@opencloning/utils 1.9.1 → 2.0.0

package/CHANGELOG.md

@@ -1,5 +1,70 @@
 # @opencloning/utils
 
+## 2.0.0
+
+### Major Changes
+
+- [#778](https://github.com/OpenCloning/OpenCloning_frontend/pull/778) [`fe1d81c`](https://github.com/OpenCloning/OpenCloning_frontend/commit/fe1d81c6f4b85f6317a2a9e46cc68c571c79c394) Thanks [@manulera](https://github.com/manulera)! - Only send the auth token to the backend, and rename the http client APIs.
+
+  - `@opencloning/utils`: `@opencloning/utils/httpClients` exports `getBackendHttpClient(backendUrl, { authenticated })`, a client that can only reach the backend (`allowAbsoluteUrls: false`) and is the only one carrying the auth token, and `getExternalHttpClient()` for whitelisted external urls. Replaces `@opencloning/utils/getHttpClient` (`getHttpClient`, `getAuthenticatedHttpClient`). `attachAuthInterceptors` refuses clients that could send the token elsewhere.
+  - `@opencloning/ui` (breaking): `useHttpClient` is renamed `useBackendHttpClient` and takes urls relative to `backendUrl`; `useBackendRoute` is removed; `useBackendAPI` is renamed `useSourceRequest` and `sendPostRequest` is renamed `sendSourceRequest`.
+  - `@opencloning/opencloningdb`, `@opencloning/opencloning-elabftw`: clients can no longer be pointed at other hosts.
+
+### Minor Changes
+
+- [#778](https://github.com/OpenCloning/OpenCloning_frontend/pull/778) [`fe1d81c`](https://github.com/OpenCloning/OpenCloning_frontend/commit/fe1d81c6f4b85f6317a2a9e46cc68c571c79c394) Thanks [@manulera](https://github.com/manulera)! - Encode values interpolated into request URL paths to prevent client-side path traversal. A sample UID such as `../workspaces/1/users/5` could make a user's own request hit a different endpoint, e.g. "delete UID" removing a workspace member.
+
+  - `@opencloning/utils`: new `encodePathSegment` (`@opencloning/utils/urlUtils`), which applies `encodeURIComponent` and rejects `.` and `..`.
+  - `@opencloning/opencloningdb`: all path parameters in `endpoints.js` are encoded.
+  - `@opencloning/opencloning-elabftw`: eLabFTW item and upload paths are encoded.
+  - `@opencloning/ui`: the `example`, `key` and `template` URL parameters are encoded when loading examples and templates.
+
+### Patch Changes
+
+- [#778](https://github.com/OpenCloning/OpenCloning_frontend/pull/778) [`fe1d81c`](https://github.com/OpenCloning/OpenCloning_frontend/commit/fe1d81c6f4b85f6317a2a9e46cc68c571c79c394) Thanks [@manulera](https://github.com/manulera)! - Safer white-list url checking
+
+- Updated dependencies []:
+  - @opencloning/store@2.0.0
+
+## 1.10.0
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @opencloning/store@1.10.0
+
+## 1.9.5
+
+### Patch Changes
+
+- [#771](https://github.com/OpenCloning/OpenCloning_frontend/pull/771) [`73363e7`](https://github.com/OpenCloning/OpenCloning_frontend/commit/73363e7a7f7e494e20a54bd87e5dba97f8a9197e) Thanks [@manulera](https://github.com/manulera)! - Keep OIDC sessions signed in by requesting a token on each API call instead of reusing a stored JWT
+
+- Updated dependencies []:
+  - @opencloning/store@1.9.5
+
+## 1.9.4
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @opencloning/store@1.9.4
+
+## 1.9.3
+
+### Patch Changes
+
+- [#762](https://github.com/OpenCloning/OpenCloning_frontend/pull/762) [`df69a1b`](https://github.com/OpenCloning/OpenCloning_frontend/commit/df69a1bfb3b3128e93d89eef48a29f81a54ebb82) Thanks [@manulera](https://github.com/manulera)! - Fix QuotaExceededError when adding more than ~10 AB1/sequencing files (OpenCloning/OpenCloning#82). The raw contents of the verification files used to be persisted in Web Storage (localStorage, later sessionStorage), which has a quota of ~5 MB, so submitting around 10+ AB1 files failed with `QuotaExceededError` and the files/alignments disappeared. The contents are now kept in an in-memory store for the duration of the tab session, which has no quota.
+
+- Updated dependencies [[`df69a1b`](https://github.com/OpenCloning/OpenCloning_frontend/commit/df69a1bfb3b3128e93d89eef48a29f81a54ebb82)]:
+  - @opencloning/store@1.9.3
+
+## 1.9.2
+
+### Patch Changes
+
+- Updated dependencies [[`bc045f9`](https://github.com/OpenCloning/OpenCloning_frontend/commit/bc045f9e74b4d5b84250dcb5a77b93de99e4d684)]:
+  - @opencloning/store@1.9.2
+
 ## 1.9.1
 
 ### Patch Changes

package/package.json

@@ -1,15 +1,17 @@
 {
   "license": "MIT",
   "name": "@opencloning/utils",
-  "version": "1.9.1",
+  "version": "2.0.0",
   "type": "module",
   "main": "./src/utils/index.js",
   "exports": {
     ".": "./src/utils/index.js",
     "./readNwrite": "./src/utils/readNwrite.js",
+    "./verificationFileStore": "./src/utils/verificationFileStore.js",
     "./network": "./src/utils/network.js",
-    "./getHttpClient": "./src/utils/getHttpClient.js",
+    "./httpClients": "./src/utils/httpClients.js",
     "./httpClientAuth": "./src/utils/httpClientAuth.js",
+    "./urlUtils": "./src/utils/urlUtils.js",
     "./sourceFunctions": "./src/utils/sourceFunctions.js",
     "./error2String": "./src/utils/error2String.js",
     "./enzyme_utils": "./src/utils/enzyme_utils.js",
@@ -31,7 +33,7 @@
     "directory": "packages/utils"
   },
   "dependencies": {
-    "@opencloning/store": "1.9.1",
+    "@opencloning/store": "2.0.0",
     "@teselagen/bio-parsers": "^0.4.38",
     "@teselagen/sequence-utils": "^0.3.42",
     "@zip.js/zip.js": "^2.8.26",

package/src/utils/httpClientAuth.js

@@ -1,20 +1,33 @@
 const AUTH_INTERCEPTORS_ATTACHED = '__opencloningHttpClientAuthAttached';
 
 let unauthorizedHandler = null;
+let tokenGetter = null;
 
 export function setHttpClientUnauthorizedHandler(fn) {
   unauthorizedHandler = fn;
 }
 
-export function attachAuthInterceptors(client, { tokenStorageKey = 'token' } = {}) {
+export function setHttpClientTokenGetter(fn) {
+  tokenGetter = fn;
+}
+
+/**
+ * Attach the bearer token to requests, and call the unauthorized handler on 401s.
+ * The client must have a baseURL and allowAbsoluteUrls: false, so that every request
+ * goes to the backend and the token can never be sent to a third party.
+ */
+export function attachAuthInterceptors(client) {
   if (client[AUTH_INTERCEPTORS_ATTACHED]) {
     return client;
   }
+  if (!client.defaults.baseURL || client.defaults.allowAbsoluteUrls !== false) {
+    throw new Error('Auth interceptors require a client with baseURL and allowAbsoluteUrls: false');
+  }
 
   client[AUTH_INTERCEPTORS_ATTACHED] = true;
 
-  client.interceptors.request.use((config) => {
-    const token = localStorage.getItem(tokenStorageKey);
+  client.interceptors.request.use(async (config) => {
+    const token = await tokenGetter?.();
     if (token) {
       config.headers = config.headers ?? {};
       config.headers.Authorization = `Bearer ${token}`;

package/src/utils/httpClientAuth.test.js

@@ -1,34 +1,60 @@
 import axios from 'axios';
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
-import { attachAuthInterceptors, setHttpClientUnauthorizedHandler } from './httpClientAuth';
+import { attachAuthInterceptors, setHttpClientTokenGetter, setHttpClientUnauthorizedHandler } from './httpClientAuth';
+
+const createClient = () => axios.create({ baseURL: 'http://localhost:8000/db', allowAbsoluteUrls: false });
 
 describe('httpClientAuth', () => {
   beforeEach(() => {
-    localStorage.clear();
     setHttpClientUnauthorizedHandler(null);
+    setHttpClientTokenGetter(null);
   });
 
   afterEach(() => {
-    localStorage.clear();
     setHttpClientUnauthorizedHandler(null);
+    setHttpClientTokenGetter(null);
   });
 
-  it('adds the bearer token to authenticated requests', () => {
-    const client = attachAuthInterceptors(axios.create());
+  it('leaves request headers unchanged when no token getter is set', async () => {
+    const client = attachAuthInterceptors(createClient());
     const requestFulfilled = client.interceptors.request.handlers[0].fulfilled;
     const config = { headers: {} };
 
-    localStorage.setItem('token', '__TEST_TOKEN__');
+    const result = await requestFulfilled(config);
 
-    const result = requestFulfilled(config);
+    expect(result).toBe(config);
+    expect(config.headers.Authorization).toBeUndefined();
+  });
+
+  it('adds the bearer token from a sync token getter', async () => {
+    const client = attachAuthInterceptors(createClient());
+    const requestFulfilled = client.interceptors.request.handlers[0].fulfilled;
+    const config = { headers: {} };
+
+    setHttpClientTokenGetter(() => '__TEST_TOKEN__');
+
+    const result = await requestFulfilled(config);
 
     expect(result).toBe(config);
     expect(config.headers.Authorization).toBe('Bearer __TEST_TOKEN__');
   });
 
+  it('adds the bearer token from an async token getter', async () => {
+    const client = attachAuthInterceptors(createClient());
+    const requestFulfilled = client.interceptors.request.handlers[0].fulfilled;
+    const config = { headers: {} };
+
+    setHttpClientTokenGetter(async () => 'fresh-token');
+
+    const result = await requestFulfilled(config);
+
+    expect(result).toBe(config);
+    expect(config.headers.Authorization).toBe('Bearer fresh-token');
+  });
+
   it('calls the shared unauthorized handler for 401 responses', async () => {
-    const client = attachAuthInterceptors(axios.create());
+    const client = attachAuthInterceptors(createClient());
     const responseRejected = client.interceptors.response.handlers[0].rejected;
     const handler = vi.fn();
     const error = { response: { status: 401 } };
@@ -40,8 +66,14 @@ describe('httpClientAuth', () => {
     expect(handler).toHaveBeenCalledTimes(1);
   });
 
+  it('refuses clients that could send the token to other hosts', () => {
+    expect(() => attachAuthInterceptors(axios.create())).toThrow('allowAbsoluteUrls');
+    expect(() => attachAuthInterceptors(axios.create({ baseURL: 'http://localhost:8000' }))).toThrow('allowAbsoluteUrls');
+    expect(() => attachAuthInterceptors(axios.create({ allowAbsoluteUrls: false }))).toThrow('allowAbsoluteUrls');
+  });
+
   it('does not attach duplicate interceptors to the same client', () => {
-    const client = axios.create();
+    const client = createClient();
 
     attachAuthInterceptors(client);
     attachAuthInterceptors(client);

package/src/utils/httpClients.js

@@ -0,0 +1,48 @@
+import axios from 'axios';
+import { attachAuthInterceptors } from './httpClientAuth';
+import { urlMatchesPrefix } from './urlUtils';
+import urlWhitelist from '../config/urlWhitelist';
+
+/**
+ * Client for requests that do not go to the backend (external services, static files):
+ * no auth token, and only whitelisted urls (plus the current origin) are allowed.
+ * For the backend, use getBackendHttpClient.
+ */
+export function getExternalHttpClient() {
+  const baseURL = import.meta.env.BASE_URL || null;
+  const whitelist = [...urlWhitelist, window.location.origin];
+  if (baseURL) {
+    whitelist.push(baseURL);
+  }
+
+  const client = axios.create();
+
+  client.interceptors.request.use((config) => {
+    const url = new URL(config.url, config.baseURL || window.location.origin);
+
+    if (!whitelist.some((whitelistedUrl) => urlMatchesPrefix(url.href, whitelistedUrl))) {
+      return Promise.reject(new Error(`Request blocked: URL not in whitelist ${url.href}`));
+    }
+
+    return config;
+  }, (error) => Promise.reject(error));
+
+  return client;
+}
+
+/**
+ * Client that can only reach the backend: urls are relative to backendUrl, and
+ * allowAbsoluteUrls: false makes axios append even absolute urls to backendUrl.
+ * Only these clients carry the auth token. Use getExternalHttpClient() for external urls.
+ */
+export function getBackendHttpClient(backendUrl, { authenticated = false } = {}) {
+  if (!backendUrl) {
+    throw new Error('backendUrl is required to create a backend http client');
+  }
+  // Handles both absolute and relative urls
+  const client = axios.create({ baseURL: new URL(backendUrl, window.location.origin).href, allowAbsoluteUrls: false });
+  if (authenticated) {
+    attachAuthInterceptors(client);
+  }
+  return client;
+}

package/src/utils/httpClients.test.js

@@ -0,0 +1,71 @@
+import { describe, expect, it } from 'vitest';
+
+import { getExternalHttpClient, getBackendHttpClient } from './httpClients';
+
+describe('getExternalHttpClient', () => {
+  it('creates a generic client without auth interceptors', () => {
+    const client = getExternalHttpClient();
+
+    expect(client.interceptors.request.handlers.filter(Boolean)).toHaveLength(1);
+    expect(client.interceptors.response.handlers.filter(Boolean)).toHaveLength(0);
+  });
+
+
+  it('blocks urls that only look like whitelisted ones', async () => {
+    const client = getExternalHttpClient();
+    const requestFulfilled = client.interceptors.request.handlers[0].fulfilled;
+
+    const allowed = { url: 'https://assets.opencloning.org/OpenCloning-submission/index.json' };
+    expect(await requestFulfilled(allowed)).toBe(allowed);
+
+    for (const url of [
+      'https://assets.opencloning.org.evil.org/OpenCloning-submission/index.json',
+      'https://assets.opencloning.org@evil.org/OpenCloning-submission/index.json',
+      'https://assets-opencloning.org/OpenCloning-submission/index.json',
+    ]) {
+      await expect(requestFulfilled({ url })).rejects.toThrow('Request blocked');
+    }
+  });
+});
+
+describe('getBackendHttpClient', () => {
+  it('creates an authenticated backend client locked to the backend url', () => {
+    const client = getBackendHttpClient('http://localhost:8000/cloning', { authenticated: true });
+
+    expect(client.defaults.baseURL).toBe('http://localhost:8000/cloning');
+    expect(client.defaults.allowAbsoluteUrls).toBe(false);
+    expect(client.interceptors.request.handlers.filter(Boolean)).toHaveLength(1);
+    expect(client.interceptors.response.handlers.filter(Boolean)).toHaveLength(1);
+  });
+
+  it('creates an unauthenticated backend client without auth interceptors', () => {
+    const client = getBackendHttpClient('http://localhost:8000/cloning');
+
+    expect(client.interceptors.request.handlers.filter(Boolean)).toHaveLength(0);
+    expect(client.interceptors.response.handlers.filter(Boolean)).toHaveLength(0);
+  });
+
+  it('keeps every request under the backend url, even absolute ones', () => {
+    const client = getBackendHttpClient('http://localhost:8000/cloning', { authenticated: true });
+
+    expect(client.getUri({ url: 'version' })).toBe('http://localhost:8000/cloning/version');
+    expect(client.getUri({ url: 'https://evil.org/x' })).toBe('http://localhost:8000/cloning/https://evil.org/x');
+  });
+
+  it('throws when the backend url is not set', () => {
+    expect(() => getBackendHttpClient(undefined)).toThrow('backendUrl is required');
+    expect(() => getBackendHttpClient('', { authenticated: true })).toThrow('backendUrl is required');
+  });
+
+  it('resolves relative backend urls against the current origin and keeps absolute ones', () => {
+    const { origin } = window.location;
+
+    const relative = getBackendHttpClient('/cloning');
+    expect(relative.defaults.baseURL).toBe(`${origin}/cloning`);
+    expect(relative.getUri({ url: 'version' })).toBe(`${origin}/cloning/version`);
+    expect(relative.getUri({ url: 'https://evil.org/x' })).toBe(`${origin}/cloning/https://evil.org/x`);
+
+    const absolute = getBackendHttpClient('https://api.example.com/cloning');
+    expect(absolute.defaults.baseURL).toBe('https://api.example.com/cloning');
+  });
+});

package/src/utils/index.js

@@ -3,7 +3,7 @@
 
 export * from './readNwrite.js';
 export * from './network.js';
-export * from './getHttpClient.js';
+export * from './httpClients.js';
 export * from './httpClientAuth.js';
 export * from './sourceFunctions.js';
 export { default as error2String } from './error2String.js';

package/src/utils/ncbiRequests.js

@@ -1,6 +1,6 @@
-import getHttpClient from './getHttpClient';
+import { getExternalHttpClient } from './httpClients';
 
-const httpClient = getHttpClient();
+const httpClient = getExternalHttpClient();
 
 
 export async function taxonSuggest(userInput) {

package/src/utils/readNwrite.js

@@ -10,6 +10,10 @@ import {
 } from '@zip.js/zip.js';
 import { tidyUpSequenceData } from '@teselagen/sequence-utils';
 import { isEqual } from 'lodash-es';
+import {
+  getVerificationFileContent,
+  setVerificationFileContent,
+} from './verificationFileStore';
 
 configure({
   useWebWorkers: false,
@@ -95,10 +99,10 @@ export const downloadStateAsZip = async (cloningState, zipFileName = 'cloning_st
   const files2write = [
     { name: 'cloning_strategy.json', reader: new TextReader(prettyPrintJson(output)) },
     ...fileNames.map((fileName) => {
-      const base64Content = sessionStorage.getItem(fileName);
+      const base64Content = getVerificationFileContent(fileName);
       if (!base64Content) {
         const nameOnly = fileName.replace(/verification-\d+-/, '');
-        throw new Error(`File ${nameOnly} not found in session storage`);
+        throw new Error(`File ${nameOnly} not found in the verification file store`);
       }
       return { name: fileName, reader: new BlobReader(base64ToBlob(base64Content)) };
     }),
@@ -154,7 +158,7 @@ export const downloadCloningStrategyAsSvg = async (fileName) => {
   downloadTextFile(svgString, fileName);
 };
 
-export async function loadHistoryFile(file) {
+export async function parseHistoryFile(file) {
   const isZipFile = file.name.endsWith('.zip');
   const isJsonFile = file.name.endsWith('.json');
 
@@ -233,14 +237,19 @@ export async function loadHistoryFile(file) {
   return { cloningStrategy: newCloningStrategy, verificationFiles };
 }
 
-export const loadFilesToSessionStorage = async (files, idShift = 0) => {
+export const loadFilesToVerificationStore = async (files, idShift = 0) => {
   await Promise.all(files.map(async (file) => {
     const fileContent = await file2base64(file);
     const filename = file.name.replace(/verification-(\d+)-/, (match, num) => `verification-${parseInt(num, 10) + idShift}-`);
-    sessionStorage.setItem(filename, fileContent);
+    setVerificationFileContent(filename, fileContent);
   }));
 };
 
+// Deprecated alias kept for backwards compatibility with the published
+// @opencloning/utils package. The contents are now kept in an in-memory store
+// instead of sessionStorage (see verificationFileStore.js).
+export const loadFilesToSessionStorage = loadFilesToVerificationStore;
+
 export function getVerificationFileName({ sequence_id, file_name }) {
   return `verification-${sequence_id}-${file_name}`;
 }
@@ -275,7 +284,7 @@ export function formatTemplate(data, url) {
   const segments = url.split('/');
   const kitUrl = segments[segments.length - 3];
   const rootGithubUrl = 'https://assets.opencloning.org/OpenCloning-submission/submissions';
-  newData.sources = newData.sources.map((s) => ((!Boolean(s.image) || s.image[0] === null) ? s : {
+  newData.sources = newData.sources.map((s) => ((!s.image || s.image[0] === null) ? s : {
     ...s, image: [`${rootGithubUrl}/${kitUrl}/${s.image[0]}`, s.image[1]],
   }));
   return newData;

package/src/utils/thunks.js

@@ -1,8 +1,9 @@
 import { cloneDeep } from 'lodash-es';
-import { base64ToBlob, downloadStateAsJson, downloadStateAsZip, loadFilesToSessionStorage } from './readNwrite';
+import { base64ToBlob, downloadStateAsJson, downloadStateAsZip, loadFilesToVerificationStore } from './readNwrite';
 import { cloningActions } from '@opencloning/store/cloning';
 import { collectParentSequencesAndSources, getSubState, mergeStates } from './network';
 import { getVerificationFileName } from './readNwrite';
+import { getVerificationFileContent } from './verificationFileStore';
 import { getUsedPrimerIds } from '@opencloning/store/cloning_utils';
 
 const { setState: setCloningState } = cloningActions;
@@ -39,11 +40,11 @@ export const CopySequenceThunk = (sequenceId) => async (dispatch, getState) => {
     files: filesToCopy,
   });
   const files = filesToCopy.map((f) => new File(
-    [base64ToBlob(sessionStorage.getItem(getVerificationFileName(f)))],
+    [base64ToBlob(getVerificationFileContent(getVerificationFileName(f)))],
     getVerificationFileName(f),
     { type: 'application/octet-stream' },
   ));
   const { mergedState, idShift } = mergeStates(newState, state.cloning, false);
   dispatch(setCloningState(mergedState));
-  await loadFilesToSessionStorage(files, idShift);
+  await loadFilesToVerificationStore(files, idShift);
 };

package/src/utils/urlUtils.js

@@ -0,0 +1,23 @@
+/**
+ * Whether `url` starts with `prefix`, comparing the normalized urls (relative urls are
+ * resolved against the current origin). Normalizing makes a host-only prefix end in "/",
+ * so https://example.com matches https://example.com/path but not
+ * https://example.com.evil.org or https://example.com@evil.org.
+ */
+export function urlMatchesPrefix(url, prefix) {
+  return new URL(url, window.location.origin).href.startsWith(new URL(prefix, window.location.origin).href);
+}
+
+/**
+ * Encode a value to be inserted as a single segment of a URL path, e.g.
+ * `/sequences/${encodePathSegment(id)}`. Prevents client-side path traversal (CSPT):
+ * "/", "?" and "#" are encoded, and "." / ".." are rejected because
+ * encodeURIComponent leaves them unchanged and the browser would resolve them.
+ */
+export function encodePathSegment(value) {
+  const segment = String(value);
+  if (segment === '.' || segment === '..') {
+    throw new Error(`Invalid URL path segment: "${segment}"`);
+  }
+  return encodeURIComponent(segment);
+}

package/src/utils/urlUtils.test.js

@@ -0,0 +1,49 @@
+import { describe, expect, it } from 'vitest';
+
+import { encodePathSegment, urlMatchesPrefix } from './urlUtils';
+
+describe('urlMatchesPrefix', () => {
+  it('matches urls under the prefix', () => {
+    expect(urlMatchesPrefix('https://example.com/a/b', 'https://example.com/a')).toBe(true);
+    expect(urlMatchesPrefix('https://example.com/a', 'https://example.com/a')).toBe(true);
+    expect(urlMatchesPrefix('https://example.com/a?x=1', 'https://example.com/a')).toBe(true);
+    expect(urlMatchesPrefix('https://example.com/a/b', 'https://example.com')).toBe(true);
+    expect(urlMatchesPrefix('https://example.com/esearch.fcgi?db=x', 'https://example.com/esearch.fcgi')).toBe(true);
+  });
+
+  it('does not match lookalike hosts or paths', () => {
+    expect(urlMatchesPrefix('https://example.com.evil.org/a', 'https://example.com')).toBe(false);
+    expect(urlMatchesPrefix('https://example.com@evil.org/a', 'https://example.com')).toBe(false);
+    expect(urlMatchesPrefix('https://exampleXcom/a', 'https://example.com')).toBe(false);
+    expect(urlMatchesPrefix('https://other.com/https://example.com/a', 'https://example.com/a')).toBe(false);
+  });
+
+  it('resolves relative urls and prefixes against the current origin', () => {
+    const { origin } = window.location;
+    expect(urlMatchesPrefix('/backend/db/sequences', '/backend/db')).toBe(true);
+    expect(urlMatchesPrefix(`${origin}/backend/db/sequences`, '/backend/db')).toBe(true);
+    expect(urlMatchesPrefix('https://evil.org/backend/db/sequences', '/backend/db')).toBe(false);
+  });
+});
+
+describe('encodePathSegment', () => {
+  it('encodes characters that would change the path', () => {
+    expect(encodePathSegment('../workspaces/1/users/5')).toBe('..%2Fworkspaces%2F1%2Fusers%2F5');
+    expect(encodePathSegment('a?b#c')).toBe('a%3Fb%23c');
+    expect(encodePathSegment(12)).toBe('12');
+  });
+
+  it('rejects dot segments', () => {
+    expect(() => encodePathSegment('.')).toThrow();
+    expect(() => encodePathSegment('..')).toThrow();
+  });
+
+  it('keeps the request path when resolved by the browser', () => {
+    for (const value of ['../workspaces/1', '..%2F..', 'a/../../b', '...']) {
+      const url = new URL(`/db/sequence_samples/${encodePathSegment(value)}`, 'https://example.com');
+      expect(url.pathname.startsWith('/db/sequence_samples/')).toBe(true);
+      // Only has 3 "/" > "/db/sequence_samples/"
+      expect(url.pathname.split('/')).toHaveLength(4);
+    }
+  });
+});

package/src/utils/verificationFileStore.js

@@ -0,0 +1,86 @@
+/**
+ * In-memory storage for the contents of verification (sequencing) files.
+ *
+ * The raw contents of uploaded sequencing files (e.g. AB1 files) are kept in
+ * memory as base64 strings, keyed by `verification-${sequence_id}-${file_name}`
+ * (see getVerificationFileName in readNwrite.js).
+ *
+ * These contents used to be persisted in Web Storage (localStorage in early
+ * versions, sessionStorage since the monorepo switch). Both have a quota of
+ * roughly 5 MB per origin, so submitting around 10+ AB1 files exceeded the
+ * quota, failed with a QuotaExceededError and made the files/alignments
+ * silently disappear:
+ * https://github.com/OpenCloning/OpenCloning/issues/82
+ *
+ * The contents are only needed while the tab is open (to display alignments,
+ * download files, export zips or realign when new files are submitted). After
+ * a page reload the cloning strategy has to be loaded from a file or the
+ * database again, and the verification files are loaded along with it, so an
+ * in-memory store with the same tab-lifetime semantics but no quota is
+ * sufficient.
+ */
+
+const fileContents = new Map();
+
+/**
+ * Store the base64 content of a verification file.
+ * @param {string} key verification file key (see getVerificationFileName)
+ * @param {string} base64Content base64-encoded file content
+ */
+export function setVerificationFileContent(key, base64Content) {
+  fileContents.set(key, base64Content);
+}
+
+/**
+ * Get the base64 content of a verification file, or null if it is not stored.
+ * @param {string} key verification file key (see getVerificationFileName)
+ */
+export function getVerificationFileContent(key) {
+  return fileContents.has(key) ? fileContents.get(key) : null;
+}
+
+/**
+ * Remove the content of a single verification file.
+ * @param {string} key verification file key (see getVerificationFileName)
+ */
+export function removeVerificationFileContent(key) {
+  fileContents.delete(key);
+}
+
+/**
+ * Remove the contents of all verification files associated to a sequence.
+ * @param {number} sequenceId id of the sequence
+ * @param {string} [fileName] if given, only files whose key starts with
+ *   `verification-${sequenceId}-${fileName}` are removed (matches the previous
+ *   sessionStorage-based behaviour)
+ */
+export function removeVerificationFileContents(sequenceId, fileName = null) {
+  const prefix = `verification-${sequenceId}-`;
+  const query = fileName ? prefix + fileName : prefix;
+  for (const key of [...fileContents.keys()]) {
+    if (key.startsWith(query)) {
+      fileContents.delete(key);
+    }
+  }
+}
+
+/**
+ * Remove all stored verification file contents.
+ */
+export function clearVerificationFileContents() {
+  fileContents.clear();
+}
+
+// Expose the store when running in Cypress, following the existing pattern of
+// exposing window.store in apps/opencloning/src/index.jsx. This lets e2e tests
+// assert on the stored file contents.
+if (typeof window !== 'undefined' && window.Cypress) {
+  window.verificationFileStore = {
+    get: getVerificationFileContent,
+    set: setVerificationFileContent,
+    remove: removeVerificationFileContent,
+    removeBySequence: removeVerificationFileContents,
+    clear: clearVerificationFileContents,
+    size: () => fileContents.size,
+  };
+}

package/src/utils/verificationFileStore.test.js

@@ -0,0 +1,101 @@
+import {
+  setVerificationFileContent,
+  getVerificationFileContent,
+  removeVerificationFileContent,
+  removeVerificationFileContents,
+  clearVerificationFileContents,
+} from './verificationFileStore';
+
+describe('verificationFileStore (in-memory verification file storage)', () => {
+  beforeEach(() => {
+    clearVerificationFileContents();
+  });
+
+  it('stores and retrieves a file content', () => {
+    setVerificationFileContent('verification-1-file.ab1', 'aGVsbG8=');
+    expect(getVerificationFileContent('verification-1-file.ab1')).toBe('aGVsbG8=');
+  });
+
+  it('returns null for a missing key', () => {
+    expect(getVerificationFileContent('verification-1-missing.ab1')).toBeNull();
+  });
+
+  it('overwrites an existing key', () => {
+    setVerificationFileContent('verification-1-file.ab1', 'first');
+    setVerificationFileContent('verification-1-file.ab1', 'second');
+    expect(getVerificationFileContent('verification-1-file.ab1')).toBe('second');
+  });
+
+  it('keeps different sequences with the same file name separate', () => {
+    setVerificationFileContent('verification-1-file.ab1', 'seq1');
+    setVerificationFileContent('verification-2-file.ab1', 'seq2');
+    expect(getVerificationFileContent('verification-1-file.ab1')).toBe('seq1');
+    expect(getVerificationFileContent('verification-2-file.ab1')).toBe('seq2');
+  });
+
+  it('removes a single file content', () => {
+    setVerificationFileContent('verification-1-file.ab1', 'a');
+    setVerificationFileContent('verification-1-other.ab1', 'b');
+    removeVerificationFileContent('verification-1-file.ab1');
+    expect(getVerificationFileContent('verification-1-file.ab1')).toBeNull();
+    expect(getVerificationFileContent('verification-1-other.ab1')).toBe('b');
+  });
+
+  it('removes all file contents for a sequence', () => {
+    setVerificationFileContent('verification-1-file.ab1', 'a');
+    setVerificationFileContent('verification-1-other.ab1', 'b');
+    // We use 10 because of the startswith deletion logic in removeVerificationFileContents
+    setVerificationFileContent('verification-10-file.ab1', 'c');
+    removeVerificationFileContents(1);
+    expect(getVerificationFileContent('verification-1-file.ab1')).toBeNull();
+    expect(getVerificationFileContent('verification-1-other.ab1')).toBeNull();
+    expect(getVerificationFileContent('verification-10-file.ab1')).toBe('c');
+  });
+
+  it('removes a specific file within a sequence when fileName is given', () => {
+    setVerificationFileContent('verification-1-file.ab1', 'a');
+    setVerificationFileContent('verification-1-file2.ab1', 'b');
+    removeVerificationFileContents(1, 'file.ab1');
+    expect(getVerificationFileContent('verification-1-file.ab1')).toBeNull();
+    expect(getVerificationFileContent('verification-1-file2.ab1')).toBe('b');
+  });
+
+  it('clears all contents', () => {
+    setVerificationFileContent('verification-1-file.ab1', 'a');
+    setVerificationFileContent('verification-2-file.ab1', 'b');
+    clearVerificationFileContents();
+    expect(getVerificationFileContent('verification-1-file.ab1')).toBeNull();
+    expect(getVerificationFileContent('verification-2-file.ab1')).toBeNull();
+  });
+
+  // Regression test for https://github.com/OpenCloning/OpenCloning/issues/82
+  // Storing ~12 AB1 files of ~350 KB each (3.9 MiB total, ~5.2 MB in base64)
+  // exceeded the ~5 MB Web Storage quota. The in-memory store has no quota, so
+  // all files must be stored and retrievable.
+  it('stores many large files without any quota limit (issue #82)', () => {
+    const nFiles = 12;
+    const totalBytes = 3.9 * 1024 * 1024; // 3.9 MiB as reported in the issue
+    const perFile = Math.floor(totalBytes / nFiles);
+    const base64Length = Math.ceil((perFile * 4) / 3);
+    const content = 'A'.repeat(base64Length);
+
+    const keys = [];
+    for (let i = 1; i <= nFiles; i++) {
+      const key = `verification-17-KKF080_${70250800 + i}_70250801.ab1`;
+      keys.push(key);
+      setVerificationFileContent(key, content);
+    }
+    // Total stored in base64 is ~5.2 MB, well above the 5 MB Web Storage quota
+    expect(keys.reduce((sum, k) => sum + getVerificationFileContent(k).length, 0))
+      .toBeGreaterThan(5 * 1024 * 1024);
+    keys.forEach((key) => {
+      expect(getVerificationFileContent(key)).toBe(content);
+    });
+
+    // And a sequence-level cleanup still empties the store for that sequence
+    removeVerificationFileContents(17);
+    keys.forEach((key) => {
+      expect(getVerificationFileContent(key)).toBeNull();
+    });
+  });
+});

package/src/utils/getHttpClient.js

@@ -1,31 +0,0 @@
-import axios from 'axios';
-import { attachAuthInterceptors } from './httpClientAuth';
-import urlWhitelist from '../config/urlWhitelist';
-
-export default function getHttpClient(extraUrls = []) {
-  const baseURL = import.meta.env.BASE_URL || null;
-  const whitelist = [...urlWhitelist, window.location.origin, ...extraUrls];
-  if (baseURL) {
-    whitelist.push(baseURL);
-  }
-
-  const client = axios.create();
-
-  client.interceptors.request.use((config) => {
-    const url = new URL(config.url, config.baseURL || window.location.origin);
-
-    if (!whitelist.some((whitelistedUrl) => url.href.match(new RegExp(`^${whitelistedUrl}`)))) {
-      return Promise.reject(new Error(`Request blocked: URL not in whitelist ${url.href}`));
-    }
-
-    return config;
-  }, (error) => Promise.reject(error));
-
-  return client;
-}
-
-export function getAuthenticatedHttpClient(extraUrls = []) {
-  const client = getHttpClient(extraUrls);
-  attachAuthInterceptors(client);
-  return client;
-}

package/src/utils/getHttpClient.test.js

@@ -1,19 +0,0 @@
-import { describe, expect, it } from 'vitest';
-
-import getHttpClient, { getAuthenticatedHttpClient } from './getHttpClient';
-
-describe('getHttpClient', () => {
-  it('creates a generic client without auth interceptors', () => {
-    const client = getHttpClient();
-
-    expect(client.interceptors.request.handlers.filter(Boolean)).toHaveLength(1);
-    expect(client.interceptors.response.handlers.filter(Boolean)).toHaveLength(0);
-  });
-
-  it('creates an authenticated client with auth interceptors', () => {
-    const client = getAuthenticatedHttpClient();
-
-    expect(client.interceptors.request.handlers.filter(Boolean)).toHaveLength(2);
-    expect(client.interceptors.response.handlers.filter(Boolean)).toHaveLength(1);
-  });
-});