alexa-cookie2 5.0.2 → 5.0.4

package/test/proxy-initial-url.test.js

@@ -0,0 +1,184 @@
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const vm = require('vm');
+
+const testName = 'proxy-initial-url';
+const outputDir = process.env.ALEXA_COOKIE_TEST_OUTPUT_DIR || path.join(__dirname, '..', 'test-output');
+const outputFile = path.join(outputDir, `${testName}.txt`);
+const lines = [];
+
+function line(value = '') {
+    lines.push(value);
+}
+
+function writeOutput() {
+    fs.mkdirSync(outputDir, { recursive: true });
+    fs.writeFileSync(outputFile, `${lines.join('\n')}\n`);
+}
+
+function recordAssertion(description, fn) {
+    try {
+        fn();
+        line(`${description}: PASS`);
+    } catch (err) {
+        line(`${description}: FAIL`);
+        writeOutput();
+        throw err;
+    }
+}
+
+const proxyFile = path.join(__dirname, '..', 'lib', 'proxy.js');
+const source = fs.readFileSync(proxyFile, 'utf8');
+
+let capturedProxyOptions;
+
+function createExpressStub() {
+    return {
+        use() {},
+        get() {},
+        listen() {
+            const server = {
+                address: () => ({ port: 3456 }),
+                on: () => server
+            };
+            return server;
+        }
+    };
+}
+
+function loadProxyModule() {
+    const module = { exports: {} };
+    const sandbox = {
+        Buffer,
+        URL,
+        __dirname: path.dirname(proxyFile),
+        console,
+        module,
+        exports: module.exports,
+        require(name) {
+            if (name === 'express') return createExpressStub;
+            if (name === 'http-proxy-response-rewrite') return () => {};
+            if (name === 'http-proxy-middleware') {
+                return {
+                    createProxyMiddleware(_context, options) {
+                        capturedProxyOptions = options;
+                        return function proxyMiddleware() {};
+                    }
+                };
+            }
+            if (name === 'cookie') {
+                return { parse: () => ({}) };
+            }
+            return require(name);
+        }
+    };
+    vm.runInNewContext(source, sandbox, { filename: proxyFile });
+    return module.exports;
+}
+
+function applyPathRewrite(pathname, req) {
+    const rewrite = capturedProxyOptions.pathRewrite;
+    if (typeof rewrite === 'function') return rewrite(pathname, req);
+    for (const pattern of Object.keys(rewrite)) {
+        const regex = new RegExp(pattern);
+        if (regex.test(pathname)) return pathname.replace(regex, rewrite[pattern]);
+    }
+    return pathname;
+}
+
+const proxyModule = loadProxyModule();
+const formerDataStorePath = path.join(os.tmpdir(), `alexa-cookie-proxy-test-${Date.now()}.json`);
+
+try {
+    const input = {
+        proxyOwnIp: '127.0.0.1',
+        proxyPort: 3456,
+        proxyListenBind: '0.0.0.0',
+        baseAmazonPage: 'amazon.co.uk',
+        baseAmazonPageHandle: '_uk',
+        amazonPageProxyLanguage: 'en_GB',
+        acceptLanguage: 'en-GB',
+        proxyLogLevel: 'silent',
+        formerDataStorePath
+    };
+    proxyModule.initAmazonProxy(input);
+
+    const req = {
+        method: 'GET',
+        url: '/',
+        headers: {
+            host: '127.0.0.1:3456'
+        }
+    };
+
+    const target = capturedProxyOptions.router(req);
+    const rewrittenPath = applyPathRewrite(req.url, req);
+    const targetUrl = new URL(target);
+    const rewrittenUrl = new URL(rewrittenPath, target);
+
+    line('TEST: proxy initial URL');
+    line('');
+    line('CODE UNDER TEST:');
+    line('- lib/proxy.js: router()');
+    line('- lib/proxy.js: pathRewrite / rewriteProxyPath()');
+    line('- lib/proxy.js: buildInitialUrl()');
+    line('');
+    line('INPUT:');
+    line(`baseAmazonPage: ${input.baseAmazonPage}`);
+    line(`baseAmazonPageHandle: ${input.baseAmazonPageHandle}`);
+    line(`proxy host header: ${req.headers.host}`);
+    line(`request url: ${req.url}`);
+    line('');
+    line('OBSERVED:');
+    line(`router target host: ${targetUrl.host}`);
+    line(`router target search: ${targetUrl.search}`);
+    line(`rewritten pathname: ${rewrittenUrl.pathname}`);
+    line(`rewritten openid.assoc_handle: ${rewrittenUrl.searchParams.get('openid.assoc_handle')}`);
+    line(`rewritten pageId: ${rewrittenUrl.searchParams.get('pageId')}`);
+    line(`rewritten openid.return_to: ${rewrittenUrl.searchParams.get('openid.return_to')}`);
+    line(`rewritten openid.ns.oa2: ${rewrittenUrl.searchParams.get('openid.ns.oa2')}`);
+    line(`rewritten path starts with /ap/signin?: ${rewrittenPath.startsWith('/ap/signin?')}`);
+    line(`rewritten path contains openid.return_to: ${rewrittenPath.includes('openid.return_to=')}`);
+    line(`rewritten path contains regional handle: ${rewrittenPath.includes('amzn_dp_project_dee_ios_uk')}`);
+    line(`rewritten path contains code challenge: ${rewrittenPath.includes('openid.oa2.code_challenge=')}`);
+    line('');
+    line('ASSERTIONS:');
+    recordAssertion('router target host === "www.amazon.co.uk"', () => {
+        assert.strictEqual(targetUrl.host, 'www.amazon.co.uk');
+    });
+    recordAssertion('router target search === ""', () => {
+        assert.ok(targetUrl.search === '', 'router target search must be empty');
+    });
+    recordAssertion('rewritten path starts with "/ap/signin?"', () => {
+        assert.ok(rewrittenPath.startsWith('/ap/signin?'), `expected signin path, got ${rewrittenPath}`);
+    });
+    recordAssertion('rewritten assoc handle === "amzn_dp_project_dee_ios_uk"', () => {
+        assert.strictEqual(rewrittenUrl.searchParams.get('openid.assoc_handle'), 'amzn_dp_project_dee_ios_uk');
+    });
+    recordAssertion('rewritten pageId === "amzn_dp_project_dee_ios_uk"', () => {
+        assert.strictEqual(rewrittenUrl.searchParams.get('pageId'), 'amzn_dp_project_dee_ios_uk');
+    });
+    recordAssertion('rewritten path contains "openid.return_to="', () => {
+        assert.ok(rewrittenPath.includes('openid.return_to='));
+    });
+    recordAssertion('rewritten path contains regional "_uk" handle', () => {
+        assert.ok(rewrittenPath.includes('amzn_dp_project_dee_ios_uk'));
+    });
+    recordAssertion('rewritten path contains "openid.oa2.code_challenge="', () => {
+        assert.ok(rewrittenPath.includes('openid.oa2.code_challenge='));
+    });
+    line('');
+    line('RESULT: PASS');
+    writeOutput();
+} catch (err) {
+    if (!lines.includes('RESULT: PASS')) {
+        line('');
+        line('RESULT: FAIL');
+        writeOutput();
+    }
+    throw err;
+} finally {
+    fs.rmSync(formerDataStorePath, { force: true });
+}

package/test/proxy-success-requires-auth-code.test.js

@@ -0,0 +1,170 @@
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const vm = require('vm');
+
+const testName = 'proxy-success-requires-auth-code';
+const outputDir = process.env.ALEXA_COOKIE_TEST_OUTPUT_DIR || path.join(__dirname, '..', 'test-output');
+const outputFile = path.join(outputDir, `${testName}.txt`);
+const lines = [];
+
+function line(value = '') {
+    lines.push(value);
+}
+
+function writeOutput() {
+    fs.mkdirSync(outputDir, { recursive: true });
+    fs.writeFileSync(outputFile, `${lines.join('\n')}\n`);
+}
+
+function recordAssertion(description, fn) {
+    try {
+        fn();
+        line(`${description}: PASS`);
+    } catch (err) {
+        line(`${description}: FAIL`);
+        writeOutput();
+        throw err;
+    }
+}
+
+const proxyFile = path.join(__dirname, '..', 'lib', 'proxy.js');
+const source = fs.readFileSync(proxyFile, 'utf8');
+
+let capturedProxyOptions;
+
+function createExpressStub() {
+    return {
+        use() {},
+        get() {},
+        listen() {
+            const server = {
+                address: () => ({ port: 3456 }),
+                on: () => server
+            };
+            return server;
+        }
+    };
+}
+
+function loadProxyModule() {
+    capturedProxyOptions = undefined;
+    const module = { exports: {} };
+    const sandbox = {
+        Buffer,
+        URL,
+        __dirname: path.dirname(proxyFile),
+        console,
+        module,
+        exports: module.exports,
+        require(name) {
+            if (name === 'express') return createExpressStub;
+            if (name === 'http-proxy-response-rewrite') return () => {};
+            if (name === 'http-proxy-middleware') {
+                return {
+                    createProxyMiddleware(_context, options) {
+                        capturedProxyOptions = options;
+                        return function proxyMiddleware() {};
+                    }
+                };
+            }
+            if (name === 'cookie') {
+                return { parse: () => ({}) };
+            }
+            return require(name);
+        }
+    };
+    vm.runInNewContext(source, sandbox, { filename: proxyFile });
+    return module.exports;
+}
+
+function createProxyResponse(location) {
+    return {
+        statusCode: 302,
+        headers: {
+            location
+        },
+        socket: {
+            _host: 'www.amazon.de',
+            parser: {
+                outgoing: {
+                    method: 'POST',
+                    path: '/ap/signin',
+                    getHeader() {
+                        return undefined;
+                    }
+                }
+            }
+        }
+    };
+}
+
+const proxyModule = loadProxyModule();
+const formerDataStorePath = path.join(os.tmpdir(), `alexa-cookie-proxy-success-test-${Date.now()}.json`);
+let callbackData;
+
+try {
+    const input = {
+        proxyOwnIp: '127.0.0.1',
+        proxyPort: 3456,
+        proxyListenBind: '0.0.0.0',
+        baseAmazonPage: 'amazon.de',
+        baseAmazonPageHandle: '_de',
+        amazonPageProxyLanguage: 'de_DE',
+        acceptLanguage: 'de-DE',
+        proxyLogLevel: 'silent',
+        formerDataStorePath
+    };
+    proxyModule.initAmazonProxy(input, (_err, data) => {
+        callbackData = data;
+    });
+
+    const responseLocation = 'https://www.amazon.de/ap/maplanding?openid.mode=id_res&openid.return_to=https%3A%2F%2Fwww.amazon.de%2Fap%2Fmaplanding';
+    const proxyRes = createProxyResponse(responseLocation);
+    const req = {
+        method: 'POST',
+        url: '/www.amazon.de/ap/signin',
+        originalUrl: '/www.amazon.de/ap/signin'
+    };
+
+    capturedProxyOptions.onProxyRes(proxyRes, req, {});
+
+    line('TEST: proxy success requires auth code');
+    line('');
+    line('CODE UNDER TEST:');
+    line('- lib/proxy.js: onProxyRes()');
+    line('- lib/proxy.js: maplanding success detection');
+    line('');
+    line('INPUT:');
+    line(`response location: ${responseLocation}`);
+    line(`request method: ${req.method}`);
+    line(`request originalUrl: ${req.originalUrl}`);
+    line('');
+    line('OBSERVED:');
+    line(`callback data present: ${callbackData !== undefined}`);
+    line(`final response location: ${proxyRes.headers.location}`);
+    line('');
+    line('ASSERTIONS:');
+    recordAssertion('callbackData === undefined', () => {
+        assert.strictEqual(callbackData === undefined, true);
+    });
+    recordAssertion('final location !== local /cookie-success', () => {
+        assert.notStrictEqual(proxyRes.headers.location, 'http://127.0.0.1:3456/cookie-success');
+    });
+    recordAssertion('final location preserves proxied maplanding path', () => {
+        assert.strictEqual(proxyRes.headers.location, 'http://127.0.0.1:3456/www.amazon.de/ap/maplanding?openid.mode=id_res&openid.return_to=https%3A%2F%2Fwww.amazon.de%2Fap%2Fmaplanding');
+    });
+    line('');
+    line('RESULT: PASS');
+    writeOutput();
+} catch (err) {
+    if (!lines.includes('RESULT: PASS')) {
+        line('');
+        line('RESULT: FAIL');
+        writeOutput();
+    }
+    throw err;
+} finally {
+    fs.rmSync(formerDataStorePath, { force: true });
+}

package/test/refresh-skips-app-registration.test.js

@@ -0,0 +1,270 @@
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const vm = require('vm');
+const EventEmitter = require('events');
+
+const testName = 'refresh-skips-app-registration';
+const outputDir = process.env.ALEXA_COOKIE_TEST_OUTPUT_DIR || path.join(__dirname, '..', 'test-output');
+const outputFile = path.join(outputDir, `${testName}.txt`);
+const lines = [];
+
+function line(value = '') {
+    lines.push(value);
+}
+
+function writeOutput() {
+    fs.mkdirSync(outputDir, { recursive: true });
+    fs.writeFileSync(outputFile, `${lines.join('\n')}\n`);
+}
+
+function recordAssertion(description, fn) {
+    try {
+        fn();
+        line(`${description}: PASS`);
+    } catch (err) {
+        line(`${description}: FAIL`);
+        writeOutput();
+        throw err;
+    }
+}
+
+function parseCookies(cookieHeader) {
+    const result = {};
+    for (const part of String(cookieHeader || '').split(';')) {
+        const trimmed = part.trim();
+        if (!trimmed) continue;
+        const idx = trimmed.indexOf('=');
+        if (idx === -1) continue;
+        result[trimmed.slice(0, idx)] = trimmed.slice(idx + 1);
+    }
+    return result;
+}
+
+const cookieFile = path.join(__dirname, '..', 'alexa-cookie.js');
+const source = fs.readFileSync(cookieFile, 'utf8');
+
+function loadCookieModule(overrides = {}) {
+    const module = { exports: {} };
+    const sandbox = {
+        Buffer,
+        URL,
+        __dirname: path.dirname(cookieFile),
+        console,
+        module,
+        exports: module.exports,
+        require(name) {
+            if (name === 'https' && overrides.https) return overrides.https;
+            if (name === './lib/proxy.js') {
+                return {
+                    initAmazonProxy() {
+                        throw new Error('proxy should not start in this test');
+                    }
+                };
+            }
+            if (name === 'cookie') return { parse: parseCookies };
+            return require(name);
+        }
+    };
+    vm.runInNewContext(source, sandbox, { filename: cookieFile });
+    return module.exports;
+}
+
+function createFakeHttps(calls) {
+    function responseFor(options) {
+        if (options.path === '/auth/token') {
+            return {
+                statusCode: 200,
+                headers: { 'set-cookie': ['session-id=SID_REFRESH; Path=/; Domain=.amazon.de'] },
+                body: JSON.stringify({ access_token: 'ACCESS_TOKEN_AFTER_REFRESH' })
+            };
+        }
+        if (options.host === 'api.amazonalexa.com' && options.path === '/v1/devices/@self/capabilities') {
+            return { statusCode: 204, headers: {}, body: '' };
+        }
+        if (options.path === '/ap/exchangetoken/cookies') {
+            return {
+                statusCode: 200,
+                headers: { 'set-cookie': ['exchange-cookie=EXCHANGE_HEADER; Path=/; Domain=.amazon.de'] },
+                body: JSON.stringify({
+                    response: {
+                        tokens: {
+                            cookies: {
+                                '.amazon.de': [
+                                    { Name: 'session-id', Value: 'SID_LOCAL' },
+                                    { Name: 'ubid-acbde', Value: 'UBID_LOCAL' }
+                                ]
+                            }
+                        }
+                    }
+                })
+            };
+        }
+        if (options.path === '/api/language') {
+            return {
+                statusCode: 200,
+                headers: { 'set-cookie': ['csrf=CSRF_FROM_API; Path=/; Domain=.amazon.de'] },
+                body: '{}'
+            };
+        }
+        throw new Error(`Unexpected request: ${options.method || 'GET'} ${options.host}${options.path}`);
+    }
+
+    return {
+        request(options, callback) {
+            const req = new EventEmitter();
+            let requestBody = '';
+            req.write = (chunk) => {
+                requestBody += chunk;
+            };
+            req.end = () => {
+                calls.push({
+                    method: options.method || 'GET',
+                    host: options.host,
+                    path: options.path,
+                    status: null,
+                    hasAuthorization: Boolean(options.headers && options.headers.authorization),
+                    bodyLength: requestBody.length
+                });
+                const response = responseFor(options);
+                calls[calls.length - 1].status = response.statusCode;
+                const res = new EventEmitter();
+                res.statusCode = response.statusCode;
+                res.headers = response.headers || {};
+                res.socket = { end() {} };
+                callback(res);
+                if (response.body) res.emit('data', Buffer.from(response.body));
+                res.emit('end');
+            };
+            return req;
+        }
+    };
+}
+
+function refresh(cookieModule, options) {
+    return new Promise((resolve, reject) => {
+        cookieModule.refreshAlexaCookie(options, (err, data) => {
+            if (err) reject(err);
+            else resolve(data);
+        });
+    });
+}
+
+(async () => {
+    const calls = [];
+    const cookieModule = loadCookieModule({ https: createFakeHttps(calls) });
+    const formerRegistrationData = {
+        loginCookie: 'frc=FRC_OLD; map-md=MAPMD_OLD; session-id=SID_OLD',
+        localCookie: 'old-local=OLD',
+        refreshToken: 'REFRESH_TOKEN_OLD',
+        accessToken: 'ACCESS_TOKEN_OLD',
+        macDms: 'MAC_DMS_OLD',
+        csrf: 'CSRF_OLD',
+        amazonPage: 'amazon.de',
+        authorization_code: 'AUTH_CODE_FROM_LOGIN',
+        verifier: 'VERIFIER_FROM_LOGIN',
+        dataVersion: 2
+    };
+
+    try {
+        const result = await refresh(cookieModule, {
+            baseAmazonPage: 'amazon.de',
+            amazonPage: 'amazon.de',
+            acceptLanguage: 'de-DE',
+            formerRegistrationData,
+            logger: () => {}
+        });
+
+        const paths = calls.map((call) => call.path);
+        const capabilityCall = calls.find((call) => call.path === '/v1/devices/@self/capabilities');
+
+        line('TEST: refresh skips app registration');
+        line('');
+        line('CODE UNDER TEST:');
+        line('- alexa-cookie.js: refreshAlexaCookie()');
+        line('- alexa-cookie.js: registerTokenCapabilities()');
+        line('- alexa-cookie.js: getLocalCookies()');
+        line('');
+        line('INPUT:');
+        line('baseAmazonPage: amazon.de');
+        line('amazonPage: amazon.de');
+        line(`formerRegistrationData has refreshToken: ${Boolean(formerRegistrationData.refreshToken)}`);
+        line(`formerRegistrationData has accessToken: ${Boolean(formerRegistrationData.accessToken)}`);
+        line(`formerRegistrationData has authorization_code: ${Object.prototype.hasOwnProperty.call(formerRegistrationData, 'authorization_code')}`);
+        line(`formerRegistrationData has verifier: ${Object.prototype.hasOwnProperty.call(formerRegistrationData, 'verifier')}`);
+        line('');
+        line('OBSERVED REQUESTS:');
+        calls.forEach((call) => {
+            line(`- ${call.method} ${call.host}${call.path} -> ${call.status}`);
+        });
+        line('');
+        line('OBSERVED RESULT:');
+        line(`result amazonPage: ${result.amazonPage}`);
+        line(`result has accessToken: ${Boolean(result.accessToken)}`);
+        line(`result has refreshToken: ${Boolean(result.refreshToken)}`);
+        line(`result has macDms: ${Boolean(result.macDms)}`);
+        line(`result has csrf: ${Boolean(result.csrf)}`);
+        line(`result has authorization_code: ${Object.prototype.hasOwnProperty.call(result, 'authorization_code')}`);
+        line(`result has verifier: ${Object.prototype.hasOwnProperty.call(result, 'verifier')}`);
+        line(`result loginCookie includes exchange-cookie: ${result.loginCookie.includes('exchange-cookie=EXCHANGE_HEADER')}`);
+        line(`result localCookie includes refreshed session-id: ${result.localCookie.includes('session-id=SID_LOCAL')}`);
+        line('');
+        line('ASSERTIONS:');
+        recordAssertion('requests include /auth/token', () => {
+            assert.ok(paths.includes('/auth/token'));
+        });
+        recordAssertion('requests include /v1/devices/@self/capabilities', () => {
+            assert.ok(paths.includes('/v1/devices/@self/capabilities'));
+        });
+        recordAssertion('requests include /ap/exchangetoken/cookies', () => {
+            assert.ok(paths.includes('/ap/exchangetoken/cookies'));
+        });
+        recordAssertion('requests include /api/language', () => {
+            assert.ok(paths.includes('/api/language'));
+        });
+        recordAssertion('requests do not include /auth/register', () => {
+            assert.ok(!paths.includes('/auth/register'));
+        });
+        recordAssertion('capability request uses PUT api.amazonalexa.com', () => {
+            assert.strictEqual(capabilityCall.host, 'api.amazonalexa.com');
+            assert.strictEqual(capabilityCall.method, 'PUT');
+        });
+        recordAssertion('capability request has authorization header', () => {
+            assert.strictEqual(capabilityCall.hasAuthorization, true);
+        });
+        recordAssertion('result accessToken was refreshed', () => {
+            assert.strictEqual(result.accessToken, 'ACCESS_TOKEN_AFTER_REFRESH');
+        });
+        recordAssertion('result refreshToken preserved', () => {
+            assert.strictEqual(result.refreshToken, 'REFRESH_TOKEN_OLD');
+        });
+        recordAssertion('result macDms preserved', () => {
+            assert.strictEqual(result.macDms, 'MAC_DMS_OLD');
+        });
+        recordAssertion('result csrf refreshed from API cookie', () => {
+            assert.strictEqual(result.csrf, 'CSRF_FROM_API');
+        });
+        recordAssertion('result localCookie contains exchanged session-id', () => {
+            assert.ok(result.localCookie.includes('session-id=SID_LOCAL'));
+        });
+        recordAssertion('result loginCookie excludes non-Amazon exchange response cookie', () => {
+            assert.ok(!result.loginCookie.includes('exchange-cookie=EXCHANGE_HEADER'));
+        });
+        recordAssertion('result does not keep authorization_code', () => {
+            assert.strictEqual(Object.prototype.hasOwnProperty.call(result, 'authorization_code'), false);
+        });
+        recordAssertion('result does not keep verifier', () => {
+            assert.strictEqual(Object.prototype.hasOwnProperty.call(result, 'verifier'), false);
+        });
+        line('');
+        line('RESULT: PASS');
+        writeOutput();
+    } catch (err) {
+        if (!lines.includes('RESULT: PASS')) {
+            line('');
+            line('RESULT: FAIL');
+            writeOutput();
+        }
+        throw err;
+    }
+})();