@inrupt/solid-client-authn-browser 1.17.2 → 1.17.4

package/dist/storage/BrowserStorage.d.ts

@@ -1,4 +1,11 @@
+/**
+ * @hidden
+ * @packageDocumentation
+ */
 import type { IStorage } from "@inrupt/solid-client-authn-core";
+/**
+ * @hidden
+ */
 export default class BrowserStorage implements IStorage {
     get storage(): typeof window.localStorage;
     get(key: string): Promise<string | undefined>;

package/dist/storage/StorageUtility.d.ts

@@ -1,5 +1,19 @@
+/**
+ * @hidden
+ * @packageDocumentation
+ */
+/**
+ * A helper class that will validate items taken from local storage
+ */
 import type { IStorage } from "@inrupt/solid-client-authn-core";
 import { StorageUtility } from "@inrupt/solid-client-authn-core";
+/**
+ * This class in a no-value-added extension of StorageUtility from the core module.
+ * The reason it has to be declared is for TSyringe to find the decorators in the
+ * same modules as where the dependency container is declared (in this case,
+ * the browser module, with the dependancy container in dependencies.ts).
+ * @hidden
+ */
 export default class StorageUtilityBrowser extends StorageUtility {
     constructor(secureStorage: IStorage, insecureStorage: IStorage);
 }

package/dist/util/UuidGenerator.d.ts

@@ -1,6 +1,12 @@
+/**
+ * @hidden
+ */
 export interface IUuidGenerator {
     v4(): string;
 }
+/**
+ * @hidden
+ */
 export default class UuidGenerator {
     v4(): string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inrupt/solid-client-authn-browser",
-  "version": "1.17.2",
+  "version": "1.17.4",
   "license": "MIT",
   "types": "dist/index.d.ts",
   "browser": "dist/index.js",
@@ -26,18 +26,18 @@
   },
   "devDependencies": {
     "@types/node": "^20.6.0",
-    "@types/uuid": "^9.0.1"
+    "@types/uuid": "^9.0.4"
   },
   "dependencies": {
-    "@inrupt/oidc-client-ext": "^1.17.2",
-    "@inrupt/solid-client-authn-core": "^1.17.2",
+    "@inrupt/oidc-client-ext": "^1.17.4",
+    "@inrupt/solid-client-authn-core": "^1.17.4",
     "@inrupt/universal-fetch": "^1.0.2",
     "events": "^3.3.0",
-    "jose": "^4.14.6",
-    "uuid": "^9.0.0"
+    "jose": "^4.15.4",
+    "uuid": "^9.0.1"
   },
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "5818a79b875812ca93235fca64c65d2ba5b59fc3"
+  "gitHead": "88355026c275933dc54ab078c4fd9b257cb7c50e"
 }

package/src/ClientAuthentication.spec.ts

@@ -336,8 +336,12 @@ describe("ClientAuthentication", () => {
     // TODO: add tests for events & errors
 
     it("reverts back to un-authenticated fetch on logout", async () => {
-      // eslint-disable-next-line no-restricted-globals
-      history.replaceState = jest.fn();
+      window.history.replaceState = jest
+        .fn<typeof window.history.replaceState>()
+        .mockImplementationOnce((_data, _unused, url) => {
+          // Pretend the current location is updated
+          window.location.href = url as string;
+        });
       const clientAuthn = getClientAuthentication();
 
       const unauthFetch = clientAuthn.fetch;
@@ -402,13 +406,17 @@ describe("ClientAuthentication", () => {
     mockEmitter.emit = jest.fn<typeof mockEmitter.emit>();
 
     it("calls handle redirect", async () => {
-      // eslint-disable-next-line no-restricted-globals
-      history.replaceState = jest.fn();
+      window.history.replaceState = jest
+        .fn<typeof window.history.replaceState>()
+        .mockImplementationOnce((_data, _unused, url) => {
+          // Pretend the current location is updated
+          window.location.href = url as string;
+        });
       const expectedResult = SessionCreatorCreateResponse;
       const clientAuthn = getClientAuthentication();
       const unauthFetch = clientAuthn.fetch;
       const url =
-        "https://coolapp.com/redirect?state=userId&id_token=idToken&access_token=accessToken";
+        "https://example.org/redirect?state=userId&id_token=idToken&access_token=accessToken";
       const redirectInfo = await clientAuthn.handleIncomingRedirect(
         url,
         mockEmitter,
@@ -436,8 +444,12 @@ describe("ClientAuthentication", () => {
     });
 
     it("clears the current IRI from OAuth query parameters in the auth code flow", async () => {
-      // eslint-disable-next-line no-restricted-globals
-      history.replaceState = jest.fn();
+      window.history.replaceState = jest
+        .fn<typeof window.history.replaceState>()
+        .mockImplementationOnce((_data, _unused, url) => {
+          // Pretend the current location is updated
+          window.location.href = url as string;
+        });
       const clientAuthn = getClientAuthentication();
       const url =
         "https://coolapp.com/redirect?state=someState&code=someAuthCode&iss=someIssuer";
@@ -452,8 +464,12 @@ describe("ClientAuthentication", () => {
     });
 
     it("clears the current IRI from OAuth query parameters even if auth flow fails", async () => {
-      // eslint-disable-next-line no-restricted-globals
-      history.replaceState = jest.fn();
+      window.history.replaceState = jest
+        .fn<typeof window.history.replaceState>()
+        .mockImplementationOnce((_data, _unused, url) => {
+          // Pretend the current location is updated
+          window.location.href = url as string;
+        });
 
       mockHandleIncomingRedirect.mockImplementationOnce(() =>
         Promise.reject(new Error("Something went wrong")),
@@ -464,8 +480,7 @@ describe("ClientAuthentication", () => {
       const url =
         "https://coolapp.com/redirect?state=someState&code=someAuthCode";
       await clientAuthn.handleIncomingRedirect(url, mockEmitter);
-      // eslint-disable-next-line no-restricted-globals
-      expect(history.replaceState).toHaveBeenCalledWith(
+      expect(window.history.replaceState).toHaveBeenCalledWith(
         null,
         "",
         "https://coolapp.com/redirect",
@@ -478,31 +493,18 @@ describe("ClientAuthentication", () => {
       );
     });
 
-    it("clears the current IRI from OAuth query parameters in the implicit flow", async () => {
-      // eslint-disable-next-line no-restricted-globals
-      history.replaceState = jest.fn();
-      const clientAuthn = getClientAuthentication();
-      const url =
-        "https://coolapp.com/redirect?state=someState&id_token=idToken&access_token=accessToken";
-      await clientAuthn.handleIncomingRedirect(url, mockEmitter);
-      // eslint-disable-next-line no-restricted-globals
-      expect(history.replaceState).toHaveBeenCalledWith(
-        null,
-        "",
-        "https://coolapp.com/redirect",
-      );
-      expect(mockEmitter.emit).not.toHaveBeenCalled();
-    });
-
     it("preserves non-OAuth query strings", async () => {
-      // eslint-disable-next-line no-restricted-globals
-      history.replaceState = jest.fn();
+      window.history.replaceState = jest
+        .fn<typeof window.history.replaceState>()
+        .mockImplementationOnce((_data, _unused, url) => {
+          // Pretend the current location is updated
+          window.location.href = url as string;
+        });
       const clientAuthn = getClientAuthentication();
       const url =
         "https://coolapp.com/redirect?state=someState&code=someAuthCode&someQuery=someValue";
       await clientAuthn.handleIncomingRedirect(url, mockEmitter);
-      // eslint-disable-next-line no-restricted-globals
-      expect(history.replaceState).toHaveBeenCalledWith(
+      expect(window.history.replaceState).toHaveBeenCalledWith(
         null,
         "",
         "https://coolapp.com/redirect?someQuery=someValue",

package/src/ClientAuthentication.ts

@@ -33,8 +33,9 @@ import {
   EVENTS,
   isValidRedirectUrl,
   ClientAuthentication as ClientAuthenticationBase,
+  removeOpenIdParams,
 } from "@inrupt/solid-client-authn-core";
-import { removeOidcQueryParam } from "@inrupt/oidc-client-ext";
+import { normalizeCallbackUrl } from "@inrupt/oidc-client-ext";
 import type { EventEmitter } from "events";
 
 /**
@@ -62,7 +63,7 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
     // normalization only applies if we default to the current location (which is
     // a bad practice and should be discouraged).
     const redirectUrl =
-      options.redirectUrl ?? removeOidcQueryParam(window.location.href);
+      options.redirectUrl ?? normalizeCallbackUrl(window.location.href);
     if (!isValidRedirectUrl(redirectUrl)) {
       throw new Error(
         `${redirectUrl} is not a valid redirect URL, it is either a malformed IRI, includes a hash fragment, or reserved query parameters ('code' or 'state').`,
@@ -109,7 +110,7 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
       this.boundLogout = redirectInfo.getLogoutUrl;
 
       // Strip the oauth params:
-      this.cleanUrlAfterRedirect(url);
+      await this.cleanUrlAfterRedirect(url);
 
       return {
         isLoggedIn: redirectInfo.isLoggedIn,
@@ -119,7 +120,7 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
       };
     } catch (err) {
       // Strip the oauth params:
-      this.cleanUrlAfterRedirect(url);
+      await this.cleanUrlAfterRedirect(url);
 
       // FIXME: EVENTS.ERROR should be errorCode, errorDescription
       //
@@ -132,24 +133,25 @@ export default class ClientAuthentication extends ClientAuthenticationBase {
     }
   };
 
-  private cleanUrlAfterRedirect(url: string): void {
-    const cleanedUpUrl = new URL(url);
-    cleanedUpUrl.searchParams.delete("state");
-    // For auth code flow
-    cleanedUpUrl.searchParams.delete("code");
-    // For implicit flow
-    cleanedUpUrl.searchParams.delete("id_token");
-    cleanedUpUrl.searchParams.delete("access_token");
-    // For login error
-    cleanedUpUrl.searchParams.delete("error");
-    cleanedUpUrl.searchParams.delete("error_description");
-    cleanedUpUrl.searchParams.delete("iss");
+  private async cleanUrlAfterRedirect(url: string): Promise<void> {
+    const cleanedUpUrl = removeOpenIdParams(url).href;
 
     // Remove OAuth-specific query params (since the login flow finishes with
     // the browser being redirected back with OAuth2 query params (e.g. for
     // 'code' and 'state'), and so if the user simply refreshes this page our
     // authentication library will be called again with what are now invalid
     // query parameters!).
-    window.history.replaceState(null, "", cleanedUpUrl.toString());
+    window.history.replaceState(null, "", cleanedUpUrl);
+    while (window.location.href !== cleanedUpUrl) {
+      // Poll the current URL every ms. Active polling is required because
+      // window.history.replaceState is asynchronous, but the associated
+      // 'popstate' event which should be listened to is only sent on active
+      // navigation, which we will not have here.
+      // See https://developer.mozilla.org/en-US/docs/Web/API/Window/popstate_event#when_popstate_is_sent
+      // eslint-disable-next-line no-await-in-loop
+      await new Promise<void>((resolve) => {
+        setTimeout(() => resolve(), 1);
+      });
+    }
   }
 }

package/src/Session.spec.ts

@@ -246,10 +246,9 @@ describe("Session", () => {
     it("uses current window location as default redirect URL", async () => {
       mockLocation("https://some.url");
       const clientAuthentication = mockClientAuthentication();
-      const incomingRedirectHandler = jest.spyOn(
-        clientAuthentication,
-        "handleIncomingRedirect",
-      );
+      const incomingRedirectHandler = jest
+        .spyOn(clientAuthentication, "handleIncomingRedirect")
+        .mockResolvedValue(undefined);
 
       const mySession = new Session({ clientAuthentication });
       await mySession.handleIncomingRedirect();
@@ -259,13 +258,12 @@ describe("Session", () => {
       );
     });
 
-    it("wraps up ClientAuthentication handleIncomingRedirect", async () => {
+    it("wraps ClientAuthentication handleIncomingRedirect", async () => {
       mockLocation("https://some.url");
       const clientAuthentication = mockClientAuthentication();
-      const incomingRedirectHandler = jest.spyOn(
-        clientAuthentication,
-        "handleIncomingRedirect",
-      );
+      const incomingRedirectHandler = jest
+        .spyOn(clientAuthentication, "handleIncomingRedirect")
+        .mockResolvedValue(undefined);
       const mySession = new Session({ clientAuthentication });
       await mySession.handleIncomingRedirect("https://some.url");
       expect(incomingRedirectHandler).toHaveBeenCalled();
@@ -401,10 +399,9 @@ describe("Session", () => {
 
     it("preserves a binding to its Session instance", async () => {
       const clientAuthentication = mockClientAuthentication();
-      const incomingRedirectHandler = jest.spyOn(
-        clientAuthentication,
-        "handleIncomingRedirect",
-      );
+      const incomingRedirectHandler = jest
+        .spyOn(clientAuthentication, "handleIncomingRedirect")
+        .mockResolvedValue(undefined);
       const mySession = new Session({ clientAuthentication });
       const objectWithHandleIncomingRedirect = {
         handleIncomingRedirect: mySession.handleIncomingRedirect,