,OAAO,CAAC,OAAO;gBANd,IAAI,EAAE,IAAI,EACF,YAAY,EAAE,YAAY,EACrB,EAAE,EAAE,iBAAiB,EAClC,IAAI,EAAE,IAAI,EACG,aAAa,EAAE,iBAAiB,EACvC,MAAM,EAAE,UAAU,EACjB,OAAO,EAAE,WAAW;IA2yB3C,KAAK,CACH,OAAO,GAAE,kBAAkB,CAAC,OAAO,IAAI,CAAC,OAAO,CAM9C;IAKH;;OAEG;IACH,gBAAgB,IAAI,IAAI;IAIxB,SAAS,CAAC,sBAAsB,IAAI,WAAW;IAQ/C,SAAS,CAAC,+BAA+B,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW;IAuB3E,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,GAAG,iBAAiB;IAgB3E,SAAS,CAAC,YAAY;;;;;;;;;;;;;;;;;;;;;MAwBpB;IAEF,SAAS,CAAC,aAAa;;;MAGpB;IAEH;;OAEG;IACH,SAAS,CAAC,qBAAqB,GAAI,oBAAoB,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA0B1D;CACJ;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,mEAA0E,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAE5C"}
+{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../src/machine/machine.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EAEf,YAAY,EACZ,iBAAiB,EAMjB,OAAO,EACR,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,8BAA8B,CAAC;AACpD,OAAO,EACL,IAAI,EASL,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,QAAQ,CAAC;AAEjD,OAAO,EAAE,UAAU,EAAqB,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAEL,iBAAiB,EAIlB,MAAM,eAAe,CAAC;AAIvB,OAAO,EACL,iBAAiB,EAQlB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAKhD,OAAO,KAAK,EAEV,kBAAkB,EAClB,gBAAgB,EAGhB,WAAW,EACX,WAAW,EAEZ,MAAM,SAAS,CAAC;AAGjB;;;GAGG;AACH,MAAM,WAAW,WAAY,SAAQ,OAAO,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;CAAG;AAErF;;;GAGG;AACH,qBAAa,kBACX,SAAQ,eAAe,CAAC,kBAAkB,EAAE,gBAAgB,CAC5D,YAAW,WAAW;IAGd,OAAO,CAAC,IAAI;IACJ,OAAO,CAAC,YAAY;IACf,OAAO,CAAC,EAAE;IACvB,OAAO,CAAC,IAAI;IACC,OAAO,CAAC,aAAa;IAC5B,OAAO,CAAC,MAAM;IACb,OAAO,CAAC,OAAO;gBANd,IAAI,EAAE,IAAI,EACF,YAAY,EAAE,YAAY,EACrB,EAAE,EAAE,iBAAiB,EAClC,IAAI,EAAE,IAAI,EACG,aAAa,EAAE,iBAAiB,EACvC,MAAM,EAAE,UAAU,EACjB,OAAO,EAAE,WAAW;IA2yB3C,KAAK,CACH,OAAO,GAAE,kBAAkB,CAAC,OAAO,IAAI,CAAC,OAAO,CAM9C;IAKH;;OAEG;IACH,gBAAgB,IAAI,IAAI;IAIxB,SAAS,CAAC,sBAAsB,IAAI,WAAW;IAQ/C;;;OAGG;IACH,SAAS,CAAC,UAAU,IAAI,OAAO;IAI/B,SAAS,CAAC,+BAA+B,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW;IAuB3E,SAAS,CAAC,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,GAAG,iBAAiB;IAgB3E,SAAS,CAAC,YAAY;;;;;;;;;;;;;;;;;;;;;MAwBpB;IAEF,SAAS,CAAC,aAAa;;;MAGpB;IAEH;;OAEG;IACH,SAAS,CAAC,qBAAqB,GAAI,oBAAoB,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA0B1D;CACJ;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,mEAA0E,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAE5C"}

package/dist/dts/machine/sso-popup.d.ts

@@ -0,0 +1,11 @@
+export declare const SSO_POPUP_KEY = "genesisAuthSSOPopup";
+/**
+ * Remembers the popup this window opened for SSO, so only that popup hands its token back.
+ */
+export declare const rememberSSOPopup: (popup: Window) => void;
+/**
+ * Whether this window is the popup its opener opened for SSO. A window keeps its identity across the IdP round
+ * trip, and reading from a cross-origin opener throws, so neither another popout nor a foreign opener matches.
+ */
+export declare const isOpenedForSSO: () => boolean;
+//# sourceMappingURL=sso-popup.d.ts.map

package/dist/dts/machine/sso-popup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-popup.d.ts","sourceRoot":"","sources":["../../../src/machine/sso-popup.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,wBAAwB,CAAC;AAInD;;GAEG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,SAE7C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,QAAO,OAOjC,CAAC"}

package/dist/dts/routes/login/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../../src/routes/login/login.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,iBAAiB,EAAkB,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC;;;;;;;;;;;;;GAaG;AACH,qBAKa,KAAM,SAAQ,SAAS;IACf,iBAAiB,EAAE,iBAAiB,CAAC;IAExD,iBAAiB;IAYjB,OAAO,CAAC,iBAAiB;IAezB,IACI,cAAc,WAMjB;IAED,UAAU;IAmBJ,aAAa;IAInB,KAAK,CAAC,MAAM,EAAE,WAAW;IAIzB,MAAM;IAIN,IAAI,cAAc,YAEjB;IAED,IAAI,aAAa,YAMhB;CACF"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../../src/routes/login/login.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,iBAAiB,EAAkB,MAAM,kBAAkB,CAAC;AAEvF,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAIpC;;;;;;;;;;;;;GAaG;AACH,qBAKa,KAAM,SAAQ,SAAS;IACf,iBAAiB,EAAE,iBAAiB,CAAC;IAExD,iBAAiB;IAYjB,OAAO,CAAC,iBAAiB;IAezB,IACI,cAAc,WAMjB;IAED,UAAU;IAqBJ,aAAa;IAInB,KAAK,CAAC,MAAM,EAAE,WAAW;IAIzB,MAAM;IAIN,IAAI,cAAc,YAEjB;IAED,IAAI,aAAa,YAMhB;CACF"}

package/dist/esm/machine/machine.js

@@ -12,6 +12,7 @@ import { AuthRouting } from '../routes/routing';
 import { logger } from '../utils';
 import { setError } from './actions';
 import { refreshCookieSession } from './session-refresh';
+import { isOpenedForSSO } from './sso-popup';
 import { defaultAuthMachineContext, isLoginParams, isQueryParams } from './types';
 /**
  * Default AuthMachine.
@@ -105,7 +106,7 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                             /**
                              * Handle SSO popups first
                              */
-                            guard: and(['hasSSOToken', 'hasWindowOpener']),
+                            guard: and(['hasSSOToken', 'isSSOPopup']),
                             actions: 'handSSOTokenToWindowOpener',
                             target: '#authMachine.idle',
                         },
@@ -807,9 +808,9 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
                 hasParams: ({ context }) => context.params !== undefined,
                 hasLoginParams: ({ context }) => isLoginParams(context.params),
                 hasQueryParams: ({ context }) => isQueryParams(context.params),
-                hasSSOToken: ({ context }) => isQueryParams(context.params) && context.params.SSO_TOKEN !== undefined,
-                hasMFACode: ({ context }) => isQueryParams(context.params) && context.params.MFA_CODE !== undefined,
-                hasWindowOpener: () => window.opener,
+                hasSSOToken: ({ context }) => isQueryParams(context.params) && Boolean(context.params.SSO_TOKEN),
+                hasMFACode: ({ context }) => isQueryParams(context.params) && Boolean(context.params.MFA_CODE),
+                isSSOPopup: () => this.isSSOPopup(),
                 isUnauthorizedError: ({ event }) => {
                     if (isErrorEvent(event)) {
                         return isUnauthorizedError(event.data);
@@ -876,12 +877,20 @@ let DefaultAuthMachine = class DefaultAuthMachine extends AbstractMachine {
         return this.container.get(AuthMachine);
     }
     captureAuthQueryParams() {
+        var _a, _b;
         const queryParams = new URLSearchParams(window.location.search);
         return {
-            SSO_TOKEN: queryParams.get('SSO_TOKEN'),
-            MFA_CODE: queryParams.get('MFA_CODE'),
+            SSO_TOKEN: (_a = queryParams.get('SSO_TOKEN')) !== null && _a !== void 0 ? _a : undefined,
+            MFA_CODE: (_b = queryParams.get('MFA_CODE')) !== null && _b !== void 0 ? _b : undefined,
         };
     }
+    /**
+     * Whether the opener opened this window for SSO and is waiting for its token. Override if the app opens its own
+     * SSO popups.
+     */
+    isSSOPopup() {
+        return isOpenedForSSO();
+    }
     convertQueryParamsToLoginParams(params) {
         const ssoCredentials = params.SSO_TOKEN
             ? {

package/dist/esm/machine/sso-popup.js

@@ -0,0 +1,20 @@
+export const SSO_POPUP_KEY = 'genesisAuthSSOPopup';
+/**
+ * Remembers the popup this window opened for SSO, so only that popup hands its token back.
+ */
+export const rememberSSOPopup = (popup) => {
+    window[SSO_POPUP_KEY] = popup;
+};
+/**
+ * Whether this window is the popup its opener opened for SSO. A window keeps its identity across the IdP round
+ * trip, and reading from a cross-origin opener throws, so neither another popout nor a foreign opener matches.
+ */
+export const isOpenedForSSO = () => {
+    try {
+        const opener = window.opener;
+        return !!opener && opener[SSO_POPUP_KEY] === window;
+    }
+    catch (_a) {
+        return false;
+    }
+};

package/dist/esm/machine/types.js

@@ -59,5 +59,5 @@ export function isResetPasswordParams(params) {
  */
 export function isQueryParams(params) {
     const queryParams = params;
-    return queryParams && (queryParams.SSO_TOKEN !== undefined || queryParams.MFA_CODE !== undefined);
+    return Boolean(queryParams && (queryParams.SSO_TOKEN || queryParams.MFA_CODE));
 }

package/dist/esm/routes/login/login.js

@@ -2,6 +2,7 @@ import { __awaiter, __decorate } from "tslib";
 import { inIFrame, inSymphonyDesktop, openPopup } from '@genesislcap/foundation-utils';
 import { customElement, volatile } from '@microsoft/fast-element';
 import { CredentialManager, CredentialType } from '../../credential';
+import { rememberSSOPopup } from '../../machine/sso-popup';
 import { logger } from '../../utils';
 import { BaseRoute } from '../base';
 import { LoginStyles as styles } from './login.styles';
@@ -62,10 +63,12 @@ let Login = class Login extends BaseRoute {
             if (inSymphonyDesktop()) {
                 // symphony/electron opens new window in the default browser instead
                 // popup within electron, so we have to navigate manually
-                openPopup('', 'symphony').location.assign(ssoLoginUrl);
+                const popup = openPopup('', 'symphony');
+                rememberSSOPopup(popup);
+                popup.location.assign(ssoLoginUrl);
             }
             else {
-                openPopup(ssoLoginUrl, 'Login');
+                rememberSSOPopup(openPopup(ssoLoginUrl, 'Login'));
             }
         }
         else {

package/dist/foundation-auth.api.json

@@ -6112,6 +6112,37 @@
               "isAbstract": false,
               "name": "getFromContainer"
             },
+            {
+              "kind": "Method",
+              "canonicalReference": "@genesislcap/foundation-auth!DefaultAuthMachine#isSSOPopup:member(1)",
+              "docComment": "/**\n * Whether the opener opened this window for SSO and is waiting for its token. Override if the app opens its own SSO popups.\n */\n",
+              "excerptTokens": [
+                {
+                  "kind": "Content",
+                  "text": "protected isSSOPopup(): "
+                },
+                {
+                  "kind": "Content",
+                  "text": "boolean"
+                },
+                {
+                  "kind": "Content",
+                  "text": ";"
+                }
+              ],
+              "isStatic": false,
+              "returnTypeTokenRange": {
+                "startIndex": 1,
+                "endIndex": 2
+              },
+              "releaseTag": "Public",
+              "isProtected": true,
+              "overloadIndex": 1,
+              "parameters": [],
+              "isOptional": false,
+              "isAbstract": false,
+              "name": "isSSOPopup"
+            },
             {
               "kind": "Property",
               "canonicalReference": "@genesislcap/foundation-auth!DefaultAuthMachine#loginDetailsStateNode:member",

package/dist/foundation-auth.d.ts

@@ -1030,6 +1030,11 @@ export declare class DefaultAuthMachine extends AbstractMachine<AuthMachineConte
      */
     getFromContainer(): this;
     protected captureAuthQueryParams(): QueryParams;
+    /**
+     * Whether the opener opened this window for SSO and is waiting for its token. Override if the app opens its own
+     * SSO popups.
+     */
+    protected isSSOPopup(): boolean;
     protected convertQueryParamsToLoginParams(params: QueryParams): LoginParams;
     protected createFetchMachineEvent(url: string, msg?: {}): FetchMachineEvent;
     protected onIdleEvents: () => {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@genesislcap/foundation-auth",
   "description": "Genesis Foundation Auth",
-  "version": "15.80.0",
+  "version": "15.81.0",
   "license": "SEE LICENSE IN license.txt",
   "main": "dist/esm/index.js",
   "types": "dist/foundation-auth.d.ts",
@@ -129,24 +129,24 @@
     }
   },
   "devDependencies": {
-    "@genesislcap/foundation-testing": "15.80.0",
-    "@genesislcap/genx": "15.80.0",
-    "@genesislcap/ts-builder": "15.80.0",
-    "@genesislcap/uvu-playwright-builder": "15.80.0",
-    "@genesislcap/vite-builder": "15.80.0",
-    "@genesislcap/webpack-builder": "15.80.0"
+    "@genesislcap/foundation-testing": "15.81.0",
+    "@genesislcap/genx": "15.81.0",
+    "@genesislcap/ts-builder": "15.81.0",
+    "@genesislcap/uvu-playwright-builder": "15.81.0",
+    "@genesislcap/vite-builder": "15.81.0",
+    "@genesislcap/webpack-builder": "15.81.0"
   },
   "dependencies": {
-    "@genesislcap/foundation-comms": "15.80.0",
-    "@genesislcap/foundation-events": "15.80.0",
-    "@genesislcap/foundation-i18n": "15.80.0",
-    "@genesislcap/foundation-logger": "15.80.0",
-    "@genesislcap/foundation-state-machine": "15.80.0",
-    "@genesislcap/foundation-store": "15.80.0",
-    "@genesislcap/foundation-ui": "15.80.0",
-    "@genesislcap/foundation-user": "15.80.0",
-    "@genesislcap/foundation-utils": "15.80.0",
-    "@genesislcap/rapid-design-system": "15.80.0",
+    "@genesislcap/foundation-comms": "15.81.0",
+    "@genesislcap/foundation-events": "15.81.0",
+    "@genesislcap/foundation-i18n": "15.81.0",
+    "@genesislcap/foundation-logger": "15.81.0",
+    "@genesislcap/foundation-state-machine": "15.81.0",
+    "@genesislcap/foundation-store": "15.81.0",
+    "@genesislcap/foundation-ui": "15.81.0",
+    "@genesislcap/foundation-user": "15.81.0",
+    "@genesislcap/foundation-utils": "15.81.0",
+    "@genesislcap/rapid-design-system": "15.81.0",
     "@microsoft/fast-components": "2.30.6",
     "@microsoft/fast-element": "1.14.0",
     "@microsoft/fast-foundation": "2.50.0",