@inrupt/solid-client-authn-browser 1.11.7 → 1.11.8-alpha.2

package/src/ClientAuthentication.ts

@@ -33,6 +33,7 @@ import {
   IIssuerConfigFetcher,
   ISessionInternalInfo,
   ILoginOptions,
+  EVENTS,
 } from "@inrupt/solid-client-authn-core";
 import { removeOidcQueryParam } from "@inrupt/oidc-client-ext";
 import { EventEmitter } from "events";
@@ -129,13 +130,37 @@ export default class ClientAuthentication {
     url: string,
     eventEmitter: EventEmitter
   ): Promise<ISessionInfo | undefined> => {
-    const redirectInfo = await this.redirectHandler.handle(url, eventEmitter);
-    // The `FallbackRedirectHandler` directly returns the global `fetch` for
-    // his value, so we should ensure it's bound to `window` rather than to
-    // ClientAuthentication, to avoid the following error:
-    // > 'fetch' called on an object that does not implement interface Window.
-    this.fetch = redirectInfo.fetch.bind(window);
+    try {
+      const redirectInfo = await this.redirectHandler.handle(url, eventEmitter);
+      // The `FallbackRedirectHandler` directly returns the global `fetch` for
+      // his value, so we should ensure it's bound to `window` rather than to
+      // ClientAuthentication, to avoid the following error:
+      // > 'fetch' called on an object that does not implement interface Window.
+      this.fetch = redirectInfo.fetch.bind(window);
+
+      // Strip the oauth params:
+      this.cleanUrlAfterRedirect(url);
+
+      return {
+        isLoggedIn: redirectInfo.isLoggedIn,
+        webId: redirectInfo.webId,
+        sessionId: redirectInfo.sessionId,
+        expirationDate: redirectInfo.expirationDate,
+      };
+    } catch (err) {
+      // Strip the oauth params:
+      this.cleanUrlAfterRedirect(url);
+
+      // FIXME: EVENTS.ERROR should be errorCode, errorDescription
+      //
+      // I'm not sure if "redirect" is a good error code, and in theory `err`
+      // maybe an Error object and not a string; Maybe we want to just hardcode
+      // a description instead?
+      eventEmitter.emit(EVENTS.ERROR, "redirect", err);
+    }
+  };
 
+  private cleanUrlAfterRedirect(url: string): void {
     const cleanedUpUrl = new URL(url);
     cleanedUpUrl.searchParams.delete("state");
     // For auth code flow
@@ -153,12 +178,5 @@ export default class ClientAuthentication {
     // authentication library will be called again with what are now invalid
     // query parameters!).
     window.history.replaceState(null, "", cleanedUpUrl.toString());
-
-    return {
-      isLoggedIn: redirectInfo.isLoggedIn,
-      webId: redirectInfo.webId,
-      sessionId: redirectInfo.sessionId,
-      expirationDate: redirectInfo.expirationDate,
-    };
-  };
+  }
 }

package/src/Session.spec.ts

@@ -395,230 +395,6 @@ describe("Session", () => {
       expect(incomingRedirectHandler).toHaveBeenCalled();
     });
 
-    // This workaround will be removed after we've settled on an API that allows us to silently
-    // re-activate the user's session after a refresh:
-    describe("(using the temporary workaround for losing a session after refresh)", () => {
-      it("does not report the user to be logged in when the workaround cookie is not present, and just executes the redirect", async () => {
-        const clientAuthentication = mockClientAuthentication();
-        clientAuthentication.handleIncomingRedirect = jest.fn(
-          async (_url: string) => undefined
-        );
-        const mySession = new Session({ clientAuthentication });
-        await mySession.handleIncomingRedirect({
-          url: "https://some.url",
-          useEssSession: true,
-        });
-        expect(mySession.info.isLoggedIn).toBe(false);
-        expect(mySession.info.webId).toBeUndefined();
-        expect(
-          clientAuthentication.handleIncomingRedirect
-        ).toHaveBeenCalledTimes(1);
-        // The workaround should be enabled by default
-        expect(
-          window.localStorage.getItem("tmp-resource-server-session-enabled")
-        ).toBe("true");
-      });
-
-      it("re-initialises the user's WebID without redirection if the proper cookie is set", async () => {
-        mockLocalStorage({
-          "tmp-resource-server-session-info": JSON.stringify({
-            webId: "https://my.pod/profile#me",
-            sessions: {
-              "https://my.pod/": { expiration: 9000000000000 },
-            },
-          }),
-        });
-        const clientAuthentication = mockClientAuthentication();
-        clientAuthentication.handleIncomingRedirect = jest.fn();
-        const mySession = new Session({ clientAuthentication });
-        await mySession.handleIncomingRedirect({
-          url: "https://some.url",
-          useEssSession: true,
-        });
-        expect(mySession.info.isLoggedIn).toBe(true);
-        expect(mySession.info.webId).toBe("https://my.pod/profile#me");
-        expect(
-          clientAuthentication.handleIncomingRedirect
-        ).toHaveBeenCalledTimes(0);
-        // The workaround should be enabled by default
-        expect(
-          window.localStorage.getItem("tmp-resource-server-session-enabled")
-        ).toBe("true");
-      });
-
-      it("does not attempt to use the workaround if the long-term solution (silent refresh) is enabled", async () => {
-        mockLocalStorage({
-          "tmp-resource-server-session-info": JSON.stringify({
-            webId: "https://my.pod/profile#me",
-            sessions: {
-              "https://my.pod/": { expiration: 9000000000000 },
-            },
-          }),
-        });
-        const clientAuthentication = mockClientAuthentication();
-        clientAuthentication.handleIncomingRedirect = jest.fn();
-        const mySession = new Session({ clientAuthentication });
-        await mySession.handleIncomingRedirect({
-          url: "https://some.url",
-          restorePreviousSession: true,
-        });
-        expect(mySession.info.isLoggedIn).toBe(false);
-        expect(mySession.info.webId).toBeUndefined();
-        expect(
-          clientAuthentication.handleIncomingRedirect
-        ).toHaveBeenCalledTimes(1);
-        expect(
-          window.localStorage.getItem("tmp-resource-server-session-enabled")
-        ).toBe("false");
-      });
-
-      it("overrides the workaround if both silent refresh and the ESS session are enabled", async () => {
-        mockLocalStorage({
-          "tmp-resource-server-session-info": JSON.stringify({
-            webId: "https://my.pod/profile#me",
-            sessions: {
-              "https://my.pod/": { expiration: 9000000000000 },
-            },
-          }),
-        });
-        const clientAuthentication = mockClientAuthentication();
-        clientAuthentication.handleIncomingRedirect = jest.fn();
-        const mySession = new Session({ clientAuthentication });
-        await mySession.handleIncomingRedirect({
-          url: "https://some.url",
-          restorePreviousSession: true,
-          useEssSession: true,
-        });
-        expect(mySession.info.isLoggedIn).toBe(false);
-        expect(mySession.info.webId).toBeUndefined();
-        expect(
-          clientAuthentication.handleIncomingRedirect
-        ).toHaveBeenCalledTimes(1);
-        expect(
-          window.localStorage.getItem("tmp-resource-server-session-enabled")
-        ).toBe("false");
-      });
-
-      it("does not attempt to use the workaround if it is not explicitly enabled", async () => {
-        mockLocalStorage({
-          "tmp-resource-server-session-info": JSON.stringify({
-            webId: "https://my.pod/profile#me",
-            sessions: {
-              "https://my.pod/": { expiration: 9000000000000 },
-            },
-          }),
-        });
-        const clientAuthentication = mockClientAuthentication();
-        clientAuthentication.handleIncomingRedirect = jest.fn();
-        const mySession = new Session({ clientAuthentication });
-        await mySession.handleIncomingRedirect({
-          url: "https://some.url",
-        });
-        expect(mySession.info.isLoggedIn).toBe(false);
-        expect(mySession.info.webId).toBeUndefined();
-        expect(
-          clientAuthentication.handleIncomingRedirect
-        ).toHaveBeenCalledTimes(1);
-        expect(
-          window.localStorage.getItem("tmp-resource-server-session-enabled")
-        ).toBe("false");
-      });
-
-      it("does not attempt to use the workaround if it is explicitly disabled", async () => {
-        mockLocalStorage({
-          "tmp-resource-server-session-info": JSON.stringify({
-            webId: "https://my.pod/profile#me",
-            sessions: {
-              "https://my.pod/": { expiration: 9000000000000 },
-            },
-          }),
-        });
-        const clientAuthentication = mockClientAuthentication();
-        clientAuthentication.handleIncomingRedirect = jest.fn();
-        const mySession = new Session({ clientAuthentication });
-        await mySession.handleIncomingRedirect({
-          url: "https://some.url",
-          useEssSession: false,
-        });
-        expect(mySession.info.isLoggedIn).toBe(false);
-        expect(mySession.info.webId).toBeUndefined();
-        expect(
-          clientAuthentication.handleIncomingRedirect
-        ).toHaveBeenCalledTimes(1);
-        expect(
-          window.localStorage.getItem("tmp-resource-server-session-enabled")
-        ).toBe("false");
-      });
-
-      it("does not mark an almost-expired session as logged in", async () => {
-        mockLocalStorage({
-          "tmp-resource-server-session-info": JSON.stringify({
-            webId: "https://my.pod/profile#me",
-            sessions: {
-              "https://my.pod/": { expiration: Date.now() + 10000 },
-            },
-          }),
-        });
-
-        const clientAuthentication = mockClientAuthentication();
-        clientAuthentication.handleIncomingRedirect = jest.fn();
-        const mySession = new Session({ clientAuthentication });
-        await mySession.handleIncomingRedirect({
-          url: "https://some.url",
-          useEssSession: true,
-        });
-        expect(mySession.info.isLoggedIn).toBe(false);
-        expect(mySession.info.webId).toBeUndefined();
-        expect(
-          clientAuthentication.handleIncomingRedirect
-        ).toHaveBeenCalledTimes(1);
-      });
-
-      it("logs you in even if your Solid Identity Provider is not your Resource server", async () => {
-        mockLocalStorage({
-          "tmp-resource-server-session-info": JSON.stringify({
-            webId: "https://my.pod/profile#me",
-            sessions: {
-              "https://not.my.pod/": { expiration: 9000000000000 },
-            },
-          }),
-        });
-        const clientAuthentication = mockClientAuthentication();
-        clientAuthentication.handleIncomingRedirect = jest.fn();
-        const mySession = new Session({ clientAuthentication });
-        await mySession.handleIncomingRedirect({
-          url: "https://some.url",
-          useEssSession: true,
-        });
-        expect(mySession.info.isLoggedIn).toBe(true);
-        expect(mySession.info.webId).toBe("https://my.pod/profile#me");
-        expect(
-          clientAuthentication.handleIncomingRedirect
-        ).toHaveBeenCalledTimes(0);
-      });
-
-      it("does not log the user in if the data in the storage was invalid", async () => {
-        mockLocalStorage({
-          "tmp-resource-server-session-info": JSON.stringify({
-            webId: "https://my.pod/profile#me",
-            // `sessions` key is intentionally missing
-          }),
-        });
-        const clientAuthentication = mockClientAuthentication();
-        clientAuthentication.handleIncomingRedirect = jest.fn();
-        const mySession = new Session({ clientAuthentication });
-        await mySession.handleIncomingRedirect({
-          url: "https://some.url",
-          useEssSession: true,
-        });
-        expect(mySession.info.isLoggedIn).toBe(false);
-        expect(mySession.info.webId).toBeUndefined();
-        expect(
-          clientAuthentication.handleIncomingRedirect
-        ).toHaveBeenCalledTimes(1);
-      });
-    });
-
     it("posts the redirect IRI to the parent if in an iframe", async () => {
       // Pretend we are in an iframe.
       const frameElement = jest.spyOn(window, "frameElement", "get");

package/src/Session.ts

@@ -28,7 +28,6 @@ import {
   ILoginInputOptions,
   ISessionInfo,
   IStorage,
-  ResourceServerSession,
 } from "@inrupt/solid-client-authn-core";
 import { v4 } from "uuid";
 import ClientAuthentication from "./ClientAuthentication";
@@ -83,6 +82,8 @@ export interface IHandleIncomingRedirectOptions {
    * `useEssSession` defaults to false and will be removed in the future; to
    * preserve sessions across page reloads, use of `restorePreviousSession` is
    * recommended.
+   *
+   * @deprecated unreleased
    */
   useEssSession?: boolean;
   /**
@@ -148,9 +149,6 @@ export class Session extends EventEmitter {
 
   private tokenRequestInProgress = false;
 
-  // Remove this when removing the `useEssSession` workaround:
-  private tmpFetchWithCookies = false;
-
   /**
    * Session object constructor. Typically called as follows:
    *
@@ -237,6 +235,11 @@ export class Session extends EventEmitter {
     this.on(EVENTS.SESSION_EXPIRED, () => this.internalLogout(false));
 
     this.on(EVENTS.ERROR, () => this.internalLogout(false));
+
+    // @deprecated: Remove this when removing all support for the useEssSession parameter.
+    // This intends at cleaning up local storage of applications from data related
+    // to the resource server session workaround.
+    window.localStorage.removeItem("tmp-resource-server-session-enabled");
   }
 
   /**
@@ -271,14 +274,7 @@ export class Session extends EventEmitter {
    * @param init Optional parameters customizing the request, by specifying an HTTP method, headers, a body, etc. Follows the [WHATWG Fetch Standard](https://fetch.spec.whatwg.org/).
    */
   fetch = async (url: RequestInfo, init?: RequestInit): Promise<Response> => {
-    return this.clientAuthentication.fetch(url, {
-      ...init,
-      credentials: this.tmpFetchWithCookies
-        ? /* istanbul ignore next Simulating a cookie-enabled session in tests is too much work for a temporary, disabled-by-default workaround: */
-          "include"
-        : /* istanbul ignore next Simulating a cookie-enabled session in tests is too much work for a temporary, disabled-by-default workaround: */
-          init?.credentials,
-    });
+    return this.clientAuthentication.fetch(url, init);
   };
 
   /**
@@ -295,7 +291,6 @@ export class Session extends EventEmitter {
     window.localStorage.removeItem(KEY_CURRENT_SESSION);
     await this.clientAuthentication.logout(this.info.sessionId);
     this.info.isLoggedIn = false;
-    this.tmpFetchWithCookies = false;
     if (emitSignal) {
       this.emit(EVENTS.LOGOUT);
     }
@@ -333,81 +328,6 @@ export class Session extends EventEmitter {
       return undefined;
     }
 
-    // Unfortunately, regular sessions are lost when the user refreshes the page or opens a new tab.
-    // While we're figuring out the API for a longer-term solution, as a temporary workaround some
-    // *resource* servers set a cookie that keeps the user logged in after authenticated requests,
-    // and expose the fact that they set it on a special endpoint.
-    // After login, we store that fact in LocalStorage. This means that we can now look for that
-    // data, and if present, indicate that the user is already logged in.
-    // Note that there are a lot of edge cases that won't work well with this approach, so it willl
-    // be removed in due time, and is disabled by default.
-    if (
-      options.useEssSession !== true ||
-      options.restorePreviousSession === true
-    ) {
-      window.localStorage.setItem(
-        "tmp-resource-server-session-enabled",
-        "false"
-      );
-    } else {
-      window.localStorage.setItem(
-        "tmp-resource-server-session-enabled",
-        "true"
-      );
-    }
-    const storedSessionCookieReference = window.localStorage.getItem(
-      "tmp-resource-server-session-info"
-    );
-    if (
-      typeof storedSessionCookieReference === "string" &&
-      options.restorePreviousSession !== true &&
-      options.useEssSession === true
-    ) {
-      // TOOD: Re-use the type used when writing this data:
-      // https://github.com/inrupt/solid-client-authn-js/pull/920/files#diff-659ac87dfd3711f4cfcea3c7bf6970980f4740fd59df45f04c7977bffaa23e98R118
-      // To keep temporary code together
-      // eslint-disable-next-line no-inner-declarations
-      function isValidSessionCookieReference(
-        reference: Record<string, unknown>
-      ): reference is ResourceServerSession {
-        const resourceServers = Object.keys(
-          (reference as ResourceServerSession).sessions ?? {}
-        );
-        return (
-          typeof (reference as ResourceServerSession).webId === "string" &&
-          resourceServers.length > 0 &&
-          typeof (reference as ResourceServerSession).sessions[
-            resourceServers[0]
-          ].expiration === "number"
-        );
-      }
-      const reference = JSON.parse(storedSessionCookieReference);
-      if (isValidSessionCookieReference(reference)) {
-        const resourceServers = Object.keys(reference.sessions);
-        const webIdOrigin = new URL(reference.webId).hostname;
-        const ownResourceServer = resourceServers.find((resourceServer) => {
-          return new URL(resourceServer).hostname === webIdOrigin;
-        });
-        // Usually the user's WebID is also a Resource server for them,
-        // so we pick the expiration time for that. If it doesn't exist,
-        // we just pick the first (and probably only) one:
-        const relevantServer = ownResourceServer ?? resourceServers[0];
-        // If the cookie is valid for fewer than five minutes,
-        // pretend it's not valid anymore already, to avoid small misalignments
-        // resulting in invalid states:
-        if (
-          reference.sessions[relevantServer].expiration - Date.now() >
-          5 * 60 * 1000
-        ) {
-          this.info.isLoggedIn = true;
-          this.info.webId = reference.webId;
-          this.tmpFetchWithCookies = true;
-          return this.info;
-        }
-      }
-    }
-    // end of temporary workaround.
-
     this.tokenRequestInProgress = true;
     const sessionInfo = await this.clientAuthentication.handleIncomingRedirect(
       url,

package/src/login/oidc/__mocks__/Redirector.ts

@@ -25,12 +25,12 @@ import {
 } from "@inrupt/solid-client-authn-core";
 import { jest } from "@jest/globals";
 
-export const RedirectorMock: jest.Mocked<IRedirector> = {
-  redirect: jest.fn(
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    (redirectUrl: string, redirectOptions: IRedirectorOptions) => {
-      /* void */
-    }
-  ),
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-} as any;
+export const mockedRedirect = jest.fn<
+  void,
+  [redirectUrl: string, redirectOptions: IRedirectorOptions]
+>();
+export const mockRedirector = (): IRedirector => {
+  return {
+    redirect: mockedRedirect,
+  };
+};

package/src/login/oidc/oidcHandlers/AuthorizationCodeWithPkceOidcHandler.spec.ts

@@ -19,23 +19,25 @@
  * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  */
 
+import { jest, it, describe, expect, afterEach } from "@jest/globals";
+import mockConsole from "jest-mock-console";
+
 /**
  * Test for AuthorizationCodeWithPkceOidcHandler
  */
 import {
   IOidcOptions,
-  IRedirector,
   IRedirectorOptions,
   mockStorage,
   StorageUtility,
   StorageUtilityMock,
 } from "@inrupt/solid-client-authn-core";
-import { jest, it, describe, expect } from "@jest/globals";
+
 import AuthorizationCodeWithPkceOidcHandler from "./AuthorizationCodeWithPkceOidcHandler";
 import canHandleTests from "./OidcHandlerCanHandleTest";
 import { SessionInfoManagerMock } from "../../../sessionInfo/__mocks__/SessionInfoManager";
 import { standardOidcOptions } from "../__mocks__/IOidcOptions";
-import { RedirectorMock } from "../__mocks__/Redirector";
+import { mockedRedirect, mockRedirector } from "../__mocks__/Redirector";
 
 jest.mock("@inrupt/oidc-client-ext");
 
@@ -57,10 +59,14 @@ const mockOidcModule = (
 };
 
 describe("AuthorizationCodeWithPkceOidcHandler", () => {
+  afterEach(() => {
+    jest.resetAllMocks();
+  });
+
   const defaultMocks = {
     sessionCreator: SessionInfoManagerMock,
     storageUtility: StorageUtilityMock,
-    redirector: RedirectorMock,
+    redirector: mockRedirector(),
   };
 
   function getAuthorizationCodeWithPkceOidcHandler(
@@ -91,20 +97,18 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
   describe("handle", () => {
     it("swallows any redirector exceptions", async () => {
       mockOidcModule();
-      const redirectorThatThrowsMock: jest.Mocked<IRedirector> = {
-        redirect: jest.fn(
-          (redirectUrl: string, redirectOptions: IRedirectorOptions) => {
-            throw new Error(
-              `Redirecting to [${redirectUrl}] with options [${redirectOptions}] throws...`
-            );
-          }
-        ),
-      } as any;
+      mockConsole("error");
+
+      mockedRedirect.mockImplementation(
+        (redirectUrl: string, redirectOptions: IRedirectorOptions) => {
+          throw new Error(
+            `Redirecting to [${redirectUrl}] with options [${redirectOptions}] throws...`
+          );
+        }
+      );
 
       const authorizationCodeWithPkceOidcHandler =
-        getAuthorizationCodeWithPkceOidcHandler({
-          redirector: redirectorThatThrowsMock,
-        });
+        getAuthorizationCodeWithPkceOidcHandler();
 
       const oidcOptions: IOidcOptions = {
         ...standardOidcOptions,
@@ -115,8 +119,20 @@ describe("AuthorizationCodeWithPkceOidcHandler", () => {
           grantTypesSupported: ["authorization_code"],
         },
       };
-      await authorizationCodeWithPkceOidcHandler.handle(oidcOptions);
-      expect(redirectorThatThrowsMock.redirect).toHaveBeenCalledTimes(1);
+
+      await expect(
+        authorizationCodeWithPkceOidcHandler.handle(oidcOptions)
+      ).resolves.toBeUndefined();
+
+      expect(mockedRedirect).toHaveBeenCalledTimes(1);
+
+      // Test the error was even printed to the console Note: this matcher is
+      // pretty nasty due to an Error instance being logged without being
+      // converted to a string:
+      expect(console.error).toHaveBeenCalledTimes(1);
+      expect(
+        (console as jest.Mocked<Console>).error.mock.calls[0][0].toString()
+      ).toMatch(/Error: Redirecting to \[[^\]]+\] with options/);
     });
 
     it("handles login properly with PKCE", async () => {