@iblai/web-utils 1.11.11 → 1.11.12

package/dist/index.js

@@ -9200,22 +9200,22 @@ async function syncAuthToCookies(storageService) {
 function hasNonExpiredAuthToken() {
     const token = window.localStorage.getItem(LOCAL_STORAGE_KEYS.AUTH_TOKEN);
     if (!token) {
-        console.log('################### [hasNonExpiredAuthToken] axd token is not defined', token);
+        console.log("################### [hasNonExpiredAuthToken] axd token is not defined", token);
         return false;
     }
     const tokenExpiry = window.localStorage.getItem(LOCAL_STORAGE_KEYS.TOKEN_EXPIRY);
     if (!tokenExpiry) {
-        console.log('################### [hasNonExpiredAuthToken] axd token expiry is not defined', tokenExpiry);
+        console.log("################### [hasNonExpiredAuthToken] axd token expiry is not defined", tokenExpiry);
         return true;
     }
     const expiryDate = new Date(tokenExpiry);
     if (isNaN(expiryDate.getTime())) {
-        console.log('################### [hasNonExpiredAuthToken] axd token expiry date', expiryDate);
+        console.log("################### [hasNonExpiredAuthToken] axd token expiry date", expiryDate);
         return false;
     }
     const currentDate = new Date();
     if (expiryDate <= currentDate) {
-        console.log('################### [hasNonExpiredAuthToken] axd token expiry date is less than current date ', expiryDate, currentDate);
+        console.log("################### [hasNonExpiredAuthToken] axd token expiry date is less than current date ", expiryDate, currentDate);
         return false;
     }
     return true;
@@ -9478,6 +9478,20 @@ function useAuthProvider({ middleware = new Map(), onAuthSuccess, onAuthFailure,
             console.log("[AuthProvider] Redirect already in progress, skipping");
             return;
         }
+        // Defer every auth redirect while a tenant switch is in flight.
+        // handleTenantSwitch() clears the SHARED (cross-tab) localStorage mid-switch,
+        // so every open window transiently sees missing tokens. Without this guard a
+        // bystander window force-logs-out on the absent DM token, which clears
+        // storage + sets a logout-timestamp cookie that wipes the tokens the
+        // switching tab just wrote and cascades the logout across tabs. The TTL lock
+        // (writeTenantSwitchLock) survives the /login/complete -> /sso-login-complete
+        // redirect and is kept fresh across tabs via useTenantSwitchSync, so it
+        // brackets the switch window. The cross-SPA cookie-sync poll keeps running
+        // and recovers once the new tenant's tokens land.
+        if (isTenantSwitchInProgress()) {
+            console.log("[AuthProvider] Tenant switch in progress, deferring auth redirect");
+            return;
+        }
         isRedirectingRef.current = true;
         redirectStartedAtRef.current = Date.now();
         // NOTE: we intentionally do NOT clear the interval here.
@@ -9663,6 +9677,17 @@ function useAuthProvider({ middleware = new Map(), onAuthSuccess, onAuthFailure,
         var _a;
         try {
             setIsAuthenticating(true);
+            // During an in-flight tenant switch the shared, cross-tab localStorage is
+            // transiently cleared (see handleTenantSwitch), so the auth/DM tokens are
+            // legitimately absent. Bail out BEFORE onAuthFailure — some apps hard
+            // navigate to /error/403 from that callback (e.g. skills does
+            // `window.location.href = '/error/403'`), which would fire even though
+            // safeRedirectToAuthSpa itself is guarded. The cookie-sync poll re-checks
+            // once the new tenant's tokens land.
+            if (isTenantSwitchInProgress()) {
+                console.log("[AuthProvider] Tenant switch in progress, skipping auth check");
+                return;
+            }
             const authToken = await (storageService === null || storageService === void 0 ? void 0 : storageService.getItem(LOCAL_STORAGE_KEYS.AUTH_TOKEN));
             if (authToken && !hasNonExpiredAuthToken()) {
                 const reason = "Auth token expired";