@thunderid/browser 1.15.0 → 1.17.0

package/dist/index.js

@@ -170,6 +170,36 @@ var BackendClient = class BackendClient {
 		}).toString()}`;
 	}
 	/**
+	* Switches the session to the organization unit `ouId` at the backend, without leaving the page. On
+	* success the cached session is dropped, so the next read returns the unit's; on a refusal the
+	* session stays as it was.
+	*
+	* The unit goes in the query (`ouId`) and in a JSON body (`{"ouId": …}`), so a backend can read it
+	* from either. A `401` left after the refresh means the backend has no session to switch, so it is
+	* reported as `login_required` whatever its body says.
+	*
+	* @returns The refusal, with the backend's OAuth `error` when it sent one, or `undefined` on success.
+	*/
+	async switchOrganizationUnit(ouId) {
+		const url = `${this.endpoints.ouSwitch}?${new URLSearchParams({ ouId }).toString()}`;
+		const readError = async (response$1) => (await response$1.json().catch(() => ({}))).error;
+		const body = JSON.stringify({ ouId });
+		let response = await this.send(url, "POST", body);
+		let error = response.ok ? void 0 : await readError(response);
+		if (response.status === 401 && error === "session_expired") {
+			if (!await this.refresh()) return { error: "login_required" };
+			response = await this.send(url, "POST", body);
+			error = response.ok ? void 0 : await readError(response);
+		}
+		if (response.status === 401) error = "login_required";
+		if (response.ok) {
+			this.session = void 0;
+			return;
+		}
+		if (error === "login_required") this.markSignedOut();
+		return error ? { error } : {};
+	}
+	/**
 	* Ends the backend session.
 	*
 	* @returns The URL the browser visits to end the session at the authorization server.
@@ -253,11 +283,19 @@ var BackendClient = class BackendClient {
 		if (this.wasSignedIn) queueMicrotask(() => this.markSignedOut());
 		return { isSignedIn: false };
 	}
-	send(url, method) {
-		return fetch(url, {
+	send(url, method, body) {
+		if (body === void 0) return fetch(url, {
 			method,
 			...BackendClient.requestInit({ Accept: "application/json" })
 		});
+		return fetch(url, {
+			body,
+			method,
+			...BackendClient.requestInit({
+				Accept: "application/json",
+				"Content-Type": "application/json"
+			})
+		});
 	}
 };
 var BackendClient_default = BackendClient;
@@ -3063,7 +3101,10 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 	* - Embedded mode starts an `AUTHENTICATION` flow with `ouId`, presenting the SSO session handles kept
 	*   from earlier flow steps. A flow that needs input fails with `interaction_required`; render the
 	*   sign-in for the unit instead.
-	* - Backend mode sends the page to the backend's sign-in endpoint with `ouId`.
+	* - Backend mode sends `POST {ouSwitch}?ouId=` with `{"ouId"}` as a JSON body to the backend, which
+	*   switches its session, then reads the session again, so the page stays where it is. When the
+	*   backend needs the user, or answers `401`, it sends the page to the backend's sign-in endpoint
+	*   with `ouId` (unless `redirect` is `false`). The extra parameters do not apply.
 	*
 	* A failed switch leaves the previous session as it was.
 	*
@@ -3072,11 +3113,7 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 	async switchOrganizationUnit(organizationUnitId, options = {}) {
 		await this.isInitialized();
 		if (typeof organizationUnitId !== "string" || organizationUnitId.trim() === "") throw new ThunderIDAPIError("An organization unit identifier is required.", OrganizationUnitSwitchErrorCodes.InvalidOrganizationUnit, "browser", 400);
-		if (this._backend) {
-			location.href = this._backend.getSignInUrl(`${window.location.pathname}${window.location.search}`, organizationUnitId);
-			await SPAUtils_default.waitTillPageRedirect();
-			return;
-		}
+		if (this._backend) return this._switchOrganizationUnitOnBackend(organizationUnitId, options.redirect !== false);
 		const { redirect = true,...params } = options;
 		const sm = this.getStorageManager();
 		const config = await sm.getConfigData();
@@ -3110,6 +3147,28 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 		await SPAUtils_default.waitTillPageRedirect();
 	}
 	/**
+	* Backend mode: asks the backend's `ouSwitch` endpoint to switch, then reads its session again, so the
+	* page stays where it is. When the backend needs the user, the page goes to the backend's sign-in for
+	* the unit instead, unless `redirect` is off.
+	*/
+	async _switchOrganizationUnitOnBackend(organizationUnitId, redirect) {
+		let refusal;
+		try {
+			refusal = await this._backend.switchOrganizationUnit(organizationUnitId);
+		} catch (error) {
+			throw ThunderIDBrowserClient._toSwitchError(void 0, error);
+		}
+		if (refusal) {
+			if (!redirect || !refusal.error || !INTERACTION_ERRORS.includes(refusal.error)) throw ThunderIDBrowserClient._toSwitchError(refusal.error);
+			location.href = this._backend.getSignInUrl(`${window.location.pathname}${window.location.search}`, organizationUnitId);
+			await SPAUtils_default.waitTillPageRedirect();
+			return;
+		}
+		const user = await this.getUser();
+		this._emitHook(Hooks_default.SignIn, user);
+		return user;
+	}
+	/**
 	* Switches back-channel by exchanging the session's device secret at the unit's token endpoint.
 	*
 	* @returns The user, `false` when the server needs the user, or `undefined` when the session holds no