@plone-collective/volto-identity 1.0.0-alpha.1

package/src/helpers/navigate.test.ts

@@ -0,0 +1,132 @@
+import { describe, expect, it, vi } from 'vitest';
+
+import { goTo, isBackendView, isInternal, isSameOrigin } from './navigate';
+
+describe('isInternal', () => {
+  it('accepts a site-relative path', () => {
+    expect(isInternal('/identities')).toBe(true);
+  });
+
+  it('refuses a protocol-relative URL', () => {
+    // It starts with a slash and is not local at all, which is exactly the
+    // shape a naive check gets wrong.
+    expect(isInternal('//evil.example/x')).toBe(false);
+  });
+
+  it('refuses an absolute URL', () => {
+    expect(isInternal('https://evil.example/x')).toBe(false);
+  });
+});
+
+describe('isBackendView', () => {
+  it('recognises a view at the root', () => {
+    expect(isBackendView('/@@oauth-authorize?response_type=code')).toBe(true);
+  });
+
+  it('recognises a view traversed to further down', () => {
+    // Per segment rather than by prefix: a view can hang off any object.
+    expect(isBackendView('/profiles/jane/@@download')).toBe(true);
+  });
+
+  it('recognises a traversal namespace', () => {
+    expect(isBackendView('/++api++/@profile')).toBe(true);
+    expect(isBackendView('/++resource++plone-logo.svg')).toBe(true);
+  });
+
+  it('recognises the user folder', () => {
+    expect(
+      isBackendView('/acl_users/credentials_cookie_auth/require_login'),
+    ).toBe(true);
+  });
+
+  it('leaves an ordinary route alone', () => {
+    expect(isBackendView('/identities')).toBe(false);
+    expect(isBackendView('/profiles/jane/edit')).toBe(false);
+  });
+
+  it('is not fooled by a query string mentioning one', () => {
+    // The decision is about where the browser is going, not about what it
+    // carries: this target is the login route and the router owns it.
+    expect(isBackendView('/login?came_from=%2F%40%40oauth-authorize')).toBe(
+      false,
+    );
+  });
+});
+
+describe('isSameOrigin', () => {
+  it('accepts this site', () => {
+    expect(isSameOrigin(`${window.location.origin}/x`)).toBe(true);
+  });
+
+  it('refuses another', () => {
+    expect(isSameOrigin('https://evil.example/x')).toBe(false);
+  });
+
+  it('refuses something that is not a URL at all', () => {
+    expect(isSameOrigin('http://[')).toBe(false);
+  });
+});
+
+describe('goTo', () => {
+  it('routes an internal path rather than reloading', () => {
+    // The whole point: a page load throws the bundle and the store away to
+    // reach a route this application is already running.
+    const push = vi.fn();
+
+    goTo('/identities', push);
+
+    expect(push).toHaveBeenCalledWith('/identities');
+  });
+
+  it('sends a foreign target nowhere without permission', () => {
+    // `came_from` arrives in a query string. Handing an absolute one to the
+    // browser is an open redirect, so the caller's fallback is used instead.
+    const push = vi.fn();
+
+    goTo('https://evil.example/x', push);
+
+    expect(push).toHaveBeenCalledWith('/');
+  });
+
+  it('allows a foreign target when the caller says it is external', () => {
+    // A provider's authorize URL, which is the case this exists for.
+    const push = vi.fn();
+    const assign = vi.spyOn(window, 'location', 'get');
+
+    goTo('https://github.com/login/oauth', push, { external: true });
+
+    expect(push).not.toHaveBeenCalled();
+    assign.mockRestore();
+  });
+
+  it('does not route a site-relative backend view', () => {
+    // The bug this predicate exists for. Plone's `require_login` hands
+    // `came_from` back as `/@@oauth-authorize?…`, the router took it because
+    // it starts with a slash, and Volto asked plone.restapi for the content
+    // at that path -- dropping the authorization request's query string,
+    // getting a 400, and rendering its own 404 at exactly that URL.
+    const push = vi.fn();
+
+    goTo('/@@oauth-authorize?response_type=code&client_id=demo-rp', push);
+
+    expect(push).not.toHaveBeenCalled();
+  });
+
+  it('does not route a backend view given as an absolute URL', () => {
+    // The shape `handedOverReturn` produces: the backend hands the paused
+    // authorization request over as a full URL on this origin.
+    const push = vi.fn();
+
+    goTo(`${window.location.origin}/@@oauth-authorize?x=1`, push);
+
+    expect(push).not.toHaveBeenCalled();
+  });
+
+  it('does nothing with an empty target', () => {
+    const push = vi.fn();
+
+    goTo('', push);
+
+    expect(push).not.toHaveBeenCalled();
+  });
+});

package/src/helpers/navigate.ts

@@ -0,0 +1,126 @@
+/**
+ * Going somewhere, without throwing the application away to do it.
+ *
+ * `window.location.href` is a page load: the bundle is fetched again, the
+ * store is rebuilt from nothing, and every route that was already rendered is
+ * rendered a second time. For an address this app owns that is pure waste, and
+ * it is what six places in this add-on were doing (Érico, 2026-08-29).
+ *
+ * It is also the *only* option for the addresses this app does not own — a
+ * provider's authorize URL, `@@oauth-authorize` on the backend — so the
+ * decision cannot be "never use it". It is a question about the target, asked
+ * once, here.
+ *
+ * A second reason to ask it in one place: `came_from` and `return_url` reach
+ * this app from a query string, and handing an absolute one to the browser is
+ * an open redirect. Everything site-relative and routable goes through the
+ * router; everything else is checked against the current origin first.
+ * @module helpers/navigate
+ */
+
+/**
+ * Whether a target is a path this application can route to itself.
+ *
+ * `//evil.example` is the case worth naming: it is protocol-relative, so it
+ * starts with a slash and is not local at all.
+ *
+ * @param target Where somebody wants to go.
+ * @returns Whether the router can take them.
+ */
+export function isInternal(target: string): boolean {
+  return target.startsWith('/') && !target.startsWith('//');
+}
+
+/**
+ * Whether a path on this origin is published by the backend rather than Volto.
+ *
+ * Same origin is not the same as same application. Zope publishes a whole
+ * grammar of traversal namespaces alongside Volto's routes — `@@` for a view,
+ * `++api++` / `++resource++` / `++plone++` for a namespace, `acl_users` for
+ * PAS — and the router owns none of them.
+ *
+ * The premise this replaces was "site-relative means a route this app owns",
+ * and `came_from` is where it breaks. Plone's `require_login` hands back a
+ * *site-relative* `/@@oauth-authorize?…`, so an authorization request paused
+ * for sign-in came back through the router: Volto asked plone.restapi for the
+ * content at that path, dropped the authorization request's query string on
+ * the way, got a 400 and rendered its own 404. The relying party that sent
+ * the visitor received neither a code nor an error (Érico, 2026-08-30,
+ * running the demo stack).
+ *
+ * Matched per segment rather than by prefix: a view can be traversed to
+ * anywhere, and `/profiles/x/@@something` is as much a backend view as
+ * `/@@something` is.
+ *
+ * @param target A path or URL.
+ * @returns Whether reaching it needs a real navigation.
+ */
+export function isBackendView(target: string): boolean {
+  const path = target.split('?')[0].split('#')[0];
+  return path
+    .split('/')
+    .some(
+      (segment) =>
+        segment.startsWith('@@') ||
+        segment.startsWith('++') ||
+        segment === 'acl_users',
+    );
+}
+
+/**
+ * Whether a full page load to this target is safe to perform.
+ *
+ * Same origin only. A target that arrived in a query string and points
+ * somewhere else is an open redirect, and the caller's fallback is a route
+ * this app owns.
+ *
+ * @param target An absolute URL.
+ * @returns Whether it stays on this site.
+ */
+export function isSameOrigin(target: string): boolean {
+  if (typeof window === 'undefined') {
+    return false;
+  }
+  try {
+    return (
+      new URL(target, window.location.origin).origin === window.location.origin
+    );
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Send the browser to a target, by the cheapest route that works.
+ *
+ * @param target Where to go.
+ * @param push The router's push or replace, for the paths it owns.
+ * @param options `external` allows a full load to another origin, which is
+ *   what a provider's authorize URL needs and what a `came_from` must never
+ *   get.
+ */
+export function goTo(
+  target: string,
+  push: (path: string) => void,
+  options: { external?: boolean } = {},
+): void {
+  if (!target) {
+    return;
+  }
+  if (isInternal(target) && !isBackendView(target)) {
+    push(target);
+    return;
+  }
+  if (typeof window === 'undefined') {
+    return;
+  }
+  // A site-relative backend path is same-origin by construction, so it needs
+  // no permission from the caller — only a real navigation.
+  if (options.external || isInternal(target) || isSameOrigin(target)) {
+    window.location.href = target;
+    return;
+  }
+  // Somewhere else entirely, arriving from a query string. The caller asked
+  // for a site-local navigation and this is not one.
+  push('/');
+}

package/src/helpers/profileGate.test.ts

@@ -0,0 +1,150 @@
+import { describe, expect, it } from 'vitest';
+
+import { editPath, gateTarget, handedOverReturn } from './profileGate';
+import type { MyProfile } from '../types';
+
+const PROFILE_URL = 'http://backend:8080/Plone/identity-profiles/alice';
+
+function profile(overrides: Partial<MyProfile> = {}): MyProfile {
+  return {
+    '@id': 'http://backend:8080/Plone/@my-profile',
+    userid: 'alice',
+    profile: PROFILE_URL,
+    review_state: 'incomplete',
+    missing: [],
+    ...overrides,
+  };
+}
+
+describe('editPath', () => {
+  it('is the profile path with /edit on it', () => {
+    expect(editPath(PROFILE_URL, 'http://backend:8080/Plone')).toBe(
+      '/identity-profiles/alice/edit',
+    );
+  });
+});
+
+describe('gateTarget', () => {
+  const api = 'http://backend:8080/Plone';
+
+  it('sends an incomplete profile to its edit form', () => {
+    expect(gateTarget(profile(), '/news', api)).toBe(
+      '/identity-profiles/alice/edit',
+    );
+  });
+
+  it('lets a complete profile through', () => {
+    expect(
+      gateTarget(profile({ review_state: 'complete' }), '/news', api),
+    ).toBe(null);
+  });
+
+  it('lets a deactivated profile through', () => {
+    // Being deactivated is not something the user can fix by filling a form
+    // in, and holding them on one would be a loop with no exit at all.
+    expect(
+      gateTarget(profile({ review_state: 'deactivated' }), '/news', api),
+    ).toBe(null);
+  });
+
+  it('lets a user with no profile through', () => {
+    expect(gateTarget(profile({ profile: null }), '/news', api)).toBe(null);
+  });
+
+  it('lets a site without the extra through', () => {
+    expect(
+      gateTarget(profile({ profile: null, review_state: null }), '/news', api),
+    ).toBe(null);
+  });
+
+  it('does nothing before the answer has arrived', () => {
+    expect(gateTarget(null, '/news', api)).toBe(null);
+    expect(gateTarget(undefined, '/news', api)).toBe(null);
+  });
+
+  it('does not gate the edit form it redirects to', () => {
+    // The loop this whole function exists to avoid.
+    expect(gateTarget(profile(), '/identity-profiles/alice/edit', api)).toBe(
+      null,
+    );
+  });
+
+  it('does not gate the profile itself', () => {
+    expect(gateTarget(profile(), '/identity-profiles/alice', api)).toBe(null);
+  });
+
+  it('does not gate anything beneath the profile', () => {
+    // The edit form loads widgets and vocabularies against paths under it,
+    // and saving bounces the user to the profile's own view.
+    expect(
+      gateTarget(profile(), '/identity-profiles/alice/@@images/image', api),
+    ).toBe(null);
+  });
+
+  it('does not gate another user profile whose path merely starts the same', () => {
+    // `/identity-profiles/alice2` starts with `/identity-profiles/alice`, and
+    // a naive prefix test would let somebody sit on a stranger's profile
+    // instead of filling in their own.
+    expect(gateTarget(profile(), '/identity-profiles/alice2', api)).toBe(
+      '/identity-profiles/alice/edit',
+    );
+  });
+
+  it.each([
+    '/login',
+    '/login-identity',
+    '/logout',
+    '/first-login',
+    '/oauth-consent',
+  ])('does not gate %s', (path) => {
+    expect(gateTarget(profile(), path, api)).toBe(null);
+  });
+
+  it('does not gate a route beneath an exempt one', () => {
+    expect(gateTarget(profile(), '/first-login?return_url=/news', api)).toBe(
+      '/identity-profiles/alice/edit',
+    );
+    expect(gateTarget(profile(), '/logout/anything', api)).toBe(null);
+  });
+
+  it('treats an empty path as the front page', () => {
+    expect(gateTarget(profile(), '', api)).toBe(
+      '/identity-profiles/alice/edit',
+    );
+  });
+});
+
+describe('handedOverReturn', () => {
+  // The backend's authorization endpoint pauses its request at the profile
+  // form and hands the request to resume over in the query string. Honouring
+  // it is a real navigation, so an unchecked value here is an open redirect:
+  // a link to somebody's profile carrying a `return_url` would bounce a
+  // signed-in user anywhere.
+
+  it('takes a site-relative path', () => {
+    expect(
+      handedOverReturn('?identity_resume=%2F%40%40oauth-authorize%3Fx%3D1'),
+    ).toBe('/@@oauth-authorize?x=1');
+  });
+
+  it('is nothing when there is none', () => {
+    expect(handedOverReturn('')).toBe(null);
+    expect(handedOverReturn('?other=1')).toBe(null);
+    // Volto's own parameter is not ours, and taking it would fight the
+    // edit form for the same navigation.
+    expect(handedOverReturn('?return_url=%2Fnews')).toBe(null);
+  });
+
+  it('refuses a protocol-relative target', () => {
+    // "//evil.example" is not site-relative, however much it looks it.
+    expect(handedOverReturn('?identity_resume=%2F%2Fevil.example%2Fx')).toBe(
+      null,
+    );
+  });
+
+  it('refuses another origin', () => {
+    expect(
+      handedOverReturn('?identity_resume=https%3A%2F%2Fevil.example%2Fx'),
+    ).toBe(null);
+  });
+});

package/src/helpers/profileGate.ts

@@ -0,0 +1,191 @@
+/**
+ * Deciding whether a user may go where they are going.
+ *
+ * The backend holds a user with an incomplete profile on its edit form, and
+ * deliberately lets `plone.restapi` requests through: Volto fetches the edit
+ * form itself over the API, so gating those would break the page the user is
+ * being sent to. Everything this app navigates to is an API request, which
+ * means the backend gate never fires for a Volto site and this is where the
+ * same rule lives.
+ *
+ * Pure and separate from the component for the reason `firstLogin` is: the
+ * decision is small, every branch of it is a way to trap somebody in a
+ * redirect loop, and each one deserves a test that needs no store.
+ * @module helpers/profileGate
+ */
+
+import { toAppPath } from './firstLogin';
+
+import type { MyProfile } from '../types';
+
+/**
+ * Routes never gated, whatever state the profile is in.
+ *
+ * Signing in has to be able to finish, and signing out has to be possible for
+ * somebody who would rather leave than fill the form in. `/first-login` is
+ * here because it is the route that decides where to send them: gating it
+ * would replace its answer with this one before it had a chance to give it.
+ */
+export const EXEMPT_PATHS = [
+  '/login',
+  '/login-identity',
+  '/logout',
+  '/first-login',
+  '/oauth-consent',
+];
+
+/**
+ * Where the pending destination is kept while the user fills the form in.
+ *
+ * `sessionStorage` rather than the URL, because the URL does not survive the
+ * step that matters: saving the form navigates to the profile's own view and
+ * drops the query string with it. Rather than the redux store, because a
+ * reload mid-detour would lose that too, and a user who reloads a form they
+ * were sent to should still be returned afterwards.
+ */
+export const RETURN_KEY = 'volto-identity:profile-return';
+
+/**
+ * Remember where the user was going before the gate interrupted them.
+ *
+ * Every access is guarded: `sessionStorage` throws outright in a private
+ * window in some browsers, and does not exist at all during server-side
+ * rendering. Losing the return is a worse journey; throwing here would be a
+ * blank page.
+ *
+ * @param path Site-relative path to come back to.
+ */
+export function rememberReturn(path: string): void {
+  if (typeof window === 'undefined' || !path) {
+    return;
+  }
+  try {
+    window.sessionStorage.setItem(RETURN_KEY, path);
+  } catch {
+    // No storage. The user completes their profile and stays there, which is
+    // where they would have stayed before any of this existed.
+  }
+}
+
+/**
+ * Query parameter the backend hands a paused request over in.
+ *
+ * Must not be `return_url`: Volto's edit form claims that name.
+ */
+export const RESUME_PARAM = 'identity_resume';
+
+/**
+ * Read a destination handed over in the query string, if it is safe to use.
+ *
+ * The backend's authorization endpoint pauses a request at the profile form
+ * and passes the request to resume as `identity_resume`. Volto knows nothing
+ * about that URL — `@@oauth-authorize` is a backend view, not a route — so it
+ * has to be carried across rather than recomputed.
+ *
+ * The name matters. `return_url` is Volto's own: its edit form reads that
+ * parameter and pushes it through the router after a save, and an absolute
+ * URL pushed that way is resolved against the current path. Using it handed
+ * the user a navigation to `/profiles/<id>/http:/host/@@oauth-authorize` and
+ * two 404s before the real redirect caught up.
+ *
+ * Only same-origin targets survive. Honouring an arbitrary `return_url` with
+ * a real navigation is an open redirect, and this one *is* a real navigation:
+ * a link to a profile with a `return_url` on it would otherwise be a way to
+ * bounce a signed-in user anywhere.
+ *
+ * @param search The location's query string.
+ * @returns The destination, or null.
+ */
+export function handedOverReturn(search: string): string | null {
+  const requested = new URLSearchParams(search).get(RESUME_PARAM);
+  if (!requested) {
+    return null;
+  }
+  if (requested.startsWith('/') && !requested.startsWith('//')) {
+    return requested;
+  }
+  if (typeof window === 'undefined') {
+    return null;
+  }
+  try {
+    const url = new URL(requested, window.location.origin);
+    return url.origin === window.location.origin ? url.href : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Take the remembered destination, clearing it.
+ *
+ * Reading and clearing together, so a return can never fire twice: the second
+ * navigation would send somebody back to a page they had already left.
+ *
+ * @returns The remembered path, or null.
+ */
+export function takeReturn(): string | null {
+  if (typeof window === 'undefined') {
+    return null;
+  }
+  try {
+    const value = window.sessionStorage.getItem(RETURN_KEY);
+    if (value) {
+      window.sessionStorage.removeItem(RETURN_KEY);
+    }
+    return value || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The path of a profile's edit form.
+ *
+ * @param profileUrl The absolute URL the backend reported.
+ * @param apiPath The backend's base URL, when it differs from the frontend's.
+ * @returns A site-relative path.
+ */
+export function editPath(profileUrl: string, apiPath = ''): string {
+  return `${toAppPath(profileUrl, apiPath)}/edit`;
+}
+
+/**
+ * Work out where a user must be sent, if anywhere.
+ *
+ * Returns `null` for every reason not to gate, which is most of them: no
+ * profile, a complete one, an answer that has not arrived, an exempt route,
+ * and — the one that matters — being already on the profile the redirect
+ * would send them to.
+ *
+ * That last check covers the whole profile rather than its edit form alone.
+ * The form loads widgets and vocabularies against paths beneath it, and a
+ * user who saves is bounced to the profile's view; gating either would be a
+ * loop that no amount of correct configuration escapes.
+ *
+ * @param profile The `@my-profile` answer, or null before it has loaded.
+ * @param pathname The path the app is on.
+ * @param apiPath The backend's base URL, when it differs from the frontend's.
+ * @returns The path to redirect to, or null to let the user through.
+ */
+export function gateTarget(
+  profile: MyProfile | null | undefined,
+  pathname: string,
+  apiPath = '',
+): string | null {
+  if (!profile?.profile || profile.review_state !== 'incomplete') {
+    return null;
+  }
+  const current = pathname || '/';
+  if (
+    EXEMPT_PATHS.some(
+      (path) => current === path || current.startsWith(`${path}/`),
+    )
+  ) {
+    return null;
+  }
+  const profilePath = toAppPath(profile.profile, apiPath);
+  if (current === profilePath || current.startsWith(`${profilePath}/`)) {
+    return null;
+  }
+  return editPath(profile.profile, apiPath);
+}

package/src/helpers/profileSource.ts

@@ -0,0 +1,41 @@
+/**
+ * Whether a user's fields live in a Profile content object.
+ *
+ * This asked `source === 'identity_profile'` first, and that was wrong.
+ * `source` names whichever PAS plugin *enumerated* the account, and which one
+ * that is depends on how the account was made: a user added with a password
+ * has a `source_users` row and reports that, while an externally
+ * authenticated one has only a Profile and reports `identity_profile`. Both
+ * of them have their fields in a Profile, so keying the menu on `source` hid
+ * the entry for whole classes of user.
+ *
+ * The question the menu actually needs is narrower: *is this person's name,
+ * email and biography stored in a content object?* Having a Profile is
+ * exactly that. The profile PAS plugin sits above `mutable_properties`, so
+ * wherever a Profile exists it is what answers for that user's fields — and
+ * `profile_url` is how the payload says so.
+ *
+ * The consequence for the menu is the one that was wanted: for a user first
+ * login has not minted a Profile for, or an account that predates the add-on,
+ * `profile_url` is null and Volto's own Profile entry keeps its slot,
+ * leading to the member form where those users' fields really are.
+ * @module helpers/profileSource
+ */
+
+/**
+ * Whether this user's fields are held in a Profile.
+ *
+ * A value rather than the user it came from, so a caller can select it out
+ * of the store on its own. `useSelector` compares what it returns by
+ * identity: handed the whole user object it sees a change on every render
+ * and re-renders forever.
+ *
+ * @param profileUrl The user's `profile_url`, when they have a Profile.
+ * @returns Whether there is a Profile holding their fields, and therefore
+ *   one to link to. A menu entry leading nowhere is worse than no entry.
+ */
+export function profileHoldsTheFields(
+  profileUrl: string | null | undefined,
+): boolean {
+  return Boolean(profileUrl);
+}