@spidy092/auth-client 3.1.6 → 3.2.1

package/dist/index.js

@@ -516,6 +516,13 @@ async function logout(options = {}) {
       clientKey
     });
   }
+  if (scope === "sso" && authBaseUrl && clientKey) {
+    const frontChannelLogoutUrl = new URL(
+      `${authBaseUrl.replace(/\/+$/, "")}/logout/${encodeURIComponent(clientKey)}`
+    );
+    window.location.replace(frontChannelLogoutUrl.toString());
+    return;
+  }
   const fallbackUrl = isRouterMode() ? new URL("/login", window.location.origin) : new URL("/login", accountUiUrl);
   fallbackUrl.searchParams.set("logged_out", "true");
   fallbackUrl.searchParams.set("client", clientKey);
@@ -963,6 +970,29 @@ api.interceptors.request.use((config2) => {
   return config2;
 });
 var refreshPromise2 = null;
+var SINGLE_ORG_DENIED_EVENT = "auth:single-org-denied";
+function responseErrorCode(response) {
+  var _a;
+  const data = response == null ? void 0 : response.data;
+  return ((_a = data == null ? void 0 : data.errors) == null ? void 0 : _a.code) || (data == null ? void 0 : data.code) || null;
+}
+function isTenantAccessDenied(response) {
+  return (response == null ? void 0 : response.status) === 403 && responseErrorCode(response) === "TENANT_ACCESS_DENIED";
+}
+function isSingleOrganizationMode(response) {
+  return (response == null ? void 0 : response.status) === 409 && responseErrorCode(response) === "SINGLE_ORGANIZATION_MODE";
+}
+function dispatchSingleOrgDenied(response) {
+  var _a, _b;
+  if (typeof window === "undefined" || typeof window.dispatchEvent !== "function") return;
+  window.dispatchEvent(new CustomEvent(SINGLE_ORG_DENIED_EVENT, {
+    detail: {
+      code: responseErrorCode(response),
+      status: (response == null ? void 0 : response.status) || null,
+      currentOrgId: ((_b = (_a = response == null ? void 0 : response.data) == null ? void 0 : _a.errors) == null ? void 0 : _b.current_org_id) || null
+    }
+  }));
+}
 api.interceptors.response.use(
   (response) => response,
   async (error) => {
@@ -970,6 +1000,10 @@ api.interceptors.response.use(
     if (!response || !config2) {
       return Promise.reject(error);
     }
+    if (isTenantAccessDenied(response) || isSingleOrganizationMode(response)) {
+      dispatchSingleOrgDenied(response);
+      return Promise.reject(error);
+    }
     if (response.status !== 401 || config2._retry) {
       return Promise.reject(error);
     }
@@ -1651,6 +1685,10 @@ var auth = {
   // 🌐 Authenticated API client
   api: api_default,
   preferences,
+  // 🏢 Single-organization mode helpers
+  SINGLE_ORG_DENIED_EVENT,
+  isTenantAccessDenied,
+  isSingleOrganizationMode,
   // 🔎 Safe authentication diagnostics
   getDiagnosticContext,
   emitAuthDiagnostic,
@@ -1702,12 +1740,15 @@ export {
   AuthProvider,
   PREFERENCE_DEFAULTS,
   PreferencesProvider,
+  SINGLE_ORG_DENIED_EVENT,
   applyPreferences,
   auth,
   formatUserDate,
   formatUserNumber,
   formatUserRelativeTime,
   getPreferences,
+  isSingleOrganizationMode,
+  isTenantAccessDenied,
   normalizePreferences,
   resolveTheme,
   startPreferenceSync,