@thunderid/browser 1.15.0 → 1.17.0

package/dist/BackendClient.d.ts

@@ -68,6 +68,20 @@ declare class BackendClient {
      * bounds the sign-in to that organization unit.
      */
     getSignInUrl(returnTo: string, ouId?: string): string;
+    /**
+     * Switches the session to the organization unit `ouId` at the backend, without leaving the page. On
+     * success the cached session is dropped, so the next read returns the unit's; on a refusal the
+     * session stays as it was.
+     *
+     * The unit goes in the query (`ouId`) and in a JSON body (`{"ouId": …}`), so a backend can read it
+     * from either. A `401` left after the refresh means the backend has no session to switch, so it is
+     * reported as `login_required` whatever its body says.
+     *
+     * @returns The refusal, with the backend's OAuth `error` when it sent one, or `undefined` on success.
+     */
+    switchOrganizationUnit(ouId: string): Promise<{
+        error?: string;
+    } | undefined>;
     /**
      * Ends the backend session.
      *

package/dist/BackendClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BackendClient.d.ts","sourceRoot":"","sources":["../src/BackendClient.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,cAAc,EAAE,wBAAwB,EAAE,WAAW,EAAyB,MAAM,uBAAuB,CAAC;AAEpH;;;GAGG;AACH,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAOzD;;;GAGG;AACH,cAAM,aAAa;IAcL,OAAO,CAAC,QAAQ,CAAC,SAAS;IAbtC,OAAO,CAAC,OAAO,CAAsC;IAErD,OAAO,CAAC,UAAU,CAA+B;IAEjD,OAAO,CAAC,gBAAgB,CAAS;IAEjC,0FAA0F;IAC1F,OAAO,CAAC,WAAW,CAAS;IAE5B,OAAO,CAAC,SAAS,CAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;gBAE5B,SAAS,EAAE,wBAAwB;IAEhE;;;OAGG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI;IAIvC;;OAEG;IACH,aAAa,IAAI,IAAI;IAUrB;;;;;OAKG;IACG,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC;IAmBtC;;;;;OAKG;IACH,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,IAAI;IA0BtC;;;;;OAKG;IACH,UAAU,CAAC,MAAM,UAAQ,GAAG,OAAO,CAAC,cAAc,CAAC;IAiBnD;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,wBAAwB,GAAG,OAAO;IAS1D;;;OAGG;IACH,SAAS,IAAI,OAAO;IAIpB;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IAkB3B;;;OAGG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM;IAIrD;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAiBhC;;;;;;OAMG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAkB3C;;OAEG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAMhC;;OAEG;IACH,qBAAqB,IAAI,OAAO;IAIhC;;;;;OAKG;IACG,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAuBzD;;;OAGG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,GAAG;QAC3F,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC;YAIa,WAAW;IA4BzB,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,IAAI;CAGb;AAED,eAAe,aAAa,CAAC"}
+{"version":3,"file":"BackendClient.d.ts","sourceRoot":"","sources":["../src/BackendClient.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,cAAc,EAAE,wBAAwB,EAAE,WAAW,EAAyB,MAAM,uBAAuB,CAAC;AAEpH;;;GAGG;AACH,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAOzD;;;GAGG;AACH,cAAM,aAAa;IAcL,OAAO,CAAC,QAAQ,CAAC,SAAS;IAbtC,OAAO,CAAC,OAAO,CAAsC;IAErD,OAAO,CAAC,UAAU,CAA+B;IAEjD,OAAO,CAAC,gBAAgB,CAAS;IAEjC,0FAA0F;IAC1F,OAAO,CAAC,WAAW,CAAS;IAE5B,OAAO,CAAC,SAAS,CAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;gBAE5B,SAAS,EAAE,wBAAwB;IAEhE;;;OAGG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI;IAIvC;;OAEG;IACH,aAAa,IAAI,IAAI;IAUrB;;;;;OAKG;IACG,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC;IAmBtC;;;;;OAKG;IACH,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,IAAI;IA0BtC;;;;;OAKG;IACH,UAAU,CAAC,MAAM,UAAQ,GAAG,OAAO,CAAC,cAAc,CAAC;IAiBnD;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,wBAAwB,GAAG,OAAO;IAS1D;;;OAGG;IACH,SAAS,IAAI,OAAO;IAIpB;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IAkB3B;;;OAGG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM;IAIrD;;;;;;;;;;OAUG;IACG,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG,SAAS,CAAC;IAmCjF;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAiBhC;;;;;;OAMG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAkB3C;;OAEG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAMhC;;OAEG;IACH,qBAAqB,IAAI,OAAO;IAIhC;;;;;OAKG;IACG,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAuBzD;;;OAGG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,GAAG;QAC3F,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC;YAIa,WAAW;IA4BzB,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,IAAI;CAWb;AAED,eAAe,aAAa,CAAC"}

package/dist/ThunderIDBrowserClient.d.ts

@@ -49,13 +49,22 @@ declare class ThunderIDBrowserClient<T = BrowserAuthConfig> extends ThunderIDJav
      * - Embedded mode starts an `AUTHENTICATION` flow with `ouId`, presenting the SSO session handles kept
      *   from earlier flow steps. A flow that needs input fails with `interaction_required`; render the
      *   sign-in for the unit instead.
-     * - Backend mode sends the page to the backend's sign-in endpoint with `ouId`.
+     * - Backend mode sends `POST {ouSwitch}?ouId=` with `{"ouId"}` as a JSON body to the backend, which
+     *   switches its session, then reads the session again, so the page stays where it is. When the
+     *   backend needs the user, or answers `401`, it sends the page to the backend's sign-in endpoint
+     *   with `ouId` (unless `redirect` is `false`). The extra parameters do not apply.
      *
      * A failed switch leaves the previous session as it was.
      *
      * @throws {ThunderIDAPIError} With a code from `OrganizationUnitSwitchErrorCodes`.
      */
     switchOrganizationUnit(organizationUnitId: string, options?: SwitchOrganizationUnitOptions): Promise<User | undefined>;
+    /**
+     * Backend mode: asks the backend's `ouSwitch` endpoint to switch, then reads its session again, so the
+     * page stays where it is. When the backend needs the user, the page goes to the backend's sign-in for
+     * the unit instead, unless `redirect` is off.
+     */
+    private _switchOrganizationUnitOnBackend;
     /**
      * Switches back-channel by exchanging the session's device secret at the unit's token endpoint.
      *

package/dist/ThunderIDBrowserClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDBrowserClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDBrowserClient.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EAEzB,IAAI,EACJ,gBAAgB,EAChB,OAAO,EACP,aAAa,EAGb,OAAO,EACP,aAAa,EAGb,iBAAiB,EACjB,YAAY,EACZ,WAAW,EAoBX,6BAA6B,EAG9B,MAAM,uBAAuB,CAAC;AAK/B,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAC,iBAAiB,EAAC,MAAM,wBAAwB,CAAC;AAEzD,OAAO,YAAY,MAAM,uBAAuB,CAAC;AAEjD,OAAO,EAAC,sBAAsB,EAAC,MAAM,8BAA8B,CAAC;AAsDpE,cAAM,sBAAsB,CAAC,CAAC,GAAG,iBAAiB,CAAE,SAAQ,yBAAyB,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,WAAW,CAAsC;IACzD,OAAO,CAAC,QAAQ,CAA0D;IAC1E,OAAO,CAAC,gCAAgC,CAAS;IACjD,OAAO,CAAC,qBAAqB,CAAQ;IACrC,OAAO,CAAC,cAAc,CAAwC;IAC9D,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,QAAQ,CAA4B;IAC5C,OAAO,CAAC,iBAAiB,CAA2B;IACpD,OAAO,CAAC,oBAAoB,CAA8B;gBAEvC,UAAU,SAAI;IAKX,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAkGnE,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC;YAmBhC,eAAe;IAwBb,SAAS,IAAI,OAAO;IAIpC;;OAEG;IACI,aAAa,IAAI,OAAO;IAI/B,OAAO,CAAC,oBAAoB;IAUN,MAAM,CAC1B,MAAM,CAAC,EAAE,YAAY,EACrB,iBAAiB,CAAC,EAAE,MAAM,EAC1B,KAAK,CAAC,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,GACrD,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;YAkCd,eAAe;YAiFf,sBAAsB;IAmBpC;;OAEG;YACW,aAAa;IAc3B;;;;;;;;;;;;;;;;;;OAkBG;IACmB,sBAAsB,CAC1C,kBAAkB,EAAE,MAAM,EAC1B,OAAO,GAAE,6BAAkC,GAC1C,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAyF5B;;;;;OAKG;YACW,uCAAuC;IAgCrD;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,cAAc;IA4B7B;;;OAGG;YACW,+BAA+B;IA2D7C;;;OAGG;YACW,+BAA+B;IAwCvB,cAAc,CAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,EAC7D,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,GACrD,OAAO,CAAC,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;YAoBxB,uBAAuB;IAef,OAAO,CAC3B,QAAQ,CAAC,EAAE,GAAG,EACd,uBAAuB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,EAC1D,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GACxC,OAAO,CAAC,MAAM,CAAC;IAyFL,WAAW,CAAC,aAAa,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAsBhF,cAAc,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,SAAS,CAAC;YAsBhF,eAAe;IAgBP,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU7D;;;;;;OAMG;IACmB,cAAc,CAAC,OAAO,CAAC,EAAE;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,WAAW,CAAC;IAiBhF,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQzE;;;;;;;;;OASG;IACU,qBAAqB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAUvD;;;;;OAKG;YACW,sBAAsB;IA0Bd,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWtE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAU5C,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAMtE,SAAS,IAAI,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAMxD,aAAa,IAAI,eAAe;IAYjB,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUnE,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI;IAI3B,eAAe,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAUtC,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,aAAa,CAAC;IAwBlE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC;IAiB/D,aAAa,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IA4BvE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAM3D,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAYtC,iBAAiB,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IASjD,kBAAkB,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IASzC,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAI5F;;;;;;;;OAQG;IACU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiD7G,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,cAAc,CAEpB;IAEF,OAAO,CAAC,eAAe,CAErB;IAEF,OAAO,CAAC,sCAAsC;YAMhC,yBAAyB;IA8BvB,aAAa,IAAI,MAAM;WAInB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;CAGlD;AAED,eAAe,sBAAsB,CAAC"}
+{"version":3,"file":"ThunderIDBrowserClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDBrowserClient.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EAEzB,IAAI,EACJ,gBAAgB,EAChB,OAAO,EACP,aAAa,EAGb,OAAO,EACP,aAAa,EAGb,iBAAiB,EACjB,YAAY,EACZ,WAAW,EAoBX,6BAA6B,EAG9B,MAAM,uBAAuB,CAAC;AAK/B,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAC,iBAAiB,EAAC,MAAM,wBAAwB,CAAC;AAEzD,OAAO,YAAY,MAAM,uBAAuB,CAAC;AAEjD,OAAO,EAAC,sBAAsB,EAAC,MAAM,8BAA8B,CAAC;AAsDpE,cAAM,sBAAsB,CAAC,CAAC,GAAG,iBAAiB,CAAE,SAAQ,yBAAyB,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,WAAW,CAAsC;IACzD,OAAO,CAAC,QAAQ,CAA0D;IAC1E,OAAO,CAAC,gCAAgC,CAAS;IACjD,OAAO,CAAC,qBAAqB,CAAQ;IACrC,OAAO,CAAC,cAAc,CAAwC;IAC9D,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,QAAQ,CAA4B;IAC5C,OAAO,CAAC,iBAAiB,CAA2B;IACpD,OAAO,CAAC,oBAAoB,CAA8B;gBAEvC,UAAU,SAAI;IAKX,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAkGnE,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC;YAmBhC,eAAe;IAwBb,SAAS,IAAI,OAAO;IAIpC;;OAEG;IACI,aAAa,IAAI,OAAO;IAI/B,OAAO,CAAC,oBAAoB;IAUN,MAAM,CAC1B,MAAM,CAAC,EAAE,YAAY,EACrB,iBAAiB,CAAC,EAAE,MAAM,EAC1B,KAAK,CAAC,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,GACrD,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;YAkCd,eAAe;YAiFf,sBAAsB;IAmBpC;;OAEG;YACW,aAAa;IAc3B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACmB,sBAAsB,CAC1C,kBAAkB,EAAE,MAAM,EAC1B,OAAO,GAAE,6BAAkC,GAC1C,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAmF5B;;;;OAIG;YACW,gCAAgC;IAiC9C;;;;;OAKG;YACW,uCAAuC;IAgCrD;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,cAAc;IA4B7B;;;OAGG;YACW,+BAA+B;IA2D7C;;;OAGG;YACW,+BAA+B;IAwCvB,cAAc,CAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,EAC7D,kBAAkB,CAAC,EAAE;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAC,GACrD,OAAO,CAAC,IAAI,GAAG,OAAO,GAAG,SAAS,CAAC;YAoBxB,uBAAuB;IAef,OAAO,CAC3B,QAAQ,CAAC,EAAE,GAAG,EACd,uBAAuB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC,EAC1D,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GACxC,OAAO,CAAC,MAAM,CAAC;IAyFL,WAAW,CAAC,aAAa,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAsBhF,cAAc,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,SAAS,CAAC;YAsBhF,eAAe;IAgBP,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU7D;;;;;;OAMG;IACmB,cAAc,CAAC,OAAO,CAAC,EAAE;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,WAAW,CAAC;IAiBhF,cAAc,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQzE;;;;;;;;;OASG;IACU,qBAAqB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAUvD;;;;;OAKG;YACW,sBAAsB;IA0Bd,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWtE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAU5C,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAMtE,SAAS,IAAI,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAMxD,aAAa,IAAI,eAAe;IAYjB,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAUnE,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI;IAI3B,eAAe,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAUtC,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,aAAa,CAAC;IAwBlE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC;IAiB/D,aAAa,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IA4BvE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAM3D,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAYtC,iBAAiB,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IASjD,kBAAkB,IAAI,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IASzC,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAI5F;;;;;;;;OAQG;IACU,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiD7G,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,cAAc,CAEpB;IAEF,OAAO,CAAC,eAAe,CAErB;IAEF,OAAO,CAAC,sCAAsC;YAMhC,yBAAyB;IA8BvB,aAAa,IAAI,MAAM;WAInB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;CAGlD;AAED,eAAe,sBAAsB,CAAC"}

package/dist/cjs/index.cjs

@@ -172,6 +172,36 @@ var BackendClient = class BackendClient {
 		}).toString()}`;
 	}
 	/**
+	* Switches the session to the organization unit `ouId` at the backend, without leaving the page. On
+	* success the cached session is dropped, so the next read returns the unit's; on a refusal the
+	* session stays as it was.
+	*
+	* The unit goes in the query (`ouId`) and in a JSON body (`{"ouId": …}`), so a backend can read it
+	* from either. A `401` left after the refresh means the backend has no session to switch, so it is
+	* reported as `login_required` whatever its body says.
+	*
+	* @returns The refusal, with the backend's OAuth `error` when it sent one, or `undefined` on success.
+	*/
+	async switchOrganizationUnit(ouId) {
+		const url = `${this.endpoints.ouSwitch}?${new URLSearchParams({ ouId }).toString()}`;
+		const readError = async (response$1) => (await response$1.json().catch(() => ({}))).error;
+		const body = JSON.stringify({ ouId });
+		let response = await this.send(url, "POST", body);
+		let error = response.ok ? void 0 : await readError(response);
+		if (response.status === 401 && error === "session_expired") {
+			if (!await this.refresh()) return { error: "login_required" };
+			response = await this.send(url, "POST", body);
+			error = response.ok ? void 0 : await readError(response);
+		}
+		if (response.status === 401) error = "login_required";
+		if (response.ok) {
+			this.session = void 0;
+			return;
+		}
+		if (error === "login_required") this.markSignedOut();
+		return error ? { error } : {};
+	}
+	/**
 	* Ends the backend session.
 	*
 	* @returns The URL the browser visits to end the session at the authorization server.
@@ -255,11 +285,19 @@ var BackendClient = class BackendClient {
 		if (this.wasSignedIn) queueMicrotask(() => this.markSignedOut());
 		return { isSignedIn: false };
 	}
-	send(url, method) {
-		return fetch(url, {
+	send(url, method, body) {
+		if (body === void 0) return fetch(url, {
 			method,
 			...BackendClient.requestInit({ Accept: "application/json" })
 		});
+		return fetch(url, {
+			body,
+			method,
+			...BackendClient.requestInit({
+				Accept: "application/json",
+				"Content-Type": "application/json"
+			})
+		});
 	}
 };
 var BackendClient_default = BackendClient;
@@ -3065,7 +3103,10 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 	* - Embedded mode starts an `AUTHENTICATION` flow with `ouId`, presenting the SSO session handles kept
 	*   from earlier flow steps. A flow that needs input fails with `interaction_required`; render the
 	*   sign-in for the unit instead.
-	* - Backend mode sends the page to the backend's sign-in endpoint with `ouId`.
+	* - Backend mode sends `POST {ouSwitch}?ouId=` with `{"ouId"}` as a JSON body to the backend, which
+	*   switches its session, then reads the session again, so the page stays where it is. When the
+	*   backend needs the user, or answers `401`, it sends the page to the backend's sign-in endpoint
+	*   with `ouId` (unless `redirect` is `false`). The extra parameters do not apply.
 	*
 	* A failed switch leaves the previous session as it was.
 	*
@@ -3074,11 +3115,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 	async switchOrganizationUnit(organizationUnitId, options = {}) {
 		await this.isInitialized();
 		if (typeof organizationUnitId !== "string" || organizationUnitId.trim() === "") throw new __thunderid_javascript.ThunderIDAPIError("An organization unit identifier is required.", __thunderid_javascript.OrganizationUnitSwitchErrorCodes.InvalidOrganizationUnit, "browser", 400);
-		if (this._backend) {
-			location.href = this._backend.getSignInUrl(`${window.location.pathname}${window.location.search}`, organizationUnitId);
-			await SPAUtils_default.waitTillPageRedirect();
-			return;
-		}
+		if (this._backend) return this._switchOrganizationUnitOnBackend(organizationUnitId, options.redirect !== false);
 		const { redirect = true,...params } = options;
 		const sm = this.getStorageManager();
 		const config = await sm.getConfigData();
@@ -3112,6 +3149,28 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 		await SPAUtils_default.waitTillPageRedirect();
 	}
 	/**
+	* Backend mode: asks the backend's `ouSwitch` endpoint to switch, then reads its session again, so the
+	* page stays where it is. When the backend needs the user, the page goes to the backend's sign-in for
+	* the unit instead, unless `redirect` is off.
+	*/
+	async _switchOrganizationUnitOnBackend(organizationUnitId, redirect) {
+		let refusal;
+		try {
+			refusal = await this._backend.switchOrganizationUnit(organizationUnitId);
+		} catch (error) {
+			throw ThunderIDBrowserClient._toSwitchError(void 0, error);
+		}
+		if (refusal) {
+			if (!redirect || !refusal.error || !INTERACTION_ERRORS.includes(refusal.error)) throw ThunderIDBrowserClient._toSwitchError(refusal.error);
+			location.href = this._backend.getSignInUrl(`${window.location.pathname}${window.location.search}`, organizationUnitId);
+			await SPAUtils_default.waitTillPageRedirect();
+			return;
+		}
+		const user = await this.getUser();
+		this._emitHook(Hooks_default.SignIn, user);
+		return user;
+	}
+	/**
 	* Switches back-channel by exchanging the session's device secret at the unit's token endpoint.
 	*
 	* @returns The user, `false` when the server needs the user, or `undefined` when the session holds no