musora-content-services 2.117.8 → 2.118.1

package/src/services/recommendations.js

@@ -126,9 +126,12 @@ export async function rankItems(brand, content_ids) {
   }
 }
 
-export async function recommendations(brand, { section = '' } = {}) {
+export async function recommendations(brand, { section = '', contentTypes = [] } = {}) {
   section = section.toUpperCase().replace('-', '_')
   const sectionString = section ? `&section=${section}` : ''
-  const url = `/api/content/v1/recommendations?brand=${brand}${sectionString}`
+  const contentTypesString = contentTypes.length > 0
+    ? contentTypes.map(type => `&content_types[]=${encodeURIComponent(type)}`).join('')
+    : ''
+  const url = `/api/content/v1/recommendations?brand=${brand}${sectionString}${contentTypesString}`
   return await GET(url)
 }

package/src/services/user/sessions.js

@@ -2,6 +2,7 @@
  * @module Sessions
  */
 import { globalConfig } from '../config.js'
+import { clearAllCachedData } from '../dataContext.js'
 import { USER_PIN_PROGRESS_KEY } from '../progress-row/base.js'
 import './types.js'
 
@@ -50,9 +51,11 @@ export async function login(email, password, deviceName, deviceToken, platform)
 
   // TODO: refactor this. I don't think this is the place for it but we need it fixed for the system test
   if (res.ok) {
+    const userId = data.user?.id
+    const userPinKey = userId ? `user_pin_progress_row_${userId}` : USER_PIN_PROGRESS_KEY
     await globalConfig.localStorage.setItem(
-      USER_PIN_PROGRESS_KEY,
-      JSON.stringify(data.pinned_progress_rows || {})
+      userPinKey,
+      JSON.stringify(data.user?.brand_pinned_progress || {})
     )
   }
 
@@ -91,6 +94,7 @@ export async function login(email, password, deviceName, deviceToken, platform)
 
 /**
  * Logs the user out of the current session.
+ * Clears all cached data to prevent data leakage between users.
  *
  * @returns {Promise<void>}
  *
@@ -108,6 +112,9 @@ export async function logout() {
       'Content-Type': 'application/json',
     },
   })
+
+  // Clear all locally cached data to prevent data leakage between users
+  await clearAllCachedData()
 }
 
 /**

package/test/logout.test.js

@@ -0,0 +1,199 @@
+import { initializeService, globalConfig } from '../src/services/config.js'
+import { LocalStorageMock } from './localStorageMock'
+import { logout } from '../src/services/user/sessions.js'
+import { clearAllCachedData } from '../src/services/dataContext.js'
+import { USER_PIN_PROGRESS_KEY } from '../src/services/progress-row/base.js'
+
+describe('logout cache clearing', function () {
+  let mockLocalStorage
+
+  beforeEach(() => {
+    // Create fresh localStorage for each test
+    mockLocalStorage = new LocalStorageMock()
+
+    // Simple initialization without SyncManager
+    const config = {
+      sanityConfig: {
+        token: 'test-token',
+        projectId: 'test-project',
+        dataset: 'test',
+        useCachedAPI: true,
+        version: '2021-06-07',
+        debug: false,
+        useDummyRailContentMethods: true,
+      },
+      railcontentConfig: {
+        baseUrl: 'https://test.musora.com',
+        token: 'test-token',
+        userId: 123,
+        authToken: 'test-token',
+      },
+      sessionConfig: { token: 'test-token', userId: 123, authToken: 'test-token' },
+      baseUrl: 'https://test.musora.com',
+      localStorage: mockLocalStorage,
+      isMA: false,
+    }
+    initializeService(config)
+  })
+
+  afterEach(() => {
+    jest.restoreAllMocks()
+  })
+
+  test('clearAllCachedData does NOT remove user_pin_progress_row keys', async () => {
+    const localStorage = globalConfig.localStorage
+    const userId = 123
+    const userPinKey = `user_pin_progress_row_${userId}`
+
+    // Add pinned progress data for user 123
+    localStorage.setItem(userPinKey, JSON.stringify({
+      drumeo: { id: 123, progressType: 'content', pinnedAt: '2025-01-01' },
+      pianote: { id: 456, progressType: 'playlist', pinnedAt: '2025-01-02' }
+    }))
+
+    // Add pinned progress data for another user
+    localStorage.setItem('user_pin_progress_row_456', JSON.stringify({
+      drumeo: { id: 789, progressType: 'content' }
+    }))
+
+    // Verify data exists
+    expect(localStorage.getItem(userPinKey)).not.toBeNull()
+    expect(localStorage.getItem('user_pin_progress_row_456')).not.toBeNull()
+
+    // Clear cached data
+    await clearAllCachedData()
+
+    // Verify user pin progress rows are NOT removed
+    expect(localStorage.getItem(userPinKey)).not.toBeNull()
+    expect(localStorage.getItem('user_pin_progress_row_456')).not.toBeNull()
+  })
+
+  test('clearAllCachedData removes dataContext keys', async () => {
+    const localStorage = globalConfig.localStorage
+
+    // Add some dataContext keys
+    localStorage.setItem('dataContext_test1', JSON.stringify({ data: 'test1' }))
+    localStorage.setItem('dataContext_test2', JSON.stringify({ data: 'test2' }))
+    localStorage.setItem('other_key', 'should_remain')
+
+    // Verify data exists
+    expect(localStorage.getItem('dataContext_test1')).not.toBeNull()
+    expect(localStorage.getItem('dataContext_test2')).not.toBeNull()
+    expect(localStorage.getItem('other_key')).not.toBeNull()
+
+    // Clear all cached data
+    await clearAllCachedData()
+
+    // Verify dataContext keys were removed but other key remains
+    expect(localStorage.getItem('dataContext_test1')).toBeNull()
+    expect(localStorage.getItem('dataContext_test2')).toBeNull()
+    expect(localStorage.getItem('other_key')).toBe('should_remain')
+  })
+
+  test('clearAllCachedData removes ONLY dataContext keys', async () => {
+    const localStorage = globalConfig.localStorage
+    const userId = 123
+    const userPinKey = `user_pin_progress_row_${userId}`
+
+    // Add various cached data
+    localStorage.setItem(userPinKey, JSON.stringify({ drumeo: { id: 123 } }))
+    localStorage.setItem('dataContext_progress', JSON.stringify({ data: 'progress' }))
+    localStorage.setItem('dataContext_likes', JSON.stringify({ data: 'likes' }))
+    localStorage.setItem('unrelated_key', 'preserved')
+    localStorage.setItem('user_pin_progress_row_999', JSON.stringify({ drumeo: { id: 999 } }))
+
+    // Verify all data exists
+    expect(localStorage.getItem(userPinKey)).not.toBeNull()
+    expect(localStorage.getItem('dataContext_progress')).not.toBeNull()
+    expect(localStorage.getItem('dataContext_likes')).not.toBeNull()
+    expect(localStorage.getItem('unrelated_key')).not.toBeNull()
+
+    // Clear cached data
+    await clearAllCachedData()
+
+    // Verify only dataContext keys were cleared
+    expect(localStorage.getItem(userPinKey)).not.toBeNull()
+    expect(localStorage.getItem('dataContext_progress')).toBeNull()
+    expect(localStorage.getItem('dataContext_likes')).toBeNull()
+    expect(localStorage.getItem('unrelated_key')).toBe('preserved')
+    // All user pinned data should remain
+    expect(localStorage.getItem('user_pin_progress_row_999')).not.toBeNull()
+  })
+
+  test('logout calls clearAllCachedData', async () => {
+    // Mock fetch to prevent actual API call
+    global.fetch = jest.fn().mockResolvedValue({
+      ok: true,
+      json: async () => ({ success: true })
+    })
+
+    const localStorage = globalConfig.localStorage
+    const userId = 123
+    const userPinKey = `user_pin_progress_row_${userId}`
+
+    // Add cached data
+    localStorage.setItem(userPinKey, JSON.stringify({ drumeo: { id: 123 } }))
+    localStorage.setItem('dataContext_test', JSON.stringify({ data: 'test' }))
+    localStorage.setItem('user_pin_progress_row_456', JSON.stringify({ drumeo: { id: 456 } }))
+
+    // Verify data exists before logout
+    expect(localStorage.getItem(userPinKey)).not.toBeNull()
+    expect(localStorage.getItem('dataContext_test')).not.toBeNull()
+
+    // Call logout
+    await logout()
+
+    // Verify only dataContext was cleared, pinned progress remains
+    expect(localStorage.getItem(userPinKey)).not.toBeNull()
+    expect(localStorage.getItem('dataContext_test')).toBeNull()
+    expect(localStorage.getItem('user_pin_progress_row_456')).not.toBeNull()
+
+    // Verify fetch was called (logout API endpoint)
+    expect(global.fetch).toHaveBeenCalledWith(
+      expect.stringContaining('/api/user-management-system/v1/sessions'),
+      expect.objectContaining({
+        method: 'DELETE'
+      })
+    )
+  })
+
+  test('logout prevents cross-account data leakage', async () => {
+    // Mock fetch to prevent actual API call
+    global.fetch = jest.fn().mockResolvedValue({
+      ok: true,
+      json: async () => ({ success: true })
+    })
+
+    const localStorage = globalConfig.localStorage
+    const user1Id = 123
+    const user2Id = 456
+    const user1PinKey = `user_pin_progress_row_${user1Id}`
+    const user2PinKey = `user_pin_progress_row_${user2Id}`
+
+    // Simulate user 1 (id: 123) with pinned content and dataContext
+    localStorage.setItem(user1PinKey, JSON.stringify({
+      drumeo: { id: 12345, progressType: 'content', pinnedAt: '2025-01-14' }
+    }))
+    localStorage.setItem('dataContext_progress', JSON.stringify({ userId: 1, data: 'user1' }))
+
+    // Simulate user 2 (id: 456) already has pinned content
+    localStorage.setItem(user2PinKey, JSON.stringify({
+      drumeo: { id: 67890, progressType: 'content', pinnedAt: '2025-01-13' }
+    }))
+
+    // User 1 logs out
+    await logout()
+
+    // Verify dataContext is cleared (prevents cross-account leakage)
+    expect(localStorage.getItem('dataContext_progress')).toBeNull()
+
+    // Verify user 1's pinned progress remains (user-specific key)
+    expect(localStorage.getItem(user1PinKey)).not.toBeNull()
+
+    // Verify user 2's pinned content is NOT affected by user 1's logout
+    const user2PinnedData = localStorage.getItem(user2PinKey)
+    expect(user2PinnedData).not.toBeNull()
+    const user2Data = JSON.parse(user2PinnedData)
+    expect(user2Data.drumeo.id).toBe(67890)
+  })
+})