@inrupt/solid-client-authn-browser 1.17.1 → 1.17.3

package/dist/storage/BrowserStorage.d.ts

@@ -1,4 +1,11 @@
+/**
+ * @hidden
+ * @packageDocumentation
+ */
 import type { IStorage } from "@inrupt/solid-client-authn-core";
+/**
+ * @hidden
+ */
 export default class BrowserStorage implements IStorage {
     get storage(): typeof window.localStorage;
     get(key: string): Promise<string | undefined>;

package/dist/storage/StorageUtility.d.ts

@@ -1,5 +1,19 @@
+/**
+ * @hidden
+ * @packageDocumentation
+ */
+/**
+ * A helper class that will validate items taken from local storage
+ */
 import type { IStorage } from "@inrupt/solid-client-authn-core";
 import { StorageUtility } from "@inrupt/solid-client-authn-core";
+/**
+ * This class in a no-value-added extension of StorageUtility from the core module.
+ * The reason it has to be declared is for TSyringe to find the decorators in the
+ * same modules as where the dependency container is declared (in this case,
+ * the browser module, with the dependancy container in dependencies.ts).
+ * @hidden
+ */
 export default class StorageUtilityBrowser extends StorageUtility {
     constructor(secureStorage: IStorage, insecureStorage: IStorage);
 }

package/dist/util/UuidGenerator.d.ts

@@ -1,6 +1,12 @@
+/**
+ * @hidden
+ */
 export interface IUuidGenerator {
     v4(): string;
 }
+/**
+ * @hidden
+ */
 export default class UuidGenerator {
     v4(): string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inrupt/solid-client-authn-browser",
-  "version": "1.17.1",
+  "version": "1.17.3",
   "license": "MIT",
   "types": "dist/index.d.ts",
   "browser": "dist/index.js",
@@ -25,19 +25,19 @@
     "build-docs-preview-site": "npm run build-api-docs; cd docs/api; make html"
   },
   "devDependencies": {
-    "@types/node": "^20.1.0",
-    "@types/uuid": "^9.0.1"
+    "@types/node": "^20.6.0",
+    "@types/uuid": "^9.0.4"
   },
   "dependencies": {
-    "@inrupt/oidc-client-ext": "^1.17.1",
-    "@inrupt/solid-client-authn-core": "^1.17.1",
+    "@inrupt/oidc-client-ext": "^1.17.3",
+    "@inrupt/solid-client-authn-core": "^1.17.3",
     "@inrupt/universal-fetch": "^1.0.2",
     "events": "^3.3.0",
-    "jose": "^4.3.7",
-    "uuid": "^9.0.0"
+    "jose": "^4.14.6",
+    "uuid": "^9.0.1"
   },
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "0c27ce0ae0da67838526a538adc78b2f96f9b96b"
+  "gitHead": "ef10e8366ee8511f726b6cf5918f9e9c6653c6cc"
 }

package/rollup.config.mjs

@@ -7,7 +7,7 @@ import { createRequire } from "node:module";
 import { nodeResolve } from '@rollup/plugin-node-resolve';
 import commonjs from '@rollup/plugin-commonjs';
 import terser from '@rollup/plugin-terser';
-import createConfig, { createSharedConfig } from '../../rollup.common.mjs';
+import createConfig, { createSharedConfig } from '@inrupt/base-rollup-config';
 
 const require = createRequire(import.meta.url);
 const pkg = require("./package.json");

package/src/ClientAuthentication.spec.ts

@@ -50,7 +50,7 @@ import { mockDefaultIssuerConfigFetcher } from "./login/oidc/__mocks__/IssuerCon
 
 jest.mock("@inrupt/universal-fetch", () => {
   const fetchModule = jest.requireActual(
-    "@inrupt/universal-fetch"
+    "@inrupt/universal-fetch",
   ) as typeof UniversalFetch;
   return {
     ...fetchModule,
@@ -60,7 +60,7 @@ jest.mock("@inrupt/universal-fetch", () => {
 
 jest.mock("@inrupt/solid-client-authn-core", () => {
   const actualCoreModule = jest.requireActual(
-    "@inrupt/solid-client-authn-core"
+    "@inrupt/solid-client-authn-core",
   ) as typeof SolidClientAuthnCore;
   return {
     ...actualCoreModule,
@@ -78,7 +78,7 @@ const mockSessionStorage = async (
   options: SessionStorageOptions = {
     clientId: "https://some.app/registration",
     issuer: "https://some.issuer",
-  }
+  },
 ): Promise<StorageUtility> => {
   return new StorageUtility(
     mockStorage({
@@ -92,7 +92,7 @@ const mockSessionStorage = async (
         clientId: options.clientId,
         issuer: options.issuer,
       },
-    })
+    }),
   );
 };
 
@@ -107,14 +107,14 @@ describe("ClientAuthentication", () => {
   };
 
   function getClientAuthentication(
-    mocks: Partial<typeof defaultMocks> = defaultMocks
+    mocks: Partial<typeof defaultMocks> = defaultMocks,
   ): ClientAuthentication {
     return new ClientAuthentication(
       mocks.loginHandler ?? defaultMocks.loginHandler,
       mocks.redirectHandler ?? defaultMocks.redirectHandler,
       mocks.logoutHandler ?? defaultMocks.logoutHandler,
       mocks.sessionInfoManager ?? defaultMocks.sessionInfoManager,
-      mocks.issuerConfigFetcher ?? defaultMocks.issuerConfigFetcher
+      mocks.issuerConfigFetcher ?? defaultMocks.issuerConfigFetcher,
     );
   }
 
@@ -144,7 +144,7 @@ describe("ClientAuthentication", () => {
           clientId: "coolApp",
           oidcIssuer: "https://idp.com",
         },
-        mockEmitter
+        mockEmitter,
       );
       expect(defaultMocks.loginHandler.handle).toHaveBeenCalledWith({
         sessionId: "mySession",
@@ -167,7 +167,7 @@ describe("ClientAuthentication", () => {
           redirectUrl: "https://coolapp.com/redirect",
           oidcIssuer: "https://idp.com",
         },
-        mockEmitter
+        mockEmitter,
       );
       expect(defaultMocks.loginHandler.handle).toHaveBeenCalledWith({
         sessionId: "mySession",
@@ -192,7 +192,7 @@ describe("ClientAuthentication", () => {
           oidcIssuer: "https://idp.com",
           tokenType: "Bearer",
         },
-        mockEmitter
+        mockEmitter,
       );
       expect(defaultMocks.loginHandler.handle).toHaveBeenCalledWith({
         sessionId: "mySession",
@@ -214,7 +214,7 @@ describe("ClientAuthentication", () => {
       await nonEmptyStorage.setForUser(
         "someUser",
         { someKey: "someValue" },
-        { secure: true }
+        { secure: true },
       );
       const clientAuthn = getClientAuthentication({
         sessionInfoManager: mockSessionInfoManager(nonEmptyStorage),
@@ -228,17 +228,17 @@ describe("ClientAuthentication", () => {
           redirectUrl: "https://coolapp.com/redirect",
           oidcIssuer: "https://idp.com",
         },
-        mockEmitter
+        mockEmitter,
       );
       await expect(
-        nonEmptyStorage.getForUser("someUser", "someKey", { secure: true })
+        nonEmptyStorage.getForUser("someUser", "someKey", { secure: true }),
       ).resolves.toBeUndefined();
       await expect(
-        nonEmptyStorage.getForUser("someUser", "someKey", { secure: false })
+        nonEmptyStorage.getForUser("someUser", "someKey", { secure: false }),
       ).resolves.toBeUndefined();
       // This test is only necessary until the key is stored safely
       await expect(
-        nonEmptyStorage.get("clientKey", { secure: false })
+        nonEmptyStorage.get("clientKey", { secure: false }),
       ).resolves.toBeUndefined();
     });
 
@@ -253,8 +253,8 @@ describe("ClientAuthentication", () => {
             redirectUrl: "not a valid URL",
             oidcIssuer: "https://idp.com",
           },
-          mockEmitter
-        )
+          mockEmitter,
+        ),
       ).rejects.toThrow();
     });
 
@@ -269,11 +269,39 @@ describe("ClientAuthentication", () => {
             redirectUrl: "https://example.org/redirect#some-fragment",
             oidcIssuer: "https://idp.com",
           },
-          mockEmitter
-        )
+          mockEmitter,
+        ),
       ).rejects.toThrow("hash fragment");
     });
 
+    it("throws if the redirect IRI contains a reserved query parameter, with a helpful message", async () => {
+      const clientAuthn = getClientAuthentication();
+      await expect(() =>
+        clientAuthn.login(
+          {
+            sessionId: "someUser",
+            tokenType: "DPoP",
+            clientId: "coolApp",
+            redirectUrl: "https://example.org/redirect?state=1234",
+            oidcIssuer: "https://idp.com",
+          },
+          mockEmitter,
+        ),
+      ).rejects.toThrow("query parameter");
+      await expect(() =>
+        clientAuthn.login(
+          {
+            sessionId: "someUser",
+            tokenType: "DPoP",
+            clientId: "coolApp",
+            redirectUrl: "https://example.org/redirect?code=1234",
+            oidcIssuer: "https://idp.com",
+          },
+          mockEmitter,
+        ),
+      ).rejects.toThrow("query parameter");
+    });
+
     it("does not normalize the redirect URL if provided by the user", async () => {
       const clientAuthn = getClientAuthentication();
       await clientAuthn.login(
@@ -285,12 +313,12 @@ describe("ClientAuthentication", () => {
           oidcIssuer: "https://idp.com",
           tokenType: "Bearer",
         },
-        mockEmitter
+        mockEmitter,
       );
       expect(defaultMocks.loginHandler.handle).toHaveBeenCalledWith(
         expect.objectContaining({
           redirectUrl: "https://example.org",
-        })
+        }),
       );
     });
   });
@@ -308,8 +336,12 @@ describe("ClientAuthentication", () => {
     // TODO: add tests for events & errors
 
     it("reverts back to un-authenticated fetch on logout", async () => {
-      // eslint-disable-next-line no-restricted-globals
-      history.replaceState = jest.fn();
+      window.history.replaceState = jest
+        .fn<typeof window.history.replaceState>()
+        .mockImplementationOnce((_data, _unused, url) => {
+          // Pretend the current location is updated
+          window.location.href = url as string;
+        });
       const clientAuthn = getClientAuthentication();
 
       const unauthFetch = clientAuthn.fetch;
@@ -337,7 +369,7 @@ describe("ClientAuthentication", () => {
     it("creates a session for the global user", async () => {
       const clientAuthn = getClientAuthentication();
       await expect(() => clientAuthn.getAllSessionInfo()).rejects.toThrow(
-        "Not implemented"
+        "Not implemented",
       );
     });
   });
@@ -355,8 +387,8 @@ describe("ClientAuthentication", () => {
             {
               "solidClientAuthenticationUser:mySession": { ...sessionInfo },
             },
-            true
-          )
+            true,
+          ),
         ),
       });
       const session = await clientAuthn.getSessionInfo("mySession");
@@ -374,16 +406,20 @@ describe("ClientAuthentication", () => {
     mockEmitter.emit = jest.fn<typeof mockEmitter.emit>();
 
     it("calls handle redirect", async () => {
-      // eslint-disable-next-line no-restricted-globals
-      history.replaceState = jest.fn();
+      window.history.replaceState = jest
+        .fn<typeof window.history.replaceState>()
+        .mockImplementationOnce((_data, _unused, url) => {
+          // Pretend the current location is updated
+          window.location.href = url as string;
+        });
       const expectedResult = SessionCreatorCreateResponse;
       const clientAuthn = getClientAuthentication();
       const unauthFetch = clientAuthn.fetch;
       const url =
-        "https://coolapp.com/redirect?state=userId&id_token=idToken&access_token=accessToken";
+        "https://example.org/redirect?state=userId&id_token=idToken&access_token=accessToken";
       const redirectInfo = await clientAuthn.handleIncomingRedirect(
         url,
-        mockEmitter
+        mockEmitter,
       );
 
       // Our injected mocked response may also contain internal-only data (for
@@ -395,11 +431,11 @@ describe("ClientAuthentication", () => {
       expect(redirectInfo?.webId).toEqual(expectedResult.webId);
       expect(redirectInfo?.isLoggedIn).toEqual(expectedResult.isLoggedIn);
       expect(redirectInfo?.expirationDate).toEqual(
-        expectedResult.expirationDate
+        expectedResult.expirationDate,
       );
       expect(defaultMocks.redirectHandler.handle).toHaveBeenCalledWith(
         url,
-        mockEmitter
+        mockEmitter,
       );
 
       // Calling the redirect handler should have updated the fetch.
@@ -408,8 +444,12 @@ describe("ClientAuthentication", () => {
     });
 
     it("clears the current IRI from OAuth query parameters in the auth code flow", async () => {
-      // eslint-disable-next-line no-restricted-globals
-      history.replaceState = jest.fn();
+      window.history.replaceState = jest
+        .fn<typeof window.history.replaceState>()
+        .mockImplementationOnce((_data, _unused, url) => {
+          // Pretend the current location is updated
+          window.location.href = url as string;
+        });
       const clientAuthn = getClientAuthentication();
       const url =
         "https://coolapp.com/redirect?state=someState&code=someAuthCode&iss=someIssuer";
@@ -418,17 +458,21 @@ describe("ClientAuthentication", () => {
       expect(history.replaceState).toHaveBeenCalledWith(
         null,
         "",
-        "https://coolapp.com/redirect"
+        "https://coolapp.com/redirect",
       );
       expect(mockEmitter.emit).not.toHaveBeenCalled();
     });
 
     it("clears the current IRI from OAuth query parameters even if auth flow fails", async () => {
-      // eslint-disable-next-line no-restricted-globals
-      history.replaceState = jest.fn();
+      window.history.replaceState = jest
+        .fn<typeof window.history.replaceState>()
+        .mockImplementationOnce((_data, _unused, url) => {
+          // Pretend the current location is updated
+          window.location.href = url as string;
+        });
 
       mockHandleIncomingRedirect.mockImplementationOnce(() =>
-        Promise.reject(new Error("Something went wrong"))
+        Promise.reject(new Error("Something went wrong")),
       );
 
       const clientAuthn = getClientAuthentication();
@@ -436,48 +480,53 @@ describe("ClientAuthentication", () => {
       const url =
         "https://coolapp.com/redirect?state=someState&code=someAuthCode";
       await clientAuthn.handleIncomingRedirect(url, mockEmitter);
-      // eslint-disable-next-line no-restricted-globals
-      expect(history.replaceState).toHaveBeenCalledWith(
+      expect(window.history.replaceState).toHaveBeenCalledWith(
         null,
         "",
-        "https://coolapp.com/redirect"
+        "https://coolapp.com/redirect",
       );
 
       expect(mockEmitter.emit).toHaveBeenCalledWith(
         EVENTS.ERROR,
         "redirect",
-        new Error("Something went wrong")
+        new Error("Something went wrong"),
       );
     });
 
     it("clears the current IRI from OAuth query parameters in the implicit flow", async () => {
-      // eslint-disable-next-line no-restricted-globals
-      history.replaceState = jest.fn();
+      window.history.replaceState = jest
+        .fn<typeof window.history.replaceState>()
+        .mockImplementationOnce((_data, _unused, url) => {
+          // Pretend the current location is updated
+          window.location.href = url as string;
+        });
       const clientAuthn = getClientAuthentication();
       const url =
         "https://coolapp.com/redirect?state=someState&id_token=idToken&access_token=accessToken";
       await clientAuthn.handleIncomingRedirect(url, mockEmitter);
-      // eslint-disable-next-line no-restricted-globals
-      expect(history.replaceState).toHaveBeenCalledWith(
+      expect(window.history.replaceState).toHaveBeenCalledWith(
         null,
         "",
-        "https://coolapp.com/redirect"
+        "https://coolapp.com/redirect",
       );
       expect(mockEmitter.emit).not.toHaveBeenCalled();
     });
 
     it("preserves non-OAuth query strings", async () => {
-      // eslint-disable-next-line no-restricted-globals
-      history.replaceState = jest.fn();
+      window.history.replaceState = jest
+        .fn<typeof window.history.replaceState>()
+        .mockImplementationOnce((_data, _unused, url) => {
+          // Pretend the current location is updated
+          window.location.href = url as string;
+        });
       const clientAuthn = getClientAuthentication();
       const url =
         "https://coolapp.com/redirect?state=someState&code=someAuthCode&someQuery=someValue";
       await clientAuthn.handleIncomingRedirect(url, mockEmitter);
-      // eslint-disable-next-line no-restricted-globals
-      expect(history.replaceState).toHaveBeenCalledWith(
+      expect(window.history.replaceState).toHaveBeenCalledWith(
         null,
         "",
-        "https://coolapp.com/redirect?someQuery=someValue"
+        "https://coolapp.com/redirect?someQuery=someValue",
       );
       expect(mockEmitter.emit).not.toHaveBeenCalled();
     });
@@ -497,14 +546,14 @@ describe("ClientAuthentication", () => {
           [`${USER_SESSION_PREFIX}:${sessionId}`]: {
             clientId: "https://some.app/registration",
           },
-        })
+        }),
       );
       const clientAuthn = getClientAuthentication({
         sessionInfoManager: mockSessionInfoManager(mockedStorage),
       });
 
       await expect(
-        clientAuthn.validateCurrentSession(sessionId)
+        clientAuthn.validateCurrentSession(sessionId),
       ).resolves.toBeNull();
     });
 
@@ -519,14 +568,14 @@ describe("ClientAuthentication", () => {
         }),
         mockStorage({
           [`${USER_SESSION_PREFIX}:${sessionId}`]: {},
-        })
+        }),
       );
       const clientAuthn = getClientAuthentication({
         sessionInfoManager: mockSessionInfoManager(mockedStorage),
       });
 
       await expect(
-        clientAuthn.validateCurrentSession(sessionId)
+        clientAuthn.validateCurrentSession(sessionId),
       ).resolves.toBeNull();
     });
 
@@ -542,14 +591,14 @@ describe("ClientAuthentication", () => {
       });
 
       await expect(
-        clientAuthn.validateCurrentSession(sessionId)
+        clientAuthn.validateCurrentSession(sessionId),
       ).resolves.toStrictEqual(
         expect.objectContaining({
           issuer: "https://some.issuer",
           clientAppId: "https://some.app/registration",
           sessionId,
           webId: "https://my.pod/profile#me",
-        })
+        }),
       );
     });
   });

package/src/ClientAuthentication.ts

@@ -45,7 +45,7 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
   // Isn't Javascript fun?
   login = async (
     options: ILoginOptions,
-    eventEmitter: EventEmitter
+    eventEmitter: EventEmitter,
   ): Promise<void> => {
     // In order to get a clean start, make sure that the session is logged out
     // on login.
@@ -65,7 +65,7 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
       options.redirectUrl ?? removeOidcQueryParam(window.location.href);
     if (!isValidRedirectUrl(redirectUrl)) {
       throw new Error(
-        `${redirectUrl} is not a valid redirect URL, it is either a malformed IRI or it includes a hash fragment.`
+        `${redirectUrl} is not a valid redirect URL, it is either a malformed IRI, includes a hash fragment, or reserved query parameters ('code' or 'state').`,
       );
     }
     await this.loginHandler.handle({
@@ -82,7 +82,7 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
   // Note that the ID token is not stored, which means the session information
   // cannot be validated at this point.
   validateCurrentSession = async (
-    currentSessionId: string
+    currentSessionId: string,
   ): Promise<(ISessionInfo & ISessionInternalInfo) | null> => {
     const sessionInfo = await this.sessionInfoManager.get(currentSessionId);
     if (
@@ -97,7 +97,7 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
 
   handleIncomingRedirect = async (
     url: string,
-    eventEmitter: EventEmitter
+    eventEmitter: EventEmitter,
   ): Promise<ISessionInfo | undefined> => {
     try {
       const redirectInfo = await this.redirectHandler.handle(url, eventEmitter);
@@ -109,7 +109,7 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
       this.boundLogout = redirectInfo.getLogoutUrl;
 
       // Strip the oauth params:
-      this.cleanUrlAfterRedirect(url);
+      await this.cleanUrlAfterRedirect(url);
 
       return {
         isLoggedIn: redirectInfo.isLoggedIn,
@@ -119,7 +119,7 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
       };
     } catch (err) {
       // Strip the oauth params:
-      this.cleanUrlAfterRedirect(url);
+      await this.cleanUrlAfterRedirect(url);
 
       // FIXME: EVENTS.ERROR should be errorCode, errorDescription
       //
@@ -132,7 +132,7 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
     }
   };
 
-  private cleanUrlAfterRedirect(url: string): void {
+  private async cleanUrlAfterRedirect(url: string): Promise<void> {
     const cleanedUpUrl = new URL(url);
     cleanedUpUrl.searchParams.delete("state");
     // For auth code flow
@@ -151,5 +151,16 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
     // authentication library will be called again with what are now invalid
     // query parameters!).
     window.history.replaceState(null, "", cleanedUpUrl.toString());
+    while (window.location.href !== cleanedUpUrl.href) {
+      // Poll the current URL every ms. Active polling is required because
+      // window.history.replaceState is asynchronous, but the associated
+      // 'popstate' event which should be listened to is only sent on active
+      // navigation, which we will not have here.
+      // See https://developer.mozilla.org/en-US/docs/Web/API/Window/popstate_event#when_popstate_is_sent
+      // eslint-disable-next-line no-await-in-loop
+      await new Promise<void>((resolve) => {
+        setTimeout(() => resolve(), 1);
+      });
+    }
   }
 }