@thunderid/browser 1.16.0 → 1.18.0

package/dist/index.js

@@ -174,18 +174,24 @@ var BackendClient = class BackendClient {
 	* success the cached session is dropped, so the next read returns the unit's; on a refusal the
 	* session stays as it was.
 	*
+	* The unit goes in the query (`ouId`) and in a JSON body (`{"ouId": …}`), so a backend can read it
+	* from either. A `401` left after the refresh means the backend has no session to switch, so it is
+	* reported as `login_required` whatever its body says.
+	*
 	* @returns The refusal, with the backend's OAuth `error` when it sent one, or `undefined` on success.
 	*/
 	async switchOrganizationUnit(ouId) {
 		const url = `${this.endpoints.ouSwitch}?${new URLSearchParams({ ouId }).toString()}`;
 		const readError = async (response$1) => (await response$1.json().catch(() => ({}))).error;
-		let response = await this.send(url, "POST");
+		const body = JSON.stringify({ ouId });
+		let response = await this.send(url, "POST", body);
 		let error = response.ok ? void 0 : await readError(response);
 		if (response.status === 401 && error === "session_expired") {
 			if (!await this.refresh()) return { error: "login_required" };
-			response = await this.send(url, "POST");
+			response = await this.send(url, "POST", body);
 			error = response.ok ? void 0 : await readError(response);
 		}
+		if (response.status === 401) error = "login_required";
 		if (response.ok) {
 			this.session = void 0;
 			return;
@@ -277,11 +283,19 @@ var BackendClient = class BackendClient {
 		if (this.wasSignedIn) queueMicrotask(() => this.markSignedOut());
 		return { isSignedIn: false };
 	}
-	send(url, method) {
-		return fetch(url, {
+	send(url, method, body) {
+		if (body === void 0) return fetch(url, {
 			method,
 			...BackendClient.requestInit({ Accept: "application/json" })
 		});
+		return fetch(url, {
+			body,
+			method,
+			...BackendClient.requestInit({
+				Accept: "application/json",
+				"Content-Type": "application/json"
+			})
+		});
 	}
 };
 var BackendClient_default = BackendClient;
@@ -3087,10 +3101,10 @@ var ThunderIDBrowserClient = class ThunderIDBrowserClient extends ThunderIDJavaS
 	* - Embedded mode starts an `AUTHENTICATION` flow with `ouId`, presenting the SSO session handles kept
 	*   from earlier flow steps. A flow that needs input fails with `interaction_required`; render the
 	*   sign-in for the unit instead.
-	* - Backend mode sends `POST {ouSwitch}?ouId=` to the backend, which switches its session, then reads
-	*   the session again, so the page stays where it is. When the backend needs the user, it sends the
-	*   page to the backend's sign-in endpoint with `ouId` (unless `redirect` is `false`). The extra
-	*   parameters do not apply.
+	* - Backend mode sends `POST {ouSwitch}?ouId=` with `{"ouId"}` as a JSON body to the backend, which
+	*   switches its session, then reads the session again, so the page stays where it is. When the
+	*   backend needs the user, or answers `401`, it sends the page to the backend's sign-in endpoint
+	*   with `ouId` (unless `redirect` is `false`). The extra parameters do not apply.
 	*
 	* A failed switch leaves the previous session as it was.
 	*