@finos/legend-application-studio 28.21.14 → 28.21.16

package/src/stores/LegendStudioBaseStore.ts

@@ -54,6 +54,18 @@ export type LegendStudioApplicationStore = ApplicationStore<
   LegendStudioPluginManager
 >;
 
+/**
+ * Same-origin path of the static page that the SDLC OAuth flow redirects to
+ * when re-authenticating in a popup window. Shipped by the Studio deployment
+ * (see `assets/popup-callback.html`); deployments enabling the popup
+ * re-auth feature must register `<base-url>/popup-callback.html` on the
+ * SDLC server's OAuth client allow-list.
+ *
+ * The leading slash is required because `navigator.generateAddress` is
+ * `origin + baseUrl + location` and baseUrl has its trailing slash stripped.
+ */
+const SDLC_POPUP_REAUTH_CALLBACK_PATH = '/popup-callback.html';
+
 export class LegendStudioBaseStore {
   readonly applicationStore: LegendStudioApplicationStore;
   readonly sdlcServerClient: SDLCServerClient;
@@ -61,18 +73,72 @@ export class LegendStudioBaseStore {
   readonly pluginManager: LegendStudioPluginManager;
 
   readonly initState = ActionState.create();
+  readonly popupReAuthState = ActionState.create();
 
   isSDLCAuthorized: boolean | undefined = false;
   private isSDLCServerInitialized = false;
   SDLCServerTermsOfServicesUrlsToView: string[] = [];
 
+  /**
+   * Tracks whether an automatic popup re-auth has already been attempted for
+   * the current "failure episode". An episode is the window between two
+   * successful SDLC interactions: the flag is set on the first auto-attempt
+   * and cleared whenever a re-auth (auto or manual) succeeds. This is what
+   * prevents endless 401 → popup → 401 loops.
+   */
+  private autoPopupReAuthAttempted = false;
+
+  /**
+   * Dedupes concurrent auto callers of `handleSDLCUnauthorized`. Wraps the
+   * raw popup promise with the auto-flow notification logic (manual-fallback
+   * warning on failure) so all concurrent 401-driven callers get the same
+   * resolution and only one warning fires per attempt.
+   */
+  private inFlightAutoReAuth: Promise<boolean> | undefined;
+
+  /**
+   * The raw popup promise, set by `reAuthorizeSDLCInPopup` for the duration
+   * of an on-screen popup REGARDLESS of who opened it (manual shield click
+   * OR auto-trigger). `handleSDLCUnauthorized` consults this before deciding
+   * to consume the episode and warn — without it, a 401 raised while the
+   * user is in a manually-opened popup would either stack a second popup or
+   * pop a "click the shield" warning at them while the shield's popup is in
+   * front of them.
+   */
+  private inFlightReAuth: Promise<boolean> | undefined;
+
+  /**
+   * Per-episode dedup flag for the "click the shield to retry" warning.
+   * `handleSDLCUnauthorized` can be re-entered many times within a single
+   * failure episode (every subsequent failing SDLC request in a burst lands
+   * in the loop-guard branch); without this flag, each one would stack an
+   * identical toast. Cleared alongside `autoPopupReAuthAttempted` on a
+   * successful re-auth so the next episode can warn again.
+   */
+  private manualReAuthNotifiedForEpisode = false;
+
+  /**
+   * Re-entry guard for the network layer's 401 hook. Set to `true` while we
+   * are re-bootstrapping the SDLC session inside the popup-success path so
+   * that a 401 raised by the re-bootstrap requests themselves (e.g. the
+   * `isAuthorized` verification GET coming back 401 because cookies didn't
+   * actually land) cannot recurse into `handleSDLCUnauthorized` — that would
+   * return the still-in-flight outer promise and deadlock the whole chain.
+   */
+  private suppressAutoReAuth = false;
+
   constructor(applicationStore: LegendStudioApplicationStore) {
-    makeObservable<LegendStudioBaseStore, 'initializeSDLCServerClient'>(this, {
+    makeObservable<
+      LegendStudioBaseStore,
+      'initializeSDLCServerClient' | 'verifySDLCSessionAfterReAuth'
+    >(this, {
       isSDLCAuthorized: observable,
       SDLCServerTermsOfServicesUrlsToView: observable,
       needsToAcceptSDLCServerTermsOfServices: computed,
+      isSDLCPopupReAuthEnabled: computed,
       initialize: flow,
       initializeSDLCServerClient: flow,
+      verifySDLCSessionAfterReAuth: flow,
       dismissSDLCServerTermsOfServicesAlert: action,
     });
 
@@ -93,6 +159,11 @@ export class LegendStudioBaseStore {
       serverUrl: this.applicationStore.config.sdlcServerUrl,
       baseHeaders: this.applicationStore.config.sdlcServerBaseHeaders,
       client: this.applicationStore.config.sdlcServerClient,
+      // On a mid-session 401, auto-launch the popup re-auth flow. The
+      // handler enforces a one-attempt-per-episode guard to prevent endless
+      // retry loops; when it gives up, the StatusBar manual button remains
+      // available.
+      autoReAuthenticate: () => this.handleSDLCUnauthorized(),
     });
     this.sdlcServerClient.setTracerService(this.applicationStore.tracerService);
   }
@@ -206,6 +277,364 @@ export class LegendStudioBaseStore {
     this.SDLCServerTermsOfServicesUrlsToView = [];
   }
 
+  /**
+   * Whether the popup-based SDLC re-authentication flow is available.
+   *
+   * The feature is opt-in via the `sdlc.enablePopupReAuth` config flag
+   * because the derived callback URL must be explicitly registered as an
+   * OAuth `redirect_uri` on the SDLC server. When `false` (or unset), only
+   * the legacy top-level redirect flow is available.
+   */
+  get isSDLCPopupReAuthEnabled(): boolean {
+    return this.applicationStore.config.sdlcEnablePopupReAuth;
+  }
+
+  /**
+   * 401 interception hook wired into the SDLC server client. Triggers the
+   * popup re-auth flow automatically — without any user action — but only
+   * once per failure episode to guard against retry loops.
+   *
+   * @returns a promise resolving to `true` if the SDLC server is now
+   * authorized (i.e. the underlying network layer should retry the original
+   * request), `false` otherwise.
+   */
+  private handleSDLCUnauthorized(): Promise<boolean> {
+    // Feature off → propagate the 401 to the caller as before.
+    if (!this.isSDLCPopupReAuthEnabled) {
+      return Promise.resolve(false);
+    }
+    // Re-entry guard: a 401 raised from inside the post-popup re-bootstrap
+    // (e.g. the verification `isAuthorized()` call itself coming back 401
+    // because cookies didn't actually land) MUST NOT recurse into the popup
+    // flow — that would return the in-flight outer promise and deadlock.
+    if (this.suppressAutoReAuth) {
+      return Promise.resolve(false);
+    }
+    // Coalesce concurrent auto callers onto the wrapped auto-flow promise so
+    // the manual-fallback warning only fires once per attempt.
+    if (this.inFlightAutoReAuth) {
+      return this.inFlightAutoReAuth;
+    }
+    // If a popup is already on screen — most commonly because the user just
+    // clicked the StatusBar shield, but also possibly because a prior auto-
+    // attempt's popup is still finalising — defer to its outcome instead of
+    // consuming this episode's one auto-attempt and warning at the user
+    // about a manual button that the popup is in the way of.
+    if (this.inFlightReAuth) {
+      return this.inFlightReAuth;
+    }
+    // Loop guard: we've already auto-attempted once this episode. Surface
+    // the manual fallback (deduped) and stop auto-retrying.
+    if (this.autoPopupReAuthAttempted) {
+      this.notifyManualReAuthAvailable();
+      return Promise.resolve(false);
+    }
+    this.autoPopupReAuthAttempted = true;
+    // NOTE: we deliberately don't fire an upfront "session expired" toast —
+    // the popup window itself is the user-visible signal that re-auth is
+    // happening. We only notify on completion (success or failure) so the
+    // toast stack stays clean.
+    this.inFlightAutoReAuth = this.reAuthorizeSDLCInPopup()
+      .then((ok) => {
+        this.inFlightAutoReAuth = undefined;
+        if (!ok) {
+          this.notifyManualReAuthAvailable();
+        }
+        // success path resets `autoPopupReAuthAttempted` inside
+        // `reAuthorizeSDLCInPopup` so the next episode can auto-attempt again
+        return ok;
+      })
+      .catch(() => {
+        this.inFlightAutoReAuth = undefined;
+        this.notifyManualReAuthAvailable();
+        return false;
+      });
+    return this.inFlightAutoReAuth;
+  }
+
+  /**
+   * Best-effort notification that nudges the user toward the manual
+   * re-authentication entry point (the StatusBar shield button) when the
+   * automatic flow could not complete (popup blocked, user dismissed, or
+   * the retry still 401'd).
+   *
+   * Deduped per failure episode: subsequent 401s within the same episode
+   * (a burst of editor requests after session expiry, for example) all hit
+   * the loop-guard branch and would otherwise each stack an identical
+   * warning toast. The flag is cleared when a re-auth attempt succeeds.
+   */
+  private notifyManualReAuthAvailable(): void {
+    if (this.manualReAuthNotifiedForEpisode) {
+      return;
+    }
+    this.manualReAuthNotifiedForEpisode = true;
+    this.applicationStore.notificationService.notifyWarning(
+      `Automatic SDLC re-authentication did not complete. Click the shield icon in the status bar to retry, or reload the page to start a fresh session.`,
+    );
+  }
+
+  /**
+   * Re-initiate the SDLC authorization step in a popup window so that the
+   * user can recover from an expired SDLC session without losing in-memory
+   * editor state (open tabs, unsaved buffers, etc.).
+   *
+   * The popup loads the SDLC server's `/auth/authorize?redirect_uri=...`
+   * endpoint with a same-origin callback page as the `redirect_uri`. That
+   * URL is derived at runtime via the navigator — the same way the
+   * boot-time auth flow derives its own `redirect_uri` — so deployments
+   * only need to declare intent (`sdlc.enablePopupReAuth: true`) and ship
+   * the static `popup-callback.html` page at their base URL.
+   *
+   * The callback page is expected to `postMessage` back to the opener with
+   * payload `{ type: 'SDLC_REAUTH_DONE' }` and then close itself.
+   *
+   * On success, the SDLC server client is re-checked and re-initialized in
+   * place — no top-level navigation, no state loss.
+   *
+   * @returns a promise that resolves to `true` if the SDLC server is
+   * authorized after the popup flow completes, `false` otherwise (popup
+   * blocked, user cancelled, authorization check still failing, ...).
+   */
+  async reAuthorizeSDLCInPopup(): Promise<boolean> {
+    if (!this.isSDLCPopupReAuthEnabled) {
+      this.applicationStore.notificationService.notifyWarning(
+        `Popup re-authentication is not enabled. Set 'sdlc.enablePopupReAuth' to true in the Studio config to enable it.`,
+      );
+      return false;
+    }
+    // Coalesce concurrent callers (manual shield click + auto 401 trigger)
+    // onto a single popup. Without this, a 401 raised while the user is in
+    // a manually-opened popup would either stack a second popup OR fire a
+    // confusing "click the shield" warning at the user while the shield's
+    // popup is literally on screen.
+    if (this.inFlightReAuth) {
+      return this.inFlightReAuth;
+    }
+    this.popupReAuthState.inProgress();
+
+    // Derive the callback URL the same way the boot-time SDLC auth flow
+    // derives its `redirect_uri` — via the navigator's same-origin address
+    // builder. The callback page is a constant static asset shipped with
+    // every Studio deployment.
+    const callbackUrl =
+      this.applicationStore.navigationService.navigator.generateAddress(
+        SDLC_POPUP_REAUTH_CALLBACK_PATH,
+      );
+    const callbackOrigin = new URL(callbackUrl).origin;
+
+    const authorizeUrl = SDLCServerClient.authorizeCallbackUrl(
+      this.applicationStore.config.sdlcServerUrl,
+      callbackUrl,
+      this.applicationStore.config.sdlcServerClient,
+    );
+
+    const popup = window.open(
+      authorizeUrl,
+      'legend-studio-sdlc-reauth',
+      'width=560,height=720,menubar=no,toolbar=no,location=no,status=no',
+    );
+    if (!popup) {
+      this.popupReAuthState.fail();
+      this.applicationStore.notificationService.notifyError(
+        `Failed to open the re-authentication popup. Please allow popups for this site and try again.`,
+      );
+      return false;
+    }
+
+    const promise = new Promise<boolean>((resolve) => {
+      let closedPoll: ReturnType<typeof setInterval> | undefined;
+      let settled = false;
+
+      // `finalize` and `onMessage` form a small cycle:
+      //   onMessage -> finalize          (call on success postMessage)
+      //   finalize  -> onMessage         (removeEventListener on teardown)
+      // We declare `finalize` first so only the one forward reference to
+      // `onMessage` from inside `finalize`'s body needs to be excused.
+      const finalize = (signalled: boolean): void => {
+        if (settled) {
+          return;
+        }
+        settled = true;
+        // eslint-disable-next-line @typescript-eslint/no-use-before-define
+        window.removeEventListener('message', onMessage);
+        if (closedPoll !== undefined) {
+          clearInterval(closedPoll);
+          closedPoll = undefined;
+        }
+        try {
+          popup.close();
+        } catch {
+          // ignored — popup may already be closed or cross-origin
+        }
+        // Always re-verify the SDLC session in place, whether the callback
+        // page managed to `postMessage` (`signalled === true`) or the popup
+        // simply closed (`signalled === false`). The popup-closed path used
+        // to fail outright, but that silently broke environments where the
+        // browser severs `window.opener` somewhere along the auth redirect
+        // chain (most commonly an IdP or the SDLC server sending
+        // `Cross-Origin-Opener-Policy: same-origin`): the callback page's
+        // `postMessage` becomes a no-op, the popup closes itself, and the
+        // only way to learn whether auth actually took is to ask the server.
+        // The cost is one cheap GET on user-cancel; the upside is robust
+        // recovery for COOP-severed deployments.
+        //
+        // We deliberately do NOT route through `initializeSDLCServerClient`
+        // here — that would do a top-level redirect on `!isAuthorized` and
+        // lose all the in-memory editor state this whole feature exists to
+        // protect. `suppressAutoReAuth` is set for the duration of the
+        // verify so that a 401 raised by the verify GET itself can't recurse
+        // back into `handleSDLCUnauthorized` (which would return the still-
+        // in-flight outer promise and deadlock).
+        this.isSDLCServerInitialized = false;
+        this.suppressAutoReAuth = true;
+        flowResult(this.verifySDLCSessionAfterReAuth())
+          .then((ok) => {
+            this.suppressAutoReAuth = false;
+            if (ok) {
+              // reset the per-episode flags so the next failure episode
+              // can auto-attempt re-auth and warn the user again
+              this.autoPopupReAuthAttempted = false;
+              this.manualReAuthNotifiedForEpisode = false;
+              this.popupReAuthState.pass();
+              this.applicationStore.notificationService.notifySuccess(
+                `Successfully re-authenticated with the SDLC server.`,
+              );
+            } else {
+              this.popupReAuthState.fail();
+              if (signalled) {
+                // The popup explicitly told us it completed, yet the SDLC
+                // server still reports the session as unauthorized. That's
+                // a real problem the user should know about (wrong identity
+                // chosen in the popup, third-party-cookie / SameSite issue,
+                // ToS race, etc.). Surface a loud error.
+                this.applicationStore.notificationService.notifyError(
+                  `Re-authentication popup completed but the SDLC session is still not authorized. Please reload the page to start a fresh session.`,
+                );
+              }
+              // !signalled + verify failed is indistinguishable from a
+              // deliberate user-cancel — stay quiet. The auto-trigger
+              // caller (`handleSDLCUnauthorized`) will fire a single
+              // "click the shield to retry" hint if this was an auto
+              // attempt; the manual button caller simply gets `false` back.
+            }
+            resolve(ok);
+          })
+          .catch((error: unknown) => {
+            this.suppressAutoReAuth = false;
+            assertErrorThrown(error);
+            this.popupReAuthState.fail();
+            this.applicationStore.logService.error(
+              LogEvent.create(LEGEND_STUDIO_APP_EVENT.SDLC_MANAGER_FAILURE),
+              error,
+            );
+            this.applicationStore.notificationService.notifyError(error);
+            resolve(false);
+          });
+      };
+
+      const onMessage = (event: MessageEvent): void => {
+        // strict origin + payload-shape check
+        if (event.origin !== callbackOrigin) {
+          return;
+        }
+        const data = event.data as { type?: unknown } | null;
+        if (!data || data.type !== 'SDLC_REAUTH_DONE') {
+          return;
+        }
+        finalize(true);
+      };
+
+      window.addEventListener('message', onMessage);
+
+      // Fallback: if the user closes the popup without completing auth,
+      // we still want to release the in-progress state.
+      closedPoll = setInterval(() => {
+        if (popup.closed) {
+          finalize(false);
+        }
+      }, 500);
+    });
+    this.inFlightReAuth = promise;
+    try {
+      return await promise;
+    } finally {
+      // Clear the slot AFTER awaiting so all concurrent callers (which got
+      // `this.inFlightReAuth` back from the early-return branch) resolve
+      // against the same promise instance. Subsequent attempts then start
+      // a fresh popup.
+      this.inFlightReAuth = undefined;
+    }
+  }
+
+  /**
+   * Shared post-auth bootstrap: ToS gate, platforms, features. Plain
+   * generator (not a flow) — delegated to from both `initializeSDLCServerClient`
+   * (the boot-time flow) and `verifySDLCSessionAfterReAuth` (the popup-success
+   * flow) via `yield*`. Caller is responsible for asserting `isSDLCAuthorized`
+   * beforehand.
+   */
+  private *bootstrapSDLCSessionAfterAuth(): GeneratorFn<void> {
+    // check terms of service agreement status
+    this.SDLCServerTermsOfServicesUrlsToView =
+      (yield this.sdlcServerClient.hasAcceptedTermsOfService()) as string[];
+    if (this.SDLCServerTermsOfServicesUrlsToView.length) {
+      this.applicationStore.alertService.setActionAlertInfo({
+        message: `Please read and accept the SDLC servers' terms of service`,
+        prompt: `Click 'Done' when you have accepted all the terms`,
+        type: ActionAlertType.CAUTION,
+        actions: [
+          {
+            label: 'See terms of services',
+            default: true,
+            handler: (): void =>
+              this.SDLCServerTermsOfServicesUrlsToView.forEach((url) =>
+                this.applicationStore.navigationService.navigator.visitAddress(
+                  url,
+                ),
+              ),
+            type: ActionAlertActionType.PROCEED,
+          },
+          {
+            label: 'Done',
+            type: ActionAlertActionType.PROCEED_WITH_CAUTION,
+            handler: (): void => {
+              this.dismissSDLCServerTermsOfServicesAlert();
+              this.applicationStore.navigationService.navigator.reload();
+            },
+          },
+        ],
+      });
+    }
+
+    // fetch server features config and platforms
+    yield this.sdlcServerClient.fetchServerPlatforms();
+    yield this.sdlcServerClient.fetchServerFeaturesConfiguration();
+
+    // the sdlc server client is authorized and initialized
+    this.isSDLCServerInitialized = true;
+  }
+
+  /**
+   * Verify the SDLC session after a popup re-auth attempt completes, and
+   * re-bootstrap the session in place if it took. Returns `true` if the
+   * session is now usable, `false` if the SDLC server still reports the
+   * session as unauthorized (e.g. cookies didn't actually land, user authed
+   * against the wrong identity).
+   *
+   * Unlike `initializeSDLCServerClient`, this does NOT do a top-level
+   * redirect on `!isAuthorized` — preserving in-memory editor state is the
+   * entire reason the popup flow exists.
+   */
+  private *verifySDLCSessionAfterReAuth(): GeneratorFn<boolean> {
+    this.isSDLCAuthorized =
+      (yield this.sdlcServerClient.isAuthorized()) as boolean;
+    if (!this.isSDLCAuthorized) {
+      return false;
+    }
+    yield* this.bootstrapSDLCSessionAfterAuth();
+    return true;
+  }
+
   private *initializeSDLCServerClient(): GeneratorFn<void> {
     try {
       this.isSDLCAuthorized =
@@ -219,46 +648,8 @@ export class LegendStudioBaseStore {
           ),
         );
       } else {
-        // Only proceed intialization after passing authorization check
-
-        // check terms of service agreement status
-        this.SDLCServerTermsOfServicesUrlsToView =
-          (yield this.sdlcServerClient.hasAcceptedTermsOfService()) as string[];
-        if (this.SDLCServerTermsOfServicesUrlsToView.length) {
-          this.applicationStore.alertService.setActionAlertInfo({
-            message: `Please read and accept the SDLC servers' terms of service`,
-            prompt: `Click 'Done' when you have accepted all the terms`,
-            type: ActionAlertType.CAUTION,
-            actions: [
-              {
-                label: 'See terms of services',
-                default: true,
-                handler: (): void =>
-                  this.SDLCServerTermsOfServicesUrlsToView.forEach((url) =>
-                    this.applicationStore.navigationService.navigator.visitAddress(
-                      url,
-                    ),
-                  ),
-                type: ActionAlertActionType.PROCEED,
-              },
-              {
-                label: 'Done',
-                type: ActionAlertActionType.PROCEED_WITH_CAUTION,
-                handler: (): void => {
-                  this.dismissSDLCServerTermsOfServicesAlert();
-                  this.applicationStore.navigationService.navigator.reload();
-                },
-              },
-            ],
-          });
-        }
-
-        // fetch server features config and platforms
-        yield this.sdlcServerClient.fetchServerPlatforms();
-        yield this.sdlcServerClient.fetchServerFeaturesConfiguration();
-
-        // the sdlc server client is authorized and initialized
-        this.isSDLCServerInitialized = true;
+        // Only proceed initialization after passing authorization check
+        yield* this.bootstrapSDLCSessionAfterAuth();
       }
     } catch (error) {
       assertErrorThrown(error);