@thunderid/browser 1.16.0 → 1.18.0

package/dist/BackendClient.d.ts

@@ -73,6 +73,10 @@ declare class BackendClient {
      * success the cached session is dropped, so the next read returns the unit's; on a refusal the
      * session stays as it was.
      *
+     * The unit goes in the query (`ouId`) and in a JSON body (`{"ouId": …}`), so a backend can read it
+     * from either. A `401` left after the refresh means the backend has no session to switch, so it is
+     * reported as `login_required` whatever its body says.
+     *
      * @returns The refusal, with the backend's OAuth `error` when it sent one, or `undefined` on success.
      */
     switchOrganizationUnit(ouId: string): Promise<{

package/dist/BackendClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BackendClient.d.ts","sourceRoot":"","sources":["../src/BackendClient.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,cAAc,EAAE,wBAAwB,EAAE,WAAW,EAAyB,MAAM,uBAAuB,CAAC;AAEpH;;;GAGG;AACH,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAOzD;;;GAGG;AACH,cAAM,aAAa;IAcL,OAAO,CAAC,QAAQ,CAAC,SAAS;IAbtC,OAAO,CAAC,OAAO,CAAsC;IAErD,OAAO,CAAC,UAAU,CAA+B;IAEjD,OAAO,CAAC,gBAAgB,CAAS;IAEjC,0FAA0F;IAC1F,OAAO,CAAC,WAAW,CAAS;IAE5B,OAAO,CAAC,SAAS,CAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;gBAE5B,SAAS,EAAE,wBAAwB;IAEhE;;;OAGG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI;IAIvC;;OAEG;IACH,aAAa,IAAI,IAAI;IAUrB;;;;;OAKG;IACG,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC;IAmBtC;;;;;OAKG;IACH,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,IAAI;IA0BtC;;;;;OAKG;IACH,UAAU,CAAC,MAAM,UAAQ,GAAG,OAAO,CAAC,cAAc,CAAC;IAiBnD;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,wBAAwB,GAAG,OAAO;IAS1D;;;OAGG;IACH,SAAS,IAAI,OAAO;IAIpB;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IAkB3B;;;OAGG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM;IAIrD;;;;;;OAMG;IACG,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG,SAAS,CAAC;IA8BjF;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAiBhC;;;;;;OAMG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAkB3C;;OAEG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAMhC;;OAEG;IACH,qBAAqB,IAAI,OAAO;IAIhC;;;;;OAKG;IACG,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAuBzD;;;OAGG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,GAAG;QAC3F,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC;YAIa,WAAW;IA4BzB,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,IAAI;CAGb;AAED,eAAe,aAAa,CAAC"}
+{"version":3,"file":"BackendClient.d.ts","sourceRoot":"","sources":["../src/BackendClient.ts"],"names":[],"mappings":"AAGA,OAAO,EAAC,cAAc,EAAE,wBAAwB,EAAE,WAAW,EAAyB,MAAM,uBAAuB,CAAC;AAEpH;;;GAGG;AACH,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAOzD;;;GAGG;AACH,cAAM,aAAa;IAcL,OAAO,CAAC,QAAQ,CAAC,SAAS;IAbtC,OAAO,CAAC,OAAO,CAAsC;IAErD,OAAO,CAAC,UAAU,CAA+B;IAEjD,OAAO,CAAC,gBAAgB,CAAS;IAEjC,0FAA0F;IAC1F,OAAO,CAAC,WAAW,CAAS;IAE5B,OAAO,CAAC,SAAS,CAAK;IAEtB,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;gBAE5B,SAAS,EAAE,wBAAwB;IAEhE;;;OAGG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI;IAIvC;;OAEG;IACH,aAAa,IAAI,IAAI;IAUrB;;;;;OAKG;IACG,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC;IAmBtC;;;;;OAKG;IACH,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,IAAI;IA0BtC;;;;;OAKG;IACH,UAAU,CAAC,MAAM,UAAQ,GAAG,OAAO,CAAC,cAAc,CAAC;IAiBnD;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,wBAAwB,GAAG,OAAO;IAS1D;;;OAGG;IACH,SAAS,IAAI,OAAO;IAIpB;;;;OAIG;IACH,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IAkB3B;;;OAGG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM;IAIrD;;;;;;;;;;OAUG;IACG,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAC,GAAG,SAAS,CAAC;IAmCjF;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;IAiBhC;;;;;;OAMG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAkB3C;;OAEG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAMhC;;OAEG;IACH,qBAAqB,IAAI,OAAO;IAIhC;;;;;OAKG;IACG,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAuBzD;;;OAGG;IACH,MAAM,CAAC,WAAW,CAAC,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,GAAG;QAC3F,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC;YAIa,WAAW;IA4BzB,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,IAAI;CAWb;AAED,eAAe,aAAa,CAAC"}

package/dist/ThunderIDBrowserClient.d.ts

@@ -49,10 +49,10 @@ declare class ThunderIDBrowserClient<T = BrowserAuthConfig> extends ThunderIDJav
      * - Embedded mode starts an `AUTHENTICATION` flow with `ouId`, presenting the SSO session handles kept
      *   from earlier flow steps. A flow that needs input fails with `interaction_required`; render the
      *   sign-in for the unit instead.
-     * - Backend mode sends `POST {ouSwitch}?ouId=` to the backend, which switches its session, then reads
-     *   the session again, so the page stays where it is. When the backend needs the user, it sends the
-     *   page to the backend's sign-in endpoint with `ouId` (unless `redirect` is `false`). The extra
-     *   parameters do not apply.
+     * - Backend mode sends `POST {ouSwitch}?ouId=` with `{"ouId"}` as a JSON body to the backend, which
+     *   switches its session, then reads the session again, so the page stays where it is. When the
+     *   backend needs the user, or answers `401`, it sends the page to the backend's sign-in endpoint
+     *   with `ouId` (unless `redirect` is `false`). The extra parameters do not apply.
      *
      * A failed switch leaves the previous session as it was.
      *

package/dist/cjs/index.cjs

@@ -176,18 +176,24 @@ var BackendClient = class BackendClient {
 	* success the cached session is dropped, so the next read returns the unit's; on a refusal the
 	* session stays as it was.
 	*
+	* The unit goes in the query (`ouId`) and in a JSON body (`{"ouId": …}`), so a backend can read it
+	* from either. A `401` left after the refresh means the backend has no session to switch, so it is
+	* reported as `login_required` whatever its body says.
+	*
 	* @returns The refusal, with the backend's OAuth `error` when it sent one, or `undefined` on success.
 	*/
 	async switchOrganizationUnit(ouId) {
 		const url = `${this.endpoints.ouSwitch}?${new URLSearchParams({ ouId }).toString()}`;
 		const readError = async (response$1) => (await response$1.json().catch(() => ({}))).error;
-		let response = await this.send(url, "POST");
+		const body = JSON.stringify({ ouId });
+		let response = await this.send(url, "POST", body);
 		let error = response.ok ? void 0 : await readError(response);
 		if (response.status === 401 && error === "session_expired") {
 			if (!await this.refresh()) return { error: "login_required" };
-			response = await this.send(url, "POST");
+			response = await this.send(url, "POST", body);
 			error = response.ok ? void 0 : await readError(response);
 		}
+		if (response.status === 401) error = "login_required";
 		if (response.ok) {
 			this.session = void 0;
 			return;
@@ -279,11 +285,19 @@ var BackendClient = class BackendClient {
 		if (this.wasSignedIn) queueMicrotask(() => this.markSignedOut());
 		return { isSignedIn: false };
 	}
-	send(url, method) {
-		return fetch(url, {
+	send(url, method, body) {
+		if (body === void 0) return fetch(url, {
 			method,
 			...BackendClient.requestInit({ Accept: "application/json" })
 		});
+		return fetch(url, {
+			body,
+			method,
+			...BackendClient.requestInit({
+				Accept: "application/json",
+				"Content-Type": "application/json"
+			})
+		});
 	}
 };
 var BackendClient_default = BackendClient;
@@ -3089,10 +3103,10 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends __thunderid_ja
 	* - Embedded mode starts an `AUTHENTICATION` flow with `ouId`, presenting the SSO session handles kept
 	*   from earlier flow steps. A flow that needs input fails with `interaction_required`; render the
 	*   sign-in for the unit instead.
-	* - Backend mode sends `POST {ouSwitch}?ouId=` to the backend, which switches its session, then reads
-	*   the session again, so the page stays where it is. When the backend needs the user, it sends the
-	*   page to the backend's sign-in endpoint with `ouId` (unless `redirect` is `false`). The extra
-	*   parameters do not apply.
+	* - Backend mode sends `POST {ouSwitch}?ouId=` with `{"ouId"}` as a JSON body to the backend, which
+	*   switches its session, then reads the session again, so the page stays where it is. When the
+	*   backend needs the user, or answers `401`, it sends the page to the backend's sign-in endpoint
+	*   with `ouId` (unless `redirect` is `false`). The extra parameters do not apply.
 	*
 	* A failed switch leaves the previous session as it was.
 	*