@eui/base 14.0.26 → 14.0.27

package/assets/openid/openid-login.js

@@ -20,6 +20,8 @@
         SESSION_STORAGE_KEY_IMPERSONATED_USER_ID: "ux-openid-connect-impersonated-user-id",
         SESSION_STORAGE_KEY_DEVELOPMENT_URL: "ux-openid-connect-dev-url",
         SESSION_STORAGE_KEY_ORIGINAL_URL: "ux-openid-connect-original-url",
+        SESSION_STORAGE_KEY_TRACK_USERNAME: "ux-openid-connect-track-username",
+        SESSION_STORAGE_KEY_TRACK_LOGIN: "ux-openid-connect-track-login",
         SESSION_STORAGE_KEY_PUBLIC_KEY: "ux-openid-connect-public-key",
         SESSION_STORAGE_KEY_PRIVATE_KEY: "ux-openid-connect-private-key",
         SESSION_STORAGE_KEY_LOGIN_TIMESTAMP: "ux-openid-connect-login-timestamp",
@@ -32,8 +34,10 @@
         DEFAULT_ACCESS_TOKEN_SIGNING_ALGORITHM: "ES256",
 
         config: null,
+        configInitialised: false,
         metadata: null,
         waitForClientQueue: [],
+        waitForConfigQueue: [],
         waitForIdTokenQueue: [],
         waitForApiGatewayAccessTokenQueue: [],
         loginWasRequested: false,
@@ -42,6 +46,7 @@
         requestingApiGatewayAccessToken: false,
         wasLoggedIn: false,
         client: null,
+        usedEuLoginAccessTokens: {},
 
         // --------------- Login with EU Login ---------------
         loadConfiguration: function (callbackFunction) {
@@ -164,12 +169,20 @@
                         }
                     }
 
-                    // Continue all pending requests:
-                    var queue = OpenIdConnect.waitForIdTokenQueue;
-                    OpenIdConnect.wasLoggedIn = true;
-                    while (queue.length > 0) {
-                        // Extra timeout to prevent endless loop in case of accidental recursion due to still not being authorized because of an unknown issue:
-                        setTimeout(queue.pop(), 0);
+                    var continuePendingRequests = function () {
+                        var queue = OpenIdConnect.waitForIdTokenQueue;
+                        OpenIdConnect.wasLoggedIn = true;
+                        while (queue.length > 0) {
+                            // Extra timeout to prevent endless loop in case of accidental recursion due to still not being authorized because of an unknown issue:
+                            setTimeout(queue.pop(), 0);
+                        }
+                    };
+
+                    // We may have the ID token already being processed, while the configuration is still loading:
+                    if (OpenIdConnect.configInitialised) {
+                        continuePendingRequests();
+                    } else {
+                        OpenIdConnect.waitForConfigQueue.push(continuePendingRequests);
                     }
                 });
             } else {
@@ -180,8 +193,8 @@
 
         getAuthorizationHeaders: function (url, callbackFunction, errorCallbackFunction) { // calls the callback function with an object containing all the headers necessary to authenticate the request
             if (url != null && (typeof callbackFunction) == "function") {
-                if (OpenIdConnect.config != null) {
-                    if (OpenIdConnect.config.enabled) {
+                if (OpenIdConnect.configInitialised) {
+                    if (OpenIdConnect.config != null && OpenIdConnect.config.enabled) {
                         if (sessionStorage.getItem(OpenIdConnect.SESSION_STORAGE_KEY_ID_TOKEN) != null) {
                             if (OpenIdConnect.config.apiGatewayServices) {
                                 var service = OpenIdConnect.getMatchingServiceFromConfiguration(url, OpenIdConnect.config.apiGatewayServices);
@@ -285,6 +298,17 @@
                     var euLoginTokenService = null;
                     var getApiGatewayAccessToken = function () {
                         if (euLoginTokenApiGateway != null && (euLoginTokenService != null || audienceId == null)) {
+                            // Prevent the same EU Login access token from being used:
+                            if (euLoginTokenApiGateway != null && OpenIdConnect.usedEuLoginAccessTokens [euLoginTokenApiGateway.access_token]) {
+                                // Due to unexpected racing conditions, the same EU Login access token is being used to request the API Gateway token.
+                                // Simply retry:
+                                OpenIdConnect.requestingApiGatewayAccessToken = false;
+                                setTimeout(function () {
+                                    OpenIdConnect.getApiGatewayAuthorizationHeaders(audienceId, callbackFunction, errorCallbackFunction, authenticatedByGateway);
+                                }, 0);
+                                return;
+                            }
+
                             var impersonatedUserId = OpenIdConnect.getImpersonatedUserId();
                             if (impersonatedUserId == null) {
                                 // We now have an EU Login access token for the API Gateway and the target service.
@@ -298,6 +322,17 @@
                                         // and by propagating the EU Login access token for the target service...
                                         var apiGatewayAccessToken = OpenIdConnect.parseSafely(xhr, errorCallbackFunction);
                                         OpenIdConnect.storeCachedApiGatewayAccessToken(apiGatewayAccessToken);
+
+                                        // Prevent the same EU Login access token from being used:
+                                        if (euLoginTokenService != null && OpenIdConnect.usedEuLoginAccessTokens [euLoginTokenService.access_token]) {
+                                            // Due to unexpected racing conditions, the same EU Login access token is being used to request the API Gateway token.
+                                            // Simply retry:
+                                            OpenIdConnect.requestingApiGatewayAccessToken = false;
+                                            setTimeout(function () {
+                                                OpenIdConnect.getApiGatewayAuthorizationHeaders(audienceId, callbackFunction, errorCallbackFunction, authenticatedByGateway);
+                                            }, 0);
+                                            return;
+                                        }
                                         OpenIdConnect.returnApiGatewayAuthorizationHeaders(apiGatewayAccessToken, euLoginTokenService, callbackFunction, authenticatedByGateway);
                                     } else if (xhr.status >= 400) {
                                         OpenIdConnect.handleErrorResponse(xhr, errorCallbackFunction);
@@ -313,6 +348,9 @@
                                     "eul_access_token=" + OpenIdConnect.signAccessToken(euLoginTokenApiGateway.access_token) + "&"+
                                     "consumer_key=" + encodeURIComponent(OpenIdConnect.config.apiGatewayConsumerKey)
                                 );
+                                if (euLoginTokenApiGateway != null) {
+                                    OpenIdConnect.usedEuLoginAccessTokens [euLoginTokenApiGateway.access_token] = true;
+                                }
                             } else {
                                 // Re-impersonate:
                                 OpenIdConnect.impersonate(impersonatedUserId, function () {
@@ -338,11 +376,21 @@
                     // We already have an API Gateway access token.
                     // Now request an EU Login access token for the target service.
                     if (audienceId != null && audienceId != "") {
-                        OpenIdConnect.doServiceAccessTokenRequest(audienceId, function (newEuLoginToken) {
-                            // We have now both the API Gateway access token and a EU Login access token for the target service;
-                            // we can call the API Gateway.
-                            OpenIdConnect.returnApiGatewayAuthorizationHeaders(OpenIdConnect.getCachedApiGatewayAccessToken(), newEuLoginToken, callbackFunction, authenticatedByGateway);
-                        }, errorCallbackFunction);
+                        var gatherHeaders = function () {
+                            OpenIdConnect.doServiceAccessTokenRequest(audienceId, function (newEuLoginToken) {
+                                // Prevent the same EU Login access token from being used:
+                                if (newEuLoginToken != null && OpenIdConnect.usedEuLoginAccessTokens [newEuLoginToken.access_token]) {
+                                    // Due to unexpected racing conditions, the same EU Login access token is being used to request the API Gateway token.
+                                    // Simply retry:
+                                    return gatherHeaders();
+                                }
+
+                                // We have now both the API Gateway access token and a EU Login access token for the target service;
+                                // we can call the API Gateway.
+                                OpenIdConnect.returnApiGatewayAuthorizationHeaders(OpenIdConnect.getCachedApiGatewayAccessToken(), newEuLoginToken, callbackFunction, authenticatedByGateway);
+                            }, errorCallbackFunction);
+                        };
+                        gatherHeaders();
                     } else {
                         OpenIdConnect.returnApiGatewayAuthorizationHeaders(OpenIdConnect.getCachedApiGatewayAccessToken(), null, callbackFunction, authenticatedByGateway);
                     }
@@ -511,6 +559,7 @@
 
             if (serviceAccessToken != null && serviceAccessToken.access_token != null) {
                 headers ["Authorization-Propagation"] = OpenIdConnect.signAccessToken(serviceAccessToken.access_token);
+                OpenIdConnect.usedEuLoginAccessTokens [serviceAccessToken.access_token] = true;
             }
             OpenIdConnect.addImpersonationHeaders(headers);
 
@@ -739,6 +788,20 @@
             }
         },
 
+        continuePendingUserTracking: function () {
+            var fullName = sessionStorage.getItem(OpenIdConnect.SESSION_STORAGE_KEY_TRACK_USERNAME);
+            if (fullName != null && (typeof dtrum) != "undefined" && (typeof dtrum.identifyUser) == "function") {
+                dtrum.identifyUser(fullName);
+            }
+            sessionStorage.removeItem(OpenIdConnect.SESSION_STORAGE_KEY_TRACK_USERNAME);
+
+            var loginAction = sessionStorage.getItem(OpenIdConnect.SESSION_STORAGE_KEY_TRACK_LOGIN);
+            if (loginAction != null && (typeof dtrum) != "undefined" && (typeof dtrum.leaveAction) == "function" && (typeof dtrum.sendBeacon) == "function") {
+                dtrum.leaveAction(loginAction);
+                dtrum.sendBeacon(true, true, true);
+                sessionStorage.removeItem(OpenIdConnect.SESSION_STORAGE_KEY_TRACK_LOGIN);
+            }
+        },
 
 
         // --------------- Utility functions ---------------
@@ -860,6 +923,7 @@
                     sessionStorage.removeItem(OpenIdConnect.SESSION_STORAGE_KEY_ID_TOKEN);
                     // Also invalidate the API Gateway token because it can be used for authentication too:
                     OpenIdConnect.clearCachedApiGatewayAccessToken();
+                    OpenIdConnect.trackUserLogin();
 
                     var redirectUrl = OpenIdConnect.config.spaRedirectUrl;
                     // Also allow the redirect URL to go to localhost in case of mock OpenIDConnect servers:
@@ -892,6 +956,12 @@
                             }
                         }
 
+                        // Check for functional test account logins:
+                        var parameters = new URLSearchParams(window.top.location.search);
+                        if (parameters != null && parameters.get("1fa") != null) {
+                            extraQueryParams ["acr_values"] = "https://ecas.ec.europa.eu/loa/basic";
+                        }
+
                         if (! OpenIdConnect.requestingLogin) {
                             OpenIdConnect.requestingLogin = true;
                             OpenIdConnect.client.createSigninRequest({redirect_uri: redirectUrl, extraQueryParams: extraQueryParams}).then(function (req) {
@@ -975,6 +1045,7 @@
                             firstName: tokenObject.given_name,
                             lastName: tokenObject.family_name
                         }));
+                        OpenIdConnect.trackUserName(tokenObject);
                     } else {
                         console.error("Not accepting ID token; incorrect audience (SPA) detected.");
                     }
@@ -1154,6 +1225,14 @@
             }
         },
 
+        continuePendingConfigRequests: function () {
+            var queue = OpenIdConnect.waitForConfigQueue;
+            while (queue.length > 0) {
+                // Extra timeout to prevent endless loop in case of accidental recursion due to still not being authorized because of an unknown issue:
+                setTimeout(queue.pop(), 0);
+            }
+        },
+
         makeSessionApplicationSpecific: function () {
             // Sometimes multiple applications are deployed on the same domain.
             // Make the session application-specific:
@@ -1169,6 +1248,35 @@
                 OpenIdConnect.SESSION_STORAGE_KEY_PRIVATE_KEY += applicationSuffix;
                 OpenIdConnect.SESSION_STORAGE_KEY_LOGIN_TIMESTAMP += applicationSuffix;
             }
+        },
+
+        trackUserLogin: function () {
+            if ((typeof dtrum) != "undefined" && (typeof dtrum.actionName) == "function" && (typeof dtrum.enterAction) == "function" && (typeof dtrum.sendBeacon) == "function") {
+                sessionStorage.setItem(OpenIdConnect.SESSION_STORAGE_KEY_TRACK_LOGIN, dtrum.enterAction("EU Login (old client)"));
+                dtrum.actionName("EU Login (old client)");
+                dtrum.sendBeacon(true, true, true);
+            }
+        },
+
+        trackUserName: function (tokenObject) {
+            if (tokenObject != null) {
+                var firstName = tokenObject.given_name;
+                if (firstName == "UNKNOWN") {
+                    firstName = tokenObject.sub;
+                }
+                var lastName = tokenObject.family_name;
+                if (lastName == "UNKNOWN") {
+                    lastName = "Generic User";
+                }
+                var fullName = lastName + " " + firstName;
+
+                if ((typeof dtrum) != "undefined" && (typeof dtrum.identifyUser) == "function") {
+                    dtrum.identifyUser(fullName);
+                } else {
+                    // The username will be picked up after restoring the original URL:
+                    sessionStorage.setItem(OpenIdConnect.SESSION_STORAGE_KEY_TRACK_USERNAME, fullName);
+                }
+            }
         }
     };
 
@@ -1180,11 +1288,16 @@
             if (OpenIdConnect.config != null && OpenIdConnect.config.enabled) {
                 OpenIdConnect.makeSessionApplicationSpecific();
                 OpenIdConnect.initializeKeypair();
+                OpenIdConnect.configInitialised = true;
+                OpenIdConnect.continuePendingConfigRequests();
                 if (OpenIdConnect.config.autoLogin == null || OpenIdConnect.config.autoLogin) {
                     OpenIdConnect.loginWithOpenIDConnect();
                 } else {
                     OpenIdConnect.loginWithOpenIDConnect(true);
                 }
+            } else {
+                OpenIdConnect.configInitialised = true;
+                OpenIdConnect.continuePendingConfigRequests();
             }
         });
     } catch (error) {