@redacto.io/consent-sdk-react 9.3.0 → 9.4.0

package/src/RedactoPrivacyCenter/lib/utils.refresh-storage.test.ts

@@ -0,0 +1,85 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+
+import {
+  setRefreshTokenCookie,
+  getStoredRefreshToken,
+  signOutPrivacyCenter,
+} from './utils';
+
+const STORAGE_KEY = 'redacto_pc_refresh_token';
+
+const expireLegacyCookie = (): void => {
+  document.cookie =
+    'refresh_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT';
+  document.cookie =
+    'refresh_token=; path=/privacy-center; expires=Thu, 01 Jan 1970 00:00:00 GMT';
+};
+
+describe('privacy center refresh token persistence', () => {
+  beforeEach(() => {
+    window.localStorage.clear();
+    expireLegacyCookie();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('persists the refresh token in localStorage (path-independent) and writes no cookie', () => {
+    // A path-scoped cookie is unreadable when the host mounts under a basePath
+    // (e.g. consent-app at /consent), which strands rotated tokens and triggers
+    // the 401 refresh storm. localStorage is origin-scoped, so it is readable
+    // regardless of basePath.
+    setRefreshTokenCookie('tok123');
+
+    expect(window.localStorage.getItem(STORAGE_KEY)).toBe('tok123');
+    expect(getStoredRefreshToken()).toBe('tok123');
+    expect(document.cookie).not.toContain('refresh_token=tok123');
+  });
+
+  it('returns null when no refresh token is stored', () => {
+    expect(getStoredRefreshToken()).toBeNull();
+  });
+
+  it('does not ingest a host app refresh_token cookie', () => {
+    // A cookie read is name-only (JS cannot see the path), so the SDK cannot tell
+    // a host app's own refresh_token cookie from its own legacy one. It must not
+    // read the cookie at all: it neither migrates the value nor deletes the
+    // cookie. (Existing SDK sessions are preserved via the AuthProvider token
+    // prop, not the cookie.)
+    document.cookie = 'refresh_token=hosttoken; path=/';
+
+    const token = getStoredRefreshToken();
+
+    expect(token).toBeNull();
+    expect(window.localStorage.getItem(STORAGE_KEY)).toBeNull();
+    expect(document.cookie).toContain('refresh_token=hosttoken');
+  });
+
+  it('clears the stored refresh token on sign out', () => {
+    setRefreshTokenCookie('tok123');
+    expect(window.localStorage.getItem(STORAGE_KEY)).toBe('tok123');
+
+    signOutPrivacyCenter();
+
+    expect(window.localStorage.getItem(STORAGE_KEY)).toBeNull();
+    expect(getStoredRefreshToken()).toBeNull();
+  });
+
+  it('does not throw when localStorage.setItem is unavailable (private mode / quota)', () => {
+    vi.spyOn(Storage.prototype, 'setItem').mockImplementation(() => {
+      throw new Error('QuotaExceededError');
+    });
+
+    expect(() => setRefreshTokenCookie('tok123')).not.toThrow();
+  });
+
+  it('returns null (no throw) when localStorage.getItem is unavailable', () => {
+    vi.spyOn(Storage.prototype, 'getItem').mockImplementation(() => {
+      throw new Error('SecurityError');
+    });
+
+    expect(() => getStoredRefreshToken()).not.toThrow();
+    expect(getStoredRefreshToken()).toBeNull();
+  });
+});

package/src/RedactoPrivacyCenter/lib/utils.session-expired.test.ts

@@ -0,0 +1,109 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import {
+  ensureValidToken,
+  resetRefreshCircuit,
+  setSessionExpiredListener,
+} from './utils';
+import { ApiError } from '../api/fetcher';
+
+/**
+ * Regression tests for the terminal "session expired" signal.
+ *
+ * When the refresh token is expired/invalid, the refresh endpoint must be hit at
+ * most once (the circuit breaker) AND the React tree must be told the session is
+ * over exactly once (so it can show the terminal screen and stop all work). A
+ * transient (5xx/network) failure must NOT raise the terminal signal — those are
+ * retryable and the user is still signed in.
+ */
+
+// Minimal JWT with a chosen `exp` (only the base64 payload is read).
+const base64url = (obj: unknown) => btoa(JSON.stringify(obj)).replace(/=+$/, '');
+const makeJwt = (expSeconds: number) =>
+  `${base64url({ alg: 'HS256', typ: 'JWT' })}.${base64url({ exp: expSeconds })}.sig`;
+
+// `exp` in 1970 → always expired, so ensureValidToken always takes the refresh path.
+const EXPIRED_ACCESS_TOKEN = makeJwt(1_000);
+const ORG = 'org-uuid';
+const WS = 'ws-uuid';
+
+const makeConsentClient = (
+  refreshOtpToken: (orgId: string, wsId: string, refreshToken: string) => Promise<unknown>,
+) => ({ refreshOtpToken: vi.fn(refreshOtpToken) }) as any;
+
+const makeAuthContext = (refreshToken: string) => ({
+  accessToken: EXPIRED_ACCESS_TOKEN,
+  refreshToken,
+  // Return false (host handles its own navigation). The terminal signal must fire
+  // regardless of this return value — that is the behaviour under test.
+  onError: vi.fn(() => false),
+  updateTokens: vi.fn(),
+});
+
+describe('ensureValidToken — terminal session-expired signal', () => {
+  beforeEach(() => {
+    resetRefreshCircuit();
+    setSessionExpiredListener(null);
+    sessionStorage.clear();
+    vi.clearAllMocks();
+  });
+
+  afterEach(() => {
+    setSessionExpiredListener(null);
+    vi.useRealTimers();
+  });
+
+  it('fires the session-expired listener exactly once on a terminal failure', async () => {
+    const onExpired = vi.fn();
+    setSessionExpiredListener(onExpired);
+
+    const client = makeConsentClient(() =>
+      Promise.reject(new ApiError('Refresh token has expired', { status: 401 })),
+    );
+    const authContext = makeAuthContext('dead-refresh-token');
+
+    // Many triggers (pollers + API calls + effects) against the same dead token.
+    const results: Array<string | null> = [];
+    for (let i = 0; i < 10; i++) {
+      results.push(await ensureValidToken(ORG, WS, undefined, authContext, client));
+    }
+
+    expect(results.every((r) => r === null)).toBe(true);
+    // Breaker: the dead refresh token is submitted at most once.
+    expect(client.refreshOtpToken).toHaveBeenCalledTimes(1);
+    // Terminal signal raised once, even though onError returned false.
+    expect(onExpired).toHaveBeenCalledTimes(1);
+  });
+
+  it('does NOT fire the listener for a transient (5xx) failure', async () => {
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date('2026-06-22T11:00:00Z'));
+
+    const onExpired = vi.fn();
+    setSessionExpiredListener(onExpired);
+
+    const client = makeConsentClient(() =>
+      Promise.reject(new ApiError('Service Unavailable', { status: 503 })),
+    );
+    const authContext = makeAuthContext('flaky-refresh-token');
+
+    await ensureValidToken(ORG, WS, undefined, authContext, client);
+    await ensureValidToken(ORG, WS, undefined, authContext, client);
+
+    // One attempt then backoff suppresses the rest — and the session is NOT
+    // declared terminally expired (the token may still be valid).
+    expect(client.refreshOtpToken).toHaveBeenCalledTimes(1);
+    expect(onExpired).not.toHaveBeenCalled();
+  });
+
+  it('tolerates a terminal failure with no listener registered (no throw)', async () => {
+    const client = makeConsentClient(() =>
+      Promise.reject(new ApiError('Refresh token has expired', { status: 401 })),
+    );
+    const authContext = makeAuthContext('dead-refresh-token');
+
+    await expect(
+      ensureValidToken(ORG, WS, undefined, authContext, client),
+    ).resolves.toBeNull();
+    expect(client.refreshOtpToken).toHaveBeenCalledTimes(1);
+  });
+});