@jetbrains/ring-ui 4.1.3 → 5.0.0-beta.0

package/components/auth/storage.test.ts

@@ -0,0 +1,182 @@
+import LocalStorage from '../storage/storage__local';
+
+import AuthStorage from './storage';
+import TokenValidator from './token-validator';
+
+// eslint-disable-next-line import/no-commonjs
+const MockedStorage: typeof LocalStorage = require('imports-loader?imports=default|storage-mock|window!../storage/storage__local').default;
+
+const TICK = 100;
+
+describe('Auth', () => {
+  describe('AuthStorage', () => {
+    const authStorage = new AuthStorage({
+      stateKeyPrefix: 'state',
+      tokenKey: 'token'
+    });
+    const stateId = 'unique';
+
+    afterEach(() => {
+      localStorage.clear();
+    });
+
+    describe('saveState', () => {
+      it('should be fulfilled', () => authStorage.saveState(stateId, {
+        restoreLocation: 'http://localhost:8080/hub#hash',
+        scopes: ['0-0-0-0-0']
+      }).should.be.fulfilled);
+    });
+
+    describe('getState', () => {
+      const state = {
+        restoreLocation: 'http://localhost:8080/hub#hash',
+        scopes: ['0-0-0-0-0']
+      };
+      it('should be get as it was saved', async () => {
+        await authStorage.saveState(stateId, state);
+        const newState = await authStorage.getState(stateId);
+        should.exist(newState);
+        newState?.should.deep.equal(state);
+      });
+
+      it('should be null if wasn\'t set', () => {
+        authStorage.getState(stateId).should.eventually.be.null;
+      });
+
+      it('should be null after first get', async () => {
+        await authStorage.saveState(stateId, state);
+        await authStorage.getState(stateId);
+        authStorage.getState(stateId).should.eventually.be.null;
+      });
+    });
+
+    describe('cleanStates', () => {
+      const state = {
+        restoreLocation: 'http://localhost:8080/hub#hash',
+        scopes: ['0-0-0-0-0']
+      };
+
+      it('should clean state by id', async () => {
+        await authStorage.saveState(stateId, {
+          restoreLocation: 'http://localhost:8080/hub#hash',
+          scopes: ['0-0-0-0-0']
+        });
+        await authStorage.saveState('unique2', {
+          restoreLocation: 'http://localhost:8080/hub#hash',
+          scopes: ['0-0-0-0-0', 'youtrack']
+        });
+        await authStorage.cleanStates(stateId);
+        localStorage.should.have.keys(['stateunique2']);
+      });
+
+      it('should clean state by quota', async () => {
+
+        const limitedAuthStorage = new AuthStorage({
+          stateKeyPrefix: 'state',
+          tokenKey: 'token',
+          stateQuota: 200
+        });
+
+        await limitedAuthStorage.saveState(stateId, state);
+        await limitedAuthStorage.saveState('unique2', {
+          restoreLocation: 'http://localhost:8080/hub#hash',
+          scopes: ['0-0-0-0-0', 'youtrack']
+        });
+        await limitedAuthStorage.cleanStates();
+        localStorage.should.have.keys(['stateunique2']);
+      });
+
+      it('should clean state by TTL', async () => {
+        sandbox.useFakeTimers({toFake: ['Date']});
+
+        const limitedAuthStorage = new AuthStorage({
+          stateKeyPrefix: 'state',
+          tokenKey: 'token',
+          stateTTL: 10
+        });
+
+        await limitedAuthStorage.saveState(stateId, state);
+        sandbox.clock.tick(TICK);
+        await limitedAuthStorage.cleanStates();
+        sandbox.clock.tick(TICK);
+        localStorage.should.be.empty;
+      });
+    });
+
+    const token = {
+      accessToken: 'silver-bullet',
+      scopes: ['0-0-0-0-0'],
+      // eslint-disable-next-line @typescript-eslint/no-magic-numbers
+      expires: TokenValidator._epoch() + 40 * 60
+    };
+
+    describe('saveToken', () => {
+      it('should be fulfilled', () => authStorage.saveToken(token).should.be.fulfilled);
+    });
+
+    describe('getToken', () => {
+      it('should be get as it was saved', async () => {
+        await authStorage.saveToken(token);
+        authStorage.getToken().should.become(token);
+      });
+
+      it('should be null if wasn\'t saved', () => authStorage.getToken().should.eventually.be.null);
+
+      it('should be the same after several get', async () => {
+        await authStorage.saveToken(token);
+        await authStorage.getToken();
+        authStorage.getToken().should.become(token);
+      });
+
+      it('should be null after wipe', async () => {
+        await authStorage.saveToken(token);
+        await authStorage.wipeToken();
+        authStorage.getToken().should.eventually.be.null;
+      });
+    });
+
+    describe('events', () => {
+      let mockedAuthStorage: AuthStorage;
+
+      beforeEach(() => {
+        mockedAuthStorage = new AuthStorage({
+          stateKeyPrefix: 'state',
+          tokenKey: 'loltoken',
+          storage: MockedStorage
+        });
+      });
+
+      it('onTokenChange should have been triggered', () => {
+        const clock = sandbox.useFakeTimers({toFake: ['setTimeout']});
+        const spy = sandbox.spy();
+        mockedAuthStorage.onTokenChange(spy);
+        mockedAuthStorage.saveToken(token);
+
+        clock.tick(1);
+        spy.should.have.been.calledOnce;
+      });
+
+      it('onStateChange should have been triggered', () => {
+        const clock = sandbox.useFakeTimers({toFake: ['setTimeout']});
+        const spy = sandbox.spy();
+        mockedAuthStorage.onStateChange(stateId, spy);
+        mockedAuthStorage.saveState(stateId, {});
+
+        clock.tick(1);
+        spy.should.have.been.calledOnce;
+      });
+
+      it('onMessage should have been triggered', () => {
+        const clock = sandbox.useFakeTimers({toFake: ['setTimeout']});
+        const spy = sandbox.spy();
+        mockedAuthStorage.onMessage(stateId, spy);
+        mockedAuthStorage.sendMessage(stateId, 'message');
+
+
+        clock.tick(1);
+        spy.should.have.been.calledOnce;
+        spy.should.have.been.calledWith('message');
+      });
+    });
+  });
+});

package/components/auth/storage.ts

@@ -0,0 +1,291 @@
+import Storage, {StorageClass, StorageInterface} from '../storage/storage';
+
+import {AuthUser} from './auth__core';
+import {AuthResponse} from './response-parser';
+
+/**
+ * @typedef {Object} StoredToken
+ * @property {string} accessToken
+ * @property {string[]} scopes
+ * @property {number} expires
+ */
+
+/**
+ * @typedef {Object} StoredState
+ * @property {Date} created
+ * @property {string} restoreLocation
+ * @property {string[]} scopes
+ */
+
+const DEFAULT_STATE_QUOTA = 102400; // 100 kb ~~ 200 tabs with a large list of scopes
+// eslint-disable-next-line @typescript-eslint/no-magic-numbers
+const DEFAULT_STATE_TTL = 1000 * 60 * 60 * 24; // nobody will need auth state after a day
+const UPDATE_USER_TIMEOUT = 1000;
+
+export interface StoredToken {
+  accessToken: string
+  scopes?: string[]
+  expires?: number
+  lifeTime?: number
+  waitForRedirectTimeout?: number
+}
+
+export interface AuthState extends AuthResponse {
+  restoreLocation?: string
+  scopes?: string[]
+  nonRedirect?: boolean | null | undefined
+  created?: number
+}
+
+export interface AuthStorageConfig {
+  stateKeyPrefix?: string | null | undefined
+  tokenKey?: string | null | undefined
+  messagePrefix?: string | null | undefined
+  userKey?: string | null | undefined
+  stateTTL?: number | null | undefined
+  storage?: StorageClass | null | undefined
+  stateQuota?: number | null | undefined
+}
+
+interface StateRemovalResult {
+  key: string
+  created: number
+  size: number
+}
+
+export default class AuthStorage<M = unknown> {
+  messagePrefix: string;
+  stateKeyPrefix: string;
+  tokenKey: string;
+  userKey: string;
+  stateTTL: number;
+  stateQuota: number;
+  private _lastMessage: unknown;
+  _stateStorage: StorageInterface;
+  _tokenStorage: StorageInterface;
+  _messagesStorage: StorageInterface;
+  private _currentUserStorage: StorageInterface;
+  /**
+   * Custom storage for Auth
+   * @param {{stateKeyPrefix: string, tokenKey: string, onTokenRemove: Function}} config
+   */
+  constructor(config: AuthStorageConfig) {
+    this.messagePrefix = config.messagePrefix || '';
+    this.stateKeyPrefix = config.stateKeyPrefix || '';
+    this.tokenKey = config.tokenKey || '';
+    this.userKey = config.userKey || 'user-key';
+    this.stateTTL = config.stateTTL || DEFAULT_STATE_TTL;
+    this._lastMessage = null;
+
+    const StorageConstructor = config.storage || Storage;
+    this.stateQuota = Math.min(
+      config.stateQuota ||
+      DEFAULT_STATE_QUOTA,
+      StorageConstructor.QUOTA || Infinity
+    );
+
+    this._stateStorage = new StorageConstructor({
+      cookieName: 'ring-state'
+    });
+    this._tokenStorage = new StorageConstructor({
+      cookieName: 'ring-token'
+    });
+    this._messagesStorage = new StorageConstructor({
+      cookieName: 'ring-message'
+    });
+    this._currentUserStorage = new StorageConstructor({
+      cookieName: 'ring-user'
+    });
+  }
+
+  /**
+   * Add token change listener
+   * @param {function(string)} fn Token change listener
+   * @return {function()} remove listener function
+   */
+  onTokenChange(fn: (token: StoredToken | null) => void) {
+    return this._tokenStorage.on(this.tokenKey, fn);
+  }
+
+  /**
+   * Add state change listener
+   * @param {string} stateKey State key
+   * @param {function(string)} fn State change listener
+   * @return {function()} remove listener function
+   */
+  onStateChange(stateKey: string, fn: (state: AuthState | null) => void) {
+    return this._stateStorage.on(this.stateKeyPrefix + stateKey, fn);
+  }
+
+  /**
+   * Add state change listener
+   * @param {string} key State key
+   * @param {function(string)} fn State change listener
+   * @return {function()} remove listener function
+   */
+  onMessage(key: string, fn: (message: M | null) => void) {
+    return this._messagesStorage.on<M>(this.messagePrefix + key, message => fn(message));
+  }
+
+  sendMessage(key: string, message: M | null = null) {
+    this._lastMessage = message;
+    this._messagesStorage.set(this.messagePrefix + key, message);
+  }
+
+  /**
+   * Save authentication request state.
+   *
+   * @param {string} id Unique state identifier
+   * @param {StoredState} state State to store
+   * @param {boolean=} dontCleanAndRetryOnFail If falsy then remove all stored states and try again to save state
+   */
+  async saveState(id: string, state: AuthState, dontCleanAndRetryOnFail?: boolean): Promise<void> {
+    state.created = Date.now();
+
+    try {
+      await this._stateStorage.set(this.stateKeyPrefix + id, state);
+    } catch (e) {
+      if (!dontCleanAndRetryOnFail) {
+        await this.cleanStates();
+        return this.saveState(id, state, true);
+      } else {
+        throw e;
+      }
+    }
+    return undefined;
+  }
+
+  /**
+   * Remove all stored states
+   *
+   * @return {Promise} promise that is resolved when OLD states [and some selected] are removed
+   */
+  async cleanStates(removeStateId?: string) {
+    const now = Date.now();
+
+    const removalResult = await this._stateStorage.each<StateRemovalResult | void>(
+      (key, value) => {
+        if (value == null) {
+          return undefined;
+        }
+
+        // Remove requested state
+        if (key === this.stateKeyPrefix + removeStateId) {
+          return this._stateStorage.remove(key);
+        }
+
+        if (key.indexOf(this.stateKeyPrefix) === 0) {
+        // Clean old states
+          const state = value as AuthState;
+          const created = state.created ?? Date.now();
+          if (created + this.stateTTL < now) {
+            return this._stateStorage.remove(key);
+          }
+
+          // Data to clean up due quota
+          return {
+            key,
+            created,
+            size: JSON.stringify(state).length
+          };
+        }
+
+        return undefined;
+      });
+    const currentStates =
+      removalResult.filter((state): state is StateRemovalResult => state != null);
+
+    let stateStorageSize = currentStates.
+      reduce((overallSize, state) => state.size + overallSize, 0);
+
+    if (stateStorageSize > this.stateQuota) {
+      currentStates.sort((a, b) => a.created - b.created);
+
+      const removalPromises = currentStates.filter(state => {
+        if (stateStorageSize > this.stateQuota) {
+          stateStorageSize -= state.size;
+          return true;
+        }
+
+        return false;
+      }).map(state => this._stateStorage.remove(state.key));
+
+      return removalPromises.length && Promise.all(removalPromises);
+    }
+
+    return undefined;
+  }
+
+  /**
+   * Get state by id and remove stored states from the storage.
+   *
+   * @param {string} id unique state identifier
+   * @return {Promise.<StoredState>}
+   */
+  async getState(id: string): Promise<AuthState | null> {
+    try {
+      const result = await this._stateStorage.get<AuthState>(this.stateKeyPrefix + id);
+      await this.cleanStates(id);
+      return result;
+    } catch (e) {
+      await this.cleanStates(id);
+      throw e;
+    }
+  }
+
+  /**
+   * @param {StoredToken} token
+   * @return {Promise} promise that is resolved when the token is saved
+   */
+  saveToken(token: StoredToken) {
+    return this._tokenStorage.set(this.tokenKey, token);
+  }
+
+  /**
+   * @return {Promise.<StoredToken>} promise that is resolved to the stored token
+   */
+  getToken(): Promise<StoredToken | null> {
+    return this._tokenStorage.get(this.tokenKey);
+  }
+
+  /**
+   * Remove stored token if any.
+   * @return {Promise} promise that is resolved when the token is wiped.
+   */
+  wipeToken() {
+    return this._tokenStorage.remove(this.tokenKey);
+  }
+
+  /**
+   * @param {function} loadUser user loader
+   * @return {Promise.<object>>} promise that is resolved to stored current user
+   */
+  async getCachedUser(loadUser: () => Promise<AuthUser | null>): Promise<AuthUser | null> {
+    const user = await this._currentUserStorage.get<AuthUser>(this.userKey);
+    const loadAndCache = () => loadUser().then(response => {
+      this._currentUserStorage.set(this.userKey, response);
+      return response;
+    });
+
+    if (user && user.id) {
+      setTimeout(loadAndCache, UPDATE_USER_TIMEOUT);
+      return user;
+    } else {
+      return loadAndCache();
+    }
+  }
+
+  /**
+   * Remove cached user if any
+   */
+  wipeCachedCurrentUser() {
+    return this._currentUserStorage.remove(this.userKey);
+  }
+
+  /**
+   * Wipes cache if user has changed
+   */
+  onUserChanged() {
+    this.wipeCachedCurrentUser();
+  }
+}

package/components/auth/token-validator.test.ts

@@ -0,0 +1,206 @@
+/* eslint-disable @typescript-eslint/no-magic-numbers */
+import type {Stub} from '../../test-helpers/globals.d';
+
+import HTTP from '../http/http';
+import LocalStorage from '../storage/storage__local';
+
+import Auth from './auth';
+import AuthStorage from './storage';
+import TokenValidator from './token-validator';
+
+// eslint-disable-next-line import/no-commonjs
+const MockedStorage: typeof LocalStorage = require('imports-loader?imports=default|storage-mock|window!../storage/storage__local').default;
+
+describe('Auth', () => {
+  describe('TokenValidator', () => {
+    const storage = new AuthStorage({
+      storage: MockedStorage
+    });
+    const http = new HTTP();
+    const getUser = (token: string) => http.authorizedFetch(Auth.API_PROFILE_PATH, token);
+    const tokenValidator = new TokenValidator({
+      scope: ['0-0-0-0-0', 'youtrack'],
+      optionalScopes: ['youtrack']
+    }, getUser, storage);
+    const lifeTime = 60 * 60;
+    const expires = TokenValidator._epoch() + lifeTime;
+
+    describe('getValidatedToken', () => {
+      let getToken: Stub<AuthStorage['getToken']>;
+      beforeEach(function beforeEach() {
+        getToken = sandbox.stub(AuthStorage.prototype, 'getToken');
+      });
+
+      it('should resolve access token when it is valid', () => {
+
+        getToken.returns(Promise.resolve({
+          accessToken: 'token',
+          expires,
+          lifeTime,
+          scopes: ['0-0-0-0-0', 'youtrack']
+        }));
+
+        return tokenValidator.validateTokenLocally().
+          should.eventually.be.equal('token');
+      });
+
+      it('should resolve access token when token is given for all required scopes', () => {
+        getToken.returns(Promise.resolve({
+          accessToken: 'token',
+          expires,
+          lifeTime,
+          scopes: ['0-0-0-0-0']
+        }));
+
+        return tokenValidator.validateTokenLocally().
+          should.eventually.be.equal('token');
+      });
+
+      it('should reject if accessToken is empty', () => {
+        // @ts-expect-error testing a wrong usage
+        getToken.returns(Promise.resolve({
+          accessToken: null,
+          expires,
+          lifeTime,
+          scopes: ['0-0-0-0-0']
+        }));
+
+        return tokenValidator.validateTokenLocally().
+          should.be.rejectedWith(TokenValidator.TokenValidationError, 'Token not found');
+      });
+
+      it('should reject if there is no token stored', () => {
+        getToken.returns(Promise.resolve(null));
+        return tokenValidator.validateTokenLocally().
+          should.be.rejectedWith(TokenValidator.TokenValidationError, 'Token not found');
+      });
+
+      it('should reject if token is about to be expired (<1/6 lifeTime left)', () => {
+        getToken.returns(Promise.resolve({
+          accessToken: 'token',
+          expires: TokenValidator._epoch() + (lifeTime / 6) - 1,
+          lifeTime,
+          scopes: ['0-0-0-0-0']
+        }));
+        return tokenValidator.validateTokenLocally().
+          should.be.rejectedWith(TokenValidator.TokenValidationError, 'Token expired');
+      });
+
+      it('should reject if short-life token is about to be expired (<1/6 lifeTime left)', () => {
+        const minimalLifeTime = 60 * 5;
+        getToken.returns(Promise.resolve({
+          accessToken: 'token',
+          expires: TokenValidator._epoch() + (minimalLifeTime / 6) - 1,
+          lifeTime: minimalLifeTime,
+          scopes: ['0-0-0-0-0']
+        }));
+        return tokenValidator.validateTokenLocally().
+          should.be.rejectedWith(TokenValidator.TokenValidationError, 'Token expired');
+      });
+
+      it('should reject if token is about to be expired but lifeTime is not set and default time used', () => {
+        getToken.returns(Promise.resolve({
+          accessToken: 'token',
+          expires: TokenValidator._epoch() + 5 * 60,
+          scopes: ['0-0-0-0-0']
+        }));
+        return tokenValidator.validateTokenLocally().
+          should.be.rejectedWith(TokenValidator.TokenValidationError, 'Token expired');
+      });
+
+      it('should reject if token scopes don\'t match required scopes', () => {
+        getToken.returns(Promise.resolve({
+          accessToken: 'token',
+          expires,
+          lifeTime,
+          scopes: ['youtrack']
+        }));
+
+        return tokenValidator.validateTokenLocally().
+          should.
+          be.
+          rejectedWith(TokenValidator.TokenValidationError, 'Token doesn\'t match required scopes');
+      });
+    });
+
+    describe('validateAgainstUser', () => {
+      let authorizedFetch: Stub<HTTP['authorizedFetch']>;
+      beforeEach(function beforeEach() {
+        authorizedFetch = sandbox.stub(HTTP.prototype, 'authorizedFetch');
+      });
+
+      it('should resolve to access token when user is returned', async () => {
+        const token = {accessToken: 'token'};
+        authorizedFetch.returns(Promise.resolve({login: 'user'}));
+        const promise = tokenValidator._validateAgainstUser(token);
+        promise.should.be.fulfilled;
+        await promise;
+        authorizedFetch.should.have.been.calledWith(Auth.API_PROFILE_PATH, 'token');
+      });
+
+      it('should reject with redirect if 401 response received', () => {
+        const token = {accessToken: 'token'};
+        authorizedFetch.returns(Promise.reject({
+          status: 401,
+          response: {
+            json() {
+              return Promise.resolve({error: 'Problem'});
+            }
+          }
+        }));
+        return tokenValidator._validateAgainstUser(token).
+          should.be.rejectedWith(TokenValidator.TokenValidationError, 'Problem');
+      });
+
+      it('should reject with redirect if invalid_grant response received', () => {
+        const token = {accessToken: 'token'};
+        authorizedFetch.returns(Promise.reject({
+          response: {
+            json() {
+              return Promise.resolve({error: 'invalid_grant'});
+            }
+          }
+        }));
+        return tokenValidator._validateAgainstUser(token).
+          should.be.rejectedWith(TokenValidator.TokenValidationError, 'invalid_grant');
+      });
+
+      it('should reject with redirect if invalid_request response received', () => {
+        const token = {accessToken: 'token'};
+        authorizedFetch.returns(Promise.reject({
+          response: {
+            json() {
+              return Promise.resolve({error: 'invalid_request'});
+            }
+          }
+        }));
+        return tokenValidator._validateAgainstUser(token).
+          should.be.rejectedWith(TokenValidator.TokenValidationError, 'invalid_request');
+      });
+
+      it('should reject with redirect if 401 response without json received', () => {
+        const token = {accessToken: 'token'};
+        authorizedFetch.returns(Promise.reject({
+          status: 401,
+          message: '403 Forbidden',
+          response: {
+            json() {
+              return Promise.reject();
+            }
+          }
+        }));
+        return tokenValidator._validateAgainstUser(token).
+          should.be.rejectedWith(TokenValidator.TokenValidationError, '403 Forbidden');
+      });
+    });
+
+
+    describe('TokenValidationError', () => {
+      it('should be cool', () => {
+        (() => {
+          throw new TokenValidator.TokenValidationError('message');
+        }).should.throw(TokenValidator.TokenValidationError, 'message');
+      });
+    });
+  });
+});