@cortezaproject/corteza-vue 2021.9.7 → 2021.9.8

package/dist/components/c3/C3.d.ts

@@ -0,0 +1,5 @@
+declare namespace _default {
+    export { itemPicker };
+}
+export default _default;
+import * as itemPicker from "../itemPicker/C3";

package/dist/components/input/CInputDateTime/lib/index.d.ts

@@ -1,4 +1,4 @@
-export declare function getDate(value: string): string | undefined;
-export declare function getTime(value: string): string | undefined;
-export declare function setDate(date: string, value: string, noDate?: boolean, noTime?: boolean): string | undefined;
-export declare function setTime(time: string, value: string, noDate?: boolean, noTime?: boolean): string | undefined;
+export declare function getDate(value: string | undefined): string | undefined;
+export declare function getTime(value: string | undefined): string | undefined;
+export declare function setDate(date: string | undefined, value: string | undefined, noDate?: boolean, noTime?: boolean): string | undefined;
+export declare function setTime(time: string | undefined, value: string | undefined, noDate?: boolean, noTime?: boolean): string | undefined;

package/dist/components/itemPicker/C3.d.ts

@@ -0,0 +1 @@
+export { default as CItemPicker } from "./CItemPicker.c3";

package/dist/components/itemPicker/CItemPicker.c3.d.ts

@@ -0,0 +1,32 @@
+/// <reference path="../../src/vue.shims.d.ts" />
+declare namespace _default {
+    export const name: string;
+    export const group: string[];
+    export { component };
+    export { props };
+    export const controls: any[];
+}
+export default _default;
+import { default as component } from "*.vue";
+declare namespace props {
+    export const options: {
+        value: string;
+        text: string;
+    }[];
+    export const value: string[];
+    export namespace labels {
+        export const searchPlaceholder: string;
+        export const availableItems: string;
+        export const selectAllItems: string;
+        export const selectedItems: string;
+        export const systemItem: string;
+        export const unselectAllItems: string;
+        export const noItemsFound: string;
+    }
+    export const hideFilter: boolean;
+    export const hideIcons: boolean;
+    export const disabled: boolean;
+    export const disabledFilter: boolean;
+    export const disabledSorting: boolean;
+    export const disabledDragging: boolean;
+}

package/dist/components/itemPicker/index.d.ts

@@ -1,2 +1,2 @@
 export { default as CItemPicker } from './CItemPicker.vue';
-export { default as CItem } from './CItem.vue';
+export { default as CItemPickerItem } from './CItemPickerItem.vue';

package/dist/components/reporter/index.d.ts

@@ -0,0 +1,4 @@
+export { default as CReportChart } from './Viewers/CReportChart.vue';
+export { default as CReportMetric } from './Viewers/CReportMetric.vue';
+export { default as CReportTable } from './Viewers/CReportTable.vue';
+export { default as CReportText } from './Viewers/CReportText.vue';

package/dist/index.es.js

@@ -1920,15 +1920,19 @@ var url = /*#__PURE__*/Object.freeze({
 const accessToken = Symbol('accessToken');
 const user = Symbol('user');
 /**
- * This is an endpoint of a oauth2 authorization-code flow + refresh token exchange
+ * This is an endpoint of an oauth2 authorization-code flow + refresh token exchange
  * for default client.
  *
- * If you are concerned about security, this is not much different than using a dedicated backend
+ * If you are concerned about security, this is not much different to using a dedicated backend
  * for this SPA that only redirects to a set of allowed URIs.
  */
 const oauth2FlowURL = '/oauth2/default-client';
 const oauth2InfoURL = '/oauth2/info';
 const oauth2Scope = 'profile api';
+const storeKeyFlowStarted = 'auth.flow-started';
+const storeKeyFinalState = 'auth.state.final';
+const storeKeyRefreshToken = 'auth.refresh-token';
+const maxStartAttempts = 5;
 class Auth {
     constructor({ app, verbose, cortezaAuthURL, callbackURL, entrypointURL, location, sessionStorage, refreshFactor }) {
         if (refreshFactor >= 1 || refreshFactor <= 0) {
@@ -1971,13 +1975,6 @@ class Auth {
             error: noop,
         };
     }
-    /**
-     * Returns prefixed key
-     * @param key
-     */
-    get refreshTokenKey() {
-        return 'auth.refresh-token';
-    }
     /**
      * Returns function that returns current access token
      */
@@ -2001,43 +1998,83 @@ class Auth {
     handle(req = new URL(this.entrypointURL)) {
         return __awaiter(this, void 0, void 0, function* () {
             this.log.info('handling authentication');
-            if (/\/auth\/callback$/.test(req.pathname)) {
+            if (this.isCallback(req.pathname)) {
                 this.log.info('handling authentication callback');
                 const params = new URLSearchParams(req.search);
                 if (params.has('error')) {
                     throw new Error(params.get('error') || 'authentication flow failed with error');
                 }
                 if (params.has('code')) {
-                    let finalLocation = null;
+                    let finalLocation = this.entrypointURL;
                     if (params.has('state')) {
                         const state = params.get('state') || '';
-                        const key = `auth.state.${state}.location`;
-                        this.log.info('state received', state);
-                        finalLocation = this.sessionStorage.getItem(key);
-                        if (!finalLocation) {
-                            throw Error('state does not match');
+                        const storeKeyStateLocation = `auth.state.${state}.location`;
+                        const tmp = this.sessionStorage.getItem(storeKeyStateLocation);
+                        if (tmp === null) {
+                            console.warn('state does not match, restarting authentication flow');
+                            this.startAuthenticationFlow();
+                            return null;
                         }
-                        if (/auth\/callback/.test(finalLocation)) {
+                        if (!this.isCallback(tmp)) {
                             // if by some coincidence we got callback URL to finalLocation
-                            // we'll silently ignore it
-                            finalLocation = null;
-                        }
-                        else {
-                            this.log.info('location before auth flow start', finalLocation);
+                            // we'll silently ignore it and redirect user back to entrypoint
+                            finalLocation = tmp;
                         }
-                        this.sessionStorage.removeItem(key);
+                        this.sessionStorage.removeItem(storeKeyStateLocation);
                     }
                     const code = params.get('code') || '';
                     this.log.info('authorization code received', code);
-                    yield this.exchangeCode(code);
-                    if (finalLocation) {
-                        this.location.assign(finalLocation);
-                    }
+                    const rsp = yield this.exchangeCode(code);
+                    this.startFinalState(finalLocation);
+                    return rsp;
                 }
             }
             return this.check();
         });
     }
+    /**
+     * Flagging session storage
+     *
+     * Challenge with sessions and browser tabs:
+     * Each browser tab & window interacts with an isolated session. When user clicks on a link to and wants to open
+     * it in a new window or a tab, or when tab is duplicated, session contents are copied!
+     *
+     * Consequences of that are that two (or more) tabs end up with the same session
+     * and the same refresh token, and we need to detect if we're dealing with refresh token in an old or new  session.
+     *
+     * With this function we start the final state and flag the session. This way we'll
+     * know, after the redirection to the final location, if this is a final stage or not and if the refresh token
+     * belongs to this session or not.
+     */
+    startFinalState(dst) {
+        this.log.info('redirecting back to final destination', dst);
+        this.sessionStorage.setItem(storeKeyFinalState, Date.now().toString());
+        this.location.assign(dst);
+    }
+    /**
+     * Called when refresh token is re-fetched.
+     *
+     * Cleanup aux items in the session store
+     */
+    completeFinalState() {
+        this.sessionStorage.removeItem(storeKeyFinalState);
+        this.sessionStorage.removeItem(storeKeyFlowStarted);
+        const stateKey = /^auth\.state\.\w+\.location$/;
+        for (let i = 0; i < this.sessionStorage.length; i++) {
+            const key = this.sessionStorage.key(i);
+            if (key !== null && stateKey.test(key)) {
+                this.sessionStorage.removeItem(key);
+            }
+        }
+    }
+    /**
+     * Are we in a final state or not?
+     *
+     * See startFinalState function for more details
+     */
+    inFinalState() {
+        return this.sessionStorage.getItem(storeKeyFinalState) !== null;
+    }
     /**
      * Checks current auth state; is access token loaded OR do we have a refresh token we can use
      *
@@ -2071,27 +2108,34 @@ class Auth {
                     this[user] = authUser;
                     return data;
                 }).catch((error) => {
-                    this.log.info('data fetch form info endpoint failed', { oauth2InfoURL, headers, error });
+                    this.log.error('data fetch form info endpoint failed', { oauth2InfoURL, headers, error });
                     // assume invalid JWT and remove it
                     this[accessToken] = undefined;
                     throw new Error('Unauthenticated');
                 });
             }
-            const refreshToken = this.sessionStorage.getItem(this.refreshTokenKey);
+            const refreshToken = this.sessionStorage.getItem(storeKeyRefreshToken);
             if (refreshToken) {
-                this.log.info('refresh token found, exchanging it for new access token');
+                this.log.debug('refresh token found', { refreshToken });
                 /**
-                 * Refresh token found in the storage,
-                 * let's use it to get new access token
+                 * Only exchange refresh token if this is the final state (see startFinalState function for more details)
+                 *
+                 * If this is a duplicated-session, an error will be thrown and authentication will be (probably)
+                 * restarted by the caller.
                  */
-                return this.exchangeRefresh(refreshToken);
+                if (this.inFinalState()) {
+                    this.log.info('refreshing token', refreshToken);
+                    /**
+                     * Refresh token found in the storage,
+                     * let's use it to get new access token
+                     */
+                    return this.exchangeRefresh(refreshToken);
+                }
             }
             throw new Error('Unauthenticated');
         });
     }
     logout() {
-        this[accessToken] = undefined;
-        this[user] = undefined;
         this.pruneStore();
         this.location.assign(Make({
             url: `${this.cortezaAuthURL}/logout`,
@@ -2106,8 +2150,9 @@ class Auth {
      */
     startAuthenticationFlow() {
         this.log.debug('starting new authentication flow');
+        this.incFlowCounter();
         const state = Math.random().toString(36).substring(2);
-        this.sessionStorage.setItem(`auth.state.${state}.location`, this.location.toString());
+        this.sessionStorage.setItem(`auth.state.${state}.location`, this.getRedirect(this.location.toString()));
         this.location.assign(Make({
             url: `${this.cortezaAuthURL}` + oauth2FlowURL,
             query: {
@@ -2118,6 +2163,38 @@ class Auth {
             },
         }));
     }
+    getRedirect(url) {
+        const u = new URL(url);
+        // In case someone started the flow on a callback route, default to the root
+        // of the webapp.
+        if (this.isCallback(u.pathname)) {
+            u.pathname = '';
+            u.search = '';
+            u.hash = '';
+        }
+        return u.toString();
+    }
+    isCallback(url) {
+        return /\/auth\/callback$/.test(url);
+    }
+    /**
+     * protects against too many tries when we try to auto-fix the "state does not match" error
+     * by restarting the aut flow.
+     */
+    incFlowCounter() {
+        const aux = this.sessionStorage.getItem(storeKeyFlowStarted);
+        if (aux === null) {
+            this.sessionStorage.setItem(storeKeyFlowStarted, '1');
+            return;
+        }
+        const count = parseInt(this.sessionStorage.getItem(storeKeyFlowStarted));
+        if (count >= maxStartAttempts) {
+            // Too many start attempts
+            this.sessionStorage.removeItem(storeKeyFlowStarted);
+            throw new Error('could not start authentication flow, too many attempts');
+        }
+        this.sessionStorage.setItem(storeKeyFlowStarted, (count + 1).toString());
+    }
     /**
      * Exchanges authorization code for access and refresh tokens
      */
@@ -2141,6 +2218,10 @@ class Auth {
      */
     exchangeRefresh(refreshToken) {
         return __awaiter(this, void 0, void 0, function* () {
+            /**
+             * Finalize
+             */
+            this.completeFinalState();
             return this.oauth2token({
                 // eslint-disable-next-line @typescript-eslint/camelcase
                 refresh_token: refreshToken || '',
@@ -2184,7 +2265,7 @@ class Auth {
                 this.startAuthenticationFlow();
             });
         }), 1000 * timeout);
-        this.sessionStorage.setItem(this.refreshTokenKey, oa2tkn.refresh_token);
+        this.sessionStorage.setItem(storeKeyRefreshToken, oa2tkn.refresh_token);
         const u = new system.User({
             userID: oa2tkn.sub,
             name: oa2tkn.name,