@thunderid/browser 1.14.1 → 1.16.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/BackendClient.d.ts +10 -0
- package/dist/BackendClient.d.ts.map +1 -1
- package/dist/ThunderIDBrowserClient.d.ts +10 -1
- package/dist/ThunderIDBrowserClient.d.ts.map +1 -1
- package/dist/cjs/index.cjs +51 -6
- package/dist/cjs/index.cjs.map +1 -1
- package/dist/index.js +51 -6
- package/dist/index.js.map +1 -1
- package/package.json +2 -2
package/dist/BackendClient.d.ts
CHANGED
|
@@ -68,6 +68,16 @@ declare class BackendClient {
|
|
|
68
68
|
* bounds the sign-in to that organization unit.
|
|
69
69
|
*/
|
|
70
70
|
getSignInUrl(returnTo: string, ouId?: string): string;
|
|
71
|
+
/**
|
|
72
|
+
* Switches the session to the organization unit `ouId` at the backend, without leaving the page. On
|
|
73
|
+
* success the cached session is dropped, so the next read returns the unit's; on a refusal the
|
|
74
|
+
* session stays as it was.
|
|
75
|
+
*
|
|
76
|
+
* @returns The refusal, with the backend's OAuth `error` when it sent one, or `undefined` on success.
|
|
77
|
+
*/
|
|
78
|
+
switchOrganizationUnit(ouId: string): Promise<{
|
|
79
|
+
error?: string;
|
|
80
|
+
} | undefined>;
|
|
71
81
|
/**
|
|
72
82
|
* Ends the backend session.
|
|
73
83
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"BackendClient.d.ts","sourceRoot":"","sources":["../src/BackendClient.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,cAAc,EAAE,wBAAwB,EAAE,WAAW,EAAyB,MAAM,uBAAuB,CAAC;AAEpH;;;GAGG;AACH,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAOzD;;;GAGG;AACH,cAAM,aAAa;IAcL,OAAO,CAAC,QAAQ,CAAC,SAAS;IAbtC,OAAO,CAAC,OAAO,CAAsC;IAErD,OAAO,CAAC,UAAU,CAA+B;IAEjD,OAAO,CAAC,gBAAgB,CAAS;IAEjC,0FAA0F;IAC1F,OAAO,CAAC,WAAW,CAAS;IAE5B,OAAO,CAAC,SAAS,CAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;gBAE5B,SAAS,EAAE,wBAAwB;IAEhE;;;OAGG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI;IAIvC;;OAEG;IACH,aAAa,IAAI,IAAI;IAUrB;;;;;OAKG;IACG,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC;IAmBtC;;;;;OAKG;IACH,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,IAAI;IA0BtC;;;;;OAKG;IACH,UAAU,CAAC,MAAM,UAAQ,GAAG,OAAO,CAAC,cAAc,CAAC;IAiBnD;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,wBAAwB,GAAG,OAAO;IAS1D;;;OAGG;IACH,SAAS,IAAI,OAAO;IAIpB;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IAkB3B;;;OAGG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM;IAIrD;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAiBhC;;;;;;OAMG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAkB3C;;OAEG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAMhC;;OAEG;IACH,qBAAqB,IAAI,OAAO;IAIhC;;;;;OAKG;IACG,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAuBzD;;;OAGG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,GAAG;QAC3F,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC;YAIa,WAAW;IA4BzB,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,IAAI;CAGb;AAED,eAAe,aAAa,CAAC"}
|
|
1
|
+
{"version":3,"file":"BackendClient.d.ts","sourceRoot":"","sources":["../src/BackendClient.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,cAAc,EAAE,wBAAwB,EAAE,WAAW,EAAyB,MAAM,uBAAuB,CAAC;AAEpH;;;GAGG;AACH,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAOzD;;;GAGG;AACH,cAAM,aAAa;IAcL,OAAO,CAAC,QAAQ,CAAC,SAAS;IAbtC,OAAO,CAAC,OAAO,CAAsC;IAErD,OAAO,CAAC,UAAU,CAA+B;IAEjD,OAAO,CAAC,gBAAgB,CAAS;IAEjC,0FAA0F;IAC1F,OAAO,CAAC,WAAW,CAAS;IAE5B,OAAO,CAAC,SAAS,CAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;gBAE5B,SAAS,EAAE,wBAAwB;IAEhE;;;OAGG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI;IAIvC;;OAEG;IACH,aAAa,IAAI,IAAI;IAUrB;;;;;OAKG;IACG,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC;IAmBtC;;;;;OAKG;IACH,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,IAAI;IA0BtC;;;;;OAKG;IACH,UAAU,CAAC,MAAM,UAAQ,GAAG,OAAO,CAAC,cAAc,CAAC;IAiBnD;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,wBAAwB,GAAG,OAAO;IAS1D;;;OAGG;IACH,SAAS,IAAI,OAAO;IAIpB;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IAkB3B;;;OAGG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM;IAIrD;;;;;;OAMG;IACG,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG,SAAS,CAAC;IA8BjF;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAiBhC;;;;;;OAMG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAkB3C;;OAEG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAMhC;;OAEG;IACH,qBAAqB,IAAI,OAAO;IAIhC;;;;;OAKG;IACG,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAuBzD;;;OAGG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,GAAG;QAC3F,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC;YAIa,WAAW;IA4BzB,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,IAAI;CAGb;AAED,eAAe,aAAa,CAAC"}
|
|
@@ -49,13 +49,22 @@ declare class ThunderIDBrowserClient<T = BrowserAuthConfig> extends ThunderIDJav
|
|
|
49
49
|
* - Embedded mode starts an `AUTHENTICATION` flow with `ouId`, presenting the SSO session handles kept
|
|
50
50
|
* from earlier flow steps. A flow that needs input fails with `interaction_required`; render the
|
|
51
51
|
* sign-in for the unit instead.
|
|
52
|
-
* - Backend mode sends
|
|
52
|
+
* - Backend mode sends `POST {ouSwitch}?ouId=` to the backend, which switches its session, then reads
|
|
53
|
+
* the session again, so the page stays where it is. When the backend needs the user, it sends the
|
|
54
|
+
* page to the backend's sign-in endpoint with `ouId` (unless `redirect` is `false`). The extra
|
|
55
|
+
* parameters do not apply.
|
|
53
56
|
*
|
|
54
57
|
* A failed switch leaves the previous session as it was.
|
|
55
58
|
*
|
|
56
59
|
* @throws {ThunderIDAPIError} With a code from `OrganizationUnitSwitchErrorCodes`.
|
|
57
60
|
*/
|
|
58
61
|
switchOrganizationUnit(organizationUnitId: string, options?: SwitchOrganizationUnitOptions): Promise<User | undefined>;
|
|
62
|
+
/**
|
|
63
|
+
* Backend mode: asks the backend's `ouSwitch` endpoint to switch, then reads its session again, so the
|
|
64
|
+
* page stays where it is. When the backend needs the user, the page goes to the backend's sign-in for
|
|
65
|
+
* the unit instead, unless `redirect` is off.
|
|
66
|
+
*/
|
|
67
|
+
private _switchOrganizationUnitOnBackend;
|
|
59
68
|
/**
|
|
60
69
|
* Switches back-channel by exchanging the session's device secret at the unit's token endpoint.
|
|
61
70
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ThunderIDBrowserClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDBrowserClient.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EAEzB,IAAI,EACJ,gBAAgB,EAChB,OAAO,EACP,aAAa,EAGb,OAAO,EACP,aAAa,EAGb,iBAAiB,EACjB,YAAY,EACZ,WAAW,EAoBX,6BAA6B,EAG9B,MAAM,uBAAuB,CAAC;AAK/B,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAC,iBAAiB,EAAC,MAAM,wBAAwB,CAAC;AAEzD,OAAO,YAAY,MAAM,uBAAuB,CAAC;AAEjD,OAAO,EAAC,sBAAsB,EAAC,MAAM,8BAA8B,CAAC;AAsDpE,cAAM,sBAAsB,CAAC,CAAC,GAAG,iBAAiB,CAAE,SAAQ,yBAAyB,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,WAAW,CAAsC;IACzD,OAAO,CAAC,QAAQ,CAA0D;IAC1E,OAAO,CAAC,gCAAgC,CAAS;IACjD,OAAO,CAAC,qBAAqB,CAAQ;IACrC,OAAO,CAAC,cAAc,CAAwC;IAC9D,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,QAAQ,CAA4B;IAC5C,OAAO,CAAC,iBAAiB,CAA2B;IACpD,OAAO,CAAC,oBAAoB,CAA8B;gBAEvC,UAAU,SAAI;IAKX,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAkGnE,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC;YAmBhC,eAAe;IAwBb,SAAS,IAAI,OAAO;IAIpC;;OAEG;IACI,aAAa,IAAI,OAAO;IAI/B,OAAO,CAAC,oBAAoB;IAUN,MAAM,CAC1B,MAAM,CAAC,EAAE,YAAY,EACrB,iBAAiB,CAAC,EAAE,MAAM,EAC1B,KAAK,CAAC,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,GACrD,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;YAkCd,eAAe;YAiFf,sBAAsB;IAmBpC;;OAEG;YACW,aAAa;IAc3B
|
|
1
|
+
{"version":3,"file":"ThunderIDBrowserClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDBrowserClient.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EAEzB,IAAI,EACJ,gBAAgB,EAChB,OAAO,EACP,aAAa,EAGb,OAAO,EACP,aAAa,EAGb,iBAAiB,EACjB,YAAY,EACZ,WAAW,EAoBX,6BAA6B,EAG9B,MAAM,uBAAuB,CAAC;AAK/B,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAC,iBAAiB,EAAC,MAAM,wBAAwB,CAAC;AAEzD,OAAO,YAAY,MAAM,uBAAuB,CAAC;AAEjD,OAAO,EAAC,sBAAsB,EAAC,MAAM,8BAA8B,CAAC;AAsDpE,cAAM,sBAAsB,CAAC,CAAC,GAAG,iBAAiB,CAAE,SAAQ,yBAAyB,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,WAAW,CAAsC;IACzD,OAAO,CAAC,QAAQ,CAA0D;IAC1E,OAAO,CAAC,gCAAgC,CAAS;IACjD,OAAO,CAAC,qBAAqB,CAAQ;IACrC,OAAO,CAAC,cAAc,CAAwC;IAC9D,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,QAAQ,CAA4B;IAC5C,OAAO,CAAC,iBAAiB,CAA2B;IACpD,OAAO,CAAC,oBAAoB,CAA8B;gBAEvC,UAAU,SAAI;IAKX,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAkGnE,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC;YAmBhC,eAAe;IAwBb,SAAS,IAAI,OAAO;IAIpC;;OAEG;IACI,aAAa,IAAI,OAAO;IAI/B,OAAO,CAAC,oBAAoB;IAUN,MAAM,CAC1B,MAAM,CAAC,EAAE,YAAY,EACrB,iBAAiB,CAAC,EAAE,MAAM,EAC1B,KAAK,CAAC,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,GACrD,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;YAkCd,eAAe;YAiFf,sBAAsB;IAmBpC;;OAEG;YACW,aAAa;IAc3B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACmB,sBAAsB,CAC1C,kBAAkB,EAAE,MAAM,EAC1B,OAAO,GAAE,6BAAkC,GAC1C,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAmF5B;;;;OAIG;YACW,gCAAgC;IAiC9C;;;;;OAKG;YACW,uCAAuC;IAgCrD;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,cAAc;IA4B7B;;;OAGG;YACW,+BAA+B;IA2D7C;;;OAGG;YACW,+BAA+B;IAwCvB,cAAc,CAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,EAC7D,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,GACrD,OAAO,CAAC,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;YAoBxB,uBAAuB;IAef,OAAO,CAC3B,QAAQ,CAAC,EAAE,GAAG,EACd,uBAAuB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,EAC1D,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GACxC,OAAO,CAAC,MAAM,CAAC;IAyFL,WAAW,CAAC,aAAa,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAsBhF,cAAc,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,SAAS,CAAC;YAsBhF,eAAe;IAgBP,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU7D;;;;;;OAMG;IACmB,cAAc,CAAC,OAAO,CAAC,EAAE;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,WAAW,CAAC;IAiBhF,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQzE;;;;;;;;;OASG;IACU,qBAAqB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAUvD;;;;;OAKG;YACW,sBAAsB;IA0Bd,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWtE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAU5C,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAMtE,SAAS,IAAI,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAMxD,aAAa,IAAI,eAAe;IAYjB,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUnE,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI;IAI3B,eAAe,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAUtC,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,aAAa,CAAC;IAwBlE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC;IAiB/D,aAAa,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IA4BvE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAM3D,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAYtC,iBAAiB,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IASjD,kBAAkB,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IASzC,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAI5F;;;;;;;;OAQG;IACU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiD7G,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,cAAc,CAEpB;IAEF,OAAO,CAAC,eAAe,CAErB;IAEF,OAAO,CAAC,sCAAsC;YAMhC,yBAAyB;IA8BvB,aAAa,IAAI,MAAM;WAInB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;CAGlD;AAED,eAAe,sBAAsB,CAAC"}
|
package/dist/cjs/index.cjs
CHANGED
|
@@ -172,6 +172,30 @@ var BackendClient = class BackendClient {
|
|
|
172
172
|
}).toString()}`;
|
|
173
173
|
}
|
|
174
174
|
/**
|
|
175
|
+
* Switches the session to the organization unit `ouId` at the backend, without leaving the page. On
|
|
176
|
+
* success the cached session is dropped, so the next read returns the unit's; on a refusal the
|
|
177
|
+
* session stays as it was.
|
|
178
|
+
*
|
|
179
|
+
* @returns The refusal, with the backend's OAuth `error` when it sent one, or `undefined` on success.
|
|
180
|
+
*/
|
|
181
|
+
async switchOrganizationUnit(ouId) {
|
|
182
|
+
const url = `${this.endpoints.ouSwitch}?${new URLSearchParams({ ouId }).toString()}`;
|
|
183
|
+
const readError = async (response$1) => (await response$1.json().catch(() => ({}))).error;
|
|
184
|
+
let response = await this.send(url, "POST");
|
|
185
|
+
let error = response.ok ? void 0 : await readError(response);
|
|
186
|
+
if (response.status === 401 && error === "session_expired") {
|
|
187
|
+
if (!await this.refresh()) return { error: "login_required" };
|
|
188
|
+
response = await this.send(url, "POST");
|
|
189
|
+
error = response.ok ? void 0 : await readError(response);
|
|
190
|
+
}
|
|
191
|
+
if (response.ok) {
|
|
192
|
+
this.session = void 0;
|
|
193
|
+
return;
|
|
194
|
+
}
|
|
195
|
+
if (error === "login_required") this.markSignedOut();
|
|
196
|
+
return error ? { error } : {};
|
|
197
|
+
}
|
|
198
|
+
/**
|
|
175
199
|
* Ends the backend session.
|
|
176
200
|
*
|
|
177
201
|
* @returns The URL the browser visits to end the session at the authorization server.
|
|
@@ -3065,7 +3089,10 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
|
|
|
3065
3089
|
* - Embedded mode starts an `AUTHENTICATION` flow with `ouId`, presenting the SSO session handles kept
|
|
3066
3090
|
* from earlier flow steps. A flow that needs input fails with `interaction_required`; render the
|
|
3067
3091
|
* sign-in for the unit instead.
|
|
3068
|
-
* - Backend mode sends
|
|
3092
|
+
* - Backend mode sends `POST {ouSwitch}?ouId=` to the backend, which switches its session, then reads
|
|
3093
|
+
* the session again, so the page stays where it is. When the backend needs the user, it sends the
|
|
3094
|
+
* page to the backend's sign-in endpoint with `ouId` (unless `redirect` is `false`). The extra
|
|
3095
|
+
* parameters do not apply.
|
|
3069
3096
|
*
|
|
3070
3097
|
* A failed switch leaves the previous session as it was.
|
|
3071
3098
|
*
|
|
@@ -3074,11 +3101,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
|
|
|
3074
3101
|
async switchOrganizationUnit(organizationUnitId, options = {}) {
|
|
3075
3102
|
await this.isInitialized();
|
|
3076
3103
|
if (typeof organizationUnitId !== "string" || organizationUnitId.trim() === "") throw new __thunderid_javascript.ThunderIDAPIError("An organization unit identifier is required.", __thunderid_javascript.OrganizationUnitSwitchErrorCodes.InvalidOrganizationUnit, "browser", 400);
|
|
3077
|
-
if (this._backend)
|
|
3078
|
-
location.href = this._backend.getSignInUrl(`${window.location.pathname}${window.location.search}`, organizationUnitId);
|
|
3079
|
-
await SPAUtils_default.waitTillPageRedirect();
|
|
3080
|
-
return;
|
|
3081
|
-
}
|
|
3104
|
+
if (this._backend) return this._switchOrganizationUnitOnBackend(organizationUnitId, options.redirect !== false);
|
|
3082
3105
|
const { redirect = true,...params } = options;
|
|
3083
3106
|
const sm = this.getStorageManager();
|
|
3084
3107
|
const config = await sm.getConfigData();
|
|
@@ -3112,6 +3135,28 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
|
|
|
3112
3135
|
await SPAUtils_default.waitTillPageRedirect();
|
|
3113
3136
|
}
|
|
3114
3137
|
/**
|
|
3138
|
+
* Backend mode: asks the backend's `ouSwitch` endpoint to switch, then reads its session again, so the
|
|
3139
|
+
* page stays where it is. When the backend needs the user, the page goes to the backend's sign-in for
|
|
3140
|
+
* the unit instead, unless `redirect` is off.
|
|
3141
|
+
*/
|
|
3142
|
+
async _switchOrganizationUnitOnBackend(organizationUnitId, redirect) {
|
|
3143
|
+
let refusal;
|
|
3144
|
+
try {
|
|
3145
|
+
refusal = await this._backend.switchOrganizationUnit(organizationUnitId);
|
|
3146
|
+
} catch (error) {
|
|
3147
|
+
throw ThunderIDBrowserClient._toSwitchError(void 0, error);
|
|
3148
|
+
}
|
|
3149
|
+
if (refusal) {
|
|
3150
|
+
if (!redirect || !refusal.error || !INTERACTION_ERRORS.includes(refusal.error)) throw ThunderIDBrowserClient._toSwitchError(refusal.error);
|
|
3151
|
+
location.href = this._backend.getSignInUrl(`${window.location.pathname}${window.location.search}`, organizationUnitId);
|
|
3152
|
+
await SPAUtils_default.waitTillPageRedirect();
|
|
3153
|
+
return;
|
|
3154
|
+
}
|
|
3155
|
+
const user = await this.getUser();
|
|
3156
|
+
this._emitHook(Hooks_default.SignIn, user);
|
|
3157
|
+
return user;
|
|
3158
|
+
}
|
|
3159
|
+
/**
|
|
3115
3160
|
* Switches back-channel by exchanging the session's device secret at the unit's token endpoint.
|
|
3116
3161
|
*
|
|
3117
3162
|
* @returns The user, `false` when the server needs the user, or `undefined` when the session holds no
|