@owlmeans/client-auth 0.1.18-rc.44 → 0.1.18-rc.45

package/tests/i18n.spec.ts

@@ -0,0 +1,68 @@
+import { describe, expect, test } from 'bun:test'
+import en from '../src/login/i18n/en.json'
+import pl from '../src/login/i18n/pl.json'
+import ru from '../src/login/i18n/ru.json'
+import be from '../src/login/i18n/be.json'
+import uk from '../src/login/i18n/uk.json'
+import es from '../src/login/i18n/es.json'
+import de from '../src/login/i18n/de.json'
+import fr from '../src/login/i18n/fr.json'
+
+type Messages = { [key: string]: string | Messages }
+
+/** Every leaf as `branch.key` → message, however deep the resource nests. */
+const leaves = (messages: Messages, prefix = ''): Map<string, unknown> => {
+  const found = new Map<string, unknown>()
+  for (const [key, value] of Object.entries(messages)) {
+    const path = prefix === '' ? key : `${prefix}.${key}`
+    if (value != null && typeof value === 'object') {
+      for (const [leaf, message] of leaves(value, path)) found.set(leaf, message)
+    } else {
+      found.set(path, value)
+    }
+  }
+  return found
+}
+
+const placeholders = (message: string): string[] =>
+  [...message.matchAll(/\{\{\s*([\w-]+)\s*\}\}/g)].map(match => match[1]).sort()
+
+describe('client-auth login localization', () => {
+  const translations: Record<string, Messages> = { en, pl, ru, be, uk, es, de, fr }
+  const reference = leaves(en)
+
+  test('ships all eight languages with exact key parity at every depth', () => {
+    expect(Object.keys(translations).sort()).toEqual(['be', 'de', 'en', 'es', 'fr', 'pl', 'ru', 'uk'])
+    expect(reference.has('login.terms.accept')).toBe(true)
+    expect(reference.has('login.terms.notice')).toBe(true)
+    expect(reference.has('login.terms.revised')).toBe(true)
+    // The removed key never comes back once every renderer has moved off it.
+    expect(reference.has('login.terms.agreement')).toBe(false)
+
+    for (const [lng, messages] of Object.entries(translations)) {
+      const found = leaves(messages)
+      expect({ lng, keys: [...found.keys()].sort() }).toEqual({ lng, keys: [...reference.keys()].sort() })
+      for (const [key, message] of found) {
+        expect({ lng, key, filled: typeof message === 'string' && message.trim().length > 0 })
+          .toEqual({ lng, key, filled: true })
+      }
+    }
+  })
+
+  test('keeps the interpolation placeholders of every message', () => {
+    for (const [lng, messages] of Object.entries(translations)) {
+      for (const [key, message] of leaves(messages)) {
+        expect({ lng, key, placeholders: placeholders(String(message)) })
+          .toEqual({ lng, key, placeholders: placeholders(String(reference.get(key))) })
+      }
+    }
+  })
+
+  test('`login.terms.required` no longer names the Privacy Policy specifically', () => {
+    for (const [lng, messages] of Object.entries(translations)) {
+      const required = leaves(messages).get('login.terms.required')
+      expect({ lng, hasDocumentsToken: placeholders(String(required)).includes('documents') })
+        .toEqual({ lng, hasDocumentsToken: true })
+    }
+  })
+})

package/tests/land.spec.ts

@@ -0,0 +1,241 @@
+import { afterEach, describe, expect, test } from 'bun:test'
+import { makeTestContext } from './context.js'
+import { makeFixtureKeyPair } from '@owlmeans/test-auth'
+import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
+import { AuthroizationType, AuthRole, DISPATCHER } from '@owlmeans/auth'
+import type { Auth } from '@owlmeans/auth'
+import { HOME } from '@owlmeans/context'
+import type { BasicContext, BasicConfig } from '@owlmeans/context'
+import { createStaticResource } from '@owlmeans/static-resource'
+import type { Resource } from '@owlmeans/resource'
+import { FLOW_STATE, RESUME_FLOW } from '@owlmeans/client-flow'
+import type { SuspendedLandingRecord } from '@owlmeans/client-flow'
+import { DEFAULT_ALIAS as AUTH_ALIAS } from '../src/consts.js'
+import type { AuthService } from '@owlmeans/auth-common'
+import { appendLogin } from '../src/login/service.js'
+import { continueLogin, landAfterLogin, LOGIN_LANDED_STORAGE } from '../src/login/land.js'
+import type { LoginLandingHook, LoginService, LoginStep } from '../src/login/types.js'
+
+/**
+ * A hand-written `window.localStorage`, not jsdom — `land.ts` reads exactly two keys through
+ * `try`/`catch`, and a real DOM would prove a fixture behaves rather than that the module does.
+ * Mirrors `web-client/tests/surrogate.spec.ts`'s own `stubWindow` idiom.
+ */
+const stubStorage = (): void => {
+  const store = new Map<string, string>()
+  ;(globalThis as unknown as { window: unknown }).window = {
+    localStorage: {
+      getItem: (key: string) => (store.has(key) ? store.get(key)! : null),
+      setItem: (key: string, value: string) => { store.set(key, value) },
+      removeItem: (key: string) => { store.delete(key) },
+    },
+  }
+}
+
+afterEach(() => {
+  delete (globalThis as { window?: unknown }).window
+})
+
+/** A validly-signed bearer, exactly as `server-auth` would issue one. */
+const makeBearer = async (auth: Partial<Auth>): Promise<string> => {
+  const appKP = makeFixtureKeyPair('client-auth-land-test-key')
+  const fullAuth: Auth = {
+    token: 'nonce-123', userId: 'user-1', scopes: ['*'], role: AuthRole.User,
+    type: AuthroizationType.Ed25519BasicToken, source: 'test-service', isUser: true,
+    createdAt: new Date(), ...auth,
+  }
+  const signed = await makeEnvelopeModel<Auth>(AuthroizationType.Ed25519BasicToken)
+    .send(fullAuth, null).sign(appKP, EnvelopeKind.Token)
+
+  return `${AuthroizationType.Ed25519BasicToken.toUpperCase()} ${signed}`
+}
+
+const bootstrap = async (opts?: {
+  authenticated?: boolean, withFlowState?: boolean
+}): Promise<[BasicContext<BasicConfig>, LoginService]> => {
+  const context = makeTestContext()
+  if (opts?.withFlowState) {
+    context.registerResource(
+      createStaticResource<SuspendedLandingRecord>(FLOW_STATE, 'client-auth-land-tests')
+    )
+  }
+  context.configure()
+  await context.init()
+
+  if (opts?.authenticated) {
+    const authService = context.service<AuthService>(AUTH_ALIAS)
+    await authService.update(await makeBearer({ userId: 'land-test-user' }))
+  }
+
+  const contextual = appendLogin(context)
+
+  return [context, contextual.login()]
+}
+
+const step = (over: Partial<LoginStep> & { alias: string, entrypoint: string }): LoginStep => ({
+  pending: async () => false, ...over,
+})
+
+/** Grant a fake alias existence without building a real entrypoint/route graph. */
+const allowEntrypoints = (context: BasicContext<BasicConfig>, ...aliases: string[]): void => {
+  (context as unknown as { hasEntrypoint: (alias: string) => boolean }).hasEntrypoint =
+    alias => aliases.includes(alias)
+}
+
+describe('continueLogin — no steps registered', () => {
+  test('falls through to a suspended flow, then HOME', async () => {
+    const [context] = await bootstrap({ authenticated: true })
+
+    expect(await continueLogin(context)).toEqual({ alias: HOME })
+  })
+})
+
+describe('continueLogin — steps', () => {
+  test('a pending step lands there, and a suspended landing is NOT consumed', async () => {
+    stubStorage()
+    const [context, login] = await bootstrap({ authenticated: true, withFlowState: true })
+    allowEntrypoints(context, 'step-screen')
+
+    const resource = context.resource<Resource<SuspendedLandingRecord>>(FLOW_STATE)
+    await resource.save({
+      id: RESUME_FLOW, entrypoint: 'suspended-screen', query: { ref: 'abc' },
+      expiresAt: Date.now() + 60_000,
+    })
+
+    login.registerStep(step({
+      alias: 'consent', entrypoint: 'step-screen', pending: async () => true,
+      query: () => ({ from: 'test' }),
+    }))
+
+    expect(await continueLogin(context)).toEqual({
+      alias: 'step-screen', query: { from: 'test' }, step: 'consent',
+    })
+    // The suspended landing is still there — a later step, or the eventual fallback, still needs it.
+    expect(await resource.load(RESUME_FLOW)).not.toBeNull()
+  })
+
+  test('a step whose `pending` throws is treated as not pending — fail open', async () => {
+    const [context, login] = await bootstrap({ authenticated: true })
+    allowEntrypoints(context, 'broken-screen')
+
+    login.registerStep(step({
+      alias: 'broken', entrypoint: 'broken-screen',
+      pending: async () => { throw new Error('boom') },
+    }))
+
+    expect(await continueLogin(context)).toEqual({ alias: HOME })
+  })
+
+  test('a step whose `pending` never resolves is treated as not pending after the timeout', async () => {
+    const [context, login] = await bootstrap({ authenticated: true })
+    allowEntrypoints(context, 'hanging-screen')
+
+    login.registerStep(step({
+      alias: 'hanging', entrypoint: 'hanging-screen',
+      pending: () => new Promise<boolean>(() => { /* never settles */ }),
+    }))
+
+    expect(await continueLogin(context, { stepTimeout: 20 })).toEqual({ alias: HOME })
+  })
+
+  test('a step whose entrypoint is unresolvable is skipped, never throws', async () => {
+    const [context, login] = await bootstrap({ authenticated: true })
+    let called = false
+
+    login.registerStep(step({
+      alias: 'unbound', entrypoint: 'nowhere', pending: async () => { called = true; return true },
+    }))
+
+    expect(await continueLogin(context)).toEqual({ alias: HOME })
+    expect(called).toBe(false)
+  })
+
+  test('`after` skips every step up to and including that alias', async () => {
+    const [context, login] = await bootstrap({ authenticated: true })
+    allowEntrypoints(context, 'a-screen', 'b-screen')
+
+    login.registerStep(step({ alias: 'a', entrypoint: 'a-screen', priority: 20, pending: async () => true }))
+    login.registerStep(step({ alias: 'b', entrypoint: 'b-screen', priority: 10, pending: async () => true }))
+
+    expect(await continueLogin(context)).toEqual({ alias: 'a-screen', query: undefined, step: 'a' })
+    expect(await continueLogin(context, { after: 'a' }))
+      .toEqual({ alias: 'b-screen', query: undefined, step: 'b' })
+  })
+
+  test('an unauthenticated caller with an explicit alias still gets that alias', async () => {
+    const [context] = await bootstrap()
+
+    expect(await continueLogin(context, {
+      fallback: { alias: 'explicit-alias' }, resume: false,
+    })).toEqual({ alias: 'explicit-alias' })
+  })
+})
+
+describe('landAfterLogin — the surrogate short circuit', () => {
+  test('returns DISPATCHER immediately; no step or hook ever runs', async () => {
+    const [context, login] = await bootstrap({ authenticated: true })
+    login.env = () => ({ hasWindow: true, embedded: true, surrogate: true, hasOpener: true })
+
+    let stepCalled = false
+    let hookCalled = false
+    login.registerStep(step({
+      alias: 'never', entrypoint: 'never-screen', pending: async () => { stepCalled = true; return true },
+    }))
+    login.onLanded({ alias: 'never', landed: async () => { hookCalled = true } })
+
+    expect(await landAfterLogin(context)).toEqual({ alias: DISPATCHER })
+    expect(stepCalled).toBe(false)
+    expect(hookCalled).toBe(false)
+  })
+})
+
+describe('landAfterLogin — landing hooks', () => {
+  const hook = (over: Partial<LoginLandingHook> & { alias: string }): LoginLandingHook => ({
+    landed: async () => { }, ...over,
+  })
+
+  test('run exactly once per distinct token, in priority order, each swallowed on error', async () => {
+    stubStorage()
+    const [context, login] = await bootstrap({ authenticated: true })
+
+    const order: string[] = []
+    login.onLanded(hook({ alias: 'low', priority: 0, landed: async () => { order.push('low') } }))
+    login.onLanded(hook({
+      alias: 'high', priority: 10, landed: async () => { order.push('high'); throw new Error('boom') },
+    }))
+
+    await landAfterLogin(context)
+    expect(order).toEqual(['high', 'low'])
+
+    // Same token again — neither hook runs a second time.
+    await landAfterLogin(context)
+    expect(order).toEqual(['high', 'low'])
+  })
+
+  test('a distinct token runs the hooks again', async () => {
+    stubStorage()
+    const [context, login] = await bootstrap({ authenticated: true })
+
+    let count = 0
+    login.onLanded(hook({ alias: 'counter', landed: async () => { count += 1 } }))
+
+    await landAfterLogin(context)
+    expect(count).toBe(1)
+
+    const authService = context.service<AuthService>(AUTH_ALIAS)
+    await authService.update(await makeBearer({ userId: 'a-different-user' }))
+
+    await landAfterLogin(context)
+    expect(count).toBe(2)
+  })
+
+  test('storage records the raw token, not a digest, under LOGIN_LANDED_STORAGE', async () => {
+    stubStorage()
+    const [context] = await bootstrap({ authenticated: true })
+    const authService = context.service<AuthService>(AUTH_ALIAS)
+
+    await landAfterLogin(context)
+
+    expect(window.localStorage.getItem(LOGIN_LANDED_STORAGE)).toBe(authService.token as string)
+  })
+})

package/tests/terms.spec.ts

@@ -0,0 +1,202 @@
+import { describe, expect, test } from 'bun:test'
+import { OWLMEANS_COOKIES_URL, OWLMEANS_PRIVACY_URL, OWLMEANS_TERMS_URL } from '@owlmeans/config'
+import type { LoginTermsConfig } from '@owlmeans/config'
+import { resolveTerms, termsSentence } from '../src/login/terms.js'
+import type { ResolvedTermsDocument } from '../src/login/terms.js'
+
+/**
+ * The pre-existing digest, copied rather than imported: `resolveTerms`'s own `digest` is private,
+ * and re-deriving it here is the whole point — this pins what the ALGORITHM produced before this
+ * file grew billing/product/custom documents, so a change to either one is caught independently.
+ */
+const legacyDigest = (parts: string[]): string => {
+  let hash = 0
+  for (const char of parts.join(' ')) {
+    hash = ((hash << 5) - hash + char.charCodeAt(0)) | 0
+  }
+
+  return (hash >>> 0).toString(36)
+}
+
+const DEFAULT_LABEL: Record<string, string> = {
+  terms: 'Terms & Conditions', privacy: 'Privacy Policy', cookies: 'Cookie Policy',
+  billing: 'Billing Terms', product: '{{product}} Product Terms',
+}
+
+/** A minimal stand-in for a renderer's own `resolveLabel` — no i18n context, just the fallback. */
+const label = (doc: ResolvedTermsDocument): string => {
+  let text = doc.label ?? DEFAULT_LABEL[doc.key] ?? doc.i18nKey ?? doc.key
+  if (doc.params != null) {
+    for (const [key, value] of Object.entries(doc.params)) {
+      text = text.split(`{{${key}}}`).join(value)
+    }
+  }
+
+  return text
+}
+
+describe('resolveTerms — the digest', () => {
+  test('is byte-identical to the pre-existing algorithm when nothing new is configured', () => {
+    const cfg: LoginTermsConfig = {
+      required: true, terms: 'https://a.test/terms', privacy: 'https://a.test/privacy',
+    }
+    const resolved = resolveTerms(cfg)
+
+    expect(resolved?.version).toBe(
+      legacyDigest(['https://a.test/terms', 'https://a.test/privacy', OWLMEANS_COOKIES_URL])
+    )
+  })
+
+  test('a defaulted config (no terms/privacy/cookies at all) matches the same algorithm', () => {
+    const resolved = resolveTerms({})
+
+    expect(resolved?.version).toBe(
+      legacyDigest([OWLMEANS_TERMS_URL, OWLMEANS_PRIVACY_URL, OWLMEANS_COOKIES_URL])
+    )
+  })
+
+  test('an explicit version override is used verbatim, as before', () => {
+    expect(resolveTerms({ version: 'pinned-v3' })?.version).toBe('pinned-v3')
+  })
+
+  test('adding a billing document changes the digest', () => {
+    const base = resolveTerms({})?.version
+    const withBilling = resolveTerms({ billing: 'https://a.test/billing' })?.version
+
+    expect(withBilling).not.toBe(base)
+  })
+
+  test('changing only a revision date changes the digest', () => {
+    const unrevised = resolveTerms({})?.version
+    const revised = resolveTerms({ revisions: { terms: '2026-01-01' } })?.version
+
+    expect(revised).not.toBe(unrevised)
+  })
+})
+
+describe('resolveTerms — documents and notices', () => {
+  test('billing/product/documents/revisions all populate `documents`, in order', () => {
+    // Module-augmentation proof: this whole literal type-checks against `LoginTermsConfig` only
+    // because `@owlmeans/client-auth/login`'s augmentation merged onto it — a file that imports
+    // NOTHING from this package would fail to compile the `billing`/`product`/`documents`/
+    // `revisions`/`showRevision` fields below.
+    const cfg: LoginTermsConfig = {
+      terms: 'https://a.test/terms',
+      billing: { href: 'https://a.test/billing', revisedAt: '2026-02-01' },
+      product: { name: 'Acme', href: 'https://a.test/product' },
+      documents: [
+        { key: 'custom-a', href: 'https://a.test/custom-a', label: 'Custom A' },
+        { key: 'custom-b', href: 'https://a.test/custom-b', i18nKey: 'login.terms.custom-b' },
+      ],
+      revisions: { terms: '2026-01-15' },
+    }
+
+    const resolved = resolveTerms(cfg)
+
+    expect(resolved?.documents.map(doc => doc.key))
+      .toEqual(['terms', 'billing', 'product', 'custom-a', 'custom-b'])
+    expect(resolved?.documents[0].revisedAt).toBe('2026-01-15')
+    expect(resolved?.documents[1].href).toBe('https://a.test/billing')
+    expect(resolved?.documents[1].revisedAt).toBe('2026-02-01')
+    expect(resolved?.documents[2].href).toBe('https://a.test/product')
+    expect(resolved?.documents[2].params).toEqual({ product: 'Acme' })
+    expect(resolved?.documents[3]).toMatchObject({ key: 'custom-a', href: 'https://a.test/custom-a', label: 'Custom A' })
+    expect(resolved?.documents[4]).toMatchObject({ key: 'custom-b', href: 'https://a.test/custom-b', i18nKey: 'login.terms.custom-b' })
+  })
+
+  test('a bare billing string is treated as `{ href }`', () => {
+    const resolved = resolveTerms({ billing: 'https://a.test/billing' })
+
+    expect(resolved?.documents.find(doc => doc.key === 'billing')?.href).toBe('https://a.test/billing')
+  })
+
+  test('`false` turns billing/product off — the default', () => {
+    const resolved = resolveTerms({ billing: false, product: false })
+
+    expect(resolved?.documents.map(doc => doc.key)).toEqual(['terms'])
+  })
+
+  test('the cookies notice is included when explicitly configured', () => {
+    const resolved = resolveTerms({
+      terms: 'https://a.test/terms', privacy: 'https://a.test/privacy', cookies: 'https://a.test/cookies',
+    })
+
+    expect(resolved?.notices.map(doc => doc.key)).toEqual(['privacy', 'cookies'])
+  })
+
+  test('the cookies notice is included when terms/privacy/cookies are ALL still the defaults', () => {
+    const resolved = resolveTerms({})
+
+    expect(resolved?.notices.map(doc => doc.key)).toEqual(['privacy', 'cookies'])
+  })
+
+  test('the cookies notice is DROPPED when terms/privacy were customised but cookies was not', () => {
+    const resolved = resolveTerms({ terms: 'https://a.test/terms', privacy: 'https://a.test/privacy' })
+
+    expect(resolved?.notices.map(doc => doc.key)).toEqual(['privacy'])
+  })
+
+  test('`revisedAt` is set only when `showRevision` is true', () => {
+    const cfg: LoginTermsConfig = { revisions: { terms: '2026-03-01' } }
+
+    expect(resolveTerms(cfg)?.revisedAt).toBeUndefined()
+    expect(resolveTerms({ ...cfg, showRevision: true })?.revisedAt).toBe('2026-03-01')
+  })
+
+  test('`revisedAt` is the LATEST revision among documents', () => {
+    const cfg: LoginTermsConfig = {
+      showRevision: true,
+      billing: { href: 'https://a.test/billing', revisedAt: '2026-01-01' },
+      revisions: { terms: '2026-06-01' },
+    }
+
+    expect(resolveTerms(cfg)?.revisedAt).toBe('2026-06-01')
+  })
+})
+
+describe('termsSentence', () => {
+  test('interpolates {{documents}} as a formatted, linked list', () => {
+    const resolved = resolveTerms({
+      terms: 'https://a.test/terms', billing: 'https://a.test/billing',
+    })!
+
+    const parts = termsSentence('I agree to the {{documents}}.', resolved, 'en', label)
+    const linked = parts.filter(part => part.href != null)
+
+    expect(linked.map(part => part.documentKey)).toEqual(['terms', 'billing'])
+    expect(parts[0]).toEqual({ text: 'I agree to the ' })
+    expect(parts.at(-1)).toEqual({ text: '.' })
+  })
+
+  test('interpolates {{notices}} the same way, from `resolved.notices`', () => {
+    const resolved = resolveTerms({
+      terms: 'https://a.test/terms', privacy: 'https://a.test/privacy', cookies: 'https://a.test/cookies',
+    })!
+
+    const parts = termsSentence('Data: {{notices}}.', resolved, 'en', label)
+    const linked = parts.filter(part => part.href != null)
+
+    expect(linked.map(part => part.documentKey)).toEqual(['privacy', 'cookies'])
+  })
+
+  test('supports the legacy {{terms}}/{{privacy}}/{{cookies}} placeholders', () => {
+    const resolved = resolveTerms({
+      terms: 'https://a.test/terms', privacy: 'https://a.test/privacy', cookies: 'https://a.test/cookies',
+    })!
+
+    const parts = termsSentence('{{terms}} and {{privacy}} and {{cookies}}', resolved, 'en', label)
+    const linked = parts.filter(part => part.href != null)
+
+    expect(linked.map(part => part.documentKey)).toEqual(['terms', 'privacy', 'cookies'])
+    expect(linked.map(part => part.href))
+      .toEqual(['https://a.test/terms', 'https://a.test/privacy', 'https://a.test/cookies'])
+  })
+
+  test('a single document renders with no list separator', () => {
+    const resolved = resolveTerms({ terms: 'https://a.test/terms' })!
+
+    const parts = termsSentence('{{documents}}', resolved, 'en', label)
+
+    expect(parts).toEqual([{ text: 'Terms & Conditions', href: 'https://a.test/terms', documentKey: 'terms' }])
+  })
+})