@iblai/web-utils 1.11.10 → 1.11.12

package/dist/index.js

@@ -1771,6 +1771,24 @@ async function preCacheMentorData(org, mentorId, userId, fetchMentorSettings, fe
     }
 }
 
+async function openExternalUrl(url) {
+    if (!url || typeof window === "undefined")
+        return;
+    if (!isTauri()) {
+        window.location.href = url;
+        return;
+    }
+    try {
+        const { invoke } = await import('@tauri-apps/api/core');
+        await invoke("open_external_url", { url });
+    }
+    catch (error) {
+        console.error("[openExternalUrl] Failed to open URL via Tauri host, falling back to navigation:", error);
+        // Fallback to normal navigation if the native command is unavailable.
+        window.location.href = url;
+    }
+}
+
 const useTenantMetadata = ({ org, spa, skip = false, }) => {
     const { data, isLoading, isError } = dataLayer.useGetTenantMetadataQuery([{ org }], {
         skip: skip || !org,
@@ -9182,22 +9200,22 @@ async function syncAuthToCookies(storageService) {
 function hasNonExpiredAuthToken() {
     const token = window.localStorage.getItem(LOCAL_STORAGE_KEYS.AUTH_TOKEN);
     if (!token) {
-        console.log('################### [hasNonExpiredAuthToken] axd token is not defined', token);
+        console.log("################### [hasNonExpiredAuthToken] axd token is not defined", token);
         return false;
     }
     const tokenExpiry = window.localStorage.getItem(LOCAL_STORAGE_KEYS.TOKEN_EXPIRY);
     if (!tokenExpiry) {
-        console.log('################### [hasNonExpiredAuthToken] axd token expiry is not defined', tokenExpiry);
+        console.log("################### [hasNonExpiredAuthToken] axd token expiry is not defined", tokenExpiry);
         return true;
     }
     const expiryDate = new Date(tokenExpiry);
     if (isNaN(expiryDate.getTime())) {
-        console.log('################### [hasNonExpiredAuthToken] axd token expiry date', expiryDate);
+        console.log("################### [hasNonExpiredAuthToken] axd token expiry date", expiryDate);
         return false;
     }
     const currentDate = new Date();
     if (expiryDate <= currentDate) {
-        console.log('################### [hasNonExpiredAuthToken] axd token expiry date is less than current date ', expiryDate, currentDate);
+        console.log("################### [hasNonExpiredAuthToken] axd token expiry date is less than current date ", expiryDate, currentDate);
         return false;
     }
     return true;
@@ -9460,6 +9478,20 @@ function useAuthProvider({ middleware = new Map(), onAuthSuccess, onAuthFailure,
             console.log("[AuthProvider] Redirect already in progress, skipping");
             return;
         }
+        // Defer every auth redirect while a tenant switch is in flight.
+        // handleTenantSwitch() clears the SHARED (cross-tab) localStorage mid-switch,
+        // so every open window transiently sees missing tokens. Without this guard a
+        // bystander window force-logs-out on the absent DM token, which clears
+        // storage + sets a logout-timestamp cookie that wipes the tokens the
+        // switching tab just wrote and cascades the logout across tabs. The TTL lock
+        // (writeTenantSwitchLock) survives the /login/complete -> /sso-login-complete
+        // redirect and is kept fresh across tabs via useTenantSwitchSync, so it
+        // brackets the switch window. The cross-SPA cookie-sync poll keeps running
+        // and recovers once the new tenant's tokens land.
+        if (isTenantSwitchInProgress()) {
+            console.log("[AuthProvider] Tenant switch in progress, deferring auth redirect");
+            return;
+        }
         isRedirectingRef.current = true;
         redirectStartedAtRef.current = Date.now();
         // NOTE: we intentionally do NOT clear the interval here.
@@ -9645,6 +9677,17 @@ function useAuthProvider({ middleware = new Map(), onAuthSuccess, onAuthFailure,
         var _a;
         try {
             setIsAuthenticating(true);
+            // During an in-flight tenant switch the shared, cross-tab localStorage is
+            // transiently cleared (see handleTenantSwitch), so the auth/DM tokens are
+            // legitimately absent. Bail out BEFORE onAuthFailure — some apps hard
+            // navigate to /error/403 from that callback (e.g. skills does
+            // `window.location.href = '/error/403'`), which would fire even though
+            // safeRedirectToAuthSpa itself is guarded. The cookie-sync poll re-checks
+            // once the new tenant's tokens land.
+            if (isTenantSwitchInProgress()) {
+                console.log("[AuthProvider] Tenant switch in progress, skipping auth check");
+                return;
+            }
             const authToken = await (storageService === null || storageService === void 0 ? void 0 : storageService.getItem(LOCAL_STORAGE_KEYS.AUTH_TOKEN));
             if (authToken && !hasNonExpiredAuthToken()) {
                 const reason = "Auth token expired";
@@ -15018,7 +15061,7 @@ const useStripeUpgrade = ({ redirectUrl, sourcePlatformKey, mainPlatformKey, cur
                 return;
             const target = redirectPlan === "free" ? resolvedFreeUrl : resolvedPremiumUrl;
             if (target) {
-                window.location.href = target;
+                await openExternalUrl(target);
             }
         }
         catch (_a) {
@@ -19049,6 +19092,7 @@ exports.markdownToPlainText = markdownToPlainText;
 exports.monetizationSlice = monetizationSlice;
 exports.onStatusChange = onStatusChange;
 exports.onUpdate = onUpdate;
+exports.openExternalUrl = openExternalUrl;
 exports.parseCSV = parseCSV;
 exports.preCacheMentorData = preCacheMentorData;
 exports.rbacReducer = rbacReducer;