@cratis/arc 22.45.0 → 22.47.0

package/identity/IdentityProvider.ts

@@ -13,14 +13,31 @@ import { joinPaths } from '../joinPaths.js';
 
 /**
  * Represents an implementation of {@link IIdentityProvider}.
+ *
+ * The identity comes from the `/.cratis/me` endpoint, which derives it from the authenticated request. The
+ * result is kept in memory for the page, so repeated calls to {@link IdentityProvider.getCurrent} do not each go to
+ * the server; {@link IdentityProvider.refresh} always asks the server again.
+ *
+ * Only when the server has no `/.cratis/me` endpoint (it answers 404) does it fall back to the readable
+ * `.cratis-identity` cookie earlier versions relied on, and it warns when it does. That fallback is for the transition
+ * and will be removed.
 */
 export class IdentityProvider extends IIdentityProvider {
 
+    /**
+     * The name of the identity cookie earlier versions of Arc wrote and read.
+     * @deprecated The identity comes from the `/.cratis/me` endpoint. The cookie is only read when that endpoint does
+     * not exist, and that fallback will be removed.
+     */
     static readonly CookieName = '.cratis-identity';
     static httpHeadersCallback: GetHttpHeaders | undefined;
     static apiBasePath: string = '';
     static origin: string = '';
 
+    private static cachedResult: Promise<IdentityProviderResult | undefined> | undefined;
+    private static hasWarnedAboutLegacyCookie = false;
+    private static legacyCookie: string | undefined;
+
     /**
      * Sets the HTTP headers callback.
      * @param callback Callback to set.
@@ -34,6 +51,10 @@ export class IdentityProvider extends IIdentityProvider {
      * @param apiBasePath API base path to set.
      */
     static setApiBasePath(apiBasePath: string): void {
+        if (IdentityProvider.apiBasePath !== apiBasePath) {
+            IdentityProvider.cachedResult = undefined;
+            IdentityProvider.legacyCookie = undefined;
+        }
         IdentityProvider.apiBasePath = apiBasePath;
     }
 
@@ -42,6 +63,10 @@ export class IdentityProvider extends IIdentityProvider {
      * @param origin Origin to set.
      */
     static setOrigin(origin: string): void {
+        if (IdentityProvider.origin !== origin) {
+            IdentityProvider.cachedResult = undefined;
+            IdentityProvider.legacyCookie = undefined;
+        }
         IdentityProvider.origin = origin;
     }
 
@@ -49,27 +74,17 @@ export class IdentityProvider extends IIdentityProvider {
      * Gets the current identity by optionally specifying the details type.
      * @param type Optional constructor for the details type to enable type-safe deserialization.
      * @returns The current identity as {@link IIdentity}.
-     * @remarks The `extends object` constraint is required for compatibility with JsonSerializer.deserializeFromInstance().
+     * @remarks The identity is fetched from `/.cratis/me` the first time and kept in memory until
+     * {@link IdentityProvider.refresh} or {@link IdentityProvider.clearCache} is called. An identity that could not be
+     * resolved is not kept, so the next call asks the server again.
+     * The `extends object` constraint is required for compatibility with JsonSerializer.deserializeFromInstance().
      */
     static async getCurrent<TDetails extends object = object>(type?: Constructor<TDetails>): Promise<IIdentity<TDetails>> {
-        const cookie = this.getCookie();
-        if (cookie.length == 2) {
-            const json = atob(cookie[1]);
-            const result = JSON.parse(json) as IdentityProviderResult;
-            const details = deserializeIdentityDetails(type, result.details);
-            return {
-                id: result.id,
-                name: result.name,
-                roles: result.roles || [],
-                details: details as TDetails,
-                isSet: true,
-                isInRole: (role: string) => (result.roles || []).includes(role),
-                refresh: () => IdentityProvider.refresh(type)
-            } as IIdentity<TDetails>;
-        } else {
-            const identity = await this.refresh<TDetails>(type);
-            return identity;
+        if (!IdentityProvider.cachedResult) {
+            IdentityProvider.fetchAndCache();
         }
+        const result = await IdentityProvider.cachedResult;
+        return IdentityProvider.toIdentity(result, type);
     }
 
     /** @inheritdoc */
@@ -77,8 +92,69 @@ export class IdentityProvider extends IIdentityProvider {
         return IdentityProvider.getCurrent<TDetails>(type);
     }
 
+    /**
+     * Fetches the current identity from `/.cratis/me`, replacing what is kept in memory.
+     * @param type Optional constructor for the details type to enable type-safe deserialization.
+     * @returns The current identity as {@link IIdentity}.
+     */
     static async refresh<TDetails extends object = object>(type?: Constructor<TDetails>): Promise<IIdentity<TDetails>> {
-        IdentityProvider.clearIdentityCookie();
+        // Earlier backends resolve the cookie before consulting the current credentials. Retain it during the
+        // request for a possible 404 transition fallback, but do not send it with an explicit refresh request.
+        IdentityProvider.legacyCookie = IdentityProvider.readLegacyCookie() ?? IdentityProvider.legacyCookie;
+        IdentityProvider.cachedResult = undefined;
+        IdentityProvider.expireLegacyCookie();
+        const result = await IdentityProvider.fetchAndCache();
+        return IdentityProvider.toIdentity(result, type);
+    }
+
+    /**
+     * Forgets the identity kept in memory, so the next {@link IdentityProvider.getCurrent} asks the server again.
+     * It also expires a readable `.cratis-identity` cookie left by an earlier version. Call this when the user logs out.
+     */
+    static clearCache(): void {
+        IdentityProvider.cachedResult = undefined;
+        IdentityProvider.legacyCookie = undefined;
+        IdentityProvider.expireLegacyCookie();
+    }
+
+    /**
+     * Forgets the identity kept in memory.
+     * @deprecated Arc no longer keeps the identity in a cookie. Use {@link IdentityProvider.clearCache} instead.
+     */
+    static clearIdentityCookie(): void {
+        IdentityProvider.clearCache();
+    }
+
+    private static expireLegacyCookie(): void {
+        if (typeof document === 'undefined') return;
+        document.cookie = `${IdentityProvider.CookieName}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/`;
+    }
+
+    private static readLegacyCookie(): string | undefined {
+        if (typeof document === 'undefined') return undefined;
+        const prefix = `${IdentityProvider.CookieName}=`;
+        return document.cookie.split(';').map(_ => _.trim()).find(_ => _.startsWith(prefix));
+    }
+
+    private static fetchAndCache(): Promise<IdentityProviderResult | undefined> {
+        const pending = IdentityProvider.fetchResult();
+        IdentityProvider.cachedResult = pending;
+
+        // Only a resolved identity is worth keeping: an unset one, or a failed request, has to be asked for
+        // again - otherwise a page that loaded before sign-in would never see the user who signed in.
+        const forget = () => {
+            if (IdentityProvider.cachedResult === pending) {
+                IdentityProvider.cachedResult = undefined;
+            }
+        };
+        pending.then(result => {
+            if (!result) forget();
+        }, forget);
+
+        return pending;
+    }
+
+    private static async fetchResult(): Promise<IdentityProviderResult | undefined> {
         const origin = IdentityProvider.origin || Globals.origin || '';
         const apiBasePath = IdentityProvider.apiBasePath || Globals.apiBasePath || '';
         const route = joinPaths(apiBasePath, '/.cratis/me');
@@ -89,13 +165,53 @@ export class IdentityProvider extends IIdentityProvider {
             headers: IdentityProvider.httpHeadersCallback?.() ?? {}
         });
 
+        // No identity endpoint at all - an application that has not mapped one, or one whose identity comes from a
+        // proxy in front of it. Anything else, a 401 or 403 above all, is the server's answer and a cookie the
+        // browser holds must never overrule it.
+        if (response.status === 404) {
+            return IdentityProvider.fromLegacyCookie();
+        }
+
+        IdentityProvider.legacyCookie = undefined;
         if (!response.ok) {
+            return undefined;
+        }
+
+        return await response.json() as IdentityProviderResult;
+    }
+
+    private static fromLegacyCookie(): IdentityProviderResult | undefined {
+        if (typeof document === 'undefined') return undefined;
+        // A proxy may issue a newer cookie on the response. Prefer it over the one expired before the request.
+        const responseCookie = IdentityProvider.readLegacyCookie();
+        const cookie = responseCookie ?? IdentityProvider.legacyCookie;
+        if (!cookie) return undefined;
+        IdentityProvider.legacyCookie = cookie;
+
+        try {
+            const result = JSON.parse(atob(decodeURIComponent(cookie.substring(`${IdentityProvider.CookieName}=`.length)))) as IdentityProviderResult;
+            // The proxy may not reissue its cookie while its own authorization record remains valid. Restore the
+            // transition fallback after a 404 so it also survives a reload, without changing a response cookie.
+            if (!responseCookie) document.cookie = `${cookie};path=/;samesite=lax${location.protocol === 'https:' ? ';secure' : ''}`;
+            if (!IdentityProvider.hasWarnedAboutLegacyCookie) {
+                IdentityProvider.hasWarnedAboutLegacyCookie = true;
+                console.warn(
+                    `The server has no '/.cratis/me' endpoint, so the identity was read from the '${IdentityProvider.CookieName}' cookie. ` +
+                    'That cookie is not protected and the fallback will be removed in a future major version. ' +
+                    'Expose /.cratis/me to the frontend: https://github.com/Cratis/Arc/blob/main/Documentation/backend/csharp/identity/migrating-from-the-identity-cookie.md');
+            }
+            return result;
+        } catch {
+            return undefined;
+        }
+    }
+
+    private static toIdentity<TDetails extends object = object>(result: IdentityProviderResult | undefined, type?: Constructor<TDetails>): IIdentity<TDetails> {
+        if (!result) {
             return IdentityProvider.notSet(type);
         }
 
-        const result = await response.json() as IdentityProviderResult;
         const details = deserializeIdentityDetails(type, result.details);
-
         return {
             id: result.id,
             name: result.name,
@@ -118,26 +234,4 @@ export class IdentityProvider extends IIdentityProvider {
             refresh: () => IdentityProvider.refresh(type)
         };
     }
-
-    private static getCookie() {
-        if (typeof document === 'undefined') return [];
-        const decoded = decodeURIComponent(document.cookie);
-        const cookies = decoded.split(';').map(_ => _.trim());
-        const cookie = cookies.find(_ => _.indexOf(`${IdentityProvider.CookieName}=`) == 0);
-        if (cookie) {
-            const keyValue = cookie.split('=');
-            return [keyValue[0].trim(), keyValue[1].trim()];
-        }
-        return [];
-    }
-
-    /**
-     * Clears the identity cookie used by Arc to cache the current identity.
-     * Call this when the user logs out to ensure subsequent requests and WebSocket
-     * connections do not carry stale credentials.
-     */
-    static clearIdentityCookie(): void {
-        if (typeof document === 'undefined') return;
-        document.cookie = `${IdentityProvider.CookieName}=;expires=Thu, 01 Jan 1970 00:00:00 GMT`;
-    }
 }

package/identity/deserializeIdentityDetails.ts

@@ -33,8 +33,7 @@ function isPrimitiveDetailsType(type: Constructor): boolean {
  * would otherwise crash or silently destroy the payload.
  * @param {Constructor | undefined} type The details type to deserialize into, or `undefined` to leave
  * the payload untouched.
- * @param {unknown} details The raw details payload - parsed JSON from the identity cookie or the
- * `/.cratis/me` endpoint.
+ * @param {unknown} details The raw details payload - parsed JSON from the `/.cratis/me` endpoint.
  * @returns {unknown} The deserialized instance, or `details` unchanged when deserializing it would be
  * unsafe, pointless, or has already been done.
  * @remarks

package/identity/for_IdentityProvider/given/a_browser_with_a_legacy_identity.ts

@@ -0,0 +1,46 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { JSDOM } from 'jsdom';
+import { an_identity_provider } from './an_identity_provider.js';
+import { IdentityProvider } from '../../IdentityProvider.js';
+
+export class a_browser_with_a_legacy_identity extends an_identity_provider {
+    private browser!: JSDOM;
+    private originalDocument!: Document;
+    private originalLocation: Location | undefined;
+    protected browserUrl = 'http://localhost/nested/page';
+
+    get cookieJar() {
+        return this.browser.cookieJar;
+    }
+
+    constructor() {
+        super();
+        beforeEach(() => {
+            this.originalDocument = document;
+            this.originalLocation = global.location;
+            this.browser = new JSDOM('', { url: this.browserUrl });
+            global.document = this.browser.window.document;
+            global.location = this.browser.window.location;
+            document.cookie = `.cratis-identity=${btoa(JSON.stringify({ id: 'user-123', name: 'Original User', roles: ['Reader'], details: {} }))};path=/;samesite=lax${location.protocol === 'https:' ? ';secure' : ''}`;
+            this.fetchStub.resolves({ ok: false, status: 404 } as Response);
+        });
+        afterEach(() => {
+            IdentityProvider.clearCache();
+            this.browser.window.close();
+            global.document = this.originalDocument;
+            if (this.originalLocation) global.location = this.originalLocation;
+            else delete (global as { location?: Location }).location;
+        });
+    }
+
+    reload(): void {
+        const cookieJar = this.browser.cookieJar;
+        const url = this.browser.window.location.href;
+        this.browser.window.close();
+        this.browser = new JSDOM('', { url, cookieJar });
+        global.document = this.browser.window.document;
+        global.location = this.browser.window.location;
+    }
+}

package/identity/for_IdentityProvider/given/a_cookie_first_backend.ts

@@ -0,0 +1,25 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { an_identity_provider } from './an_identity_provider.js';
+import { IdentityProviderResult } from '../../IdentityProviderResult.js';
+
+export class a_cookie_first_backend extends an_identity_provider {
+    currentIdentity: IdentityProviderResult | undefined;
+
+    constructor() {
+        super();
+        beforeEach(() => {
+            this.currentIdentity = { id: 'user-123', name: 'Original User', roles: ['Reader'], details: { department: 'Original' } };
+            document.cookie = `.cratis-identity=${btoa(JSON.stringify(this.currentIdentity))}`;
+            this.fetchStub.callsFake(async () => {
+                // Earlier backends return the readable cookie before checking credentials or recomputing details.
+                const encodedCookie = document.cookie.split(';').map(_ => _.trim()).find(_ => _.startsWith('.cratis-identity='))?.substring('.cratis-identity='.length);
+                const identity = encodedCookie ? JSON.parse(atob(encodedCookie)) : this.currentIdentity;
+                return identity
+                    ? { ok: true, status: 200, json: async () => identity } as Response
+                    : { ok: false, status: 401 } as Response;
+            });
+        });
+    }
+}

package/identity/for_IdentityProvider/given/a_secure_browser_with_a_legacy_identity.ts

@@ -0,0 +1,8 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { a_browser_with_a_legacy_identity } from './a_browser_with_a_legacy_identity.js';
+
+export class a_secure_browser_with_a_legacy_identity extends a_browser_with_a_legacy_identity {
+    protected browserUrl = 'https://identity.example/nested/page';
+}

package/identity/for_IdentityProvider/given/an_identity_provider.ts

@@ -27,5 +27,24 @@ export class an_identity_provider {
         
         this.fetchHelper = createFetchHelper();
         this.fetchStub = this.fetchHelper.stubFetch();
+
+        // The context is created once per suite, but every spec has to start from a page that has not asked
+        // for the identity yet.
+        beforeEach(() => {
+            (global as { document?: { cookie: string } }).document!.cookie = '';
+            IdentityProvider.clearCache();
+            this.fetchStub.resetHistory();
+        });
+    }
+
+    /**
+     * Answers every request to `/.cratis/me` with the given identity.
+     * @param identity The identity the server reports.
+     */
+    serverReports(identity: object) {
+        this.fetchStub.resolves({
+            ok: true,
+            json: async () => identity
+        } as Response);
     }
 }

package/identity/for_IdentityProvider/when_clearing_cache/after_a_legacy_refresh.ts

@@ -0,0 +1,21 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { IdentityProvider } from '../../IdentityProvider.js';
+import { IIdentity } from '../../IIdentity.js';
+import { a_browser_with_a_legacy_identity } from '../given/a_browser_with_a_legacy_identity.js';
+import { given } from '../../../given.js';
+
+describe('when clearing cache after a legacy refresh', given(a_browser_with_a_legacy_identity, context => {
+    let identity: IIdentity;
+
+    beforeEach(async () => {
+        await IdentityProvider.refresh();
+        IdentityProvider.clearCache();
+        identity = await IdentityProvider.getCurrent();
+    });
+
+    it('should ask the server again', () => context.fetchStub.calledTwice.should.be.true);
+    it('should discard the retained transition identity', () => identity.isSet.should.be.false);
+    it('should leave the legacy cookie expired', () => document.cookie.should.equal(''));
+}));

package/identity/for_IdentityProvider/when_clearing_cache.ts

@@ -0,0 +1,24 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { IdentityProvider } from '../IdentityProvider.js';
+import { IIdentity } from '../IIdentity.js';
+import { an_identity_provider } from './given/an_identity_provider.js';
+import { given } from '../../given.js';
+
+describe('when clearing cache', given(an_identity_provider, context => {
+    let identity: IIdentity;
+
+    beforeEach(async () => {
+        context.serverReports({ id: 'user-123', name: 'Test User', roles: [], details: {} });
+        await IdentityProvider.getCurrent();
+
+        IdentityProvider.clearCache();
+        context.fetchStub.resolves({ ok: false, status: 401 } as Response);
+        identity = await IdentityProvider.getCurrent();
+    });
+
+    it('should ask the server again', () => context.fetchStub.calledTwice.should.be.true);
+    it('should report what the server reports now', () => identity.isSet.should.be.false);
+    it('should expire a legacy identity cookie', () => (global as { document?: { cookie: string } }).document!.cookie.should.contain('.cratis-identity=;expires=Thu, 01 Jan 1970'));
+}));

package/identity/for_IdentityProvider/when_getting_current/after_reloading_a_legacy_refresh.ts

@@ -0,0 +1,24 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { vi } from 'vitest';
+import { IdentityProvider } from '../../IdentityProvider.js';
+import { IIdentity } from '../../IIdentity.js';
+import { a_browser_with_a_legacy_identity } from '../given/a_browser_with_a_legacy_identity.js';
+import { given } from '../../../given.js';
+
+describe('when getting current after reloading a legacy refresh', given(a_browser_with_a_legacy_identity, context => {
+    let identity: IIdentity;
+
+    beforeEach(async () => {
+        await IdentityProvider.refresh();
+        context.reload();
+        vi.resetModules();
+        const { IdentityProvider: reloadedProvider } = await import('../../IdentityProvider.js');
+        identity = await reloadedProvider.getCurrent();
+    });
+
+    it('should ask the server again after the reload', () => context.fetchStub.calledTwice.should.be.true);
+    it('should preserve the transition identity across the reload', () => identity.id.should.equal('user-123'));
+    it('should preserve the transition roles across the reload', () => identity.isInRole('Reader').should.be.true);
+}));

package/identity/for_IdentityProvider/when_getting_current/after_the_server_did_not_resolve_an_identity.ts

@@ -0,0 +1,31 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { IdentityProvider } from '../../IdentityProvider.js';
+import { IIdentity } from '../../IIdentity.js';
+import { an_identity_provider } from '../given/an_identity_provider.js';
+import { given } from '../../../given.js';
+
+/**
+ * An identity the server could not resolve is not kept, so a page that loaded before the user signed in sees
+ * them once they have.
+ */
+describe('when getting current after the server did not resolve an identity', given(an_identity_provider, context => {
+    let first: IIdentity;
+    let second: IIdentity;
+
+    beforeEach(async () => {
+        context.fetchStub.onFirstCall().resolves({ ok: false, status: 401 } as Response);
+        context.fetchStub.onSecondCall().resolves({
+            ok: true,
+            json: async () => ({ id: 'user-123', name: 'Test User', roles: [], details: {} })
+        } as Response);
+
+        first = await IdentityProvider.getCurrent();
+        second = await IdentityProvider.getCurrent();
+    });
+
+    it('should report the first identity as not set', () => first.isSet.should.be.false);
+    it('should ask the server again', () => context.fetchStub.calledTwice.should.be.true);
+    it('should report the identity the server resolved', () => second.id.should.equal('user-123'));
+}));

package/identity/for_IdentityProvider/when_getting_current/and_the_server_has_no_identity_endpoint.ts

@@ -0,0 +1,38 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { IdentityProvider } from '../../IdentityProvider.js';
+import { IIdentity } from '../../IIdentity.js';
+import { an_identity_provider } from '../given/an_identity_provider.js';
+import { given } from '../../../given.js';
+
+/**
+ * An application whose identity comes from a proxy in front of it may have no `/.cratis/me` of its own, and earlier
+ * versions read the identity from the cookie that proxy writes. Until the proxy serves the endpoint, the cookie is
+ * still read in that one case - loudly, so the dependency does not go unnoticed.
+ */
+describe('when getting current and the server has no identity endpoint', given(an_identity_provider, context => {
+    let identity: IIdentity;
+    let warnings: unknown[][];
+    let originalConsoleWarn: typeof console.warn;
+
+    beforeEach(async () => {
+        warnings = [];
+        originalConsoleWarn = console.warn;
+        console.warn = (...args: unknown[]) => { warnings.push(args); };
+        (IdentityProvider as unknown as { hasWarnedAboutLegacyCookie: boolean }).hasWarnedAboutLegacyCookie = false;
+
+        const cookie = btoa(JSON.stringify({ id: 'user-123', name: 'Test User', roles: ['Reader'], details: {} }));
+        (global as { document?: { cookie: string } }).document!.cookie = `.cratis-identity=${cookie}`;
+        context.fetchStub.resolves({ ok: false, status: 404 } as Response);
+
+        identity = await IdentityProvider.getCurrent();
+    });
+
+    afterEach(() => { console.warn = originalConsoleWarn; });
+
+    it('should ask the server first', () => context.fetchStub.calledOnce.should.be.true);
+    it('should report the identity from the cookie', () => identity.id.should.equal('user-123'));
+    it('should report the roles from the cookie', () => identity.isInRole('Reader').should.be.true);
+    it('should warn that the cookie was read', () => warnings.length.should.equal(1));
+}));

package/identity/for_IdentityProvider/when_getting_current/and_the_server_rejects_the_caller_with_a_forged_identity_cookie.ts

@@ -0,0 +1,23 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { IdentityProvider } from '../../IdentityProvider.js';
+import { IIdentity } from '../../IIdentity.js';
+import { an_identity_provider } from '../given/an_identity_provider.js';
+import { given } from '../../../given.js';
+
+describe('when getting current and the server rejects the caller with a forged identity cookie', given(an_identity_provider, context => {
+    let identity: IIdentity;
+
+    beforeEach(async () => {
+        const forged = btoa(JSON.stringify({ id: 'admin', name: 'Forged Administrator', roles: ['admin'], details: {} }));
+        (global as { document?: { cookie: string } }).document!.cookie = `.cratis-identity=${forged}`;
+        context.fetchStub.resolves({ ok: false, status: 401 } as Response);
+
+        identity = await IdentityProvider.getCurrent();
+    });
+
+    it('should not be set', () => identity.isSet.should.be.false);
+    it('should not report the forged identity', () => identity.id.should.equal(''));
+    it('should not report the forged role', () => identity.isInRole('admin').should.be.false);
+}));

package/identity/for_IdentityProvider/when_getting_current/twice.ts

@@ -0,0 +1,22 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { IdentityProvider } from '../../IdentityProvider.js';
+import { IIdentity } from '../../IIdentity.js';
+import { an_identity_provider } from '../given/an_identity_provider.js';
+import { given } from '../../../given.js';
+
+describe('when getting current twice', given(an_identity_provider, context => {
+    let first: IIdentity;
+    let second: IIdentity;
+
+    beforeEach(async () => {
+        context.serverReports({ id: 'user-123', name: 'Test User', roles: [], details: {} });
+
+        first = await IdentityProvider.getCurrent();
+        second = await IdentityProvider.getCurrent();
+    });
+
+    it('should ask the server only once', () => context.fetchStub.calledOnce.should.be.true);
+    it('should report the same identity both times', () => second.id.should.equal(first.id));
+}));

package/identity/for_IdentityProvider/when_getting_current/with_a_details_type_that_declares_no_fields.ts

@@ -12,7 +12,7 @@ class UndecoratedDetails {
     role!: string;
 }
 
-describe('when getting current with a details type that declares no fields', given(an_identity_provider, () => {
+describe('when getting current with a details type that declares no fields', given(an_identity_provider, context => {
     let originalConsoleWarn: typeof console.warn;
     let result: { details: UndecoratedDetails };
 
@@ -28,8 +28,7 @@ describe('when getting current with a details type that declares no fields', giv
                 role: 'admin'
             }
         };
-        const encodedData = btoa(JSON.stringify(identityData));
-        (global as { document?: { cookie: string } }).document!.cookie = `.cratis-identity=${encodedData}`;
+        context.serverReports(identityData);
 
         const identity = await IdentityProvider.getCurrent(UndecoratedDetails);
         result = { details: identity.details };

package/identity/for_IdentityProvider/when_getting_current/with_a_forged_identity_cookie.ts

@@ -0,0 +1,29 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { IdentityProvider } from '../../IdentityProvider.js';
+import { IIdentity } from '../../IIdentity.js';
+import { an_identity_provider } from '../given/an_identity_provider.js';
+import { given } from '../../../given.js';
+
+/**
+ * A script on the page, or on a sibling subdomain, can write a `.cratis-identity` cookie. Earlier versions read
+ * the identity from it, so whoever wrote it decided who the page thought the user was.
+ */
+describe('when getting current with a forged identity cookie', given(an_identity_provider, context => {
+    let identity: IIdentity;
+
+    beforeEach(async () => {
+        const forged = btoa(JSON.stringify({ id: 'admin', name: 'Forged Administrator', roles: ['admin'], details: {} }));
+        (global as { document?: { cookie: string } }).document!.cookie = `.cratis-identity=${forged}`;
+        context.serverReports({ id: 'user-123', name: 'Test User', roles: ['Reader'], details: {} });
+
+        identity = await IdentityProvider.getCurrent();
+    });
+
+    it('should ask the server', () => context.fetchStub.calledOnce.should.be.true);
+    it('should ask the identity endpoint', () => String(context.fetchStub.firstCall.args[0]).should.contain('/.cratis/me'));
+    it('should report the identity the server reported', () => identity.id.should.equal('user-123'));
+    it('should report the roles the server reported', () => identity.roles.should.deep.equal(['Reader']));
+    it('should not report the forged role', () => identity.isInRole('admin').should.be.false);
+}));

package/identity/for_IdentityProvider/when_getting_current/with_roles.ts

@@ -5,7 +5,7 @@ import { IdentityProvider } from '../../IdentityProvider.js';
 import { an_identity_provider } from '../given/an_identity_provider.js';
 import { given } from '../../../given.js';
 
-describe('when getting current with roles', given(an_identity_provider, () => {
+describe('when getting current with roles', given(an_identity_provider, context => {
     let identity: { id: string; name: string; roles: string[]; isInRole: (role: string) => boolean };
 
     beforeEach(async () => {
@@ -15,8 +15,7 @@ describe('when getting current with roles', given(an_identity_provider, () => {
             roles: ['Admin', 'User'],
             details: {}
         };
-        const encodedData = btoa(JSON.stringify(identityData));
-        (global as { document?: { cookie: string } }).document!.cookie = `.cratis-identity=${encodedData}`;
+        context.serverReports(identityData);
 
         const result = await IdentityProvider.getCurrent();
         identity = {

package/identity/for_IdentityProvider/when_getting_current/with_type_safe_details.ts

@@ -14,14 +14,13 @@ class TestDetails {
     role!: string;
 }
 
-describe('when getting current with type safe details', given(an_identity_provider, () => {
+describe('when getting current with type safe details', given(an_identity_provider, context => {
     let result: { id: string; name: string; details: TestDetails };
     let testGuid: Guid;
 
     beforeEach(async () => {
         testGuid = Guid.create();
 
-        // Mock document.cookie with base64-encoded identity data
         const identityData = {
             id: 'test-user-id',
             name: 'Test User',
@@ -30,8 +29,7 @@ describe('when getting current with type safe details', given(an_identity_provid
                 role: 'admin'
             }
         };
-        const encodedData = btoa(JSON.stringify(identityData));
-        (global as { document?: { cookie: string } }).document!.cookie = `.cratis-identity=${encodedData}`;
+        context.serverReports(identityData);
 
         const identity = await IdentityProvider.getCurrent(TestDetails);
         result = {