@controleonline/ui-common 1.2.101 → 1.2.102

package/src/tests/react/components/UserAvatar.test.js

@@ -12,6 +12,8 @@ jest.mock('react-native', () => ({
   View: props => React.createElement('View', props, props.children),
 }));
 
+jest.mock('@env', () => ({env: {API_ENTRYPOINT: 'https://api.controleonline.com', DOMAIN: 'manager.controleonline.com'}}));
+
 const UserAvatar = require('../../../react/components/UserAvatar').default;
 
 const {describe, expect, it} = global;
@@ -54,3 +56,31 @@ describe('UserAvatar', () => {
     expect(image.props.source.uri).toContain('d=404');
   });
 });
+
+
+describe('avatar credential boundary', () => {
+  it('does not authenticate an external download-shaped image on web', async () => {
+    const {Platform} = require('react-native');
+    const previousStorage = global.localStorage;
+    const previousFetch = global.fetch;
+    Platform.OS = 'web';
+    global.localStorage = {getItem: () => JSON.stringify({token: 'session-secret'})};
+    global.fetch = jest.fn();
+    let tree;
+    try {
+      await renderer.act(async () => { tree = renderer.create(React.createElement(UserAvatar, {imageUrl: 'https://images.example.test/files/1/download', useGravatar: false})); });
+      expect(global.fetch).not.toHaveBeenCalled();
+      expect(tree.root.findByType('Image').props.source.uri).toBe('https://images.example.test/files/1/download');
+    } finally {
+      if (tree) await renderer.act(async () => tree.unmount());
+      Platform.OS = 'ios'; global.localStorage = previousStorage; global.fetch = previousFetch;
+    }
+  });
+  it('removes session headers from external native avatars', async () => {
+    let tree;
+    try {
+      await renderer.act(async () => { tree = renderer.create(React.createElement(UserAvatar, {imageUrl: 'https://images.example.test/avatar.png', imageHeaders: {'API-TOKEN': 'session-secret', Accept: 'image/*'}, useGravatar: false})); });
+      expect(tree.root.findByType('Image').props.source.headers).toEqual({Accept: 'image/*'});
+    } finally { if (tree) await renderer.act(async () => tree.unmount()); }
+  });
+});

package/src/tests/react/utils/fileUrl.test.js

@@ -60,7 +60,7 @@ describe('fileUrl helpers', () => {
     });
   });
 
-  it('does not path-inject environment hosts like staging (app-community#432)', () => {
+  it('keeps the explicit environment domain on the registered download route', () => {
     const source = resolveDefaultFileSource(
       {
         id: 8444,
@@ -77,24 +77,41 @@ describe('fileUrl helpers', () => {
     );
 
     expect(source).toEqual({
-      uri: 'https://api.controleonline.com/files/8444/download',
+      uri: 'https://api.controleonline.com/staging.controleonline.com/files/8444/download',
       headers: {
         Authorization: 'Bearer token',
         'app-domain': 'staging.controleonline.com',
       },
     });
-    expect(source.uri).not.toContain('staging.controleonline.com/files');
+    expect(source.uri).toContain('staging.controleonline.com/files');
   });
 
-  it('does not path-inject when fallback DOMAIN is manager platform host', () => {
+  it('uses the configured platform domain on the registered download route', () => {
     // DOMAIN mock is manager.controleonline.com; no company → environment-like
     const source = resolveDefaultFileSource(
       {id: 9, url: '/files/9/download'},
       {headers: {Authorization: 'Bearer t'}},
     );
 
-    expect(source.uri).toBe('https://api.controleonline.com/files/9/download');
+    expect(source.uri).toBe('https://api.controleonline.com/manager.controleonline.com/files/9/download');
     expect(source.headers['app-domain']).toBe('manager.controleonline.com');
-    expect(source.uri).not.toMatch(/manager\.controleonline\.com\/files/);
+    expect(source.uri).toMatch(/manager\.controleonline\.com\/files/);
+  });
+});
+
+
+describe('file authentication origin boundary', () => {
+  it('removes ERP credentials from external images and download-shaped URLs', () => {
+    for (const uri of ['https://images.example.test/image.png', 'https://images.example.test/files/1/download', '//images.example.test/image.png']) {
+      const source = resolveDefaultFileSource(uri, {headers: {'API-TOKEN': 'session-secret', Authorization: 'Bearer session-secret', 'App-Domain': 'tenant.test', Accept: 'image/*'}});
+      expect(source.headers).not.toHaveProperty('API-TOKEN');
+      expect(source.headers).not.toHaveProperty('Authorization');
+      expect(source.headers).not.toHaveProperty('App-Domain');
+      expect(source.headers.Accept).toBe('image/*');
+    }
+  });
+  it('preserves authentication on the configured API download', () => {
+    const source = resolveDefaultFileSource(1, {headers: {'API-TOKEN': 'session-secret'}});
+    expect(source.headers['API-TOKEN']).toBe('session-secret');
   });
 });

package/src/tests/react/utils/runtimeFooter.test.js

@@ -30,17 +30,17 @@ const setLocation = value => {
   Object.defineProperty(globalThis, 'location', {
     configurable: true,
     enumerable: true,
-    writable: true,
-    value,
-  })
-}
-
-const restoreLocation = () => {
-  if (originalLocationDescriptor) {
-    Object.defineProperty(globalThis, 'location', originalLocationDescriptor)
-    return
-  }
-
+    writable: true,
+    value,
+  })
+}
+
+const restoreLocation = () => {
+  if (originalLocationDescriptor) {
+    Object.defineProperty(globalThis, 'location', originalLocationDescriptor)
+    return
+  }
+
   delete globalThis.location
 }
 
@@ -59,101 +59,101 @@ after(() => {
 
 test('prefers the persisted public ip for web runtime devices', () => {
   setLocation({hostname: '10.0.0.15'})
-
-  try {
-    assert.equal(
-      getRuntimeFooterPrimaryText({
-        device: {
-          alias: 'app',
-          appVersion: '1.3.6',
-          deviceType: 'web',
-          id: 'web-12',
-          externalIp: '198.51.100.21',
-          metadata: {
-            network: {
-              publicIp: '198.51.100.21',
-            },
-          },
-        },
-        appVersion: '1.3.6',
-        deviceConfig: {
-          device: {
-            metadata: {
-              network: {
-                publicIp: '203.0.113.42',
-              },
-            },
-          },
-          configs: {
-            'config-version': '1.3.5',
-          },
-        },
-      }),
-      'web (203.0.113.42) / v1.3.6',
-    )
-
-    const debugInfo = getRuntimeFooterDebugInfo({
-      device: {
-        alias: 'app',
-        appVersion: '1.3.6',
-        deviceType: 'web',
-        id: 'web-12',
-        externalIp: '198.51.100.21',
-        metadata: {
-          network: {
-            publicIp: '198.51.100.21',
-          },
-        },
-      },
-      appVersion: '1.3.6',
-      deviceConfig: {
-        device: {
-          metadata: {
-            network: {
-              publicIp: '203.0.113.42',
-            },
-          },
-        },
-        configs: {
-          'config-version': '1.3.5',
-        },
-      },
-    })
-
-    assert.equal(debugInfo.runtimeDetailSource, 'device_config.device.metadata.network.publicIp')
-    assert.equal(debugInfo.rawValues.storedDeviceMetadataPublicIp, '203.0.113.42')
-    assert.equal(debugInfo.rawValues.deviceMetadataPublicIp, '198.51.100.21')
-  } finally {
-    restoreLocation()
-  }
-})
-
-test('normalizes localhost to the loopback address on web', () => {
-  setLocation({hostname: 'localhost'})
-
-  try {
-    assert.equal(getRuntimeFooterWebHost(), '127.0.0.1')
-  } finally {
-    restoreLocation()
-  }
-})
-
+
+  try {
+    assert.equal(
+      getRuntimeFooterPrimaryText({
+        device: {
+          alias: 'app',
+          appVersion: '1.3.6',
+          deviceType: 'web',
+          id: 'web-12',
+          externalIp: '198.51.100.21',
+          metadata: {
+            network: {
+              publicIp: '198.51.100.21',
+            },
+          },
+        },
+        appVersion: '1.3.6',
+        deviceConfig: {
+          device: {
+            metadata: {
+              network: {
+                publicIp: '203.0.113.42',
+              },
+            },
+          },
+          configs: {
+            'config-version': '1.3.5',
+          },
+        },
+      }),
+      'web (203.0.113.42) / v1.3.6',
+    )
+
+    const debugInfo = getRuntimeFooterDebugInfo({
+      device: {
+        alias: 'app',
+        appVersion: '1.3.6',
+        deviceType: 'web',
+        id: 'web-12',
+        externalIp: '198.51.100.21',
+        metadata: {
+          network: {
+            publicIp: '198.51.100.21',
+          },
+        },
+      },
+      appVersion: '1.3.6',
+      deviceConfig: {
+        device: {
+          metadata: {
+            network: {
+              publicIp: '203.0.113.42',
+            },
+          },
+        },
+        configs: {
+          'config-version': '1.3.5',
+        },
+      },
+    })
+
+    assert.equal(debugInfo.runtimeDetailSource, 'device_config.device.metadata.network.publicIp')
+    assert.equal(debugInfo.rawValues.storedDeviceMetadataPublicIp, '203.0.113.42')
+    assert.equal(debugInfo.rawValues.deviceMetadataPublicIp, '198.51.100.21')
+  } finally {
+    restoreLocation()
+  }
+})
+
+test('normalizes localhost to the loopback address on web', () => {
+  setLocation({hostname: 'localhost'})
+
+  try {
+    assert.equal(getRuntimeFooterWebHost(), '127.0.0.1')
+  } finally {
+    restoreLocation()
+  }
+})
+
 test('falls back to the browser hostname for web when no persisted public ip exists', () => {
   setLocation({hostname: 'localhost'})
-
-  try {
-    const candidates = getRuntimeFooterWebIdentifierCandidates({
-      device: {
-        deviceType: 'web',
-        id: 'web-12',
-      },
-      deviceConfig: {},
-    })
-
-    assert.equal(candidates[0]?.value, '127.0.0.1')
-    assert.equal(candidates[0]?.source, 'location.hostname')
-  } finally {
-    restoreLocation()
+
+  try {
+    const candidates = getRuntimeFooterWebIdentifierCandidates({
+      device: {
+        deviceType: 'web',
+        id: 'web-12',
+      },
+      deviceConfig: {},
+    })
+
+    assert.equal(candidates[0]?.value, '127.0.0.1')
+    assert.equal(candidates[0]?.source, 'location.hostname')
+  } finally {
+    restoreLocation()
   }
 })
 
@@ -191,91 +191,91 @@ test('recognizes backend web devices by their persisted runtime metadata or devi
 
 test('reads the persisted config-version for non-web runtimes', () => {
   assert.equal(
-    getRuntimeFooterStoredVersion({
-      configs: JSON.stringify({
-        'config-version': '1.3.5',
-      }),
-    }),
-    'v1.3.5',
-  )
-
-  assert.equal(
-    getRuntimeFooterPrimaryText({
-      device: {
-        alias: 'PDV',
-        appVersion: '1.3.7',
-        deviceType: 'android',
-        id: 'native-12',
-      },
-      appVersion: '1.3.6',
-      deviceConfig: {
-        device: {
-          device: '229252771069b294',
-        },
-        configs: {
-          'config-version': '1.3.5',
-        },
-      },
-    }),
-    'PDV (229252771069b294) / v1.3.7',
-  )
-})
-
+    getRuntimeFooterStoredVersion({
+      configs: JSON.stringify({
+        'config-version': '1.3.5',
+      }),
+    }),
+    'v1.3.5',
+  )
+
+  assert.equal(
+    getRuntimeFooterPrimaryText({
+      device: {
+        alias: 'PDV',
+        appVersion: '1.3.7',
+        deviceType: 'android',
+        id: 'native-12',
+      },
+      appVersion: '1.3.6',
+      deviceConfig: {
+        device: {
+          device: '229252771069b294',
+        },
+        configs: {
+          'config-version': '1.3.5',
+        },
+      },
+    }),
+    'PDV (229252771069b294) / v1.3.7',
+  )
+})
+
 test('prefers the backend device identifier used by the devices page', () => {
   assert.equal(
     getRuntimeFooterPrimaryText({
       device: {
         alias: 'PDV',
-        appVersion: '1.3.7',
-        deviceType: 'android',
-        id: 'd41ac8afb9f178eb',
-      },
-      appVersion: '1.3.6',
-      deviceConfig: {
-        device: {
-          device: '229252771069b294',
-          metadata: {
-            app: {
-              version: '1.3.7',
-            },
-          },
-        },
-        configs: {
-          'config-version': '1.3.7',
-        },
-      },
-    }),
-    'PDV (229252771069b294) / v1.3.7',
-  )
-
-  const debugInfo = getRuntimeFooterDebugInfo({
-    device: {
-      alias: 'PDV',
-      appVersion: '1.3.7',
-      deviceType: 'android',
-      id: 'd41ac8afb9f178eb',
-    },
-    appVersion: '1.3.6',
-    deviceConfig: {
-      device: {
-        device: '229252771069b294',
-        metadata: {
-          app: {
-            version: '1.3.7',
-          },
-        },
-      },
-      configs: {
-        'config-version': '1.3.7',
-      },
-    },
-  })
-
-  assert.equal(debugInfo.versionLabel, 'v1.3.7')
-  assert.equal(debugInfo.displayName, 'PDV (229252771069b294)')
-  assert.equal(debugInfo.runtimeDetail, '229252771069b294')
-  assert.equal(debugInfo.runtimeDetailSource, 'device_config.device.device')
-  assert.equal(debugInfo.versionCandidates[0]?.source, 'device_config.device.metadata.app.version')
+        appVersion: '1.3.7',
+        deviceType: 'android',
+        id: 'd41ac8afb9f178eb',
+      },
+      appVersion: '1.3.6',
+      deviceConfig: {
+        device: {
+          device: '229252771069b294',
+          metadata: {
+            app: {
+              version: '1.3.7',
+            },
+          },
+        },
+        configs: {
+          'config-version': '1.3.7',
+        },
+      },
+    }),
+    'PDV (229252771069b294) / v1.3.7',
+  )
+
+  const debugInfo = getRuntimeFooterDebugInfo({
+    device: {
+      alias: 'PDV',
+      appVersion: '1.3.7',
+      deviceType: 'android',
+      id: 'd41ac8afb9f178eb',
+    },
+    appVersion: '1.3.6',
+    deviceConfig: {
+      device: {
+        device: '229252771069b294',
+        metadata: {
+          app: {
+            version: '1.3.7',
+          },
+        },
+      },
+      configs: {
+        'config-version': '1.3.7',
+      },
+    },
+  })
+
+  assert.equal(debugInfo.versionLabel, 'v1.3.7')
+  assert.equal(debugInfo.displayName, 'PDV (229252771069b294)')
+  assert.equal(debugInfo.runtimeDetail, '229252771069b294')
+  assert.equal(debugInfo.runtimeDetailSource, 'device_config.device.device')
+  assert.equal(debugInfo.versionCandidates[0]?.source, 'device_config.device.metadata.app.version')
   assert.equal(debugInfo.rawValues.deviceId, 'd41ac8afb9f178eb')
   assert.equal(debugInfo.rawValues.storedDeviceIdentifier, '229252771069b294')
 })
@@ -417,11 +417,11 @@ test('falls back to the local device id when the backend identifier is unavailab
   const candidates = getRuntimeFooterNativeIdentifierCandidates({
     device: {
       id: 'local-device-99',
-    },
-    deviceConfig: {
-      device: {},
-    },
-  })
+    },
+    deviceConfig: {
+      device: {},
+    },
+  })
 
   assert.equal(candidates[0]?.value, 'local-device-99')
   assert.equal(candidates[0]?.source, 'device.id')

package/src/tests/react/utils/storedSessionToken.test.js

@@ -0,0 +1,22 @@
+const assert = require('node:assert/strict');
+const {test} = require('node:test');
+const {readStoredSessionToken} = require('../../../utils/storedSessionToken');
+
+for (const prefix of ['', '__q_objt|']) {
+  for (const field of ['token', 'api_key']) {
+    test(`reads ${field} from ${prefix ? 'wrapped' : 'plain'} session`, () => {
+      const storage = {getItem: key => key === 'session' ? prefix + JSON.stringify({[field]: 'synthetic-token'}) : null};
+      assert.equal(readStoredSessionToken(storage), 'synthetic-token');
+    });
+  }
+}
+test('prefers the canonical token field when both are present', () => {
+  assert.equal(readStoredSessionToken({getItem: () => JSON.stringify({token: 'current', api_key: 'old'})}), 'current');
+});
+test('missing, malformed and inaccessible sessions have no token', () => {
+  for (const raw of [null, '', 'broken', '__q_objt|broken', '{}', 'null']) {
+    assert.equal(readStoredSessionToken({getItem: () => raw}), '');
+  }
+  assert.equal(readStoredSessionToken({getItem: () => {throw new Error('unavailable');}}), '');
+  assert.equal(readStoredSessionToken(null), '');
+});

package/src/utils/integrationConfigs.js

@@ -1,6 +1,7 @@
 export const CIELO_CONFIG_KEY = 'CIELO';
 export const NEW_RELIC_CONFIG_KEY = 'NEW_RELIC';
 export const SPOTIFY_CONFIG_KEY = 'SPOTIFY';
+export const SEM_PARAR_CONFIG_KEY = 'SEM_PARAR';
 
 export const DEFAULT_CIELO_CONFIG = {
   ACCESS_TOKEN: '',
@@ -23,6 +24,21 @@ export const DEFAULT_SPOTIFY_CONFIG = {
   CLIENT_SECRET: '',
 };
 
+/**
+ * Company-scoped Sem Parar credentials for vale-pedágio emission.
+ * ENABLED: "1" | "0"
+ * ENVIRONMENT: "sandbox" | "production"
+ */
+export const DEFAULT_SEM_PARAR_CONFIG = {
+  ENABLED: '0',
+  CLIENT_ID: '',
+  CLIENT_SECRET: '',
+  USERNAME: '',
+  PASSWORD: '',
+  ENVIRONMENT: 'sandbox',
+  CONVENIADO: '',
+};
+
 const isConfigMap = value =>
   value && typeof value === 'object' && !Array.isArray(value);
 
@@ -78,3 +94,10 @@ export const resolveSpotifyConfig = configs =>
     SPOTIFY_CONFIG_KEY,
     DEFAULT_SPOTIFY_CONFIG,
   );
+
+export const resolveSemPararConfig = configs =>
+  resolveIntegrationConfig(
+    configs,
+    SEM_PARAR_CONFIG_KEY,
+    DEFAULT_SEM_PARAR_CONFIG,
+  );

package/src/utils/storedSessionToken.js

@@ -0,0 +1,18 @@
+// Quasar LocalStorage serializes objects with this marker; plain JSON is also used.
+const OBJECT_PREFIX = '__q_objt|';
+
+const readStoredSessionToken = (storage = typeof localStorage === 'undefined' ? null : localStorage) => {
+  try {
+    const raw = storage?.getItem?.('session');
+    if (!raw) return '';
+    const json = typeof raw === 'string' && raw.startsWith(OBJECT_PREFIX)
+      ? raw.slice(OBJECT_PREFIX.length)
+      : raw;
+    const session = JSON.parse(json);
+    return session?.token || session?.api_key || '';
+  } catch {
+    return '';
+  }
+};
+
+module.exports = {readStoredSessionToken};

package/src/utils/trustedApiUrl.js

@@ -0,0 +1,19 @@
+const isTrustedApiUrl = (uri, apiEntryPoint) => {
+  try {
+    const base = new URL(String(apiEntryPoint || ''));
+    const target = new URL(String(uri || ''), `${base.href.replace(/\/$/, '')}/`);
+    const prefix = base.pathname.replace(/\/$/, '');
+    return ['http:', 'https:'].includes(base.protocol)
+      && target.origin === base.origin && !target.username && !target.password
+      && (!prefix || target.pathname === prefix || target.pathname.startsWith(`${prefix}/`));
+  } catch { return false; }
+};
+
+// ERP credentials belong only to the configured API, never an image/CDN origin.
+const filterApiHeaders = (uri, headers = {}, apiEntryPoint) => {
+  if (isTrustedApiUrl(uri, apiEntryPoint)) return {...headers};
+  return Object.fromEntries(Object.entries(headers).filter(([key]) =>
+    !/^(api[-_]?(token|key)|authorization|proxy-authorization|cookie|app-domain|device)$/i.test(key)));
+};
+
+module.exports = {isTrustedApiUrl, filterApiHeaders};