@thunderid/browser 1.11.0 → 1.12.1

package/dist/index.d.ts

@@ -26,6 +26,7 @@ export { default as navigate } from './utils/navigate';
 export { default as http } from './utils/http';
 export { default as createHttpClientFetcher } from './utils/createHttpClientFetcher';
 export { default as copyTextToClipboard } from './utils/copyTextToClipboard';
+export { getCurrentProjectStorageKey, readCurrentProject, writeCurrentProject } from './utils/currentProjectStorage';
 export { default as handleWebAuthnAuthentication } from './utils/handleWebAuthnAuthentication';
 export { default as resolveEmojiUrisInHtml } from './utils/resolveEmojiUrisInHtml';
 export { default as isAvatarUri, AVATAR_URI_SCHEME } from './utils/isAvatarUri';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;GAEG;AAGH,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAC,OAAO,IAAI,aAAa,EAAE,sBAAsB,EAAC,MAAM,iBAAiB,CAAC;AACjF,OAAO,EAAC,OAAO,IAAI,iBAAiB,EAAC,MAAM,qBAAqB,CAAC;AAGjE,OAAO,EAAC,OAAO,IAAI,KAAK,EAAE,KAAK,IAAI,YAAY,EAAC,MAAM,mBAAmB,CAAC;AAC1E,cAAc,0BAA0B,CAAC;AAGzC,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,wBAAwB,CAAC;AACnF,YAAY,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAC,sBAAsB,EAAC,MAAM,8BAA8B,CAAC;AACzE,YAAY,EAAC,sBAAsB,EAAC,MAAM,iBAAiB,CAAC;AAG5D,OAAO,EAAC,OAAO,IAAI,UAAU,EAAC,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAC,OAAO,IAAI,WAAW,EAAC,MAAM,sBAAsB,CAAC;AAG5D,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAC,OAAO,IAAI,QAAQ,EAAC,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAC,OAAO,IAAI,SAAS,EAAC,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAC,OAAO,IAAI,oBAAoB,EAAC,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAC,OAAO,IAAI,kBAAkB,EAAC,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAC,OAAO,IAAI,6BAA6B,EAAC,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAC,OAAO,IAAI,QAAQ,EAAC,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAC,OAAO,IAAI,IAAI,EAAC,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAC,OAAO,IAAI,mBAAmB,EAAC,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,4BAA4B,EAAC,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAC,OAAO,IAAI,WAAW,EAAE,iBAAiB,EAAC,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAC,OAAO,IAAI,0BAA0B,EAAC,MAAM,oCAAoC,CAAC;AACzF,YAAY,EAAC,YAAY,EAAE,WAAW,EAAE,aAAa,EAAC,MAAM,oCAAoC,CAAC;AACjG,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,OAAO,IAAI,qBAAqB,EAChC,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAC,sBAAsB,EAAC,MAAM,wCAAwC,CAAC;AAC9E,YAAY,EAAC,mBAAmB,EAAC,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAC,sBAAsB,EAAC,MAAM,wCAAwC,CAAC;AAC9E,YAAY,EAAC,mBAAmB,EAAC,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,YAAY,EAAC,YAAY,EAAE,gBAAgB,EAAC,MAAM,wBAAwB,CAAC;AAG3E,OAAO,EAAC,eAAe,EAAE,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,wBAAwB,CAAC;AACtG,YAAY,EAAC,qBAAqB,EAAE,kBAAkB,EAAC,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAC,OAAO,IAAI,qBAAqB,EAAC,MAAM,+BAA+B,CAAC;AAG/E,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;GAEG;AAGH,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAC,OAAO,IAAI,aAAa,EAAE,sBAAsB,EAAC,MAAM,iBAAiB,CAAC;AACjF,OAAO,EAAC,OAAO,IAAI,iBAAiB,EAAC,MAAM,qBAAqB,CAAC;AAGjE,OAAO,EAAC,OAAO,IAAI,KAAK,EAAE,KAAK,IAAI,YAAY,EAAC,MAAM,mBAAmB,CAAC;AAC1E,cAAc,0BAA0B,CAAC;AAGzC,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,yBAAyB,CAAC;AAClE,YAAY,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,wBAAwB,CAAC;AACnF,YAAY,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,uBAAuB,CAAC;AACnE,YAAY,EAAC,sBAAsB,EAAC,MAAM,8BAA8B,CAAC;AACzE,YAAY,EAAC,sBAAsB,EAAC,MAAM,iBAAiB,CAAC;AAG5D,OAAO,EAAC,OAAO,IAAI,UAAU,EAAC,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAC,OAAO,IAAI,YAAY,EAAC,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAC,OAAO,IAAI,WAAW,EAAC,MAAM,sBAAsB,CAAC;AAG5D,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAC,OAAO,IAAI,QAAQ,EAAC,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAC,OAAO,IAAI,SAAS,EAAC,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAC,OAAO,IAAI,oBAAoB,EAAC,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAC,OAAO,IAAI,kBAAkB,EAAC,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAC,OAAO,IAAI,6BAA6B,EAAC,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAC,OAAO,IAAI,QAAQ,EAAC,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAC,OAAO,IAAI,IAAI,EAAC,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAC,OAAO,IAAI,mBAAmB,EAAC,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAC,2BAA2B,EAAE,kBAAkB,EAAE,mBAAmB,EAAC,MAAM,+BAA+B,CAAC;AACnH,OAAO,EAAC,OAAO,IAAI,4BAA4B,EAAC,MAAM,sCAAsC,CAAC;AAC7F,OAAO,EAAC,OAAO,IAAI,sBAAsB,EAAC,MAAM,gCAAgC,CAAC;AACjF,OAAO,EAAC,OAAO,IAAI,WAAW,EAAE,iBAAiB,EAAC,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAC,OAAO,IAAI,0BAA0B,EAAC,MAAM,oCAAoC,CAAC;AACzF,YAAY,EAAC,YAAY,EAAE,WAAW,EAAE,aAAa,EAAC,MAAM,oCAAoC,CAAC;AACjG,OAAO,EAAC,OAAO,IAAI,eAAe,EAAC,MAAM,yBAAyB,CAAC;AACnE,OAAO,EACL,OAAO,IAAI,qBAAqB,EAChC,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAC,OAAO,IAAI,uBAAuB,EAAC,MAAM,iCAAiC,CAAC;AACnF,OAAO,EAAC,sBAAsB,EAAC,MAAM,wCAAwC,CAAC;AAC9E,YAAY,EAAC,mBAAmB,EAAC,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAC,sBAAsB,EAAC,MAAM,wCAAwC,CAAC;AAC9E,YAAY,EAAC,mBAAmB,EAAC,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,YAAY,EAAC,YAAY,EAAE,gBAAgB,EAAC,MAAM,wBAAwB,CAAC;AAG3E,OAAO,EAAC,eAAe,EAAE,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,wBAAwB,CAAC;AACtG,YAAY,EAAC,qBAAqB,EAAE,kBAAkB,EAAC,MAAM,wBAAwB,CAAC;AACtF,OAAO,EAAC,OAAO,IAAI,cAAc,EAAC,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAC,OAAO,IAAI,qBAAqB,EAAC,MAAM,+BAA+B,CAAC;AAG/E,cAAc,uBAAuB,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 import { Buffer } from 'buffer/index.js';
 if (typeof window !== 'undefined' && !window.Buffer) { window.Buffer = Buffer; }
-import { DEFAULT_THEME, HttpClient, OIDCRequestConstants, ThunderIDAuthException, ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants, arrayBufferToBase64url, base64urlToArrayBuffer, createPackageComponentLogger, extractEmojiFromUri, extractPkceStorageKeyFromState, generateFlattenedUserProfile, getTokenPermissions, getUsersMe, isEmojiUri, resolveBackendEndpoints, resolveRequestBaseUrl, resolveResourceEndpoint } from "@thunderid/javascript";
+import { DEFAULT_THEME, EmbeddedFlowType, EmbeddedSignInFlowStatus, HttpClient, OIDCRequestConstants, OrganizationUnitSwitchErrorCodes, ThunderIDAPIError, ThunderIDAuthException, ThunderIDJavaScriptClient, ThunderIDRuntimeError, TokenConstants, arrayBufferToBase64url, base64urlToArrayBuffer, createPackageComponentLogger, executeEmbeddedSignInFlow, extractEmojiFromUri, extractPkceStorageKeyFromState, generateFlattenedUserProfile, getTokenPermissions, getUsersMe, getVendorPrefix, isEmojiUri, resolveBackendEndpoints, resolveRequestBaseUrl, resolveResourceEndpoint } from "@thunderid/javascript";
 import base64url from "base64url";
 import sha256 from "fast-sha256";
 import { createLocalJWKSet, jwtVerify } from "jose";
@@ -160,10 +160,14 @@ var BackendClient = class BackendClient {
 		return this.refreshing;
 	}
 	/**
-	* The URL that starts sign-in at the backend and comes back to `returnTo`.
+	* The URL that starts sign-in at the backend and comes back to `returnTo`. With `ouId`, the backend
+	* bounds the sign-in to that organization unit.
 	*/
-	getSignInUrl(returnTo) {
-		return `${this.endpoints.signIn}?${new URLSearchParams({ returnTo }).toString()}`;
+	getSignInUrl(returnTo, ouId) {
+		return `${this.endpoints.signIn}?${new URLSearchParams({
+			returnTo,
+			...ouId ? { ouId } : {}
+		}).toString()}`;
 	}
 	/**
 	* Ends the backend session.
@@ -929,7 +933,7 @@ var AuthenticationHelper = class {
 	* @param timeout - How long to wait for the iframe's response, in milliseconds.
 	* @returns The user session, or `false` if the user is not signed in.
 	*/
-	async signInSilently(constructSilentSignInUrl, requestAccessToken, additionalParams, tokenRequestConfig, timeout = SILENT_SIGN_IN_TIMEOUT) {
+	async signInSilently(constructSilentSignInUrl, requestAccessToken, additionalParams, tokenRequestConfig, timeout = SILENT_SIGN_IN_TIMEOUT, onSignedOut) {
 		if (SPAUtils_default.isInitializedSilentSignIn()) {
 			await this.handleSilentSignInResponse();
 			return Promise.resolve({
@@ -964,6 +968,7 @@ var AuthenticationHelper = class {
 				const data = e.data;
 				if (data?.type === SILENT_SIGN_IN_SIGNED_OUT) {
 					cleanUp();
+					onSignedOut?.(typeof data?.data?.error === "string" ? data.data.error : void 0);
 					resolve(false);
 				}
 				if (data?.type === SILENT_SIGN_IN_SIGNED_IN && data?.data?.code) {
@@ -994,7 +999,14 @@ var AuthenticationHelper = class {
 				state
 			},
 			type: SILENT_SIGN_IN_SIGNED_IN
-		} : { type: SILENT_SIGN_IN_SIGNED_OUT };
+		} : {
+			data: url.searchParams.get("error") ? {
+				code: "",
+				error: url.searchParams.get("error") ?? "",
+				state
+			} : void 0,
+			type: SILENT_SIGN_IN_SIGNED_OUT
+		};
 		window.parent.postMessage(message, window.location.origin);
 		window.location.href = "about:blank";
 		await SPAUtils_default.waitTillPageRedirect();
@@ -2785,6 +2797,24 @@ var SPAHelper_default = SPAHelper;
 
 //#endregion
 //#region src/ThunderIDBrowserClient.ts
+/**
+* OAuth errors that mean the server needs the user, so a silent switch falls back to a redirect.
+*/
+const INTERACTION_ERRORS = [
+	"interaction_required",
+	"login_required",
+	"consent_required",
+	"account_selection_required"
+];
+/**
+* OAuth errors for a device secret the server cannot use, which the SDK drops before signing in again.
+*/
+const UNUSABLE_DEVICE_SECRET_ERRORS = ["invalid_request", "invalid_grant"];
+/**
+* Temporary-data key that marks a switch to another organization unit left the page, so its callback is
+* redeemed although the previous session is still signed in.
+*/
+const ORGANIZATION_UNIT_SWITCH_KEY = "organization_unit_switch";
 const logger$2 = createPackageComponentLogger("@thunderid/browser", "ThunderIDBrowserClient");
 const BROWSER_DEFAULT_CONFIG = {
 	autoLogoutOnTokenRefreshError: false,
@@ -2918,7 +2948,8 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 		await this.isInitialized();
 		if (this._backend) {
 			if (config?.callOnlyOnRedirect) return;
-			location.href = this._backend.getSignInUrl(`${window.location.pathname}${window.location.search}`);
+			const backendOuId = config?.["organizationUnitId"];
+			location.href = this._backend.getSignInUrl(`${window.location.pathname}${window.location.search}`, typeof backendOuId === "string" && backendOuId !== "" ? backendOuId : void 0);
 			await SPAUtils_default.waitTillPageRedirect();
 			return;
 		}
@@ -2931,6 +2962,8 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 	async _signInInternal(signInConfig, authorizationCode, state, tokenRequestConfig) {
 		const sm = this.getStorageManager();
 		const config = await sm.getConfigData();
+		const switchedUser = await this._completeOrganizationUnitSwitch(tokenRequestConfig);
+		if (switchedUser) return switchedUser;
 		const basicUserInfo = await this._authHelper.handleSignIn();
 		if (basicUserInfo) return basicUserInfo;
 		let resolvedAuthorizationCode;
@@ -2982,14 +3015,186 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 			await this.setPKCECode(pkce, pkceKey);
 		}
 		await this.requestAccessToken(authorizationCode, state ?? "", void 0, tokenRequestConfig);
+		return this._startSession(config.clientId);
+	}
+	/**
+	* Prepares the sign-out URL and the token refresh for tokens just stored, and reads the user.
+	*/
+	async _startSession(clientId) {
 		try {
 			const signOutUrl = await this.getSignOutUrl();
-			SPAUtils_default.setSignOutURL(signOutUrl, config.clientId, this._browserInstanceId);
+			SPAUtils_default.setSignOutURL(signOutUrl, clientId, this._browserInstanceId);
 		} catch {}
 		await this._spaHelper.clearRefreshTokenTimeout();
 		await this._spaHelper.refreshAccessTokenAutomatically(() => this.refreshAccessToken());
 		return this.getUser();
 	}
+	/**
+	* Signs in again bounded to the organization unit `organizationUnitId`, and replaces the session with
+	* the one it gets. The server reuses the SSO session when the user can sign in there, so normally no
+	* credentials are asked.
+	*
+	* - Redirect mode exchanges the session's device secret at `{baseUrl}/ou/{ouId}/oauth2/token` when it
+	*   holds one, which a sign-in with the `device_sso` scope returns. Otherwise it tries a `prompt=none`
+	*   request to `{baseUrl}/ou/{ouId}/oauth2/authorize` in a hidden iframe. When the server needs the
+	*   user, it redirects the page there (unless `redirect` is `false`), and the callback replaces the
+	*   session.
+	* - Embedded mode starts an `AUTHENTICATION` flow with `ouId`, presenting the SSO session handles kept
+	*   from earlier flow steps. A flow that needs input fails with `interaction_required`; render the
+	*   sign-in for the unit instead.
+	* - Backend mode sends the page to the backend's sign-in endpoint with `ouId`.
+	*
+	* A failed switch leaves the previous session as it was.
+	*
+	* @throws {ThunderIDAPIError} With a code from `OrganizationUnitSwitchErrorCodes`.
+	*/
+	async switchOrganizationUnit(organizationUnitId, options = {}) {
+		await this.isInitialized();
+		if (typeof organizationUnitId !== "string" || organizationUnitId.trim() === "") throw new ThunderIDAPIError("An organization unit identifier is required.", OrganizationUnitSwitchErrorCodes.InvalidOrganizationUnit, "browser", 400);
+		if (this._backend) {
+			location.href = this._backend.getSignInUrl(`${window.location.pathname}${window.location.search}`, organizationUnitId);
+			await SPAUtils_default.waitTillPageRedirect();
+			return;
+		}
+		const { redirect = true,...params } = options;
+		const sm = this.getStorageManager();
+		const config = await sm.getConfigData();
+		if (config?.mode === "embedded") return this._switchOrganizationUnitEmbedded(organizationUnitId, config);
+		const exchangedUser = await this._switchOrganizationUnitWithDeviceSecret(organizationUnitId, config);
+		if (exchangedUser) return exchangedUser;
+		let silentError;
+		let silentUser = false;
+		if (exchangedUser === void 0) try {
+			silentUser = await this._authHelper.signInSilently((additional) => this._constructSilentSignInUrl(additional), (code$1, s, trc) => this._exchangeCodeForTokens(code$1, s, trc), {
+				...params,
+				organizationUnitId
+			}, void 0, config?.session?.silentSignIn?.timeout, (error) => {
+				silentError = error;
+			});
+		} catch (error) {
+			throw ThunderIDBrowserClient._toSwitchError(error instanceof Error ? error.message : void 0, error);
+		}
+		if (silentUser && typeof silentUser === "object") {
+			this._emitHook(Hooks_default.SignIn, silentUser);
+			return silentUser;
+		}
+		if (silentError && !INTERACTION_ERRORS.includes(silentError)) throw ThunderIDBrowserClient._toSwitchError(silentError);
+		if (!redirect) throw ThunderIDBrowserClient._toSwitchError("interaction_required");
+		const url = await this.getSignInUrl({
+			...params,
+			organizationUnitId
+		});
+		await sm.setTemporaryDataParameter(ORGANIZATION_UNIT_SWITCH_KEY, organizationUnitId);
+		location.href = url;
+		await SPAUtils_default.waitTillPageRedirect();
+	}
+	/**
+	* Switches back-channel by exchanging the session's device secret at the unit's token endpoint.
+	*
+	* @returns The user, `false` when the server needs the user, or `undefined` when the session holds no
+	*   device secret.
+	*/
+	async _switchOrganizationUnitWithDeviceSecret(organizationUnitId, config) {
+		let result;
+		try {
+			result = await this.switchOrganizationUnitWithDeviceSecret(organizationUnitId);
+		} catch (error) {
+			throw ThunderIDBrowserClient._toSwitchError(void 0, error);
+		}
+		if (!result) return;
+		if ("error" in result) {
+			if (INTERACTION_ERRORS.includes(result.error) || UNUSABLE_DEVICE_SECRET_ERRORS.includes(result.error)) return false;
+			throw ThunderIDBrowserClient._toSwitchError(result.error);
+		}
+		const user = await this._startSession(config.clientId ?? "");
+		this._emitHook(Hooks_default.SignIn, user);
+		return user;
+	}
+	/**
+	* Maps an OAuth error from a bounded sign-in onto the switch's documented errors.
+	*/
+	static _toSwitchError(oauthError, cause) {
+		if (cause instanceof ThunderIDAPIError && Object.values(OrganizationUnitSwitchErrorCodes).includes(cause.code)) return cause;
+		let code$1 = OrganizationUnitSwitchErrorCodes.Failed;
+		if (oauthError === "unauthorized_client") code$1 = OrganizationUnitSwitchErrorCodes.UnauthorizedClient;
+		else if (oauthError && INTERACTION_ERRORS.includes(oauthError)) code$1 = OrganizationUnitSwitchErrorCodes.InteractionRequired;
+		const serverCode = oauthError ?? "switch_failed";
+		return new ThunderIDAPIError(JSON.stringify({
+			code: serverCode,
+			message: { defaultValue: serverCode }
+		}), code$1, "browser", oauthError === "unauthorized_client" ? 400 : void 0, void 0, "Switching the organization unit failed");
+	}
+	/**
+	* Embedded mode: starts a sign-in flow bounded to the unit. When the SSO session is reused, the flow
+	* completes at once and its assertion replaces the session.
+	*/
+	async _switchOrganizationUnitEmbedded(organizationUnitId, config) {
+		let response;
+		const sessionData = await this.getFlowSessions();
+		try {
+			response = await executeEmbeddedSignInFlow({
+				baseUrl: config?.baseUrl,
+				payload: {
+					applicationId: config?.applicationId ?? "",
+					flowType: EmbeddedFlowType.Authentication,
+					ouId: organizationUnitId,
+					...sessionData.length > 0 ? { sessionData } : {}
+				},
+				url: resolveResourceEndpoint("flowExecute", config)
+			});
+		} catch (error) {
+			const serverCode = error instanceof ThunderIDAPIError ? error.serverError?.code : void 0;
+			throw ThunderIDBrowserClient._toSwitchError(serverCode === "FES-1023" ? "unauthorized_client" : serverCode, error);
+		}
+		await this.storeFlowSessions(response);
+		if (response?.flowStatus === EmbeddedSignInFlowStatus.Complete && response.assertion) {
+			const claims = await this.decodeJwtToken(response.assertion);
+			const iat = typeof claims["iat"] === "number" ? claims["iat"] : void 0;
+			const exp = typeof claims["exp"] === "number" ? claims["exp"] : void 0;
+			await this.setSession({
+				access_token: response.assertion,
+				created_at: iat ? iat * 1e3 : Date.now(),
+				expires_in: exp && iat ? exp - iat : 3600,
+				id_token: response.assertion,
+				scope: claims["scope"],
+				token_type: "Bearer"
+			});
+			const user = await this.getUser();
+			this._emitHook(Hooks_default.SignIn, user);
+			return user;
+		}
+		if (response?.flowStatus === EmbeddedSignInFlowStatus.Error) throw ThunderIDBrowserClient._toSwitchError("access_denied");
+		throw ThunderIDBrowserClient._toSwitchError("interaction_required");
+	}
+	/**
+	* Completes a switch that left the page for the unit's authorization endpoint: redeems the returned
+	* code, or reports the returned error and keeps the previous session.
+	*/
+	async _completeOrganizationUnitSwitch(tokenRequestConfig) {
+		const sm = this.getStorageManager();
+		if (!await sm.getTemporaryDataParameter(ORGANIZATION_UNIT_SWITCH_KEY) || SPAUtils_default.isInitializedSilentSignIn()) return;
+		const url = new URL(window.location.href);
+		const code$1 = url.searchParams.get(OIDCRequestConstants.Params.AUTHORIZATION_CODE);
+		const state = url.searchParams.get(OIDCRequestConstants.Params.STATE);
+		const error = url.searchParams.get("error");
+		if (code$1 && state) {
+			await sm.removeTemporaryDataParameter(ORGANIZATION_UNIT_SWITCH_KEY);
+			SPAUtils_default.removeAuthorizationCode();
+			try {
+				return await this._exchangeCodeForTokens(code$1, state, tokenRequestConfig);
+			} catch (exchangeError) {
+				throw ThunderIDBrowserClient._toSwitchError(void 0, exchangeError);
+			}
+		}
+		if (error) {
+			await sm.removeTemporaryDataParameter(ORGANIZATION_UNIT_SWITCH_KEY);
+			url.searchParams.delete("error");
+			url.searchParams.delete("error_description");
+			url.searchParams.delete(OIDCRequestConstants.Params.STATE);
+			history.replaceState(null, document.title, url.toString());
+			throw ThunderIDBrowserClient._toSwitchError(error);
+		}
+	}
 	async signInSilently(additionalParams, tokenRequestConfig) {
 		await this.isInitialized();
 		if (this._backend) return await this.isSignedIn() ? this.getUser() : false;
@@ -3286,13 +3491,14 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 		const config = await this.getStorageManager().getConfigData();
 		const urlString = await this.getSignInUrl({
 			prompt: "none",
+			response_mode: "query",
 			state: SILENT_SIGN_IN_STATE,
 			...additionalParams
 		});
 		const urlObject = new URL(urlString);
-		urlObject.searchParams.set("response_mode", "query");
+		if (!urlObject.searchParams.has("request_uri")) urlObject.searchParams.set("response_mode", "query");
 		if (this._storage === BrowserStorage_default.BrowserMemory && config.enablePKCE) {
-			const state = urlObject.searchParams.get(OIDCRequestConstants.Params.STATE);
+			const state = urlObject.searchParams.get(OIDCRequestConstants.Params.STATE) ?? this.lastAuthorizeRequestState;
 			SPAUtils_default.setPKCE(extractPkceStorageKeyFromState(state ?? ""), await this.getPKCECode(state ?? ""));
 		}
 		return urlObject.toString();
@@ -3377,6 +3583,48 @@ const copyTextToClipboard = async (text) => {
 };
 var copyTextToClipboard_default = copyTextToClipboard;
 
+//#endregion
+//#region src/utils/currentProjectStorage.ts
+/**
+* The `localStorage` key the current project is kept under, scoped to the vendor like the SDK's
+* other UI preferences.
+*
+* @param vendor - The vendor prefix.
+* @returns The key.
+*/
+const getCurrentProjectStorageKey = (vendor) => `${getVendorPrefix(vendor)}-current-project`;
+/**
+* Reads the project the user last chose. The current project is a client-side preference for the
+* management UI: it does not change the session, the tokens or what the server allows.
+*
+* @param vendor - The vendor prefix.
+* @returns The project, or `null` when none is kept or storage is unavailable.
+*/
+const readCurrentProject = (vendor) => {
+	try {
+		if (typeof window === "undefined" || !window.localStorage) return null;
+		const stored = window.localStorage.getItem(getCurrentProjectStorageKey(vendor));
+		const parsed = stored ? JSON.parse(stored) : null;
+		return parsed && typeof parsed === "object" && typeof parsed.id === "string" ? parsed : null;
+	} catch {
+		return null;
+	}
+};
+/**
+* Keeps the project the user chose, or forgets it with `null`.
+*
+* @param vendor - The vendor prefix.
+* @param project - The project, or `null`.
+*/
+const writeCurrentProject = (vendor, project) => {
+	try {
+		if (typeof window === "undefined" || !window.localStorage) return;
+		const key = getCurrentProjectStorageKey(vendor);
+		if (project) window.localStorage.setItem(key, JSON.stringify(project));
+		else window.localStorage.removeItem(key);
+	} catch {}
+};
+
 //#endregion
 //#region src/utils/handleWebAuthnAuthentication.ts
 const logger$1 = createPackageComponentLogger("@thunderid/browser", "WebAuthn");
@@ -4228,5 +4476,5 @@ const normalizeBorderRadius = (raw) => {
 var normalizeBorderRadius_default = normalizeBorderRadius;
 
 //#endregion
-export { ACCESS_TOKEN_INVALID, ANONYMOUS_ANIMAL_ICONS, ANONYMOUS_ENTITY_ICONS, AVATAR_GRADIENT_COUNT, AVATAR_URI_SCHEME, AuthenticationHelper_default as AuthenticationHelper, BACKEND_REQUEST_HEADER, BackendClient_default as BackendClient, BackendHttpClient_default as BackendHttpClient, Hooks as BrowserHooks, BrowserStorage_default as BrowserStorage, CUSTOM_GRANT_CONFIG, ERROR, ERROR_DESCRIPTION, FetchHttpClient_default as FetchHttpClient, Hooks_default as Hooks, LocalStore_default as LocalStore, MemoryStore_default as MemoryStore, REFRESH_ACCESS_TOKEN_ERR0R, SILENT_SIGN_IN_SIGNED_IN, SILENT_SIGN_IN_SIGNED_OUT, SILENT_SIGN_IN_STATE, SILENT_SIGN_IN_TIMEOUT, SPACryptoUtils_default as SPACryptoUtils, SPAHelper_default as SPAHelper, SPAUtils_default as SPAUtils, STATE_QUERY, SessionStore_default as SessionStore, TOKEN_REQUEST_CONFIG_KEY, ThunderIDBrowserClient_default as ThunderIDBrowserClient, buildAvatarSpec_default as buildAvatarSpec, copyTextToClipboard_default as copyTextToClipboard, createClassObserver, createHttpClientFetcher_default as createHttpClientFetcher, createMediaQueryListener, deriveAvatarContent, detectThemeMode, extractAvatarParamsFromUri_default as extractAvatarParamsFromUri, generateAvatarDataUri_default as generateAvatarDataUri, getActiveTheme_default as getActiveTheme, handleWebAuthnAuthentication_default as handleWebAuthnAuthentication, hasAuthParamsInUrl_default as hasAuthParamsInUrl, hasCalledForThisInstanceInUrl_default as hasCalledForThisInstanceInUrl, http_default as http, isAvatarUri_default as isAvatarUri, navigate_default as navigate, normalizeBorderRadius_default as normalizeBorderRadius, pickAnonymousAvatarName_default as pickAnonymousAvatarName, pickAnonymousEntityName_default as pickAnonymousEntityName, resolveEmojiUrisInHtml_default as resolveEmojiUrisInHtml, resolveLogoUri_default as resolveLogoUri };
+export { ACCESS_TOKEN_INVALID, ANONYMOUS_ANIMAL_ICONS, ANONYMOUS_ENTITY_ICONS, AVATAR_GRADIENT_COUNT, AVATAR_URI_SCHEME, AuthenticationHelper_default as AuthenticationHelper, BACKEND_REQUEST_HEADER, BackendClient_default as BackendClient, BackendHttpClient_default as BackendHttpClient, Hooks as BrowserHooks, BrowserStorage_default as BrowserStorage, CUSTOM_GRANT_CONFIG, ERROR, ERROR_DESCRIPTION, FetchHttpClient_default as FetchHttpClient, Hooks_default as Hooks, LocalStore_default as LocalStore, MemoryStore_default as MemoryStore, REFRESH_ACCESS_TOKEN_ERR0R, SILENT_SIGN_IN_SIGNED_IN, SILENT_SIGN_IN_SIGNED_OUT, SILENT_SIGN_IN_STATE, SILENT_SIGN_IN_TIMEOUT, SPACryptoUtils_default as SPACryptoUtils, SPAHelper_default as SPAHelper, SPAUtils_default as SPAUtils, STATE_QUERY, SessionStore_default as SessionStore, TOKEN_REQUEST_CONFIG_KEY, ThunderIDBrowserClient_default as ThunderIDBrowserClient, buildAvatarSpec_default as buildAvatarSpec, copyTextToClipboard_default as copyTextToClipboard, createClassObserver, createHttpClientFetcher_default as createHttpClientFetcher, createMediaQueryListener, deriveAvatarContent, detectThemeMode, extractAvatarParamsFromUri_default as extractAvatarParamsFromUri, generateAvatarDataUri_default as generateAvatarDataUri, getActiveTheme_default as getActiveTheme, getCurrentProjectStorageKey, handleWebAuthnAuthentication_default as handleWebAuthnAuthentication, hasAuthParamsInUrl_default as hasAuthParamsInUrl, hasCalledForThisInstanceInUrl_default as hasCalledForThisInstanceInUrl, http_default as http, isAvatarUri_default as isAvatarUri, navigate_default as navigate, normalizeBorderRadius_default as normalizeBorderRadius, pickAnonymousAvatarName_default as pickAnonymousAvatarName, pickAnonymousEntityName_default as pickAnonymousEntityName, readCurrentProject, resolveEmojiUrisInHtml_default as resolveEmojiUrisInHtml, resolveLogoUri_default as resolveLogoUri, writeCurrentProject };
 //# sourceMappingURL=index.js.map