@thoughtspot/visual-embed-sdk 1.53.1 → 1.53.2-beta

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@thoughtspot/visual-embed-sdk",
-    "version": "1.53.1",
+    "version": "1.53.2-beta",
     "description": "ThoughtSpot Embed SDK",
     "module": "lib/src/index.js",
     "main": "dist/tsembed.js",

package/src/auth.spec.ts

@@ -475,35 +475,48 @@ describe('Unit test for auth', () => {
             expect(tokenAuthService.isActiveService).toHaveBeenCalledTimes(1);
         });
 
-        it('should store decoded accessToken in window when SAMLComplete event includes accessToken', async () => {
-            Object.defineProperty(window, 'location', { value: { href: '', hash: '' } });
-            global.window.open = jest.fn().mockReturnValue({ closed: false, focus: jest.fn(), close: jest.fn() });
-
+        const startSamlPopupFlow = async () => {
+            Object.defineProperty(window, 'location', {
+                value: { href: '', hash: '', origin: 'https://host.app.com' },
+            });
+            // samlAuthWindow is module state: retire a popup left open by an
+            // earlier test so this flow opens (and trusts) a fresh one.
+            if (authInstance.samlAuthWindow) {
+                (authInstance.samlAuthWindow as any).closed = true;
+            }
+            const popup = { closed: false, focus: jest.fn(), close: jest.fn() };
+            global.window.open = jest.fn().mockReturnValue(popup);
             (authInstance as any).samlCompletionPromise = null;
 
-            let capturedMessageHandler: ((e: any) => void) | null = null;
+            let messageHandler: ((e: any) => void) | null = null;
             jest.spyOn(window, 'addEventListener').mockImplementation((type: any, handler: any) => {
                 if (type === 'message') {
-                    capturedMessageHandler = handler;
+                    messageHandler = handler;
                 }
             });
-
             jest.spyOn(tokenAuthService, 'isActiveService')
                 .mockReturnValueOnce(Promise.resolve(false));
 
             const authPromise = authInstance.doSamlAuth({ ...embedConfig.doSamlAuthNoRedirect });
-
             await new Promise<void>((resolve) => setTimeout(resolve, 0));
+            document.getElementById('ts-auth-btn').click();
+            return { popup, authPromise, messageHandler };
+        };
 
-            expect(capturedMessageHandler).not.toBeNull();
+        it('should store decoded accessToken in window when SAMLComplete event includes accessToken', async () => {
+            const { popup, authPromise, messageHandler } = await startSamlPopupFlow();
+
+            expect(decodeURIComponent((window.open as jest.Mock).mock.calls[0][0]))
+                .toContain('/v2/#/embed/saml-complete?hostAppOrigin=https%3A%2F%2Fhost.app.com');
 
             const accessToken = 'my-access-token';
-            capturedMessageHandler!({
+            messageHandler!({
+                origin: new URL(thoughtSpotHost).origin,
+                source: popup,
                 data: {
                     type: EmbedEvent.SAMLComplete,
                     accessToken: encodeURIComponent(accessToken),
                 },
-                source: { close: jest.fn() },
             });
 
             await authPromise;
@@ -512,6 +525,29 @@ describe('Unit test for auth', () => {
                 checkReleaseVersionInBetaInstance.getValueFromWindow('cachedAuthToken'),
             ).toBe(accessToken);
             expect(authInstance.loggedInStatus).toBe(true);
+            expect(popup.close).toHaveBeenCalled();
+        });
+
+        it('should ignore SAMLComplete from any origin or window other than the SSO popup', async () => {
+            const { popup, authPromise, messageHandler } = await startSamlPopupFlow();
+            const data = { type: EmbedEvent.SAMLComplete, accessToken: 'attacker-token' };
+            const tsOrigin = new URL(thoughtSpotHost).origin;
+
+            [
+                { origin: 'https://evil.com', source: popup, data },
+                { origin: tsOrigin, source: { close: jest.fn() }, data },
+                { origin: tsOrigin, source: null, data },
+            ].forEach((event) => messageHandler!(event));
+
+            expect(
+                checkReleaseVersionInBetaInstance.getValueFromWindow('cachedAuthToken'),
+            ).toBeFalsy();
+            expect(popup.close).not.toHaveBeenCalled();
+
+            // The genuine completion still goes through afterwards.
+            messageHandler!({ origin: tsOrigin, source: popup, data: { type: EmbedEvent.SAMLComplete } });
+            await authPromise;
+            expect(popup.close).toHaveBeenCalled();
         });
 
     });

package/src/auth.ts

@@ -426,11 +426,18 @@ export const doBasicAuth = async (embedConfig: EmbedConfig): Promise<boolean> =>
  * @param ssoURL
  * @param triggerContainer
  * @param triggerText
+ * @param thoughtSpotHost
  */
-async function samlPopupFlow(ssoURL: string, triggerContainer: DOMSelector, triggerText: string) {
+async function samlPopupFlow(
+    ssoURL: string,
+    triggerContainer: DOMSelector,
+    triggerText: string,
+    thoughtSpotHost: string,
+) {
+    const thoughtSpotOrigin = new URL(thoughtSpotHost).origin;
     let popupClosedCheck: NodeJS.Timeout;
     const openPopup = () => {
-        if (samlAuthWindow === null || samlAuthWindow.closed) {
+        if (!samlAuthWindow || samlAuthWindow.closed) {
             samlAuthWindow = window.open(
                 ssoURL,
                 '_blank',
@@ -461,7 +468,13 @@ async function samlPopupFlow(ssoURL: string, triggerContainer: DOMSelector, trig
     }
     samlCompletionPromise = samlCompletionPromise || new Promise<void>((resolve, reject) => {
         window.addEventListener('message', (e) => {
-            if (e.data.type === EmbedEvent.SAMLComplete) {
+            // Only the SSO popup we opened, on the ThoughtSpot origin, may
+            // complete the flow or hand us a token; anything else could
+            // inject an attacker's token into the auth cache.
+            if (e.origin !== thoughtSpotOrigin || !samlAuthWindow || e.source !== samlAuthWindow) {
+                return;
+            }
+            if (e.data?.type === EmbedEvent.SAMLComplete) {
                 if (e.data.accessToken) {
                     const decodedToken = decodeURIComponent(e.data.accessToken);
                     storeAuthTokenInCache(decodedToken);
@@ -506,7 +519,12 @@ const doSSOAuth = async (embedConfig: EmbedConfig, ssoEndPoint: string): Promise
 
     const ssoURL = `${thoughtSpotHost}${ssoEndPoint}`;
     if (embedConfig.inPopup) {
-        await samlPopupFlow(ssoURL, embedConfig.authTriggerContainer, embedConfig.authTriggerText);
+        await samlPopupFlow(
+            ssoURL,
+            embedConfig.authTriggerContainer,
+            embedConfig.authTriggerText,
+            thoughtSpotHost,
+        );
         const cachedToken = getCacheAuthToken();
         if (cachedToken) {
             loggedInStatus = true;
@@ -519,12 +537,23 @@ const doSSOAuth = async (embedConfig: EmbedConfig, ssoEndPoint: string): Promise
     window.location.href = ssoURL;
 };
 
+/**
+ * The popup's SSO completion page. hostAppOrigin tells ThoughtSpot which
+ * origin opened the popup; the cluster only posts a token back to it if it
+ * is an allowed redirect domain.
+ * @param thoughtSpotHost
+ */
+const getSSOCompletePageUrl = (thoughtSpotHost: string): string => {
+    const hostAppOrigin = encodeURIComponent(window.location.origin);
+    return `${thoughtSpotHost}/v2/#/embed/saml-complete?hostAppOrigin=${hostAppOrigin}`;
+};
+
 export const doSamlAuth = async (embedConfig: EmbedConfig) => {
     const { thoughtSpotHost } = embedConfig;
     // redirect for SSO, when the SSO authentication is done, this page will be
     // loaded again and the same JS will execute again.
     const ssoRedirectUrl = embedConfig.inPopup
-        ? `${thoughtSpotHost}/v2/#/embed/saml-complete`
+        ? getSSOCompletePageUrl(thoughtSpotHost)
         : getRedirectUrl(
             window.location.href,
             SSO_REDIRECTION_MARKER_GUID,
@@ -543,7 +572,7 @@ export const doOIDCAuth = async (embedConfig: EmbedConfig) => {
     // redirect for SSO, when the SSO authentication is done, this page will be
     // loaded again and the same JS will execute again.
     const ssoRedirectUrl = embedConfig.noRedirect || embedConfig.inPopup
-        ? `${thoughtSpotHost}/v2/#/embed/saml-complete`
+        ? getSSOCompletePageUrl(thoughtSpotHost)
         : getRedirectUrl(
             window.location.href,
             SSO_REDIRECTION_MARKER_GUID,

package/src/contracts/contracts.spec.ts

@@ -15,6 +15,8 @@
  * stop — that breaks published SDK consumers and the host runtime validation
  * derived from these contracts.
  */
+import * as fs from 'fs';
+import * as path from 'path';
 import { HostEvent, EmbedEvent, RuntimeFilterOp } from '../types';
 import { UIPassthroughEvent } from './ui-passthrough-contracts';
 import type {
@@ -234,17 +236,121 @@ describe('event contracts (drift guardrails)', () => {
         );
     });
 
-    test('embed event enum wire values referenced by typed payloads are stable', () => {
+    test('typed embed event wire values are stable (additive-only)', () => {
         expect(
             [
+                EmbedEvent.AIHighlights,
+                EmbedEvent.AddRemoveColumns,
+                EmbedEvent.AddToCoaching,
+                EmbedEvent.AddToFavorites,
+                EmbedEvent.AnswerChartSwitcher,
+                EmbedEvent.AnswerDelete,
                 EmbedEvent.AuthInit,
-                EmbedEvent.EmbedListenerReady,
+                EmbedEvent.Cancel,
+                EmbedEvent.CopyLink,
+                EmbedEvent.CopyToClipboard,
+                EmbedEvent.CrossFilterChanged,
                 EmbedEvent.CustomAction,
+                EmbedEvent.Data,
+                EmbedEvent.DataSourceSelected,
+                EmbedEvent.Delete,
+                EmbedEvent.DialogClose,
+                EmbedEvent.DialogOpen,
+                EmbedEvent.Download,
+                EmbedEvent.DownloadAsCsv,
+                EmbedEvent.DownloadAsPdf,
+                EmbedEvent.DownloadAsPng,
+                EmbedEvent.DownloadAsXlsx,
+                EmbedEvent.DownloadLiveboardAsContinuousPDF,
+                EmbedEvent.Drilldown,
+                EmbedEvent.Edit,
+                EmbedEvent.EditTML,
+                EmbedEvent.EmbedIframeCenter,
+                EmbedEvent.EmbedListenerReady,
+                EmbedEvent.Error,
+                EmbedEvent.ExitPresentMode,
+                EmbedEvent.Explore,
+                EmbedEvent.ExportTML,
+                EmbedEvent.FilterChanged,
+                EmbedEvent.LiveboardInfo,
+                EmbedEvent.LiveboardRendered,
+                EmbedEvent.MakeACopy,
+                EmbedEvent.ParameterChanged,
+                EmbedEvent.Pin,
+                EmbedEvent.Present,
+                EmbedEvent.QueryChanged,
+                EmbedEvent.Rename,
+                EmbedEvent.RequestVisibleEmbedCoordinates,
+                EmbedEvent.Save,
+                EmbedEvent.SavePersonalisedView,
+                EmbedEvent.Schedule,
+                EmbedEvent.SchedulesList,
+                EmbedEvent.SendTestScheduleEmail,
+                EmbedEvent.ShowUnderlyingData,
+                EmbedEvent.SpotIQAnalyze,
+                EmbedEvent.TableVizRendered,
+                EmbedEvent.UpdatePersonalisedView,
+                EmbedEvent.UpdateTML,
+                EmbedEvent.VizPointClick,
+                EmbedEvent.VizPointDoubleClick,
+                EmbedEvent.VizPointRightClick,
             ].map((e) => `${e}`).sort(),
         ).toEqual([
+            'AIHighlights',
+            'EmbedIframeCenter',
             'EmbedListenerReady',
+            'Error',
+            'PinboardRendered',
+            'TableVizRendered',
+            'addRemoveColumns',
+            'addToCoaching',
+            'addToFavorites',
+            'answerChartSwitcher',
+            'answerDelete',
             'authInit',
+            'cancel',
+            'context-menu-item-copy-to-clipboard',
+            'cross-filter-changed',
             'customAction',
+            'data',
+            'dataSourceSelected',
+            'delete',
+            'dialog-close',
+            'dialog-open',
+            'download',
+            'downloadAsCsv',
+            'downloadAsPdf',
+            'downloadAsPng',
+            'downloadAsXlsx',
+            'downloadLiveboardAsContinuousPDF',
+            'drillDown',
+            'edit',
+            'editTSL',
+            'embedDocument',
+            'exitPresentMode',
+            'explore',
+            'exportTSL',
+            'filterChanged',
+            'makeACopy',
+            'parameterChanged',
+            'pin',
+            'pinboardInfo',
+            'present',
+            'queryChanged',
+            'rename',
+            'requestVisibleEmbedCoordinates',
+            'save',
+            'savePersonalisedView',
+            'schedule-list',
+            'sendTestScheduleEmail',
+            'showUnderlyingData',
+            'spotIQAnalyze',
+            'subscription',
+            'updatePersonalisedView',
+            'updateTSL',
+            'vizPointClick',
+            'vizPointDoubleClick',
+            'vizPointRightClick',
         ]);
     });
 
@@ -262,7 +368,7 @@ describe('event contracts (drift guardrails)', () => {
         const svc: AnswerServiceField = undefined;
         expect(svc).toBeUndefined();
         // Untyped embed event stays `any` (backward compatible).
-        const untyped: EmbedEventData<EmbedEvent.Data> = { anything: 'goes' };
+        const untyped: EmbedEventData<EmbedEvent.RouteChange> = { anything: 'goes' };
         expect(untyped).toBeDefined();
     });
 
@@ -393,4 +499,77 @@ describe('event contracts (drift guardrails)', () => {
         const all = [valid, empty, loose, topExtra, nestedExtra, zeroOverlap, bad];
         expect([...all, voidEmpty, unmapped].every(Boolean)).toBe(true);
     });
+
+    // Doc <-> type drift guard. Event enum members document their payload with a
+    // `Payload: {@link XxxRequest}` / `{@link XxxPayload}` TypeDoc link. TypeScript
+    // does NOT validate {@link} targets, so documenting an event's payload without
+    // declaring the type ships a dangling doc link and an untyped event. This test
+    // fails in exactly that case: every payload link in types.ts must resolve to a
+    // real declared contract type.
+    test('event doc payload links resolve to a declared type (docs and types must agree)', () => {
+        const contractsDir = __dirname;
+        const sources = [
+            fs.readFileSync(path.join(contractsDir, '../types.ts'), 'utf8'),
+            ...fs
+                .readdirSync(contractsDir)
+                .filter((f) => f.endsWith('.ts') && !f.endsWith('.spec.ts'))
+                .map((f) => fs.readFileSync(path.join(contractsDir, f), 'utf8')),
+        ];
+
+        // Every type/interface/enum/class declared across types.ts + contracts.
+        const declared = new Set<string>();
+        const declRe = /(?:export\s+)?(?:declare\s+)?(?:abstract\s+)?(?:interface|type|enum|class)\s+(\w+)/g;
+        for (const src of sources) {
+            for (const m of src.matchAll(declRe)) declared.add(m[1]);
+        }
+
+        // Payload-shaped {@link} references in the event docs (types.ts).
+        const typesSrc = sources[0];
+        const linkRe = /\{@link\s+(\w+(?:Request|Payload|Scope))\b[^}]*\}/g;
+        const dangling = new Set<string>();
+        for (const m of typesSrc.matchAll(linkRe)) {
+            if (!declared.has(m[1])) dangling.add(m[1]);
+        }
+
+        // If this fails, a doc links a payload type that does not exist — add the
+        // type (and map it), or fix the link.
+        expect([...dangling]).toEqual([]);
+    });
+
+    // Doc drives the type: if an event's TypeDoc documents a payload with a
+    // `Payload: {@link X}` link, that event MUST be typed in EmbedEventDataExtension.
+    // Otherwise the published doc promises a payload type while `on()` still hands
+    // back `any`. Adding the doc link is the trigger; this fails until the event is
+    // added to the map.
+    test('every embed event with a Payload {@link} is typed in the map', () => {
+        const typesSrc = fs.readFileSync(
+            path.join(__dirname, '..', 'types.ts'), 'utf8',
+        );
+        const payloadsSrc = fs.readFileSync(
+            path.join(__dirname, 'embed-event-payloads.ts'), 'utf8',
+        );
+
+        // Events typed in the map.
+        const mapBody = payloadsSrc.match(
+            /EmbedEventDataExtension\s*\{([\s\S]*?)\n\}/,
+        )?.[1] ?? '';
+        const typedMembers = new Set(
+            [...mapBody.matchAll(/\[EmbedEvent\.(\w+)\]/g)].map((m) => m[1]),
+        );
+
+        // EmbedEvent members whose doc carries a `Payload: {@link ...}` link.
+        const enumBody = typesSrc.match(
+            /export enum EmbedEvent\s*\{([\s\S]*?)\n\}/,
+        )?.[1] ?? '';
+        const documentedWithLink: string[] = [];
+        for (const m of enumBody.matchAll(/\/\*\*([\s\S]*?)\*\/\s*(\w+)\s*=/g)) {
+            if (/Payload:\s*\{@link/.test(m[1])) documentedWithLink.push(m[2]);
+        }
+
+        // Documented a payload type but not mapped -> on() still returns `any`.
+        const documentedButUntyped = documentedWithLink.filter(
+            (name) => !typedMembers.has(name),
+        );
+        expect(documentedButUntyped).toEqual([]);
+    });
 });