@jbrowse/plugin-authentication 2.5.0 → 2.6.2

package/dist/OAuthModel/configSchema.js

@@ -67,18 +67,10 @@ const OAuthConfigSchema = (0, configuration_1.ConfigurationSchema)('OAuthInterne
      * #slot
      */
     responseType: {
-        description: 'the type of response from the authorization endpoint',
+        description: "the type of response from the authorization endpoint. can be 'token' or 'code'",
         type: 'string',
         defaultValue: 'code',
     },
-    /**
-     * #slot
-     */
-    hasRefreshToken: {
-        description: 'true if the endpoint can supply a refresh token',
-        type: 'boolean',
-        defaultValue: false,
-    },
 }, {
     /**
      * #baseConfiguration
@@ -87,4 +79,3 @@ const OAuthConfigSchema = (0, configuration_1.ConfigurationSchema)('OAuthInterne
     explicitlyTyped: true,
 });
 exports.default = OAuthConfigSchema;
-//# sourceMappingURL=configSchema.js.map

package/dist/OAuthModel/index.js

@@ -8,4 +8,3 @@ var configSchema_1 = require("./configSchema");
 Object.defineProperty(exports, "configSchema", { enumerable: true, get: function () { return __importDefault(configSchema_1).default; } });
 var model_1 = require("./model");
 Object.defineProperty(exports, "modelFactory", { enumerable: true, get: function () { return __importDefault(model_1).default; } });
-//# sourceMappingURL=index.js.map

package/dist/OAuthModel/model.d.ts

@@ -1,6 +1,9 @@
 /// <reference types="react" />
 import { UriLocation } from '@jbrowse/core/util';
 import { Instance } from 'mobx-state-tree';
+/**
+ * #stateModel OAuthInternetAccount
+ */
 declare const stateModelFactory: (configSchema: import("@jbrowse/core/configuration/configurationSchema").ConfigurationSchemaType<{
     tokenType: {
         description: string;
@@ -23,7 +26,9 @@ declare const stateModelFactory: (configSchema: import("@jbrowse/core/configurat
         defaultValue: boolean;
     };
     clientId: {
-        description: string;
+        description: string; /**
+         * #getter
+         */
         type: string;
         defaultValue: string;
     };
@@ -42,11 +47,6 @@ declare const stateModelFactory: (configSchema: import("@jbrowse/core/configurat
         type: string;
         defaultValue: string;
     };
-    hasRefreshToken: {
-        description: string;
-        type: string;
-        defaultValue: boolean;
-    };
 }, import("@jbrowse/core/configuration/configurationSchema").ConfigurationSchemaOptions<import("@jbrowse/core/configuration/configurationSchema").ConfigurationSchemaType<{
     name: {
         description: string;
@@ -98,13 +98,21 @@ declare const stateModelFactory: (configSchema: import("@jbrowse/core/configurat
             defaultValue: string;
         };
         domains: {
-            description: string;
+            description: string; /**
+             * #getter
+             */
             type: string;
             defaultValue: never[];
         };
     }, import("@jbrowse/core/configuration/configurationSchema").ConfigurationSchemaOptions<undefined, "internetAccountId">>;
 } & {
+    /**
+     * #property
+     */
     type: import("mobx-state-tree").ISimpleType<"OAuthInternetAccount">;
+    /**
+     * #property
+     */
     configuration: import("@jbrowse/core/configuration/configurationSchema").ConfigurationSchemaType<{
         tokenType: {
             description: string;
@@ -127,7 +135,9 @@ declare const stateModelFactory: (configSchema: import("@jbrowse/core/configurat
             defaultValue: boolean;
         };
         clientId: {
-            description: string;
+            description: string; /**
+             * #getter
+             */
             type: string;
             defaultValue: string;
         };
@@ -146,11 +156,6 @@ declare const stateModelFactory: (configSchema: import("@jbrowse/core/configurat
             type: string;
             defaultValue: string;
         };
-        hasRefreshToken: {
-            description: string;
-            type: string;
-            defaultValue: boolean;
-        };
     }, import("@jbrowse/core/configuration/configurationSchema").ConfigurationSchemaOptions<import("@jbrowse/core/configuration/configurationSchema").ConfigurationSchemaType<{
         name: {
             description: string;
@@ -181,9 +186,13 @@ declare const stateModelFactory: (configSchema: import("@jbrowse/core/configurat
 }, {
     readonly name: string;
     readonly description: string;
-    readonly internetAccountId: string;
+    readonly internetAccountId: string; /**
+     * #getter
+     */
     readonly authHeader: string;
-    readonly tokenType: string;
+    readonly tokenType: string; /**
+     * #getter
+     */
     readonly domains: string[];
     readonly toggleContents: import("react").ReactNode;
     readonly SelectorComponent: import("@jbrowse/core/util").AnyReactComponentType | undefined;
@@ -218,7 +227,10 @@ declare const stateModelFactory: (configSchema: import("@jbrowse/core/configurat
     getPreAuthorizationInformation(location: UriLocation): Promise<{
         internetAccountType: string;
         authInfo: {
-            token: string;
+            token: string; /**
+             * #action
+             * used to listen to child window for auth code/token
+             */
             configuration: any;
         };
     }>;
@@ -227,34 +239,107 @@ declare const stateModelFactory: (configSchema: import("@jbrowse/core/configurat
 } & {
     openLocation(location: UriLocation): import("@jbrowse/core/util/io").RemoteFileWithRangeCache;
 } & {
+    /**
+     * #getter
+     */
     readonly codeVerifierPKCE: string;
 } & {
+    /**
+     * #getter
+     */
     readonly authEndpoint: string;
+    /**
+     * #getter
+     */
     readonly tokenEndpoint: string;
+    /**
+     * #getter
+     */
     readonly needsPKCE: boolean;
+    /**
+     * #getter
+     */
     readonly clientId: string;
+    /**
+     * #getter
+     */
     readonly scopes: string;
     /**
-     * OAuth state parameter: https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1
+     * #method
+     * OAuth state parameter:
+     * https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1
+     *
      * Can override or extend if dynamic state is needed.
      */
     state(): string | undefined;
+    /**
+     * #getter
+     */
     readonly responseType: "code" | "token";
-    readonly hasRefreshToken: boolean;
+    /**
+     * #getter
+     */
     readonly refreshTokenKey: string;
 } & {
+    /**
+     * #action
+     */
     storeRefreshToken(refreshToken: string): void;
+    /**
+     * #action
+     */
     removeRefreshToken(): void;
+    /**
+     * #method
+     */
     retrieveRefreshToken(): string | null;
+    /**
+     * #action
+     */
     exchangeAuthorizationForAccessToken(token: string, redirectUri: string): Promise<string>;
+    /**
+     * #action
+     */
     exchangeRefreshForAccessToken(refreshToken: string): Promise<string>;
 } & {
+    /**
+     * #action
+     * used to listen to child window for auth code/token
+     */
     addMessageChannel(resolve: (token: string) => void, reject: (error: Error) => void): void;
+    /**
+     * #action
+     */
     deleteMessageChannel(): void;
+    /**
+     * #action
+     */
     finishOAuthWindow(event: MessageEvent, resolve: (token: string) => void, reject: (error: Error) => void): Promise<void>;
+    /**
+     * #action
+     * opens external OAuth flow, popup for web and new browser window for
+     * desktop
+     */
     useEndpointForAuthorization(resolve: (token: string) => void, reject: (error: Error) => void): Promise<void>;
+    /**
+     * #action
+     */
     getTokenFromUser(resolve: (token: string) => void, reject: (error: Error) => void): Promise<void>;
+    /**
+     * #action
+     */
     validateToken(token: string, location: UriLocation): Promise<string>;
+} & {
+    /**
+     * #action
+     * Get a fetch method that will add any needed authentication headers to
+     * the request before sending it. If location is provided, it will be
+     * checked to see if it includes a token in it's pre-auth information.
+     *
+     * @param loc - UriLocation of the resource
+     * @returns A function that can be used to fetch
+     */
+    getFetcher(loc?: UriLocation): (input: RequestInfo, init?: RequestInit) => Promise<Response>;
 }, import("mobx-state-tree")._NotCustomized, import("mobx-state-tree")._NotCustomized>;
 export default stateModelFactory;
 export type OAuthStateModel = ReturnType<typeof stateModelFactory>;

package/dist/OAuthModel/model.js

@@ -1,172 +1,174 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 const configuration_1 = require("@jbrowse/core/configuration");
 const models_1 = require("@jbrowse/core/pluggableElementTypes/models");
 const util_1 = require("@jbrowse/core/util");
 const mobx_state_tree_1 = require("mobx-state-tree");
-const jwt_decode_1 = __importDefault(require("jwt-decode"));
-function fixup(buf) {
-    return buf.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
-}
+const util_2 = require("./util");
+const util_3 = require("../util");
+/**
+ * #stateModel OAuthInternetAccount
+ */
 const stateModelFactory = (configSchema) => {
     return models_1.InternetAccount.named('OAuthInternetAccount')
         .props({
+        /**
+         * #property
+         */
         type: mobx_state_tree_1.types.literal('OAuthInternetAccount'),
+        /**
+         * #property
+         */
         configuration: (0, configuration_1.ConfigurationReference)(configSchema),
     })
         .views(() => {
         let codeVerifier = undefined;
         return {
+            /**
+             * #getter
+             */
             get codeVerifierPKCE() {
                 if (codeVerifier) {
                     return codeVerifier;
                 }
                 const array = new Uint8Array(32);
                 globalThis.crypto.getRandomValues(array);
-                codeVerifier = fixup(Buffer.from(array).toString('base64'));
+                codeVerifier = (0, util_2.fixup)(Buffer.from(array).toString('base64'));
                 return codeVerifier;
             },
         };
     })
         .views(self => ({
+        /**
+         * #getter
+         */
         get authEndpoint() {
             return (0, configuration_1.getConf)(self, 'authEndpoint');
         },
+        /**
+         * #getter
+         */
         get tokenEndpoint() {
             return (0, configuration_1.getConf)(self, 'tokenEndpoint');
         },
+        /**
+         * #getter
+         */
         get needsPKCE() {
             return (0, configuration_1.getConf)(self, 'needsPKCE');
         },
+        /**
+         * #getter
+         */
         get clientId() {
             return (0, configuration_1.getConf)(self, 'clientId');
         },
+        /**
+         * #getter
+         */
         get scopes() {
             return (0, configuration_1.getConf)(self, 'scopes');
         },
         /**
-         * OAuth state parameter: https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1
+         * #method
+         * OAuth state parameter:
+         * https://www.rfc-editor.org/rfc/rfc6749#section-4.1.1
+         *
          * Can override or extend if dynamic state is needed.
          */
         state() {
-            return (0, configuration_1.getConf)(self, 'state') || undefined;
+            return (0, configuration_1.getConf)(self, 'state');
         },
+        /**
+         * #getter
+         */
         get responseType() {
             return (0, configuration_1.getConf)(self, 'responseType');
         },
-        get hasRefreshToken() {
-            return (0, configuration_1.getConf)(self, 'hasRefreshToken');
-        },
+        /**
+         * #getter
+         */
         get refreshTokenKey() {
             return `${self.internetAccountId}-refreshToken`;
         },
     }))
         .actions(self => ({
+        /**
+         * #action
+         */
         storeRefreshToken(refreshToken) {
             localStorage.setItem(self.refreshTokenKey, refreshToken);
         },
+        /**
+         * #action
+         */
         removeRefreshToken() {
             localStorage.removeItem(self.refreshTokenKey);
         },
+        /**
+         * #method
+         */
         retrieveRefreshToken() {
             return localStorage.getItem(self.refreshTokenKey);
         },
+        /**
+         * #action
+         */
         async exchangeAuthorizationForAccessToken(token, redirectUri) {
-            const data = {
+            const params = new URLSearchParams(Object.entries({
                 code: token,
                 grant_type: 'authorization_code',
                 client_id: self.clientId,
-                code_verifier: self.codeVerifierPKCE,
                 redirect_uri: redirectUri,
-            };
-            const params = new URLSearchParams(Object.entries(data));
+                ...(self.needsPKCE ? { code_verifier: self.codeVerifierPKCE } : {}),
+            }));
             const response = await fetch(self.tokenEndpoint, {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
                 body: params.toString(),
             });
             if (!response.ok) {
-                let errorMessage;
-                try {
-                    errorMessage = await response.text();
-                }
-                catch (error) {
-                    errorMessage = '';
-                }
-                throw new Error(`Failed to obtain token from endpoint: ${response.status} (${response.statusText})${errorMessage ? ` (${errorMessage})` : ''}`);
+                throw new Error(await (0, util_3.getResponseError)({
+                    response,
+                    reason: 'Failed to obtain token',
+                }));
             }
-            const accessToken = await response.json();
-            if (accessToken.refresh_token) {
-                this.storeRefreshToken(accessToken.refresh_token);
-            }
-            return accessToken.access_token;
+            const data = await response.json();
+            return (0, util_2.processTokenResponse)(data, token => this.storeRefreshToken(token));
         },
+        /**
+         * #action
+         */
         async exchangeRefreshForAccessToken(refreshToken) {
-            var _a;
-            const data = {
-                grant_type: 'refresh_token',
-                refresh_token: refreshToken,
-                client_id: self.clientId,
-            };
-            const params = new URLSearchParams(Object.entries(data));
             const response = await fetch(self.tokenEndpoint, {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-                body: params.toString(),
+                body: new URLSearchParams(Object.entries({
+                    grant_type: 'refresh_token',
+                    refresh_token: refreshToken,
+                    client_id: self.clientId,
+                })).toString(),
             });
             if (!response.ok) {
                 self.removeToken();
-                let text = await response.text();
-                try {
-                    const obj = JSON.parse(text);
-                    if (obj.error === 'invalid_grant') {
-                        this.removeRefreshToken();
-                    }
-                    text = (_a = obj === null || obj === void 0 ? void 0 : obj.error_description) !== null && _a !== void 0 ? _a : text;
-                }
-                catch (e) {
-                    /* just use original text as error */
-                }
-                throw new Error(`Network response failure — ${response.status} (${response.statusText}) ${text ? ` (${text})` : ''}`);
+                const text = await response.text();
+                throw new Error(await (0, util_3.getResponseError)({
+                    response,
+                    statusText: (0, util_2.processError)(text, () => this.removeRefreshToken()),
+                }));
             }
-            const accessToken = await response.json();
-            if (accessToken.refresh_token) {
-                this.storeRefreshToken(accessToken.refresh_token);
-            }
-            return accessToken.access_token;
+            const data = await response.json();
+            return (0, util_2.processTokenResponse)(data, token => this.storeRefreshToken(token));
         },
     }))
         .actions(self => {
         let listener;
-        let refreshTokenPromise = undefined;
+        let exchangedTokenPromise = undefined;
         return {
-            // used to listen to child window for auth code/token
+            /**
+             * #action
+             * used to listen to child window for auth code/token
+             */
             addMessageChannel(resolve, reject) {
                 listener = event => {
                     // this should probably get better handling, but ignored for now
@@ -175,9 +177,15 @@ const stateModelFactory = (configSchema) => {
                 };
                 window.addEventListener('message', listener);
             },
+            /**
+             * #action
+             */
             deleteMessageChannel() {
                 window.removeEventListener('message', listener);
             },
+            /**
+             * #action
+             */
             async finishOAuthWindow(event, resolve, reject) {
                 if (event.data.name !== `JBrowseAuthWindow-${self.internetAccountId}`) {
                     return this.deleteMessageChannel();
@@ -205,21 +213,25 @@ const stateModelFactory = (configSchema) => {
                         self.storeToken(token);
                         return resolve(token);
                     }
-                    catch (error) {
-                        return error instanceof Error
-                            ? reject(error)
-                            : reject(new Error(String(error)));
+                    catch (e) {
+                        return e instanceof Error
+                            ? reject(e)
+                            : reject(new Error(String(e)));
                     }
                 }
                 if (redirectUriWithInfo.includes('access_denied')) {
                     return reject(new Error('OAuth flow was cancelled'));
                 }
                 if (redirectUriWithInfo.includes('error')) {
-                    return reject(new Error('Oauth flow error: ' + queryStringSearch));
+                    return reject(new Error('OAuth flow error: ' + queryStringSearch));
                 }
                 this.deleteMessageChannel();
             },
-            // opens external OAuth flow, popup for web and new browser window for desktop
+            /**
+             * #action
+             * opens external OAuth flow, popup for web and new browser window for
+             * desktop
+             */
             async useEndpointForAuthorization(resolve, reject) {
                 const redirectUri = util_1.isElectron
                     ? 'http://localhost/auth'
@@ -228,6 +240,7 @@ const stateModelFactory = (configSchema) => {
                     client_id: self.clientId,
                     redirect_uri: redirectUri,
                     response_type: self.responseType || 'code',
+                    token_access_type: 'offline',
                 };
                 if (self.state()) {
                     data.state = self.state();
@@ -236,16 +249,9 @@ const stateModelFactory = (configSchema) => {
                     data.scope = self.scopes;
                 }
                 if (self.needsPKCE) {
-                    const { codeVerifierPKCE } = self;
-                    const sha256 = await Promise.resolve().then(() => __importStar(require('crypto-js/sha256'))).then(f => f.default);
-                    const Base64 = await Promise.resolve().then(() => __importStar(require('crypto-js/enc-base64')));
-                    const codeChallenge = fixup(Base64.stringify(sha256(codeVerifierPKCE)));
-                    data.code_challenge = codeChallenge;
+                    data.code_challenge = await (0, util_2.generateChallenge)(self.codeVerifierPKCE);
                     data.code_challenge_method = 'S256';
                 }
-                if (self.hasRefreshToken) {
-                    data.token_access_type = 'offline';
-                }
                 const params = new URLSearchParams(Object.entries(data));
                 const url = new URL(self.authEndpoint);
                 url.search = params.toString();
@@ -265,45 +271,90 @@ const stateModelFactory = (configSchema) => {
                     this.finishOAuthWindow(eventFromDesktop, resolve, reject);
                 }
                 else {
-                    const options = `width=500,height=600,left=0,top=0`;
-                    window.open(url, eventName, options);
+                    window.open(url, eventName, `width=500,height=600,left=0,top=0`);
                 }
             },
+            /**
+             * #action
+             */
             async getTokenFromUser(resolve, reject) {
-                const refreshToken = self.hasRefreshToken && self.retrieveRefreshToken();
+                const refreshToken = self.retrieveRefreshToken();
+                let doUserFlow = true;
+                // if there is a refresh token, then try it out, and only if that
+                // refresh token succeeds, set doUserFlow to false
                 if (refreshToken) {
-                    resolve(await self.exchangeRefreshForAccessToken(refreshToken));
+                    try {
+                        const token = await self.exchangeRefreshForAccessToken(refreshToken);
+                        resolve(token);
+                        doUserFlow = false;
+                    }
+                    catch (e) {
+                        console.error(e);
+                        self.removeRefreshToken();
+                    }
+                }
+                if (doUserFlow) {
+                    this.addMessageChannel(resolve, reject);
+                    // may want to improve handling
+                    // eslint-disable-next-line @typescript-eslint/no-floating-promises
+                    this.useEndpointForAuthorization(resolve, reject);
                 }
-                this.addMessageChannel(resolve, reject);
-                // may want to improve handling
-                // eslint-disable-next-line @typescript-eslint/no-floating-promises
-                this.useEndpointForAuthorization(resolve, reject);
             },
+            /**
+             * #action
+             */
             async validateToken(token, location) {
-                const decoded = (0, jwt_decode_1.default)(token);
-                if (decoded.exp && decoded.exp < Date.now() / 1000) {
-                    const refreshToken = self.hasRefreshToken && self.retrieveRefreshToken();
+                const newInit = self.addAuthHeaderToInit({ method: 'HEAD' }, token);
+                const response = await fetch(location.uri, newInit);
+                if (!response.ok) {
+                    self.removeToken();
+                    const refreshToken = self.retrieveRefreshToken();
                     if (refreshToken) {
                         try {
-                            if (!refreshTokenPromise) {
-                                refreshTokenPromise =
+                            if (!exchangedTokenPromise) {
+                                exchangedTokenPromise =
                                     self.exchangeRefreshForAccessToken(refreshToken);
                             }
-                            const newToken = await refreshTokenPromise;
-                            return this.validateToken(newToken, location);
+                            const newToken = await exchangedTokenPromise;
+                            exchangedTokenPromise = undefined;
+                            return newToken;
                         }
                         catch (err) {
-                            throw new Error(`Token could not be refreshed. ${err}`);
+                            console.error('Token could not be refreshed', err);
+                            // let original error be thrown
                         }
                     }
-                }
-                else {
-                    refreshTokenPromise = undefined;
+                    throw new Error(await (0, util_3.getResponseError)({
+                        response,
+                        reason: 'Error validating token',
+                    }));
                 }
                 return token;
             },
         };
+    })
+        .actions(self => {
+        const superGetFetcher = self.getFetcher;
+        return {
+            /**
+             * #action
+             * Get a fetch method that will add any needed authentication headers to
+             * the request before sending it. If location is provided, it will be
+             * checked to see if it includes a token in it's pre-auth information.
+             *
+             * @param loc - UriLocation of the resource
+             * @returns A function that can be used to fetch
+             */
+            getFetcher(loc) {
+                const fetcher = superGetFetcher(loc);
+                return async (input, init) => {
+                    if (loc) {
+                        await self.validateToken(await self.getToken(loc), loc);
+                    }
+                    return fetcher(input, init);
+                };
+            },
+        };
     });
 };
 exports.default = stateModelFactory;
-//# sourceMappingURL=model.js.map