@thunderid/browser 1.14.1 → 1.16.0

package/dist/index.js

@@ -170,6 +170,30 @@ var BackendClient = class BackendClient {
 		}).toString()}`;
 	}
 	/**
+	* Switches the session to the organization unit `ouId` at the backend, without leaving the page. On
+	* success the cached session is dropped, so the next read returns the unit's; on a refusal the
+	* session stays as it was.
+	*
+	* @returns The refusal, with the backend's OAuth `error` when it sent one, or `undefined` on success.
+	*/
+	async switchOrganizationUnit(ouId) {
+		const url = `${this.endpoints.ouSwitch}?${new URLSearchParams({ ouId }).toString()}`;
+		const readError = async (response$1) => (await response$1.json().catch(() => ({}))).error;
+		let response = await this.send(url, "POST");
+		let error = response.ok ? void 0 : await readError(response);
+		if (response.status === 401 && error === "session_expired") {
+			if (!await this.refresh()) return { error: "login_required" };
+			response = await this.send(url, "POST");
+			error = response.ok ? void 0 : await readError(response);
+		}
+		if (response.ok) {
+			this.session = void 0;
+			return;
+		}
+		if (error === "login_required") this.markSignedOut();
+		return error ? { error } : {};
+	}
+	/**
 	* Ends the backend session.
 	*
 	* @returns The URL the browser visits to end the session at the authorization server.
@@ -3063,7 +3087,10 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 	* - Embedded mode starts an `AUTHENTICATION` flow with `ouId`, presenting the SSO session handles kept
 	*   from earlier flow steps. A flow that needs input fails with `interaction_required`; render the
 	*   sign-in for the unit instead.
-	* - Backend mode sends the page to the backend's sign-in endpoint with `ouId`.
+	* - Backend mode sends `POST {ouSwitch}?ouId=` to the backend, which switches its session, then reads
+	*   the session again, so the page stays where it is. When the backend needs the user, it sends the
+	*   page to the backend's sign-in endpoint with `ouId` (unless `redirect` is `false`). The extra
+	*   parameters do not apply.
 	*
 	* A failed switch leaves the previous session as it was.
 	*
@@ -3072,11 +3099,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 	async switchOrganizationUnit(organizationUnitId, options = {}) {
 		await this.isInitialized();
 		if (typeof organizationUnitId !== "string" || organizationUnitId.trim() === "") throw new ThunderIDAPIError("An organization unit identifier is required.", OrganizationUnitSwitchErrorCodes.InvalidOrganizationUnit, "browser", 400);
-		if (this._backend) {
-			location.href = this._backend.getSignInUrl(`${window.location.pathname}${window.location.search}`, organizationUnitId);
-			await SPAUtils_default.waitTillPageRedirect();
-			return;
-		}
+		if (this._backend) return this._switchOrganizationUnitOnBackend(organizationUnitId, options.redirect !== false);
 		const { redirect = true,...params } = options;
 		const sm = this.getStorageManager();
 		const config = await sm.getConfigData();
@@ -3110,6 +3133,28 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 		await SPAUtils_default.waitTillPageRedirect();
 	}
 	/**
+	* Backend mode: asks the backend's `ouSwitch` endpoint to switch, then reads its session again, so the
+	* page stays where it is. When the backend needs the user, the page goes to the backend's sign-in for
+	* the unit instead, unless `redirect` is off.
+	*/
+	async _switchOrganizationUnitOnBackend(organizationUnitId, redirect) {
+		let refusal;
+		try {
+			refusal = await this._backend.switchOrganizationUnit(organizationUnitId);
+		} catch (error) {
+			throw ThunderIDBrowserClient._toSwitchError(void 0, error);
+		}
+		if (refusal) {
+			if (!redirect || !refusal.error || !INTERACTION_ERRORS.includes(refusal.error)) throw ThunderIDBrowserClient._toSwitchError(refusal.error);
+			location.href = this._backend.getSignInUrl(`${window.location.pathname}${window.location.search}`, organizationUnitId);
+			await SPAUtils_default.waitTillPageRedirect();
+			return;
+		}
+		const user = await this.getUser();
+		this._emitHook(Hooks_default.SignIn, user);
+		return user;
+	}
+	/**
 	* Switches back-channel by exchanging the session's device secret at the unit's token endpoint.
 	*
 	* @returns The user, `false` when the server needs the user, or `undefined` when the session holds no