@quiltt/react-native 3.9.6 → 3.9.7

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @quiltt/react-native
 
+## 3.9.7
+
+### Patch Changes
+
+- [#330](https://github.com/quiltt/quiltt-js/pull/330) [`e7b8e74`](https://github.com/quiltt/quiltt-js/commit/e7b8e74613f7725c6f2653be6d8ac0e06cce661d) Thanks [@zubairaziz](https://github.com/zubairaziz)! - Make OAuth Handling Safer
+
+- Updated dependencies [[`e7b8e74`](https://github.com/quiltt/quiltt-js/commit/e7b8e74613f7725c6f2653be6d8ac0e06cce661d)]:
+  - @quiltt/core@3.9.7
+  - @quiltt/react@3.9.7
+
 ## 3.9.6
 
 ### Patch Changes

package/dist/index.js

@@ -9,7 +9,7 @@ import { URL } from 'react-native-url-polyfill';
 import { WebView } from 'react-native-webview';
 import { generateStackTrace, makeBacktrace, getCauses } from '@honeybadger-io/core/build/src/util';
 
-var version = "3.9.6";
+var version = "3.9.7";
 
 const ErrorReporterConfig = {
     honeybadger_api_key: 'undefined'
@@ -103,7 +103,7 @@ const getErrorMessage = (responseStatus, error)=>{
  * Checks if a string appears to be already URL encoded
  * @param str The string to check
  * @returns boolean indicating if the string appears to be URL encoded
- */ const isAlreadyEncoded = (str)=>{
+ */ const isEncoded = (str)=>{
     // Check for typical URL encoding patterns like %20, %3A, etc.
     const hasEncodedChars = /%[0-9A-F]{2}/i.test(str);
     // Check if double encoding has occurred (e.g., %253A instead of %3A)
@@ -118,7 +118,7 @@ const getErrorMessage = (responseStatus, error)=>{
  */ const smartEncodeURIComponent = (str)=>{
     if (!str) return str;
     // If it's already encoded, return as is
-    if (isAlreadyEncoded(str)) {
+    if (isEncoded(str)) {
         console.log('URL already encoded, skipping encoding:', str);
         return str;
     }
@@ -267,19 +267,18 @@ const checkConnectorUrl = async (connectorUrl, retryCount = 0)=>{
         const response = await fetch(connectorUrl);
         if (!response.ok) {
             responseStatus = response.status;
-            throw new Error(`The URL ${connectorUrl} is not routable.`);
+            throw new Error('Connector URL is not routable.');
         }
-        console.log(`The URL ${connectorUrl} is routable.`);
         return {
             checked: true
         };
     } catch (e) {
         error = e;
-        console.error(`An error occurred while checking the connector URL: ${error}`);
+        console.error('Failed to connect to connector URL');
         if (retryCount < PREFLIGHT_RETRY_COUNT) {
             const delay = 50 * 2 ** retryCount;
             await new Promise((resolve)=>setTimeout(resolve, delay));
-            console.log(`Retrying... Attempt number ${retryCount + 1}`);
+            console.log(`Retrying connection... Attempt ${retryCount + 1}`);
             return checkConnectorUrl(connectorUrl, retryCount + 1);
         }
         const errorMessage = getErrorMessage(responseStatus, error);
@@ -301,30 +300,28 @@ const checkConnectorUrl = async (connectorUrl, retryCount = 0)=>{
     try {
         // Throw error if oauthUrl is null or undefined
         if (oauthUrl == null) {
-            throw new Error('handleOAuthUrl - Received null or undefined URL');
+            throw new Error('OAuth URL missing');
         }
         // Convert to string if it's a URL object
         const urlString = oauthUrl.toString();
         // Throw error if the resulting string is empty
         if (!urlString || urlString.trim() === '') {
-            throw new Error('handleOAuthUrl - Received empty URL string');
+            throw new Error('Empty OAuth URL');
         }
         // Normalize the URL encoding
         const normalizedUrl = normalizeUrlEncoding(urlString);
-        // Log the URL we're about to open
-        console.log(`handleOAuthUrl - Opening URL - ${normalizedUrl}`);
         // Open the normalized URL
         Linking.openURL(normalizedUrl);
     } catch (error) {
-        console.error('Error handling OAuth URL:', error);
+        console.error('OAuth URL handling error');
         // Only try the fallback if oauthUrl is not null
         if (oauthUrl != null) {
             try {
                 const fallbackUrl = typeof oauthUrl === 'string' ? oauthUrl : oauthUrl.toString();
-                console.log(`handleOAuthUrl - Fallback opening URL - ${fallbackUrl}`);
+                console.log('Attempting fallback OAuth opening');
                 Linking.openURL(fallbackUrl);
             } catch (fallbackError) {
-                console.error('Failed even with fallback approach:', fallbackError);
+                console.error('Fallback OAuth opening failed');
             }
         }
     }
@@ -355,7 +352,6 @@ const QuilttConnector = ({ testId, connectorId, connectionId, institution, oauth
     }, []);
     // Ensure oauthRedirectUrl is encoded properly - only once
     const safeOAuthRedirectUrl = useMemo(()=>{
-        console.log('Original oauthRedirectUrl:', oauthRedirectUrl);
         return smartEncodeURIComponent(oauthRedirectUrl);
     }, [
         oauthRedirectUrl
@@ -368,17 +364,13 @@ const QuilttConnector = ({ testId, connectorId, connectionId, institution, oauth
         // For the oauth_redirect_url, we need to be careful
         // If it's already encoded, we need to decode it once to prevent
         // the automatic encoding that happens with searchParams.append
-        if (isAlreadyEncoded(safeOAuthRedirectUrl)) {
+        if (isEncoded(safeOAuthRedirectUrl)) {
             const decodedOnce = decodeURIComponent(safeOAuthRedirectUrl);
             url.searchParams.append('oauth_redirect_url', decodedOnce);
-            console.log('Using decoded oauth_redirect_url:', decodedOnce);
         } else {
             url.searchParams.append('oauth_redirect_url', safeOAuthRedirectUrl);
-            console.log('Using original oauth_redirect_url:', safeOAuthRedirectUrl);
         }
-        const finalUrl = url.toString();
-        console.log('Final connectorUrl:', finalUrl);
-        return finalUrl;
+        return url.toString();
     }, [
         connectorId,
         safeOAuthRedirectUrl
@@ -435,50 +427,58 @@ const QuilttConnector = ({ testId, connectorId, connectionId, institution, oauth
             const eventType = url.host;
             switch(eventType){
                 case 'Load':
+                    console.log('Event: Load');
                     initInjectedJavaScript();
                     onEvent?.(ConnectorSDKEventType.Load, metadata);
                     onLoad?.(metadata);
                     break;
                 case 'ExitAbort':
+                    console.log('Event: ExitAbort');
                     clearLocalStorage();
                     onEvent?.(ConnectorSDKEventType.ExitAbort, metadata);
                     onExit?.(ConnectorSDKEventType.ExitAbort, metadata);
                     onExitAbort?.(metadata);
                     break;
                 case 'ExitError':
+                    console.log('Event: ExitError');
                     clearLocalStorage();
                     onEvent?.(ConnectorSDKEventType.ExitError, metadata);
                     onExit?.(ConnectorSDKEventType.ExitError, metadata);
                     onExitError?.(metadata);
                     break;
                 case 'ExitSuccess':
+                    console.log('Event: ExitSuccess');
                     clearLocalStorage();
                     onEvent?.(ConnectorSDKEventType.ExitSuccess, metadata);
                     onExit?.(ConnectorSDKEventType.ExitSuccess, metadata);
                     onExitSuccess?.(metadata);
                     break;
                 case 'Authenticate':
+                    console.log('Event: Authenticate');
                     break;
                 case 'OauthRequested':
                     {
-                        // Log available search parameters
-                        console.log('Available search params:', Array.from(url.searchParams.keys()));
-                        // Now we should be getting the oauthUrl parameter directly
+                        console.log('Event: OauthRequested');
                         const oauthUrl = url.searchParams.get('oauthUrl');
-                        console.log('Received oauthUrl:', oauthUrl);
-                        // Check if oauthUrl exists before proceeding
                         if (oauthUrl) {
-                            // Create a new URL from the normalized oauthUrl
-                            handleOAuthUrl(oauthUrl);
+                            if (isEncoded(oauthUrl)) {
+                                try {
+                                    const decodedUrl = decodeURIComponent(oauthUrl);
+                                    handleOAuthUrl(decodedUrl);
+                                } catch (error) {
+                                    console.error('OAuth URL decoding failed, using original');
+                                    handleOAuthUrl(oauthUrl);
+                                }
+                            } else {
+                                handleOAuthUrl(oauthUrl);
+                            }
                         } else {
-                            // Log an error if oauthUrl is missing
-                            console.error('OauthRequested event missing oauthUrl parameter');
-                            console.log('All available params:', Object.fromEntries(url.searchParams.entries()));
+                            console.error('OAuth URL missing from request');
                         }
                         break;
                     }
                 default:
-                    console.log('unhandled event', url);
+                    console.log(`Unhandled event: ${eventType}`);
                     break;
             }
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quiltt/react-native",
-  "version": "3.9.6",
+  "version": "3.9.7",
   "description": "React Native Components for Quiltt Connector",
   "homepage": "https://github.com/quiltt/quiltt-js/tree/main/packages/react-native#readme",
   "repository": {
@@ -30,8 +30,8 @@
   "dependencies": {
     "@honeybadger-io/core": "6.6.0",
     "lodash.debounce": "4.0.8",
-    "@quiltt/react": "3.9.6",
-    "@quiltt/core": "3.9.6"
+    "@quiltt/core": "3.9.7",
+    "@quiltt/react": "3.9.7"
   },
   "devDependencies": {
     "@biomejs/biome": "1.9.4",

package/src/components/QuilttConnector.tsx

@@ -11,7 +11,7 @@ import type { ConnectorSDKCallbackMetadata, ConnectorSDKCallbacks } from '@quilt
 import {
   ErrorReporter,
   getErrorMessage,
-  isAlreadyEncoded,
+  isEncoded,
   normalizeUrlEncoding,
   smartEncodeURIComponent,
 } from '@/utils'
@@ -38,18 +38,17 @@ export const checkConnectorUrl = async (
     const response = await fetch(connectorUrl)
     if (!response.ok) {
       responseStatus = response.status
-      throw new Error(`The URL ${connectorUrl} is not routable.`)
+      throw new Error('Connector URL is not routable.')
     }
-    console.log(`The URL ${connectorUrl} is routable.`)
     return { checked: true }
   } catch (e) {
     error = e as Error
-    console.error(`An error occurred while checking the connector URL: ${error}`)
+    console.error('Failed to connect to connector URL')
 
     if (retryCount < PREFLIGHT_RETRY_COUNT) {
       const delay = 50 * 2 ** retryCount
       await new Promise((resolve) => setTimeout(resolve, delay))
-      console.log(`Retrying... Attempt number ${retryCount + 1}`)
+      console.log(`Retrying connection... Attempt ${retryCount + 1}`)
       return checkConnectorUrl(connectorUrl, retryCount + 1)
     }
     const errorMessage = getErrorMessage(responseStatus, error as Error)
@@ -67,7 +66,7 @@ export const handleOAuthUrl = (oauthUrl: URL | string | null | undefined) => {
   try {
     // Throw error if oauthUrl is null or undefined
     if (oauthUrl == null) {
-      throw new Error('handleOAuthUrl - Received null or undefined URL')
+      throw new Error('OAuth URL missing')
     }
 
     // Convert to string if it's a URL object
@@ -75,28 +74,25 @@ export const handleOAuthUrl = (oauthUrl: URL | string | null | undefined) => {
 
     // Throw error if the resulting string is empty
     if (!urlString || urlString.trim() === '') {
-      throw new Error('handleOAuthUrl - Received empty URL string')
+      throw new Error('Empty OAuth URL')
     }
 
     // Normalize the URL encoding
     const normalizedUrl = normalizeUrlEncoding(urlString)
 
-    // Log the URL we're about to open
-    console.log(`handleOAuthUrl - Opening URL - ${normalizedUrl}`)
-
     // Open the normalized URL
     Linking.openURL(normalizedUrl)
   } catch (error) {
-    console.error('Error handling OAuth URL:', error)
+    console.error('OAuth URL handling error')
 
     // Only try the fallback if oauthUrl is not null
     if (oauthUrl != null) {
       try {
         const fallbackUrl = typeof oauthUrl === 'string' ? oauthUrl : oauthUrl.toString()
-        console.log(`handleOAuthUrl - Fallback opening URL - ${fallbackUrl}`)
+        console.log('Attempting fallback OAuth opening')
         Linking.openURL(fallbackUrl)
       } catch (fallbackError) {
-        console.error('Failed even with fallback approach:', fallbackError)
+        console.error('Fallback OAuth opening failed')
       }
     }
   }
@@ -149,7 +145,6 @@ const QuilttConnector = ({
 
   // Ensure oauthRedirectUrl is encoded properly - only once
   const safeOAuthRedirectUrl = useMemo(() => {
-    console.log('Original oauthRedirectUrl:', oauthRedirectUrl)
     return smartEncodeURIComponent(oauthRedirectUrl)
   }, [oauthRedirectUrl])
 
@@ -163,18 +158,14 @@ const QuilttConnector = ({
     // For the oauth_redirect_url, we need to be careful
     // If it's already encoded, we need to decode it once to prevent
     // the automatic encoding that happens with searchParams.append
-    if (isAlreadyEncoded(safeOAuthRedirectUrl)) {
+    if (isEncoded(safeOAuthRedirectUrl)) {
       const decodedOnce = decodeURIComponent(safeOAuthRedirectUrl)
       url.searchParams.append('oauth_redirect_url', decodedOnce)
-      console.log('Using decoded oauth_redirect_url:', decodedOnce)
     } else {
       url.searchParams.append('oauth_redirect_url', safeOAuthRedirectUrl)
-      console.log('Using original oauth_redirect_url:', safeOAuthRedirectUrl)
     }
 
-    const finalUrl = url.toString()
-    console.log('Final connectorUrl:', finalUrl)
-    return finalUrl
+    return url.toString()
   }, [connectorId, safeOAuthRedirectUrl])
 
   useEffect(() => {
@@ -226,52 +217,59 @@ const QuilttConnector = ({
         const eventType = url.host
         switch (eventType) {
           case 'Load':
+            console.log('Event: Load')
             initInjectedJavaScript()
             onEvent?.(ConnectorSDKEventType.Load, metadata)
             onLoad?.(metadata)
             break
           case 'ExitAbort':
+            console.log('Event: ExitAbort')
             clearLocalStorage()
             onEvent?.(ConnectorSDKEventType.ExitAbort, metadata)
             onExit?.(ConnectorSDKEventType.ExitAbort, metadata)
             onExitAbort?.(metadata)
             break
           case 'ExitError':
+            console.log('Event: ExitError')
             clearLocalStorage()
             onEvent?.(ConnectorSDKEventType.ExitError, metadata)
             onExit?.(ConnectorSDKEventType.ExitError, metadata)
             onExitError?.(metadata)
             break
           case 'ExitSuccess':
+            console.log('Event: ExitSuccess')
             clearLocalStorage()
             onEvent?.(ConnectorSDKEventType.ExitSuccess, metadata)
             onExit?.(ConnectorSDKEventType.ExitSuccess, metadata)
             onExitSuccess?.(metadata)
             break
           case 'Authenticate':
+            console.log('Event: Authenticate')
             // TODO: handle Authenticate
             break
           case 'OauthRequested': {
-            // Log available search parameters
-            console.log('Available search params:', Array.from(url.searchParams.keys()))
-
-            // Now we should be getting the oauthUrl parameter directly
+            console.log('Event: OauthRequested')
             const oauthUrl = url.searchParams.get('oauthUrl')
-            console.log('Received oauthUrl:', oauthUrl)
 
-            // Check if oauthUrl exists before proceeding
             if (oauthUrl) {
-              // Create a new URL from the normalized oauthUrl
-              handleOAuthUrl(oauthUrl)
+              if (isEncoded(oauthUrl)) {
+                try {
+                  const decodedUrl = decodeURIComponent(oauthUrl)
+                  handleOAuthUrl(decodedUrl)
+                } catch (error) {
+                  console.error('OAuth URL decoding failed, using original')
+                  handleOAuthUrl(oauthUrl)
+                }
+              } else {
+                handleOAuthUrl(oauthUrl)
+              }
             } else {
-              // Log an error if oauthUrl is missing
-              console.error('OauthRequested event missing oauthUrl parameter')
-              console.log('All available params:', Object.fromEntries(url.searchParams.entries()))
+              console.error('OAuth URL missing from request')
             }
             break
           }
           default:
-            console.log('unhandled event', url)
+            console.log(`Unhandled event: ${eventType}`)
             break
         }
       })

package/src/utils/url.ts

@@ -3,7 +3,7 @@
  * @param str The string to check
  * @returns boolean indicating if the string appears to be URL encoded
  */
-export const isAlreadyEncoded = (str: string): boolean => {
+export const isEncoded = (str: string): boolean => {
   // Check for typical URL encoding patterns like %20, %3A, etc.
   const hasEncodedChars = /%[0-9A-F]{2}/i.test(str)
 
@@ -23,7 +23,7 @@ export const smartEncodeURIComponent = (str: string): string => {
   if (!str) return str
 
   // If it's already encoded, return as is
-  if (isAlreadyEncoded(str)) {
+  if (isEncoded(str)) {
     console.log('URL already encoded, skipping encoding:', str)
     return str
   }
@@ -51,7 +51,7 @@ export const createUrlWithParams = (baseUrl: string, params: Record<string, stri
       if (value == null) return
 
       // For oauth_redirect_url specifically, ensure it's not double encoded
-      if (key === 'oauth_redirect_url' && isAlreadyEncoded(value)) {
+      if (key === 'oauth_redirect_url' && isEncoded(value)) {
         // Decode once to counteract the automatic encoding that will happen
         const decodedOnce = decodeURIComponent(value)
         url.searchParams.append(key, decodedOnce)