@inrupt/solid-client-authn-browser 1.11.7 → 1.11.8-alpha.0

package/src/login/oidc/oidcHandlers/AuthorizationCodeWithPkceOidcHandler.spec.ts

@@ -19,23 +19,32 @@
  * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  */
 
+import {
+  jest,
+  it,
+  describe,
+  expect,
+  beforeEach,
+  afterEach,
+} from "@jest/globals";
+import mockConsole, { RestoreConsole } from "jest-mock-console";
+
 /**
  * Test for AuthorizationCodeWithPkceOidcHandler
  */
 import {
   IOidcOptions,
-  IRedirector,
   IRedirectorOptions,
   mockStorage,
   StorageUtility,
   StorageUtilityMock,
 } from "@inrupt/solid-client-authn-core";
-import { jest, it, describe, expect } from "@jest/globals";
+
 import AuthorizationCodeWithPkceOidcHandler from "./AuthorizationCodeWithPkceOidcHandler";
 import canHandleTests from "./OidcHandlerCanHandleTest";
 import { SessionInfoManagerMock } from "../../../sessionInfo/__mocks__/SessionInfoManager";
 import { standardOidcOptions } from "../__mocks__/IOidcOptions";
-import { RedirectorMock } from "../__mocks__/Redirector";
+import { mockedRedirect, mockRedirector } from "../__mocks__/Redirector";
 
 jest.mock("@inrupt/oidc-client-ext");
 
@@ -57,10 +66,14 @@ const mockOidcModule = (
 };
 
 describe("AuthorizationCodeWithPkceOidcHandler", () => {
+  afterEach(() => {
+    jest.resetAllMocks();
+  });
+
   const defaultMocks = {
     sessionCreator: SessionInfoManagerMock,
     storageUtility: StorageUtilityMock,
-    redirector: RedirectorMock,
+    redirector: mockRedirector(),
   };
 
   function getAuthorizationCodeWithPkceOidcHandler(
@@ -91,20 +104,18 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
   describe("handle", () => {
     it("swallows any redirector exceptions", async () => {
       mockOidcModule();
-      const redirectorThatThrowsMock: jest.Mocked<IRedirector> = {
-        redirect: jest.fn(
-          (redirectUrl: string, redirectOptions: IRedirectorOptions) => {
-            throw new Error(
-              `Redirecting to [${redirectUrl}] with options [${redirectOptions}] throws...`
-            );
-          }
-        ),
-      } as any;
+      mockConsole("error");
+
+      mockedRedirect.mockImplementation(
+        (redirectUrl: string, redirectOptions: IRedirectorOptions) => {
+          throw new Error(
+            `Redirecting to [${redirectUrl}] with options [${redirectOptions}] throws...`
+          );
+        }
+      );
 
       const authorizationCodeWithPkceOidcHandler =
-        getAuthorizationCodeWithPkceOidcHandler({
-          redirector: redirectorThatThrowsMock,
-        });
+        getAuthorizationCodeWithPkceOidcHandler();
 
       const oidcOptions: IOidcOptions = {
         ...standardOidcOptions,
@@ -115,8 +126,20 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
           grantTypesSupported: ["authorization_code"],
         },
       };
-      await authorizationCodeWithPkceOidcHandler.handle(oidcOptions);
-      expect(redirectorThatThrowsMock.redirect).toHaveBeenCalledTimes(1);
+
+      await expect(
+        authorizationCodeWithPkceOidcHandler.handle(oidcOptions)
+      ).resolves.toBeUndefined();
+
+      expect(mockedRedirect).toHaveBeenCalledTimes(1);
+
+      // Test the error was even printed to the console Note: this matcher is
+      // pretty nasty due to an Error instance being logged without being
+      // converted to a string:
+      expect(console.error).toHaveBeenCalledTimes(1);
+      expect(
+        (console as jest.Mocked<Console>).error.mock.calls[0][0].toString()
+      ).toMatch(/Error: Redirecting to \[[^\]]+\] with options/);
     });
 
     it("handles login properly with PKCE", async () => {

package/src/login/oidc/redirectHandler/AuthCodeRedirectHandler.spec.ts

@@ -35,11 +35,8 @@ import { CodeExchangeResult, getBearerToken } from "@inrupt/oidc-client-ext";
 import { Response } from "cross-fetch";
 import { JWK, importJWK } from "jose";
 import { KeyObject } from "crypto";
-import {
-  AuthCodeRedirectHandler,
-  DEFAULT_LIFESPAN,
-} from "./AuthCodeRedirectHandler";
-import { RedirectorMock } from "../__mocks__/Redirector";
+import { AuthCodeRedirectHandler } from "./AuthCodeRedirectHandler";
+import { mockRedirector } from "../__mocks__/Redirector";
 import { SessionInfoManagerMock } from "../../../sessionInfo/__mocks__/SessionInfoManager";
 import { LocalStorageMock } from "../../../storage/__mocks__/LocalStorage";
 import {
@@ -211,7 +208,7 @@ const mockFetch = (response: Response) => {
 
 const defaultMocks = {
   storageUtility: StorageUtilityMock,
-  redirector: RedirectorMock,
+  redirector: mockRedirector(),
   sessionInfoManager: SessionInfoManagerMock,
   clientRegistrar: mockClientRegistrar(mockClient()),
   issuerConfigFetcher: mockIssuerConfigFetcher(mockIssuer()),
@@ -514,15 +511,11 @@ describe("AuthCodeRedirectHandler", () => {
     it("returns the expiration time normalised to the current time", async () => {
       mockOidcClient();
       window.fetch = jest.fn();
-      mockLocalStorage({
-        "tmp-resource-server-session-enabled": "false",
-      });
       const MOCK_TIMESTAMP = 10000;
       Date.now = jest
         .fn()
         // Date.now is called twice: once to be able to calculate the auth token expiry time,
         // and once to set the cookie expiry. We only care about the second in this test.
-        .mockReturnValueOnce(MOCK_TIMESTAMP)
         .mockReturnValueOnce(MOCK_TIMESTAMP) as typeof Date.now;
 
       const authCodeRedirectHandler = getAuthCodeRedirectHandler({
@@ -541,9 +534,6 @@ describe("AuthCodeRedirectHandler", () => {
     it("returns null for the expiration time if none was provided", async () => {
       const mockedOidcClient = mockOidcClient();
       window.fetch = jest.fn();
-      mockLocalStorage({
-        "tmp-resource-server-session-enabled": "false",
-      });
       mockedOidcClient.getBearerToken = jest
         .fn(getBearerToken)
         .mockResolvedValueOnce({
@@ -582,165 +572,7 @@ describe("AuthCodeRedirectHandler", () => {
     });
   });
 
-  it("stores information about the resource server cookie in local storage on successful authentication", async () => {
-    mockOidcClient();
-
-    // This mocks the fetch to the Resource Server session endpoint
-    // Note: Currently, the endpoint only returns the webid in plain/text, it could
-    // be extended later to also provide the cookie expiration.
-    mockFetch(
-      new Response("https://my.webid", {
-        status: 200,
-      })
-    );
-
-    const MOCK_TIMESTAMP = 10000;
-    Date.now = jest
-      .fn()
-      // Date.now is called twice: once to be able to calculate the auth token expiry time,
-      // and once to set the cookie expiry. We only care about the second in this test.
-      .mockReturnValueOnce(MOCK_TIMESTAMP)
-      .mockReturnValueOnce(MOCK_TIMESTAMP) as typeof Date.now;
-
-    const mockedStorage = mockDefaultStorageUtility();
-
-    const authCodeRedirectHandler = getAuthCodeRedirectHandler({
-      storageUtility: mockedStorage,
-    });
-
-    await authCodeRedirectHandler.handle(mockRedirectUrl());
-    expect(
-      JSON.parse(
-        (await mockedStorage.get("tmp-resource-server-session-info")) as string
-      )
-    ).toEqual({
-      webId: "https://my.webid",
-      sessions: {
-        "https://my.webid": {
-          expiration: MOCK_TIMESTAMP + DEFAULT_LIFESPAN,
-        },
-      },
-    });
-  });
-
-  it("does not look the session endpoint up if the ESS cookie workaround has been disabled", async () => {
-    mockOidcClient();
-    mockLocalStorage({
-      "tmp-resource-server-session-enabled": "false",
-    });
-
-    // This mocks the fetch to the Resource Server session endpoint
-    // Note: Currently, the endpoint only returns the webid in plain/text, it could
-    // be extended later to also provide the cookie expiration.
-    mockFetch(
-      new Response("https://my.webid", {
-        status: 200,
-      })
-    );
-
-    const MOCK_TIMESTAMP = 10000;
-    Date.now = jest
-      .fn()
-      // Date.now is called twice: once to be able to calculate the auth token expiry time,
-      // and once to set the cookie expiry. We only care about the second in this test.
-      .mockReturnValueOnce(MOCK_TIMESTAMP)
-      .mockReturnValueOnce(MOCK_TIMESTAMP) as typeof Date.now;
-
-    const mockedStorage = mockDefaultStorageUtility();
-
-    const authCodeRedirectHandler = getAuthCodeRedirectHandler({
-      storageUtility: mockedStorage,
-    });
-
-    await authCodeRedirectHandler.handle(mockRedirectUrl());
-    expect(
-      JSON.parse(
-        (await mockedStorage.get("tmp-resource-server-session-info")) ?? "{}"
-      )
-    ).toEqual({});
-  });
-
-  it("store nothing if the resource server has no session endpoint", async () => {
-    mockOidcClient();
-    mockLocalStorage({});
-    // This mocks the fetch to the Resource Server session endpoint
-    // Note: Currently, the endpoint only returns the WebID in plain/text, it could
-    // be extended later to also provide the cookie expiration.
-    mockFetch(
-      new Response("", {
-        status: 404,
-      })
-    );
-
-    const mockedStorage = mockDefaultStorageUtility();
-
-    const authCodeRedirectHandler = getAuthCodeRedirectHandler({
-      storageUtility: mockedStorage,
-    });
-
-    await authCodeRedirectHandler.handle(mockRedirectUrl());
-    expect(
-      JSON.parse(
-        (await mockedStorage.get("tmp-resource-server-session-info")) ?? "{}"
-      )
-    ).toEqual({});
-  });
-
-  it("swallows the exception if the fetch to the session endpoint fails", async () => {
-    mockOidcClient();
-    mockLocalStorage({});
-    window.fetch = (jest.fn() as any)
-      .mockResolvedValueOnce(
-        new Response("https://my.webid", {
-          status: 200,
-        })
-      )
-      .mockRejectedValueOnce("Some error");
-
-    const mockedStorage = mockDefaultStorageUtility();
-
-    const authCodeRedirectHandler = getAuthCodeRedirectHandler({
-      storageUtility: mockedStorage,
-    });
-
-    await authCodeRedirectHandler.handle(mockRedirectUrl());
-    expect(
-      JSON.parse(
-        (await mockedStorage.get("tmp-resource-server-session-info")) ?? "{}"
-      )
-    ).toEqual({});
-  });
-
-  it("store nothing if the resource server does not recognize the user", async () => {
-    mockOidcClient();
-    mockLocalStorage({});
-    // This mocks the fetch to the Resource Server session endpoint
-    // Note: Currently, the endpoint only returns the WebID in plain/text, it could
-    // be extended later to also provide the cookie expiration.
-    mockFetch(
-      new Response("", {
-        status: 401,
-      })
-    );
-
-    const mockedStorage = mockDefaultStorageUtility({ dpop: false });
-
-    const authCodeRedirectHandler = getAuthCodeRedirectHandler({
-      storageUtility: mockedStorage,
-    });
-
-    await authCodeRedirectHandler.handle(mockRedirectUrl());
-    expect(
-      JSON.parse(
-        (await mockedStorage.get("tmp-resource-server-session-info")) ?? "{}"
-      )
-    ).toEqual({});
-  });
-
   it("returns a fetch that supports the refresh flow", async () => {
-    mockLocalStorage({
-      "tmp-resource-server-session-enabled": "false",
-    });
     mockOidcClient();
     const mockedStorage = mockDefaultStorageUtility();
     const coreModule = jest.requireActual(

package/src/login/oidc/redirectHandler/AuthCodeRedirectHandler.ts

@@ -44,62 +44,6 @@ import {
 } from "@inrupt/oidc-client-ext";
 import { EventEmitter } from "events";
 
-// A lifespan of 30 minutes is ESS's default. This could be removed if we
-// configure the server to return the remaining lifespan of the cookie.
-export const DEFAULT_LIFESPAN = 30 * 60 * 1000;
-
-/**
- * Stores the resource server session information in local storage, so that they
- * can be used on refresh.
- * @param webId
- * @param authenticatedFetch
- * @param storageUtility
- */
-async function setupResourceServerSession(
-  webId: string,
-  authenticatedFetch: typeof fetch,
-  storageUtility: IStorageUtility
-): Promise<void> {
-  const webIdAsUrl = new URL(webId);
-  const resourceServerIri = webIdAsUrl.origin;
-  // Querying the /session endpoint does not set the cookie, but issuing an
-  // authenticated request to any actual resource (even public ones) does,
-  // so we fetch the user's WebID before checking the /session endpoint.
-  await authenticatedFetch(webId);
-  try {
-    const resourceServerResponse = await authenticatedFetch(
-      `${resourceServerIri}/session`
-    );
-
-    if (resourceServerResponse.status === 200) {
-      await storageUtility.storeResourceServerSessionInfo(
-        webId,
-        resourceServerIri,
-        // Note that here, if the lifespan of the cookie was returned by the
-        // server, we'd expect a relative value (the remaining time of validity)
-        // rather than an absolute one (the moment when the cookie expires).
-        Date.now() + DEFAULT_LIFESPAN
-      );
-      return;
-    }
-    // In this case, the resource server either:
-    // - does not have the expected endpoint, or
-    // - does not recognize the user
-    // Either way, no cookie is expected to be set there, and any existing
-    // session information should be cleared.
-    await storageUtility.clearResourceServerSessionInfo(resourceServerIri);
-  } catch (_e) {
-    // Setting the `credentials=include` option on fetch, which is required in
-    // the current approach based on a RS cookie, may result in an error if
-    // attempting to access an URL, depending on the CORS policies.
-    // Since this internal fetch is necessary, and out of control of the
-    // calling library, there is no other solution but to swallow the exception.
-    // This may happen depending on how the target RS handles a request to the
-    // /session endpoint.
-    await storageUtility.clearResourceServerSessionInfo(resourceServerIri);
-  }
-}
-
 /**
  * @hidden
  */
@@ -233,18 +177,6 @@ export class AuthCodeRedirectHandler implements IRedirectHandler {
         secure: false,
       }
     );
-    // TODO: This is a temporary workaround. When deprecating the cookie-based auth,
-    // this should be all cleared.
-    const essWorkaroundDisabled =
-      window.localStorage.getItem("tmp-resource-server-session-enabled") ===
-      "false";
-    if (!essWorkaroundDisabled) {
-      await setupResourceServerSession(
-        tokens.webId,
-        authFetch,
-        this.storageUtility
-      );
-    }
 
     const sessionInfo = await this.sessionInfoManager.get(storedSessionId);
     if (!sessionInfo) {

package/src/sessionInfo/SessionInfoManager.spec.ts

@@ -274,33 +274,6 @@ describe("SessionInfoManager", () => {
         await mockedStorage.getForUser("mySession", "key", { secure: false })
       ).toBeUndefined();
     });
-
-    it("clears resource server session info from local storage", async () => {
-      const mockedStorage = mockStorageUtility(
-        {
-          "solidClientAuthenticationUser:mySession": {
-            webId: "https://my.pod/profile#me",
-          },
-        },
-        true
-      );
-      await mockedStorage.storeResourceServerSessionInfo(
-        "https://my.pod/profile#me",
-        "https://my.pod",
-        10000
-      );
-      const sessionManager = getSessionInfoManager({
-        storageUtility: mockedStorage,
-      });
-      await sessionManager.clear("mySession");
-      expect(
-        JSON.parse(
-          (await mockedStorage.get("tmp-resource-server-session-info", {
-            secure: false,
-          })) ?? ""
-        )
-      ).toEqual({});
-    });
   });
 
   describe("getAll", () => {

package/src/sessionInfo/SessionInfoManager.ts

@@ -54,16 +54,6 @@ export async function clear(
   sessionId: string,
   storage: IStorageUtility
 ): Promise<void> {
-  const storedSessionCookieReference = await storage.get(
-    "tmp-resource-server-session-info"
-  );
-  const reference = JSON.parse(storedSessionCookieReference ?? "{}");
-  const { webId } = reference;
-  if (webId !== undefined) {
-    const webIdAsUrl = new URL(webId);
-    const resourceServerIri = webIdAsUrl.origin;
-    await storage.clearResourceServerSessionInfo(resourceServerIri);
-  }
   await Promise.all([
     storage.deleteAllUserData(sessionId, { secure: false }),
     storage.deleteAllUserData(sessionId, { secure: true }),