@opengeoweb/authentication 19.6.1 → 20.0.0-nightly-20260918

package/dist/index.esm.js

@@ -641,6 +641,7 @@ var authConfigKeys = {
   GW_AUTH_CLIENT_ID: null,
   GW_AUTH_ROLE_CLAIM_NAME: null,
   GW_AUTH_ROLE_CLAIM_VALUE_PRESETS_ADMIN: null,
+  GW_AUTH_TRUSTED_HOSTS: null,
   GW_FEATURE_SILENT_LOGIN: false,
   GW_FEATURE_FORCE_AUTHENTICATION: false
 };
@@ -684,6 +685,7 @@ var getAuthConfig = function getAuthConfig(_configUrls) {
     GW_AUTH_CLIENT_ID = _configUrls.GW_AUTH_CLIENT_ID,
     GW_AUTH_ROLE_CLAIM_NAME = _configUrls.GW_AUTH_ROLE_CLAIM_NAME,
     GW_AUTH_ROLE_CLAIM_VALUE_PRESETS_ADMIN = _configUrls.GW_AUTH_ROLE_CLAIM_VALUE_PRESETS_ADMIN,
+    GW_AUTH_TRUSTED_HOSTS = _configUrls.GW_AUTH_TRUSTED_HOSTS,
     GW_FEATURE_SILENT_LOGIN = _configUrls.GW_FEATURE_SILENT_LOGIN,
     GW_FEATURE_FORCE_AUTHENTICATION = _configUrls.GW_FEATURE_FORCE_AUTHENTICATION;
   var loginUrl = replaceTemplateKeys(GW_AUTH_LOGIN_URL, GW_AUTH_CLIENT_ID, GW_APP_URL, sessionStorageProvider.getOauthState(), sessionStorageProvider.getOauthCodeChallenge());
@@ -697,6 +699,7 @@ var getAuthConfig = function getAuthConfig(_configUrls) {
     GW_AUTH_CLIENT_ID: GW_AUTH_CLIENT_ID,
     GW_AUTH_ROLE_CLAIM_NAME: GW_AUTH_ROLE_CLAIM_NAME,
     GW_AUTH_ROLE_CLAIM_VALUE_PRESETS_ADMIN: GW_AUTH_ROLE_CLAIM_VALUE_PRESETS_ADMIN,
+    GW_AUTH_TRUSTED_HOSTS: GW_AUTH_TRUSTED_HOSTS,
     GW_FEATURE_SILENT_LOGIN: GW_FEATURE_SILENT_LOGIN,
     GW_FEATURE_FORCE_AUTHENTICATION: GW_FEATURE_FORCE_AUTHENTICATION
   };
@@ -853,7 +856,15 @@ var AuthenticationProvider = function AuthenticationProvider(_ref2) {
       currentRole: currentRole,
       setCurrentRole: setCurrentRole
     };
-  }, [isLoggedIn, onLogin, auth, onSetAuth, authConfig, sessionStorageProvider, currentRole, setCurrentRole]);
+  },
+  // `auth` is a mutable ref (see the hotfix note in
+  // useAuthenticationDefaultProps), so its identity never changes when its
+  // contents do -- eslint can't know that, and considers the fields below
+  // redundant with `auth`. They're not: depending on them individually is
+  // what makes this memo (and therefore the context value handed to
+  // consumers) actually update when e.g. the access token is refreshed.
+  // eslint-disable-next-line react-hooks/exhaustive-deps
+  [isLoggedIn, onLogin, auth, auth == null ? void 0 : auth.token, auth == null ? void 0 : auth.refresh_token, auth == null ? void 0 : auth.expires_at, auth == null ? void 0 : auth.has_connection_issue, auth == null ? void 0 : auth.username, auth == null ? void 0 : auth.roles, onSetAuth, authConfig, sessionStorageProvider, currentRole, setCurrentRole]);
   return jsx(AuthenticationContext.Provider, {
     value: contextValue,
     children: children
@@ -1219,6 +1230,139 @@ var UserMenuRoles = function UserMenuRoles(_ref) {
   });
 };
 
+/* *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright 2026 - Koninklijk Nederlands Meteorologisch Instituut (KNMI)
+ * Copyright 2026 - Finnish Meteorological Institute (FMI)
+ * Copyright 2026 - The Norwegian Meteorological Institute (MET Norway)
+ * */
+var store = {
+  access_token: undefined,
+  trustedHosts: new Set()
+};
+var setJWTAccessTokenForTrustedServices = function setJWTAccessTokenForTrustedServices(access_token) {
+  store.access_token = access_token;
+};
+/**
+ * Resets the list of trusted services
+ */
+var resetAuthFetchTrustedServices = function resetAuthFetchTrustedServices() {
+  store.trustedHosts.clear();
+};
+/**
+ * A list of hostnames (e.g. "adaguc-server-geoweb.geoweb.knmi.cloud") that
+ * are allowed to receive the JWT access_token.
+ * @param hosts
+ * @param enable
+ */
+var enableAuthFetchTrustedServices = function enableAuthFetchTrustedServices(hosts, enable) {
+  if (enable === void 0) {
+    enable = true;
+  }
+  hosts.forEach(function (host) {
+    var normalizedHost = host.toLowerCase();
+    if (enable) {
+      store.trustedHosts.add(normalizedHost);
+    } else {
+      store.trustedHosts["delete"](normalizedHost);
+    }
+  });
+};
+/**
+ * Extend the headers with an Authorization header containing the JWT access_token.
+ * @param fetchHeaders Incoming Headers, will be extended with an Authorization header.
+ * @param url Incoming url, whose hostname is checked (case-insensitively) against the list of hosts set by enableAuthFetchTrustedServices.
+ * @returns
+ */
+var extendHeadersWithJWTAccessToken = function extendHeadersWithJWTAccessToken(fetchHeaders, url) {
+  if (!store.access_token) {
+    return fetchHeaders;
+  }
+  try {
+    var newUrl = url.url || url;
+    var _URL = new URL(newUrl.toString()),
+      hostname = _URL.hostname;
+    if (store.trustedHosts.has(hostname.toLowerCase())) {
+      fetchHeaders.append('Authorization', "Bearer " + store.access_token);
+    }
+  } catch (_e) {
+    /* empty */
+  }
+  return fetchHeaders;
+};
+/**
+ * Similar to fetch, but when trusted it adds an Authorization header with the JWT access_token. The trusted urls can be set as regexp in enableAuthFetchTrustedServices.
+ * @param url
+ * @param init
+ * @returns
+ */
+// eslint-disable-next-line @typescript-eslint/promise-function-async, @typescript-eslint/explicit-function-return-type, @typescript-eslint/explicit-module-boundary-types
+var authFetch = function authFetch(url, init) {
+  return fetch(url, Object.assign({}, init || {}, {
+    headers: extendHeadersWithJWTAccessToken(new Headers(init == null ? void 0 : init.headers), url)
+  }));
+};
+
+var AuthFetchTrustedServicesContext = /*#__PURE__*/React.createContext('');
+/**
+ * Provider that keeps authFetch's module-level trusted-services store in
+ * sync with the current auth token and GW_AUTH_TRUSTED_HOSTS config.
+ *
+ * authFetch() is also called from outside the React tree (e.g. WMImage.ts,
+ * the timeseries/soundings api clients), so the token itself cannot live in
+ * React context alone -- this provider is what bridges React state into
+ * that module-level store. It also exposes the token via context for React
+ * consumers, see useAuthFetchToken.
+ */
+var AuthFetchTrustedServicesProvider = function AuthFetchTrustedServicesProvider(_ref) {
+  var auth = _ref.auth,
+    authConfig = _ref.authConfig,
+    children = _ref.children;
+  // This will make the JWT token available for authFetch.
+  React.useEffect(function () {
+    setJWTAccessTokenForTrustedServices((auth == null ? void 0 : auth.token) || '');
+  }, [auth == null ? void 0 : auth.token]);
+  // This will tell authFetch to do calls with the JWT token for specific trusted services.
+  React.useEffect(function () {
+    var _authConfig$GW_AUTH_T;
+    var trustedHosts = ((_authConfig$GW_AUTH_T = authConfig == null ? void 0 : authConfig.GW_AUTH_TRUSTED_HOSTS) != null ? _authConfig$GW_AUTH_T : '').split(',').map(function (host) {
+      return host.trim();
+    }).filter(function (host) {
+      return host.length > 0;
+    });
+    if (trustedHosts.length === 0) {
+      return undefined;
+    }
+    enableAuthFetchTrustedServices(trustedHosts);
+    return function () {
+      enableAuthFetchTrustedServices(trustedHosts, false);
+    };
+  }, [authConfig == null ? void 0 : authConfig.GW_AUTH_TRUSTED_HOSTS]);
+  return jsx(AuthFetchTrustedServicesContext.Provider, {
+    value: (auth == null ? void 0 : auth.token) || '',
+    children: children
+  });
+};
+/**
+ * Consumer hook for React components that want to read the access token
+ * currently registered with authFetch for trusted services. Must be used
+ * within an AuthFetchTrustedServicesProvider; returns '' otherwise.
+ */
+var useAuthFetchToken = function useAuthFetchToken() {
+  return React.useContext(AuthFetchTrustedServicesContext);
+};
+
 var generateRandomId = function generateRandomId() {
   return "-" + Math.random().toString(36).substring(2, 11);
 };
@@ -1315,4 +1459,4 @@ params, callbacks) {
   };
 };
 
-export { AUTH_NAMESPACE, AuthenticationContext, AuthenticationProvider, HandleOAuth2Code as Code, GEOWEB_ROLE_PRESETS_ADMIN, GEOWEB_ROLE_USER, KEEP_ALIVE_POLLER_IN_SECONDS, OAuth2Login as Login, OAuth2Logout as Logout, MILLISECOND_TO_SECOND, OIDC_NO_INTERACTION_ERROR_CODES, REFRESH_TOKEN_WHEN_PCT_EXPIRED, UserMenuRoles, apiTranslations, authTranslations, broadcastLogout, buildSilentLoginUrl, clearSession, clearSilentLoginAttempt, clearSilentLoginSuppression, createApiInstance, createFakeApiInstance, createLogoutBroadcastChannel, createNonAuthApiInstance, fakeApiRequest, getAuthConfig, getCodeChallenge, getCurrentTimeInSeconds, getCurrentUrlLocation, getRandomString, groupsToRoles, hasRecentSilentLoginAttempt, isSilentLoginEnabled, isSilentLoginSuppressed, makeCredentialsFromTokenResponse, recordSilentLoginAttempt, refreshAccessToken, refreshAccessTokenAndSetAuthContext, setAuthChangeListener, suppressSilentLogin, useApi, useAuthenticationContext, useAuthenticationDefaultProps };
+export { AUTH_NAMESPACE, AuthFetchTrustedServicesProvider, AuthenticationContext, AuthenticationProvider, HandleOAuth2Code as Code, GEOWEB_ROLE_PRESETS_ADMIN, GEOWEB_ROLE_USER, KEEP_ALIVE_POLLER_IN_SECONDS, OAuth2Login as Login, OAuth2Logout as Logout, MILLISECOND_TO_SECOND, OIDC_NO_INTERACTION_ERROR_CODES, REFRESH_TOKEN_WHEN_PCT_EXPIRED, UserMenuRoles, apiTranslations, authFetch, authTranslations, broadcastLogout, buildSilentLoginUrl, clearSession, clearSilentLoginAttempt, clearSilentLoginSuppression, createApiInstance, createFakeApiInstance, createLogoutBroadcastChannel, createNonAuthApiInstance, enableAuthFetchTrustedServices, extendHeadersWithJWTAccessToken, fakeApiRequest, getAuthConfig, getCodeChallenge, getCurrentTimeInSeconds, getCurrentUrlLocation, getRandomString, groupsToRoles, hasRecentSilentLoginAttempt, isSilentLoginEnabled, isSilentLoginSuppressed, makeCredentialsFromTokenResponse, recordSilentLoginAttempt, refreshAccessToken, refreshAccessTokenAndSetAuthContext, resetAuthFetchTrustedServices, setAuthChangeListener, setJWTAccessTokenForTrustedServices, suppressSilentLogin, useApi, useAuthFetchToken, useAuthenticationContext, useAuthenticationDefaultProps };

package/dist/src/index.d.ts

@@ -5,9 +5,11 @@ export { default as Login } from './lib/components/pages/Login';
 export { default as Logout } from './lib/components/pages/Logout';
 export * from './lib/components/UserMenuRoles';
 export * from './lib/components/AuthenticationContext';
+export * from './lib/components/AuthFetchTrustedServicesContext';
 export * from './lib/components/ApiContext';
 export * from './lib/components/apiHooks';
 export * from './lib/utils/utils';
+export * from './lib/utils/authFetch';
 export * from './lib/utils/silentLogin';
 export { AUTH_NAMESPACE } from './lib/utils/i18n';
 export { authTranslations, apiTranslations };

package/dist/src/lib/components/AuthFetchTrustedServicesContext/AuthFetchTrustedServicesContext.d.ts

@@ -0,0 +1,19 @@
+import React from 'react';
+import type { AuthFetchTrustedServicesProviderProps } from './types';
+/**
+ * Provider that keeps authFetch's module-level trusted-services store in
+ * sync with the current auth token and GW_AUTH_TRUSTED_HOSTS config.
+ *
+ * authFetch() is also called from outside the React tree (e.g. WMImage.ts,
+ * the timeseries/soundings api clients), so the token itself cannot live in
+ * React context alone -- this provider is what bridges React state into
+ * that module-level store. It also exposes the token via context for React
+ * consumers, see useAuthFetchToken.
+ */
+export declare const AuthFetchTrustedServicesProvider: React.FC<AuthFetchTrustedServicesProviderProps>;
+/**
+ * Consumer hook for React components that want to read the access token
+ * currently registered with authFetch for trusted services. Must be used
+ * within an AuthFetchTrustedServicesProvider; returns '' otherwise.
+ */
+export declare const useAuthFetchToken: () => string;

package/dist/src/lib/components/AuthFetchTrustedServicesContext/index.d.ts

@@ -0,0 +1,2 @@
+export { AuthFetchTrustedServicesProvider, useAuthFetchToken, } from './AuthFetchTrustedServicesContext';
+export type * from './types';

package/dist/src/lib/components/AuthFetchTrustedServicesContext/types.d.ts

@@ -0,0 +1,8 @@
+import type React from 'react';
+import type { Credentials } from '../ApiContext/types';
+import type { AuthenticationConfig } from '../AuthenticationContext/types';
+export interface AuthFetchTrustedServicesProviderProps {
+    auth?: Credentials | null;
+    authConfig?: AuthenticationConfig;
+    children?: React.ReactNode;
+}

package/dist/src/lib/components/AuthenticationContext/types.d.ts

@@ -9,6 +9,7 @@ export interface AuthenticationConfig {
     GW_APP_URL: string;
     GW_BE_VERSION_BASE_URL?: string;
     GW_AUTH_CLIENT_ID: string;
+    GW_AUTH_TRUSTED_HOSTS?: string;
     GW_FEATURE_SILENT_LOGIN?: boolean;
     GW_FEATURE_FORCE_AUTHENTICATION?: boolean;
 }

package/dist/src/lib/utils/authFetch.d.ts

@@ -0,0 +1,26 @@
+export declare const setJWTAccessTokenForTrustedServices: (access_token: string | undefined) => void;
+/**
+ * Resets the list of trusted services
+ */
+export declare const resetAuthFetchTrustedServices: () => void;
+/**
+ * A list of hostnames (e.g. "adaguc-server-geoweb.geoweb.knmi.cloud") that
+ * are allowed to receive the JWT access_token.
+ * @param hosts
+ * @param enable
+ */
+export declare const enableAuthFetchTrustedServices: (hosts: string[], enable?: boolean) => void;
+/**
+ * Extend the headers with an Authorization header containing the JWT access_token.
+ * @param fetchHeaders Incoming Headers, will be extended with an Authorization header.
+ * @param url Incoming url, whose hostname is checked (case-insensitively) against the list of hosts set by enableAuthFetchTrustedServices.
+ * @returns
+ */
+export declare const extendHeadersWithJWTAccessToken: (fetchHeaders: Headers, url: string | URL | Request) => Headers;
+/**
+ * Similar to fetch, but when trusted it adds an Authorization header with the JWT access_token. The trusted urls can be set as regexp in enableAuthFetchTrustedServices.
+ * @param url
+ * @param init
+ * @returns
+ */
+export declare const authFetch: (url: string | URL | Request, init?: RequestInit) => Promise<Response>;

package/package.json

@@ -1,45 +1,45 @@
 {
-  "name": "@opengeoweb/authentication",
-  "version": "19.6.1",
-  "description": "GeoWeb authentication library for the opengeoweb project",
-  "license": "Apache-2.0",
-  "repository": {
-    "type": "git",
-    "url": "git@gitlab.com:opengeoweb/opengeoweb.git"
-  },
-  "main": "./dist/index.esm.js",
-  "module": "./dist/index.esm.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    "./package.json": "./package.json",
-    ".": {
-      "@opengeoweb/source": "./src/index.ts",
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.esm.js",
-      "default": "./dist/index.esm.js"
-    }
-  },
-  "dependencies": {
-    "axios": "^1.18.0",
-    "@opengeoweb/shared": "*",
-    "@opengeoweb/theme": "*",
-    "i18next": "^25.0.1",
-    "react-i18next": "^15.1.1",
-    "@mui/material": "^9.0.1",
-    "react-router": "^7.18.2"
-  },
-  "peerDependencies": {
-    "react": "19",
-    "@emotion/react": "*",
-    "@emotion/styled": "*"
-  },
-  "devDependencies": {
-    "eslint-plugin-storybook": "10.3.3"
-  },
-  "files": [
-    "dist",
-    "!dist/package.json",
-    "README.md",
-    "package.json"
-  ]
-}
+    "name": "@opengeoweb/authentication",
+    "version": "20.0.0-nightly-20260918",
+    "description": "GeoWeb authentication library for the opengeoweb project",
+    "license": "Apache-2.0",
+    "repository": {
+        "type": "git",
+        "url": "git@gitlab.com:opengeoweb/opengeoweb.git"
+    },
+    "main": "./dist/index.esm.js",
+    "module": "./dist/index.esm.js",
+    "types": "./dist/index.d.ts",
+    "exports": {
+        "./package.json": "./package.json",
+        ".": {
+            "@opengeoweb/source": "./src/index.ts",
+            "types": "./dist/index.d.ts",
+            "import": "./dist/index.esm.js",
+            "default": "./dist/index.esm.js"
+        }
+    },
+    "dependencies": {
+        "axios": "^1.18.0",
+        "@opengeoweb/shared": "20.0.0-nightly-20260918",
+        "@opengeoweb/theme": "20.0.0-nightly-20260918",
+        "i18next": "^25.0.1",
+        "react-i18next": "^15.1.1",
+        "@mui/material": "^9.0.1",
+        "react-router": "^7.18.2"
+    },
+    "peerDependencies": {
+        "react": "19",
+        "@emotion/react": "*",
+        "@emotion/styled": "*"
+    },
+    "devDependencies": {
+        "eslint-plugin-storybook": "10.3.3"
+    },
+    "files": [
+        "dist",
+        "!dist/package.json",
+        "README.md",
+        "package.json"
+    ]
+}