@plone-collective/volto-identity 1.0.0-alpha.1

package/news/.changelog_template.jinja

@@ -0,0 +1,15 @@
+{% if sections[""] %}
+{% for category, val in definitions.items() if category in sections[""] %}
+
+### {{ definitions[category]['name'] }}
+
+{% for text, values in sections[""][category].items() %}
+- {{ text }} {{ values|join(', ') }}
+{% endfor %}
+
+{% endfor %}
+{% else %}
+No significant changes.
+
+
+{% endif %}

package/package.json

@@ -0,0 +1,66 @@
+{
+  "name": "@plone-collective/volto-identity",
+  "version": "1.0.0-alpha.1",
+  "description": "Volto add-on for multi-provider external authentication in Plone, with identity linking",
+  "main": "src/index.ts",
+  "license": "MIT",
+  "keywords": [
+    "volto-addon",
+    "volto",
+    "plone",
+    "react"
+  ],
+  "author": "Érico Andrei",
+  "homepage": "https://collective.github.io/pas-plugins-identity/",
+  "bugs": {
+    "url": "https://github.com/collective/pas-plugins-identity/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git@github.com:collective/pas-plugins-identity"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "addons": [],
+  "theme": "",
+  "dependencies": {},
+  "peerDependencies": {
+    "react": "^18.2.0",
+    "react-dom": "^18.2.0",
+    "react-redux": "^8.1.2",
+    "react-aria-components": "^1.17.0",
+    "react-router-dom": "^5.2.0",
+    "@plone/components": "4.2.1"
+  },
+  "devDependencies": {
+    "@types/react": "^18.3.1",
+    "@types/react-dom": "^18.3.1",
+    "typescript": "^5.7.3",
+    "@testing-library/react": "^16.2.0",
+    "release-it": "^19.0.5",
+    "vitest": "^3.1.2",
+    "react-redux": "8.1.2",
+    "react-intl": "3.12.1",
+    "react-toastify": "5.5.0",
+    "semantic-ui-react": "2.1.5",
+    "react-router-dom": "5.2.0",
+    "@types/react-redux": "^7.1.34",
+    "@types/react-router-dom": "^5.3.3",
+    "react-aria-components": "^1.17.0",
+    "react-cookie": "8.1.2",
+    "@storybook/react": "^8.0.4",
+    "@plone/scripts": "4.0.1",
+    "@plone/types": "2.0.1",
+    "@plone/components": "4.2.1",
+    "@plone/registry": "3.0.1"
+  },
+  "scripts": {
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "i18n": "rm -rf build/messages && NODE_ENV=production i18n --addon",
+    "dry-release": "release-it --dry-run",
+    "release": "release-it",
+    "release-major-alpha": "release-it major --preRelease=alpha",
+    "release-alpha": "release-it --preRelease=alpha"
+  }
+}

package/src/actions/actions.test.ts

@@ -0,0 +1,226 @@
+import { describe, expect, it } from 'vitest';
+
+import {
+  completeCallback,
+  confirmMagicLink,
+  createClient,
+  deleteClient,
+  getMyProfile,
+  listClients,
+  listKeys,
+  listLoginProviders,
+  rotateClientSecret,
+  rotateKey,
+  sendMagicLink,
+  setPreferredEmail,
+  getUserProfile,
+  listIdentities,
+  startLinking,
+  startProviderLogin,
+  updateClient,
+} from './index';
+
+describe('listLoginProviders', () => {
+  it('reads the listing', () => {
+    expect(listLoginProviders().request).toEqual({
+      op: 'get',
+      path: '/@login-providers',
+    });
+  });
+});
+
+describe('listIdentities', () => {
+  it('reads the listing', () => {
+    expect(listIdentities().request.path).toBe('/@identities');
+  });
+
+  it('can ask for the providers alongside, in one request', () => {
+    expect(listIdentities(true).request.path).toBe(
+      '/@identities?expand=login-providers',
+    );
+  });
+});
+
+describe('getUserProfile', () => {
+  it("reads Plone's own user endpoint", () => {
+    // Not an endpoint of this package's own: the serializer adds fields to
+    // the one Plone already serves rather than inventing a parallel view.
+    expect(getUserProfile('alice').request.path).toBe('/@users/alice');
+  });
+});
+
+describe('startProviderLogin', () => {
+  it('addresses one provider', () => {
+    expect(startProviderLogin('dex').request.path).toBe(
+      '/@login-providers/dex',
+    );
+  });
+
+  it('carries came_from when there is one', () => {
+    const { path } = startProviderLogin('dex', '/some/page').request;
+
+    expect(path).toBe('/@login-providers/dex?came_from=%2Fsome%2Fpage');
+  });
+
+  it('encodes came_from rather than pasting it in', () => {
+    const { path } = startProviderLogin('dex', '/a page?with=query').request;
+
+    // An unencoded value would end the query string early and silently drop
+    // the rest of the target.
+    expect(path).not.toContain(' ');
+    expect(path).toContain('%3Fwith%3Dquery');
+  });
+
+  it('omits the parameter entirely when there is nothing to carry', () => {
+    expect(startProviderLogin('dex', '').request.path).toBe(
+      '/@login-providers/dex',
+    );
+  });
+});
+
+describe('completeCallback', () => {
+  it('posts all three parts', () => {
+    const { op, path, data } = completeCallback(
+      'dex',
+      'the-code',
+      'the-state',
+    ).request;
+
+    expect(op).toBe('post');
+    expect(path).toBe('/@identity-callback');
+    expect(data).toEqual({
+      provider: 'dex',
+      code: 'the-code',
+      state: 'the-state',
+    });
+  });
+});
+
+describe('magic link', () => {
+  it('sends an address', () => {
+    const { op, path, data } = sendMagicLink('erico@plone.org').request;
+
+    expect(op).toBe('post');
+    expect(path).toBe('/@magic-link');
+    expect(data).toEqual({ email: 'erico@plone.org' });
+  });
+
+  it('confirms a token', () => {
+    const { path, data } = confirmMagicLink('tok').request;
+
+    expect(path).toBe('/@magic-link-confirm');
+    expect(data).toEqual({ token: 'tok' });
+  });
+});
+
+describe('getMyProfile', () => {
+  it('reads the routing endpoint', () => {
+    expect(getMyProfile().request).toEqual({
+      op: 'get',
+      path: '/@my-profile',
+    });
+  });
+});
+
+describe('setPreferredEmail', () => {
+  it('patches the profile with the whole list', () => {
+    // The whole list, because `emails` is a field: a PATCH carrying one
+    // address would replace the list with it rather than move it.
+    expect(
+      setPreferredEmail('/identity-profiles/alice', [
+        'alice@example.org',
+        'alice@example.com',
+      ]).request,
+    ).toEqual({
+      op: 'patch',
+      path: '/identity-profiles/alice',
+      data: { emails: ['alice@example.org', 'alice@example.com'] },
+    });
+  });
+});
+
+describe('the OAuth client registry', () => {
+  it('lists clients', () => {
+    expect(listClients().request).toEqual({
+      op: 'get',
+      path: '/@identity-clients',
+    });
+  });
+
+  it('registers one', () => {
+    const { op, path, data } = createClient({ client_id: 'app' }).request;
+
+    expect(op).toBe('post');
+    expect(path).toBe('/@identity-clients');
+    expect(data).toEqual({ client_id: 'app' });
+  });
+
+  it('amends one', () => {
+    const { op, path, data } = updateClient('app', { enabled: false }).request;
+
+    expect(op).toBe('patch');
+    expect(path).toBe('/@identity-clients/app');
+    expect(data).toEqual({ enabled: false });
+  });
+
+  it('unregisters one', () => {
+    const { op, path } = deleteClient('app').request;
+
+    expect(op).toBe('del');
+    expect(path).toBe('/@identity-clients/app');
+  });
+
+  it('rotates a secret', () => {
+    const { op, path } = rotateClientSecret('app').request;
+
+    expect(op).toBe('post');
+    expect(path).toBe('/@identity-clients/app/rotate-secret');
+  });
+
+  it('escapes a client id with a slash in it', () => {
+    // A client id is operator-supplied and is not validated as a URL
+    // segment, so an unescaped one would silently address a different path.
+    expect(deleteClient('a/b').request.path).toBe('/@identity-clients/a%2Fb');
+  });
+});
+
+describe('the signing key ring', () => {
+  it('reads the ring', () => {
+    expect(listKeys().request).toEqual({
+      op: 'get',
+      path: '/@identity-keys',
+    });
+  });
+
+  it('rotates the key', () => {
+    const { op, path } = rotateKey().request;
+
+    expect(op).toBe('post');
+    expect(path).toBe('/@identity-keys/rotate');
+  });
+});
+
+describe('startLinking', () => {
+  it('names the provider to link', () => {
+    expect(startLinking('github', '/identities').request.data).toEqual({
+      provider: 'github',
+      came_from: '/identities',
+    });
+  });
+
+  it('sends no address for a redirect provider', () => {
+    // The backend takes none, and an empty one would be a malformed request
+    // rather than an omitted field.
+    expect(startLinking('github').request.data).not.toHaveProperty('email');
+  });
+
+  it('carries the address for the email provider', () => {
+    expect(
+      startLinking('email', '/identities', 'erico@plone.org').request.data,
+    ).toEqual({
+      provider: 'email',
+      came_from: '/identities',
+      email: 'erico@plone.org',
+    });
+  });
+});