@openneuro/app 4.47.6 → 4.47.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openneuro/app",
-  "version": "4.47.6",
+  "version": "4.47.7",
   "description": "React JS web frontend for the OpenNeuro platform.",
   "license": "MIT",
   "main": "public/client.js",
@@ -79,5 +79,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "e00e369a538900524544a396e7fd60e5e41d715e"
+  "gitHead": "af17c267fa700dff5b13d1b31aaf4f89c0853165"
 }

package/src/client.jsx

@@ -15,11 +15,10 @@ import { relayStylePagination } from "@apollo/client/utilities"
 // TODO - This should be a global SCSS?
 import "./scripts/components/page/page.scss"
 import cookies from "./scripts/utils/cookies.js"
-import { getProfile, guardExpired } from "./scripts/authentication/profile"
+import { shouldRemoveToken } from "./scripts/authentication/profile"
 
-// Clear expired JWT before the app mounts to avoid stale auth state
-const profile = getProfile(cookies.getAll())
-if (profile && !guardExpired(profile)) {
+// Clear expired or corrupted JWT before the app mounts to avoid stale auth state
+if (shouldRemoveToken(cookies.getAll())) {
   cookies.remove("accessToken", { path: "/" })
 }
 

package/src/scripts/authentication/__tests__/profile.spec.js

@@ -1,23 +1,89 @@
-import { parseJwt } from "../profile"
+import {
+  getProfile,
+  guardExpired,
+  parseJwt,
+  shouldRemoveToken,
+} from "../profile"
+
+const header = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9"
+const dummySig = "SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
 
 const asciiToken =
-  "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
+  `${header}.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.${dummySig}`
 const utf8Token =
-  "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6Iuelnue1jOenkeWtpuiAhSIsImlhdCI6MTUxNjIzOTAyMn0.pUw2ARoXv4LkJXB1ZR3Th6xG83URT6mn1TftC7ac_O8"
+  `${header}.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6Iuelnue1jOenkeWtpuiAhSIsImlhdCI6MTUxNjIzOTAyMn0.${dummySig}`
+
+// Token with exp far in the future
+const validToken =
+  `${header}.eyJzdWIiOiJ1c2VyMTIzIiwiYWRtaW4iOmZhbHNlLCJpYXQiOjE1MTYyMzkwMjIsImV4cCI6OTk5OTk5OTk5OX0.${dummySig}`
+// Token with exp = 1 (long expired)
+const expiredToken =
+  `${header}.eyJzdWIiOiJ1c2VyMTIzIiwiYWRtaW4iOmZhbHNlLCJpYXQiOjE1MTYyMzkwMjIsImV4cCI6MX0.${dummySig}`
 
 describe("authentication/profile", () => {
-  it("decodes a JWT to Javascript object", () => {
-    expect(parseJwt(asciiToken)).toEqual({
-      sub: "1234567890",
-      name: "John Doe",
-      iat: 1516239022,
+  describe("parseJwt", () => {
+    it("decodes a JWT to Javascript object", () => {
+      expect(parseJwt(asciiToken)).toEqual({
+        sub: "1234567890",
+        name: "John Doe",
+        iat: 1516239022,
+      })
+    })
+    it("decodes a JWT with Unicode strings", () => {
+      expect(parseJwt(utf8Token)).toEqual({
+        sub: "1234567890",
+        name: "神経科学者",
+        iat: 1516239022,
+      })
+    })
+  })
+
+  describe("getProfile", () => {
+    it("returns null when no accessToken cookie exists", () => {
+      expect(getProfile({})).toBeNull()
+    })
+    it("returns null for a corrupted token", () => {
+      expect(getProfile({ accessToken: "not-a-jwt" })).toBeNull()
+    })
+    it("returns the decoded profile for a valid token", () => {
+      const profile = getProfile({ accessToken: validToken })
+      expect(profile).toMatchObject({
+        sub: "user123",
+        admin: false,
+        exp: 9999999999,
+      })
+    })
+  })
+
+  describe("guardExpired", () => {
+    it("returns true for an unexpired token", () => {
+      const profile = getProfile({ accessToken: validToken })
+      expect(guardExpired(profile)).toBe(true)
+    })
+    it("returns false for an expired token", () => {
+      const profile = getProfile({ accessToken: expiredToken })
+      expect(guardExpired(profile)).toBe(false)
+    })
+    it("returns false for a null profile", () => {
+      expect(guardExpired(null)).toBe(false)
     })
   })
-  it("decodes a JWT with Unicode strings", () => {
-    expect(parseJwt(utf8Token)).toEqual({
-      sub: "1234567890",
-      name: "神経科学者",
-      iat: 1516239022,
+
+  describe("shouldRemoveToken", () => {
+    it("removes nothing when no token is present", () => {
+      expect(shouldRemoveToken({})).toBe(false)
+    })
+    it("keeps a valid unexpired token", () => {
+      expect(shouldRemoveToken({ accessToken: validToken })).toBe(false)
+    })
+    it("removes an expired token", () => {
+      expect(shouldRemoveToken({ accessToken: expiredToken })).toBe(true)
+    })
+    it("removes a corrupted token", () => {
+      expect(shouldRemoveToken({ accessToken: "garbage" })).toBe(true)
+    })
+    it("removes an empty string token", () => {
+      expect(shouldRemoveToken({ accessToken: "" })).toBe(false)
     })
   })
 })

package/src/scripts/authentication/profile.ts

@@ -36,6 +36,15 @@ export const getUnexpiredProfile = (cookies) => {
   if (guardExpired(profile)) return profile
 }
 
+/**
+ * Check if the accessToken cookie should be removed due to expiration or corruption
+ */
+export function shouldRemoveToken(cookies): boolean {
+  const profile = getProfile(cookies)
+  const hasToken = !!cookies["accessToken"]
+  return hasToken && (!profile || !guardExpired(profile))
+}
+
 /**
  * Test for an expired token
  * @param {object} profile A profile returned by getProfile()

package/src/scripts/queries/user.ts

@@ -1,4 +1,3 @@
-import { useEffect } from "react"
 import { gql, useQuery } from "@apollo/client"
 import { useCookies } from "react-cookie"
 import { getProfile } from "../authentication/profile"
@@ -212,7 +211,7 @@ export const ADVANCED_SEARCH_DATASETS_QUERY = gql`
 
 // Reusable hook to fetch user data
 export const useUser = (userId?: string) => {
-  const [cookies, , removeCookie] = useCookies()
+  const [cookies] = useCookies()
   const profile = getProfile(cookies)
   const profileSub = profile?.sub
 
@@ -231,13 +230,6 @@ export const useUser = (userId?: string) => {
     Sentry.captureException(userError)
   }
 
-  // Clear invalid session: cookie exists but query failed or returned no user
-  useEffect(() => {
-    if (!userLoading && profile && (userError || !userData?.user)) {
-      removeCookie("accessToken", { path: "/" })
-    }
-  }, [userLoading, profile, userError, userData?.user, removeCookie])
-
   return {
     user: userData?.user,
     loading: userLoading,

package/src/scripts/users/user-menu.tsx

@@ -62,7 +62,7 @@ export const UserMenu: React.FC<UserMenuProps> = ({ signOutAndRedirect }) => {
 
   return (
     <span className="user-menu-wrap">
-      {user.orcid && (
+      {user.orcid && user.id !== "reviewer" && (
         <span className="notifications-link">
           <Link to={`/user/${user.orcid}/notifications/unread`}>
             <i className="fa fa-inbox">