@axa-fr/react-oidc 7.29.4 → 7.29.6

package/src/FetchToken.spec.tsx

@@ -0,0 +1,135 @@
+import type { Fetch } from '@axa-fr/oidc-client';
+import { renderHook } from '@testing-library/react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { useOidcFetch } from './FetchToken';
+
+const { getOrThrow, fetchWithTokens } = vi.hoisted(() => ({
+  getOrThrow: vi.fn(),
+  fetchWithTokens: vi.fn(),
+}));
+
+vi.mock('@axa-fr/oidc-client', () => ({
+  OidcClient: { getOrThrow },
+}));
+
+describe('useOidcFetch', () => {
+  const originalFetch = vi.fn<Fetch>();
+  const authenticatedFetch = vi.fn<Fetch>();
+  const response = new Response('response');
+
+  beforeEach(() => {
+    vi.resetAllMocks();
+    getOrThrow.mockReturnValue({ fetchWithTokens });
+    fetchWithTokens.mockReturnValue(authenticatedFetch);
+    authenticatedFetch.mockResolvedValue(response);
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it('looks up the default configuration only when a request is made', async () => {
+    const { result } = renderHook(() => useOidcFetch(originalFetch));
+
+    expect(getOrThrow).not.toHaveBeenCalled();
+    await expect(result.current.fetch('/resource')).resolves.toBe(response);
+    expect(getOrThrow).toHaveBeenCalledExactlyOnceWith('default');
+    expect(fetchWithTokens).toHaveBeenCalledExactlyOnceWith(originalFetch, false);
+    expect(authenticatedFetch).toHaveBeenCalledExactlyOnceWith('/resource', undefined);
+  });
+
+  it('defaults to the browser fetch implementation', async () => {
+    vi.stubGlobal('fetch', originalFetch);
+    const { result } = renderHook(() => useOidcFetch());
+
+    await result.current.fetch('/resource');
+
+    expect(fetchWithTokens).toHaveBeenCalledExactlyOnceWith(originalFetch, false);
+  });
+
+  it.each([new URL('https://example.com/resource'), new Request('https://example.com/resource')])(
+    'forwards request objects and options unchanged: %s',
+    async input => {
+      const init: RequestInit = { method: 'POST', headers: { 'X-Custom': 'value' }, body: 'body' };
+      const { result } = renderHook(() => useOidcFetch(originalFetch, 'custom', true));
+
+      await expect(result.current.fetch(input, init)).resolves.toBe(response);
+
+      expect(getOrThrow).toHaveBeenCalledWith('custom');
+      expect(fetchWithTokens).toHaveBeenCalledWith(originalFetch, true);
+      expect(authenticatedFetch.mock.calls[0][0]).toBe(input);
+      expect(authenticatedFetch.mock.calls[0][1]).toBe(init);
+    },
+  );
+
+  it('uses the current client for each request rather than caching it', async () => {
+    const nextFetchWithTokens = vi.fn().mockReturnValue(authenticatedFetch);
+    const { result } = renderHook(() => useOidcFetch(originalFetch));
+    await result.current.fetch('/first');
+
+    getOrThrow.mockReturnValue({ fetchWithTokens: nextFetchWithTokens });
+    await result.current.fetch('/second');
+
+    expect(getOrThrow).toHaveBeenCalledTimes(2);
+    expect(fetchWithTokens).toHaveBeenCalledTimes(1);
+    expect(nextFetchWithTokens).toHaveBeenCalledExactlyOnceWith(originalFetch, false);
+  });
+
+  it('keeps the callback stable when its dependencies are unchanged', () => {
+    const { result, rerender } = renderHook(() => useOidcFetch(originalFetch));
+    const callback = result.current.fetch;
+
+    rerender();
+
+    expect(result.current.fetch).toBe(callback);
+  });
+
+  it.each([
+    { fetch: vi.fn<Fetch>(), configurationName: 'default', isDpop: false },
+    { fetch: originalFetch, configurationName: 'custom', isDpop: false },
+    { fetch: originalFetch, configurationName: 'default', isDpop: true },
+  ])('updates the callback when a dependency changes: %s', async nextProps => {
+    const { result, rerender } = renderHook(
+      ({ fetch, configurationName, isDpop }) => useOidcFetch(fetch, configurationName, isDpop),
+      { initialProps: { fetch: originalFetch, configurationName: 'default', isDpop: false } },
+    );
+    const callback = result.current.fetch;
+
+    rerender(nextProps);
+    expect(result.current.fetch).not.toBe(callback);
+    await result.current.fetch('/resource');
+
+    expect(getOrThrow).toHaveBeenCalledWith(nextProps.configurationName);
+    expect(fetchWithTokens).toHaveBeenCalledWith(nextProps.fetch, nextProps.isDpop);
+  });
+
+  it('rejects the request rather than throwing synchronously when configuration is missing', async () => {
+    const error = new Error('Missing configuration');
+    getOrThrow.mockImplementation(() => {
+      throw error;
+    });
+    const { result } = renderHook(() => useOidcFetch(originalFetch));
+
+    await expect(result.current.fetch('/resource')).rejects.toBe(error);
+    expect(fetchWithTokens).not.toHaveBeenCalled();
+  });
+
+  it('preserves errors thrown while constructing the authenticated fetch', async () => {
+    const error = new Error('Cannot construct fetch');
+    fetchWithTokens.mockImplementation(() => {
+      throw error;
+    });
+    const { result } = renderHook(() => useOidcFetch(originalFetch));
+
+    await expect(result.current.fetch('/resource')).rejects.toBe(error);
+  });
+
+  it('preserves rejected fetch errors', async () => {
+    const error = new Error('Network failure');
+    authenticatedFetch.mockRejectedValue(error);
+    const { result } = renderHook(() => useOidcFetch(originalFetch));
+
+    await expect(result.current.fetch('/resource')).rejects.toBe(error);
+  });
+});

package/src/FetchToken.tsx

@@ -7,18 +7,6 @@ export interface ComponentWithOidcFetchProps {
 
 const defaultConfigurationName = 'default';
 
-const fetchWithToken =
-  (
-    fetch: Fetch,
-    getOidcWithConfigurationName: () => OidcClient | null,
-    demonstratingProofOfPossession: boolean = false,
-  ) =>
-  async (...params: Parameters<Fetch>) => {
-    const oidc = getOidcWithConfigurationName();
-    const newFetch = oidc.fetchWithTokens(fetch, demonstratingProofOfPossession);
-    return await newFetch(...params);
-  };
-
 export const withOidcFetch =
   (
     fetch: Fetch = null,
@@ -46,14 +34,13 @@ export const useOidcFetch = (
   const getOidc = OidcClient.getOrThrow;
 
   const memoizedFetchCallback = useCallback(
-    (input: RequestInfo | URL, init?: RequestInit) => {
-      const getOidcWithConfigurationName = () => getOidc(configurationName);
-      const newFetch = fetchWithToken(
+    async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+      const oidc = getOidc(configurationName);
+      const authenticatedFetch = oidc.fetchWithTokens(
         previousFetch,
-        getOidcWithConfigurationName,
         demonstratingProofOfPossession,
       );
-      return newFetch(input, init);
+      return await authenticatedFetch(input, init);
     },
     [previousFetch, configurationName, demonstratingProofOfPossession],
   );

package/src/OidcSecure.spec.tsx

@@ -0,0 +1,84 @@
+import { render, screen } from '@testing-library/react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { OidcSecure, withOidcSecure } from './OidcSecure';
+
+const { getOrThrow, loginAsync } = vi.hoisted(() => ({
+  getOrThrow: vi.fn(),
+  loginAsync: vi.fn(),
+}));
+
+vi.mock('@axa-fr/oidc-client', () => ({ OidcClient: { getOrThrow } }));
+
+describe('OidcSecure', () => {
+  beforeEach(() => {
+    vi.resetAllMocks();
+  });
+
+  it('renders children without logging in when tokens are present', () => {
+    getOrThrow.mockReturnValue({ tokens: {}, loginAsync });
+
+    render(<OidcSecure>Protected content</OidcSecure>);
+
+    expect(screen.getByText('Protected content')).toBeDefined();
+    expect(getOrThrow).toHaveBeenCalledWith('default');
+    expect(loginAsync).not.toHaveBeenCalled();
+  });
+
+  it('hides children and starts login with the supplied configuration and arguments', () => {
+    getOrThrow.mockReturnValue({ tokens: null, loginAsync });
+    const extras = { prompt: 'login' };
+
+    render(
+      <OidcSecure configurationName="custom" callbackPath="/private" extras={extras}>
+        Protected content
+      </OidcSecure>,
+    );
+
+    expect(screen.queryByText('Protected content')).toBeNull();
+    expect(getOrThrow).toHaveBeenCalledWith('custom');
+    expect(loginAsync).toHaveBeenCalledExactlyOnceWith('/private', extras);
+  });
+
+  it('does not restart login while logout is in progress', () => {
+    getOrThrow.mockReturnValue({ tokens: null, isLoggingOut: true, loginAsync });
+
+    render(<OidcSecure>Protected content</OidcSecure>);
+
+    expect(screen.queryByText('Protected content')).toBeNull();
+    expect(loginAsync).not.toHaveBeenCalled();
+  });
+
+  it('does not repeat login on an unchanged render', () => {
+    getOrThrow.mockReturnValue({ tokens: null, loginAsync });
+    const { rerender } = render(<OidcSecure>Protected content</OidcSecure>);
+
+    rerender(<OidcSecure>Protected content</OidcSecure>);
+
+    expect(loginAsync).toHaveBeenCalledExactlyOnceWith(null, null);
+  });
+
+  it('preserves the fail-fast behavior for a missing configuration', () => {
+    const error = new Error('Missing configuration');
+    getOrThrow.mockImplementation(() => {
+      throw error;
+    });
+
+    expect(() => render(<OidcSecure>Protected content</OidcSecure>)).toThrow(error);
+  });
+
+  it('passes props through the higher-order component', () => {
+    getOrThrow.mockReturnValue({ tokens: {}, loginAsync });
+    const Component = withOidcSecure(
+      ({ children }) => <span>{children}</span>,
+      '/callback',
+      null,
+      'custom',
+    );
+
+    render(<Component>Wrapped content</Component>);
+
+    expect(screen.getByText('Wrapped content')).toBeDefined();
+    expect(getOrThrow).toHaveBeenCalledWith('custom');
+  });
+});

package/src/ReactOidc.spec.tsx

@@ -0,0 +1,222 @@
+import type { Tokens } from '@axa-fr/oidc-client';
+import { act, renderHook } from '@testing-library/react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { useOidc, useOidcAccessToken, useOidcIdToken } from './ReactOidc';
+
+const { get, subscribeEvents, removeEventSubscription, generateProof } = vi.hoisted(() => ({
+  get: vi.fn(),
+  subscribeEvents: vi.fn<(listener: (name: string) => void) => string>(),
+  removeEventSubscription: vi.fn(),
+  generateProof: vi.fn(),
+}));
+
+vi.mock('@axa-fr/oidc-client', () => ({
+  OidcClient: {
+    get,
+    eventNames: {
+      token_renewed: 'token_renewed',
+      token_acquired: 'token_acquired',
+      logout_from_another_tab: 'logout_from_another_tab',
+      logout_from_same_tab: 'logout_from_same_tab',
+      refreshTokensAsync_error: 'refreshTokensAsync_error',
+      syncTokensAsync_error: 'syncTokensAsync_error',
+    },
+  },
+}));
+
+const initialTokens = {
+  accessToken: 'access-example',
+  accessTokenPayload: { sub: 'user' },
+  idToken: 'id-example',
+  idTokenPayload: { sub: 'user' },
+};
+
+const client = {
+  tokens: null as Pick<
+    Tokens,
+    'accessToken' | 'accessTokenPayload' | 'idToken' | 'idTokenPayload'
+  > | null,
+  configuration: { demonstrating_proof_of_possession: false },
+  subscribeEvents,
+  removeEventSubscription,
+  generateDemonstrationOfProofOfPossessionAsync: generateProof,
+  loginAsync: vi.fn(),
+  logoutAsync: vi.fn(),
+  renewTokensAsync: vi.fn(),
+};
+
+beforeEach(() => {
+  vi.resetAllMocks();
+  client.tokens = { ...initialTokens };
+  client.configuration.demonstrating_proof_of_possession = false;
+  get.mockReturnValue(client);
+  subscribeEvents.mockReturnValue('subscription');
+});
+
+describe.each([
+  {
+    name: 'access token',
+    useToken: useOidcAccessToken,
+    initial: {
+      accessToken: initialTokens.accessToken,
+      accessTokenPayload: initialTokens.accessTokenPayload,
+      generateDemonstrationOfProofOfPossessionAsync: null,
+    },
+    empty: { accessToken: null, accessTokenPayload: null },
+  },
+  {
+    name: 'ID token',
+    useToken: useOidcIdToken,
+    initial: {
+      idToken: initialTokens.idToken,
+      idTokenPayload: initialTokens.idTokenPayload,
+    },
+    empty: { idToken: null, idTokenPayload: null },
+  },
+])('$name hook', ({ useToken, initial, empty }) => {
+  it('initializes from the configured client', () => {
+    const { result } = renderHook(() => useToken('custom'));
+
+    expect(result.current).toEqual(initial);
+    expect(get).toHaveBeenCalledWith('custom');
+  });
+
+  it('uses the empty state when the client has no tokens', () => {
+    client.tokens = null;
+    const { result } = renderHook(() => useToken());
+
+    expect(result.current).toEqual(empty);
+  });
+
+  it.each([
+    'token_renewed',
+    'token_acquired',
+    'logout_from_another_tab',
+    'logout_from_same_tab',
+    'refreshTokensAsync_error',
+    'syncTokensAsync_error',
+  ])('refreshes token state on %s', eventName => {
+    const { result } = renderHook(() => useToken());
+    const listener = subscribeEvents.mock.calls[0][0];
+
+    client.tokens = null;
+    act(() => listener(eventName));
+    expect(result.current).toEqual(empty);
+
+    client.tokens = { ...initialTokens };
+    act(() => listener(eventName));
+    expect(result.current).toEqual(initial);
+  });
+
+  it('ignores unrelated events', () => {
+    const { result } = renderHook(() => useToken());
+    client.tokens = null;
+
+    act(() => subscribeEvents.mock.calls[0][0]('unrelated'));
+
+    expect(result.current).toEqual(initial);
+  });
+
+  it('cleans up subscriptions on configuration changes and unmount', () => {
+    subscribeEvents.mockReturnValueOnce('first').mockReturnValueOnce('second');
+    const { rerender, unmount } = renderHook(({ name }) => useToken(name), {
+      initialProps: { name: 'first' },
+    });
+
+    rerender({ name: 'second' });
+    expect(removeEventSubscription).toHaveBeenCalledExactlyOnceWith('first');
+    expect(subscribeEvents).toHaveBeenCalledTimes(2);
+    expect(get).toHaveBeenLastCalledWith('second');
+
+    unmount();
+    expect(removeEventSubscription.mock.calls).toEqual([['first'], ['second']]);
+  });
+});
+
+describe('access token proof generation', () => {
+  it('uses the initial access token when generating a proof', async () => {
+    client.configuration.demonstrating_proof_of_possession = true;
+    generateProof.mockResolvedValue('proof');
+    const { result } = renderHook(() => useOidcAccessToken());
+
+    await expect(
+      result.current.generateDemonstrationOfProofOfPossessionAsync(
+        'https://api.example.com',
+        'GET',
+      ),
+    ).resolves.toBe('proof');
+    expect(generateProof).toHaveBeenCalledExactlyOnceWith(
+      'access-example',
+      'https://api.example.com',
+      'GET',
+    );
+  });
+
+  it('uses refreshed tokens and forwards proof extras after a token event', async () => {
+    client.configuration.demonstrating_proof_of_possession = true;
+    const { result } = renderHook(() => useOidcAccessToken());
+    client.tokens = { ...initialTokens, accessToken: 'renewed-example' };
+    act(() => subscribeEvents.mock.calls[0][0]('token_renewed'));
+    const extras = { nonce: 'example-nonce' };
+
+    await result.current.generateDemonstrationOfProofOfPossessionAsync(
+      'https://api.example.com',
+      'POST',
+      extras,
+    );
+
+    expect(generateProof).toHaveBeenCalledExactlyOnceWith(
+      'renewed-example',
+      'https://api.example.com',
+      'POST',
+      extras,
+    );
+  });
+});
+
+describe('useOidc', () => {
+  it('tracks authentication on login and logout events', () => {
+    client.tokens = null;
+    const { result } = renderHook(() => useOidc('custom'));
+    const listener = subscribeEvents.mock.calls[0][0];
+    expect(result.current.isAuthenticated).toBe(false);
+
+    client.tokens = { ...initialTokens };
+    act(() => listener('token_acquired'));
+    expect(result.current.isAuthenticated).toBe(true);
+
+    client.tokens = null;
+    act(() => listener('logout_from_same_tab'));
+    expect(result.current.isAuthenticated).toBe(false);
+  });
+
+  it('forwards login and logout arguments and returns their promises', () => {
+    const loginPromise = Promise.resolve();
+    const logoutPromise = Promise.resolve();
+    client.loginAsync.mockReturnValue(loginPromise);
+    client.logoutAsync.mockReturnValue(logoutPromise);
+    const { result } = renderHook(() => useOidc('custom'));
+    const extras = { prompt: 'login' };
+
+    expect(result.current.login('/callback', extras, true, 'openid')).toBe(loginPromise);
+    expect(client.loginAsync).toHaveBeenCalledExactlyOnceWith(
+      '/callback',
+      extras,
+      false,
+      'openid',
+      true,
+    );
+    expect(result.current.logout('/logout', extras)).toBe(logoutPromise);
+    expect(client.logoutAsync).toHaveBeenCalledExactlyOnceWith('/logout', extras);
+  });
+
+  it('returns renewed token data without adding internal fields', async () => {
+    client.renewTokensAsync.mockResolvedValue({ ...initialTokens, internal: 'not exposed' });
+    const { result } = renderHook(() => useOidc());
+    const extras = { scope: 'openid' };
+
+    await expect(result.current.renewTokens(extras)).resolves.toEqual(initialTokens);
+    expect(client.renewTokensAsync).toHaveBeenCalledExactlyOnceWith(extras);
+  });
+});

package/src/ReactOidc.tsx

@@ -9,15 +9,19 @@ type GetOidcFn = {
   (configurationName?: string): any;
 };
 
-const defaultIsAuthenticated = (getOidc: GetOidcFn, configurationName: string) => {
-  let isAuthenticated = false;
+const defaultIsAuthenticated = (getOidc: GetOidcFn, configurationName: string): boolean => {
   const oidc = getOidc(configurationName);
-  if (oidc) {
-    isAuthenticated = oidc.tokens != null;
-  }
-  return isAuthenticated;
+  return oidc ? oidc.tokens != null : false;
 };
 
+const isTokenStateEvent = (name: string): boolean =>
+  name === OidcClient.eventNames.token_renewed ||
+  name === OidcClient.eventNames.token_acquired ||
+  name === OidcClient.eventNames.logout_from_another_tab ||
+  name === OidcClient.eventNames.logout_from_same_tab ||
+  name === OidcClient.eventNames.refreshTokensAsync_error ||
+  name === OidcClient.eventNames.syncTokensAsync_error;
+
 export const useOidc = (configurationName = defaultConfigurationName) => {
   const getOidc = OidcClient.get;
   const [isAuthenticated, setIsAuthenticated] = useState<boolean>(() =>
@@ -149,14 +153,7 @@ export const useOidcAccessToken = (configurationName = defaultConfigurationName)
     }
 
     const newSubscriptionId = oidc.subscribeEvents((name: string, data: any) => {
-      if (
-        name === OidcClient.eventNames.token_renewed ||
-        name === OidcClient.eventNames.token_acquired ||
-        name === OidcClient.eventNames.logout_from_another_tab ||
-        name === OidcClient.eventNames.logout_from_same_tab ||
-        name === OidcClient.eventNames.refreshTokensAsync_error ||
-        name === OidcClient.eventNames.syncTokensAsync_error
-      ) {
+      if (isTokenStateEvent(name)) {
         if (isMounted) {
           const tokens = oidc.tokens;
           setAccessToken(
@@ -215,14 +212,7 @@ export const useOidcIdToken = (configurationName = defaultConfigurationName) =>
     }
 
     const newSubscriptionId = oidc.subscribeEvents((name: string, data: any) => {
-      if (
-        name === OidcClient.eventNames.token_renewed ||
-        name === OidcClient.eventNames.token_acquired ||
-        name === OidcClient.eventNames.logout_from_another_tab ||
-        name === OidcClient.eventNames.logout_from_same_tab ||
-        name === OidcClient.eventNames.refreshTokensAsync_error ||
-        name === OidcClient.eventNames.syncTokensAsync_error
-      ) {
+      if (isTokenStateEvent(name)) {
         if (isMounted) {
           const tokens = oidc.tokens;
           setIDToken(

package/src/core/default-component/SilentLogin.component.spec.tsx

@@ -0,0 +1,71 @@
+import { render } from '@testing-library/react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+import SilentLogin from './SilentLogin.component';
+
+const { getOrThrow, getParseQueryStringFromLocation, loginAsync } = vi.hoisted(() => ({
+  getOrThrow: vi.fn(),
+  getParseQueryStringFromLocation: vi.fn(),
+  loginAsync: vi.fn(),
+}));
+
+vi.mock('@axa-fr/oidc-client', () => ({
+  OidcClient: { getOrThrow },
+  getParseQueryStringFromLocation,
+}));
+
+describe('silent login', () => {
+  beforeEach(() => {
+    vi.resetAllMocks();
+    getOrThrow.mockReturnValue({ tokens: null, loginAsync });
+  });
+
+  it.each([{}, { state: 'state' }, { state: 'state', scope: 'openid' }])(
+    'passes null extras when the query contains only reserved parameters: %s',
+    query => {
+      getParseQueryStringFromLocation.mockReturnValue(query);
+
+      render(<SilentLogin configurationName="custom" />);
+
+      expect(getOrThrow).toHaveBeenCalledWith('custom');
+      expect(loginAsync).toHaveBeenCalledExactlyOnceWith(null, null, true, query.scope);
+    },
+  );
+
+  it('forwards non-reserved parameters without changing the query data', () => {
+    const query = Object.freeze({
+      state: 'state',
+      scope: 'openid profile',
+      prompt: 'none',
+      login_hint: 'example',
+    });
+    getParseQueryStringFromLocation.mockReturnValue(query);
+
+    render(<SilentLogin configurationName="custom" />);
+
+    expect(loginAsync).toHaveBeenCalledExactlyOnceWith(
+      null,
+      { prompt: 'none', login_hint: 'example' },
+      true,
+      'openid profile',
+    );
+  });
+
+  it('does not start login when already authenticated', () => {
+    getParseQueryStringFromLocation.mockReturnValue({});
+    getOrThrow.mockReturnValue({ tokens: {}, loginAsync });
+
+    render(<SilentLogin configurationName="custom" />);
+
+    expect(loginAsync).not.toHaveBeenCalled();
+  });
+
+  it('only starts silent login on the initial mount', () => {
+    getParseQueryStringFromLocation.mockReturnValue({ prompt: 'none' });
+    const { rerender } = render(<SilentLogin configurationName="custom" />);
+
+    rerender(<SilentLogin configurationName="custom" />);
+
+    expect(loginAsync).toHaveBeenCalledOnce();
+  });
+});

package/src/core/default-component/SilentLogin.component.tsx

@@ -13,9 +13,7 @@ const SilentLogin: ComponentType<any> = ({ configurationName }) => {
     if (key === 'state' || key === 'scope') {
       continue;
     }
-    if (extras === null) {
-      extras = {};
-    }
+    extras ??= {};
     extras[key] = value;
   }