@cratis/arc 22.45.0 → 22.47.0

package/identity/for_IdentityProvider/when_getting_current/without_roles.ts

@@ -5,7 +5,7 @@ import { IdentityProvider } from '../../IdentityProvider.js';
 import { an_identity_provider } from '../given/an_identity_provider.js';
 import { given } from '../../../given.js';
 
-describe('when getting current without roles', given(an_identity_provider, () => {
+describe('when getting current without roles', given(an_identity_provider, context => {
     let identity: { id: string; name: string; roles: string[]; isInRole: (role: string) => boolean };
 
     beforeEach(async () => {
@@ -14,8 +14,7 @@ describe('when getting current without roles', given(an_identity_provider, () =>
             name: 'Test User',
             details: {}
         };
-        const encodedData = btoa(JSON.stringify(identityData));
-        (global as { document?: { cookie: string } }).document!.cookie = `.cratis-identity=${encodedData}`;
+        context.serverReports(identityData);
 
         const result = await IdentityProvider.getCurrent();
         identity = {

package/identity/for_IdentityProvider/when_refreshing/after_getting_current.ts

@@ -0,0 +1,25 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { IdentityProvider } from '../../IdentityProvider.js';
+import { IIdentity } from '../../IIdentity.js';
+import { an_identity_provider } from '../given/an_identity_provider.js';
+import { given } from '../../../given.js';
+
+describe('when refreshing after getting current', given(an_identity_provider, context => {
+    let refreshed: IIdentity;
+    let current: IIdentity;
+
+    beforeEach(async () => {
+        context.serverReports({ id: 'user-123', name: 'Test User', roles: [], details: {} });
+        await IdentityProvider.getCurrent();
+
+        context.serverReports({ id: 'user-123', name: 'Renamed User', roles: [], details: {} });
+        refreshed = await IdentityProvider.refresh();
+        current = await IdentityProvider.getCurrent();
+    });
+
+    it('should ask the server again', () => context.fetchStub.calledTwice.should.be.true);
+    it('should report what the server reports now', () => refreshed.name.should.equal('Renamed User'));
+    it('should keep the refreshed identity for the next caller', () => current.name.should.equal('Renamed User'));
+}));

package/identity/for_IdentityProvider/when_refreshing/after_the_server_rejects_a_retained_transition_identity.ts

@@ -0,0 +1,23 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { IdentityProvider } from '../../IdentityProvider.js';
+import { IIdentity } from '../../IIdentity.js';
+import { a_browser_with_a_legacy_identity } from '../given/a_browser_with_a_legacy_identity.js';
+import { given } from '../../../given.js';
+
+describe('when refreshing after the server rejects a retained transition identity', given(a_browser_with_a_legacy_identity, context => {
+    let rejected: IIdentity;
+    let refreshed: IIdentity;
+
+    beforeEach(async () => {
+        await IdentityProvider.refresh();
+        context.fetchStub.resolves({ ok: false, status: 401 } as Response);
+        rejected = await IdentityProvider.refresh();
+        context.fetchStub.resolves({ ok: false, status: 404 } as Response);
+        refreshed = await IdentityProvider.refresh();
+    });
+
+    it('should not overrule the rejection with the retained identity', () => rejected.isSet.should.be.false);
+    it('should discard the transition identity after the rejection', () => refreshed.isSet.should.be.false);
+}));

package/identity/for_IdentityProvider/when_refreshing/and_the_server_has_no_identity_endpoint.ts

@@ -0,0 +1,19 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { IdentityProvider } from '../../IdentityProvider.js';
+import { IIdentity } from '../../IIdentity.js';
+import { a_browser_with_a_legacy_identity } from '../given/a_browser_with_a_legacy_identity.js';
+import { given } from '../../../given.js';
+
+describe('when refreshing and the server has no identity endpoint', given(a_browser_with_a_legacy_identity, context => {
+    let refreshed: IIdentity;
+
+    beforeEach(async () => {
+        refreshed = await IdentityProvider.refresh();
+    });
+
+    it('should ask the server first', () => context.fetchStub.calledOnce.should.be.true);
+    it('should preserve the transition fallback', () => refreshed.id.should.equal('user-123'));
+    it('should preserve the roles from the fallback', () => refreshed.isInRole('Reader').should.be.true);
+}));

package/identity/for_IdentityProvider/when_refreshing/and_there_is_no_identity_endpoint_on_consecutive_requests.ts

@@ -0,0 +1,24 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { IdentityProvider } from '../../IdentityProvider.js';
+import { IIdentity } from '../../IIdentity.js';
+import { a_browser_with_a_legacy_identity } from '../given/a_browser_with_a_legacy_identity.js';
+import { given } from '../../../given.js';
+
+// The proxy may authorize from its own cache without reissuing its readable cookie.
+describe('when refreshing consecutively without an identity endpoint', given(a_browser_with_a_legacy_identity, context => {
+    let refreshed: IIdentity;
+
+    beforeEach(async () => {
+        await IdentityProvider.refresh();
+        refreshed = await IdentityProvider.refresh();
+    });
+
+    it('should ask the server for each refresh', () => context.fetchStub.calledTwice.should.be.true);
+    it('should retain the transition identity', () => refreshed.id.should.equal('user-123'));
+    it('should retain the transition roles', () => refreshed.isInRole('Reader').should.be.true);
+    it('should restore the root cookie for navigation', () => document.cookie.should.contain('.cratis-identity='));
+    it('should retain SameSite Lax on HTTP', () => context.cookieJar.getCookiesSync('http://localhost/')[0].sameSite!.should.equal('lax'));
+    it('should not require HTTPS on an HTTP site', () => context.cookieJar.getCookiesSync('http://localhost/')[0].secure.should.be.false);
+}));

package/identity/for_IdentityProvider/when_refreshing/with_a_cookie_first_backend_and_changed_credentials.ts

@@ -0,0 +1,27 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { IdentityProvider } from '../../IdentityProvider.js';
+import { IIdentity } from '../../IIdentity.js';
+import { a_cookie_first_backend } from '../given/a_cookie_first_backend.js';
+import { given } from '../../../given.js';
+
+describe('when refreshing with a cookie-first backend and changed credentials', given(a_cookie_first_backend, context => {
+    let refreshed: IIdentity;
+    let current: IIdentity;
+
+    beforeEach(async () => {
+        await IdentityProvider.getCurrent();
+        context.currentIdentity = { id: 'user-456', name: 'Current User', roles: ['Editor'], details: { department: 'Current' } };
+        refreshed = await IdentityProvider.refresh();
+        current = await IdentityProvider.getCurrent();
+    });
+
+    it('should ask the backend again', () => context.fetchStub.calledTwice.should.be.true);
+    it('should report the current principal', () => refreshed.id.should.equal('user-456'));
+    it('should report the current name', () => refreshed.name.should.equal('Current User'));
+    it('should report the current roles', () => refreshed.roles.should.deep.equal(['Editor']));
+    it('should report the recomputed details', () => refreshed.details.should.deep.equal({ department: 'Current' }));
+    it('should cache the refreshed identity', () => current.id.should.equal('user-456'));
+    it('should expire the legacy cookie at the root path', () => document.cookie.should.equal('.cratis-identity=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/'));
+}));

package/identity/for_IdentityProvider/when_refreshing/with_a_cookie_first_backend_and_expired_credentials.ts

@@ -0,0 +1,22 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { IdentityProvider } from '../../IdentityProvider.js';
+import { IIdentity } from '../../IIdentity.js';
+import { a_cookie_first_backend } from '../given/a_cookie_first_backend.js';
+import { given } from '../../../given.js';
+
+describe('when refreshing with a cookie-first backend and expired credentials', given(a_cookie_first_backend, context => {
+    let refreshed: IIdentity;
+
+    beforeEach(async () => {
+        await IdentityProvider.getCurrent();
+        context.currentIdentity = undefined;
+        refreshed = await IdentityProvider.refresh();
+    });
+
+    it('should ask the backend again', () => context.fetchStub.calledTwice.should.be.true);
+    it('should report that the identity is no longer set', () => refreshed.isSet.should.be.false);
+    it('should not keep the previous principal', () => refreshed.id.should.equal(''));
+    it('should not keep the previous roles', () => refreshed.roles.should.be.empty);
+}));

package/identity/for_IdentityProvider/when_refreshing/with_a_new_cookie_on_the_not_found_response.ts

@@ -0,0 +1,23 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { IdentityProvider } from '../../IdentityProvider.js';
+import { IIdentity } from '../../IIdentity.js';
+import { a_browser_with_a_legacy_identity } from '../given/a_browser_with_a_legacy_identity.js';
+import { given } from '../../../given.js';
+
+describe('when refreshing with a new cookie on the not found response', given(a_browser_with_a_legacy_identity, context => {
+    let refreshed: IIdentity;
+
+    beforeEach(async () => {
+        context.fetchStub.callsFake(async () => {
+            document.cookie = `.cratis-identity=${btoa(JSON.stringify({ id: 'user-456', name: 'Updated User', roles: ['Writer'], details: {} }))};path=/`;
+            return { ok: false, status: 404 } as Response;
+        });
+        refreshed = await IdentityProvider.refresh();
+    });
+
+    it('should prefer the identity issued by the response', () => refreshed.id.should.equal('user-456'));
+    it('should use the updated roles', () => refreshed.isInRole('Writer').should.be.true);
+    it('should not retain the earlier roles', () => refreshed.isInRole('Reader').should.be.false);
+}));

package/identity/for_IdentityProvider/when_refreshing/with_a_secure_legacy_cookie_and_no_identity_endpoint.ts

@@ -0,0 +1,21 @@
+// Copyright (c) Cratis. All rights reserved.
+// Licensed under the MIT license. See LICENSE file in the project root for full license information.
+
+import { IdentityProvider } from '../../IdentityProvider.js';
+import { IIdentity } from '../../IIdentity.js';
+import { a_secure_browser_with_a_legacy_identity } from '../given/a_secure_browser_with_a_legacy_identity.js';
+import { given } from '../../../given.js';
+
+describe('when refreshing a secure legacy cookie without an identity endpoint', given(a_secure_browser_with_a_legacy_identity, context => {
+    let refreshed: IIdentity;
+
+    beforeEach(async () => {
+        await IdentityProvider.refresh();
+        refreshed = await IdentityProvider.refresh();
+    });
+
+    it('should retain the transition identity', () => refreshed.id.should.equal('user-123'));
+    it('should restore the cookie for HTTPS navigation', () => context.cookieJar.getCookieStringSync('https://identity.example/').should.contain('.cratis-identity='));
+    it('should not send the restored cookie over HTTP', () => context.cookieJar.getCookieStringSync('http://identity.example/').should.equal(''));
+    it('should retain SameSite Lax', () => context.cookieJar.getCookiesSync('https://identity.example/')[0].sameSite!.should.equal('lax'));
+}));

package/package.json

@@ -1,7 +1,7 @@
 {
     "type": "module",
     "name": "@cratis/arc",
-    "version": "22.45.0",
+    "version": "22.47.0",
     "description": "TypeScript command, query, validation, identity, and messaging runtime for Cratis Arc — the CQRS application framework for ASP.NET Core — used by generated proxies.",
     "keywords": [
         "cratis",