pryv 3.12.1 → 3.13.0

package/test/LoginButton.test.js

@@ -2,7 +2,7 @@
  * @license
  * [BSD-3-Clause](https://github.com/pryv/lib-js/blob/master/LICENSE)
  */
-/* global describe, it, before, after, expect, JSDOM, testData */
+/* global describe, it, before, after, afterEach, expect, JSDOM, testData */
 
 const LoginButton = require('../src/Browser/LoginButton');
 const Service = require('../src/Service');
@@ -168,25 +168,35 @@ describe('[LBTX] LoginButton', function () {
       expect(loginBtn.text).to.include('Test error');
     });
 
-    it('[LBSE] handles SIGNOUT state when confirmed', async function () {
-      // Save some auth data first
+    it('[LBSE] handles SIGNOUT state by asking in a built-in dialog', async function () {
       loginBtn.saveAuthorizationData({ test: 'data' });
       await loginBtn.onStateChange({ status: AuthStates.SIGNOUT });
-      // Confirm is mocked to return true
+      expect(document.querySelector('.pryv-menu .pryv-menu-logout')).to.exist;
+      expect(document.querySelector('.pryv-menu').getAttribute('role')).to.equal('alertdialog');
+      loginBtn.closeMenu(true); // no re-initialization running into the next test
     });
 
-    it('[LBSG] SIGNOUT waits for the re-init to finish (none left running in the background)', async function () {
-      // A re-init that outlives onStateChange resumes later and consumes
-      // whatever poll URL the page shows by then (it raced [LBRU] on CI).
+    it('[LBSG] the re-init after the logout question is awaitable, never left running untracked', async function () {
+      // A re-init that nobody waits for resumes later and consumes whatever
+      // poll URL the page shows by then (it raced [LBRU] on CI). SIGNOUT itself
+      // starts none now: it asks first; "Log out" and a dismissal each start
+      // one and expose it (`pending`, and closeMenu's promise).
       const originalInit = loginBtn.auth.init;
-      let reinitDone = false;
+      let reinits = 0;
       loginBtn.auth.init = async function () {
         await new Promise((resolve) => setTimeout(resolve, 50));
-        reinitDone = true;
+        reinits++;
       };
       try {
         await loginBtn.onStateChange({ status: AuthStates.SIGNOUT });
-        expect(reinitDone).to.equal(true);
+        expect(reinits).to.equal(0);
+        document.querySelector('.pryv-menu .pryv-menu-logout').click();
+        await loginBtn.pending;
+        expect(reinits).to.equal(1);
+
+        await loginBtn.onStateChange({ status: AuthStates.SIGNOUT });
+        await loginBtn.closeMenu(); // dismissed
+        expect(reinits).to.equal(2);
       } finally {
         loginBtn.auth.init = originalInit;
       }
@@ -198,6 +208,557 @@ describe('[LBTX] LoginButton', function () {
     });
   });
 
+  describe('[LBMX] account menu', function () {
+    let confirms;
+    let originalConfirm;
+
+    before(() => {
+      originalConfirm = global.confirm;
+      global.confirm = () => { confirms++; return true; };
+    });
+    after(() => { global.confirm = originalConfirm; });
+
+    async function signedInButton (extra) {
+      confirms = 0;
+      const states = [];
+      const settings = Object.assign({
+        spanButtonID: 'loginButton',
+        authRequest: { requestingAppId: 'test-app-menu', requestedPermissions: [] },
+        onStateChange: (s) => states.push(s.status),
+        accountUrl: 'https://account.example.com'
+      }, extra);
+      const loginBtn = new LoginButton(settings, service);
+      await loginBtn.init();
+      loginBtn.auth.state = { status: AuthStates.AUTHORIZED, username: 'menu-user', apiEndpoint: 'https://tok@menu-user.example.com/' };
+      states.length = 0;
+      return { loginBtn, states };
+    }
+    const dialog = () => document.querySelector('.pryv-menu');
+    const key = (k, opts) => document.dispatchEvent(new window.KeyboardEvent('keydown', Object.assign({ key: k, bubbles: true }, opts)));
+
+    afterEach(() => {
+      document.querySelectorAll('.pryv-menu-overlay').forEach((n) => n.parentNode.removeChild(n));
+    });
+
+    it('[LBMA] a click on the signed-in button opens the menu and emits no state', async function () {
+      const { loginBtn, states } = await signedInButton();
+      loginBtn.onClick();
+      await new Promise((resolve) => setTimeout(resolve, 0));
+      expect(states).to.deep.equal([]);
+      expect(confirms).to.equal(0);
+      expect(dialog()).to.exist;
+      expect(dialog().getAttribute('role')).to.equal('dialog');
+      expect(dialog().getAttribute('aria-modal')).to.equal('true');
+      expect(dialog().querySelector('.pryv-menu-username').textContent).to.equal('menu-user');
+      expect(dialog().querySelector('.pryv-menu-info').textContent).to.include('test-app-menu');
+      expect(dialog().querySelector('.pryv-menu-logout')).to.exist;
+      expect(dialog().querySelector('.pryv-menu-account')).to.exist;
+      // the built-in style comes first, so a service stylesheet overrides it
+      expect(document.head.firstChild.id).to.equal('pryv-menu-style');
+      expect(dialog().getAttribute('aria-labelledby')).to.equal('pryv-menu-username');
+    });
+
+    it('[LBMH] the stored credentials keep the auth page URL of the sign-in', async function () {
+      const { loginBtn } = await signedInButton();
+      await loginBtn.onStateChange({ status: AuthStates.AUTHORIZED, username: 'menu-user', apiEndpoint: 'https://tok@menu-user.example.com/', authUrl: 'https://ui.example.com/auth' });
+      expect(loginBtn.getAuthorizationData().authUrl).to.equal('https://ui.example.com/auth');
+      // the ACCEPTED poll body carries no authUrl: the one remembered from the request is used
+      loginBtn.auth._authUrl = 'https://ui2.example.com/auth';
+      await loginBtn.onStateChange({ status: AuthStates.AUTHORIZED, username: 'menu-user', apiEndpoint: 'https://tok@menu-user.example.com/' });
+      expect(loginBtn.getAuthorizationData().authUrl).to.equal('https://ui2.example.com/auth');
+    });
+
+    it('[LBMB] "Log out" emits SIGNOUT exactly once, without a confirmation, and clears the credentials', async function () {
+      const { loginBtn, states } = await signedInButton();
+      loginBtn.saveAuthorizationData({ apiEndpoint: 'https://tok@menu-user.example.com/', username: 'menu-user' });
+      loginBtn.showMenu();
+      dialog().querySelector('.pryv-menu-logout').click();
+      await new Promise((resolve) => setTimeout(resolve, 50));
+      expect(states.filter((s) => s === AuthStates.SIGNOUT)).to.have.lengthOf(1);
+      expect(confirms).to.equal(0);
+      expect(dialog()).to.equal(null);
+      expect(loginBtn.auth.state.status).to.equal(AuthStates.INITIALIZED);
+      const stored = loginBtn.getAuthorizationData();
+      expect(stored == null || stored.deleted === true).to.equal(true);
+    });
+
+    it('[LBMC] closes on its close button, on Escape and on a click outside, without logging out', async function () {
+      const { loginBtn, states } = await signedInButton();
+      loginBtn.showMenu();
+      dialog().querySelector('.pryv-menu-close').click();
+      expect(dialog()).to.equal(null);
+      loginBtn.showMenu();
+      key('Escape');
+      expect(dialog()).to.equal(null);
+      loginBtn.showMenu();
+      const overlay = document.querySelector('.pryv-menu-overlay');
+      overlay.dispatchEvent(new window.MouseEvent('mousedown', { bubbles: true }));
+      overlay.click();
+      expect(dialog()).to.equal(null);
+      // a text selection that started inside the dialog and ended outside it
+      loginBtn.showMenu();
+      dialog().dispatchEvent(new window.MouseEvent('mousedown', { bubbles: true }));
+      document.querySelector('.pryv-menu-overlay').click();
+      expect(dialog()).to.exist;
+      loginBtn.closeMenu();
+      loginBtn.showMenu();
+      dialog().click(); // inside: stays open
+      expect(dialog()).to.exist;
+      expect(states).to.deep.equal([]);
+    });
+
+    it('[LBMD] keeps focus inside the menu', async function () {
+      const { loginBtn } = await signedInButton();
+      loginBtn.showMenu();
+      const buttons = Array.from(dialog().querySelectorAll('button'));
+      expect(document.activeElement).to.equal(buttons[0]);
+      buttons[buttons.length - 1].focus();
+      key('Tab');
+      expect(document.activeElement).to.equal(buttons[0]);
+      key('Tab', { shiftKey: true });
+      expect(document.activeElement).to.equal(buttons[buttons.length - 1]);
+    });
+
+    it('[LBME] "Manage my account" opens the account app and closes the menu; hidden when unknown', async function () {
+      const { loginBtn } = await signedInButton();
+      const opened = [];
+      const original = window.open;
+      window.open = (...args) => { opened.push(args); return null; };
+      try {
+        loginBtn.showMenu();
+        dialog().querySelector('.pryv-menu-account').click();
+      } finally { window.open = original; }
+      expect(opened).to.have.lengthOf(1);
+      expect(opened[0][0]).to.match(/^https:\/\/account\.example\.com\/account\/profile\?pryvServiceInfoUrl=/);
+      expect(dialog()).to.equal(null);
+
+      const { loginBtn: unknown } = await signedInButton({ accountUrl: undefined });
+      unknown.auth.serviceInfo = Object.assign({}, unknown.auth.serviceInfo, { account: undefined });
+      unknown.showMenu();
+      expect(dialog().querySelector('.pryv-menu-account')).to.equal(null);
+    });
+
+    it('[LBMF] entries can be hidden', async function () {
+      for (const menu of [{ hide: ['account', 'info'] }, { account: false, info: false }]) {
+        const { loginBtn } = await signedInButton({ menu });
+        loginBtn.showMenu();
+        expect(dialog().querySelector('.pryv-menu-account')).to.equal(null);
+        expect(dialog().querySelector('.pryv-menu-info')).to.equal(null);
+        expect(dialog().querySelector('.pryv-menu-logout')).to.exist;
+        loginBtn.closeMenu();
+      }
+    });
+
+    it('[LBMG] menu: false keeps the legacy flow (SIGNOUT on click) with a built-in "Log out?" dialog, never confirm()', async function () {
+      const { loginBtn, states } = await signedInButton({ menu: false });
+      expect(loginBtn.showMenu()).to.equal(false);
+      loginBtn.saveAuthorizationData({ apiEndpoint: 'https://tok@menu-user.example.com/', username: 'menu-user' });
+      loginBtn.onClick();
+      await new Promise((resolve) => setTimeout(resolve, 50));
+      expect(states.filter((s) => s === AuthStates.SIGNOUT)).to.have.lengthOf(1);
+      expect(confirms).to.equal(0);
+      expect(dialog().querySelector('.pryv-menu-username').textContent).to.equal('Logout?');
+      expect(dialog().querySelector('.pryv-menu-account')).to.equal(null);
+      // Cancel keeps the credentials and returns to the signed-in state
+      // (the button used to stay inert after a cancelled logout)
+      states.length = 0;
+      dialog().querySelector('.pryv-menu-cancel').click();
+      expect(dialog()).to.equal(null);
+      await loginBtn.pending;
+      expect(loginBtn.getAuthorizationData().username).to.equal('menu-user');
+      expect(loginBtn.auth.state.status).to.equal(AuthStates.AUTHORIZED);
+      // the documented contract: re-initialized from the stored credentials
+      expect(states).to.deep.equal([AuthStates.LOADING, AuthStates.AUTHORIZED]);
+      // the service's button stylesheet is added once (a browser page carries others)
+      expect(Array.from(document.querySelectorAll('link[rel="stylesheet"]')).filter((l) => /buttonSignIn/.test(l.href)).length).to.be.at.most(1);
+      // Log out clears them and re-initializes
+      loginBtn.onClick();
+      await new Promise((resolve) => setTimeout(resolve, 50));
+      dialog().querySelector('.pryv-menu-logout').click();
+      await loginBtn.pending;
+      expect(confirms).to.equal(0);
+      expect(loginBtn.auth.state.status).to.equal(AuthStates.INITIALIZED);
+      const stored = loginBtn.getAuthorizationData();
+      expect(stored == null || stored.deleted === true).to.equal(true);
+    });
+  });
+
+  describe('[LBPX] several accounts and account switching', function () {
+    const utils = require('../src/utils');
+    const PARENT = 'parent-doe';
+    const KIM = 'kim-doe';
+    const hint = { isDelegatedAccess: true, controlledUsername: KIM, delegate: { username: PARENT } };
+    const dialog = () => document.querySelector('.pryv-menu');
+    let originals;
+
+    before(() => {
+      originals = { fetchPost: utils.fetchPost, fetchGet: utils.fetchGet, open: window.open };
+      window.open = () => ({ focus () {} });
+    });
+    afterEach(() => {
+      utils.fetchPost = originals.fetchPost;
+      utils.fetchGet = originals.fetchGet;
+      document.querySelectorAll('.pryv-menu-overlay').forEach((n) => n.parentNode.removeChild(n));
+    });
+    after(() => { window.open = originals.open; });
+
+    async function button (extra, stored) {
+      const states = [];
+      const settings = Object.assign({
+        spanButtonID: 'loginButton',
+        authRequest: { requestingAppId: 'test-app-profiles', requestedPermissions: [] },
+        onStateChange: (s) => states.push(s),
+        accountUrl: 'https://account.example.com'
+      }, extra);
+      const loginBtn = new LoginButton(settings, service);
+      loginBtn._cookieKey = 'pryv-libjs-test-app-profiles';
+      await loginBtn.deleteAuthorizationData();
+      if (stored != null) loginBtn.saveAuthorizationData(stored);
+      await loginBtn.init();
+      states.length = 0;
+      return { loginBtn, states };
+    }
+
+    /** Answer the next auth request with NEED_SIGNIN, then `final` on the first poll. */
+    function stubAuthRequest (final) {
+      const posted = [];
+      utils.fetchPost = async (url, body) => {
+        posted.push(body);
+        return { response: { ok: true }, body: { status: 'NEED_SIGNIN', key: 'k1', poll: 'https://reg.example.com/access/k1', poll_rate_ms: 10, authUrl: 'https://ui.example.com/auth?key=k1' } };
+      };
+      utils.fetchGet = async () => final;
+      return posted;
+    }
+
+    async function settle () {
+      await new Promise((resolve) => setTimeout(resolve, 50));
+    }
+
+    it('[LBPA] a grant for a controlled account is labelled "via" its delegate and remembered next to the own account', async function () {
+      const { loginBtn } = await button(null, { username: PARENT, apiEndpoint: 'https://tok1@parent.example.com/' });
+      expect(loginBtn.auth.currentProfile()).to.deep.equal({ username: PARENT });
+      stubAuthRequest({ response: { status: 200 }, body: { status: 'ACCEPTED', username: KIM, apiEndpoint: 'https://tok2@kim.example.com/', delegation: hint } });
+      await loginBtn.auth.addAccount();
+      await settle();
+      expect(loginBtn.text).to.equal(KIM + ' (via ' + PARENT + ')');
+      expect(loginBtn.auth.currentProfile()).to.deep.equal({ username: KIM, actingAs: { username: KIM, delegate: PARENT } });
+      expect(loginBtn.auth.profiles()).to.deep.equal([
+        { username: KIM, active: true, available: true, actingAs: { username: KIM, delegate: PARENT } },
+        { username: PARENT, active: false, available: true }
+      ]);
+      const stored = loginBtn.getAuthorizationData();
+      // the active account stays readable at the top level; the auth page is kept without its query
+      expect(stored.username).to.equal(KIM);
+      expect(stored.authUrl).to.equal('https://ui.example.com/auth');
+      // after a reload the same account is signed in, still labelled "via"
+      const { loginBtn: reloaded } = await button(null, stored);
+      expect(reloaded.auth.currentProfile().actingAs.delegate).to.equal(PARENT);
+      expect(reloaded.text).to.equal(KIM + ' (via ' + PARENT + ')');
+    });
+
+    it('[LBPB] "another account" sends actAs: allow; a switch to a named account sends that name; SWITCHING comes first', async function () {
+      const { loginBtn, states } = await button(null, { username: PARENT, apiEndpoint: 'https://tok1@parent.example.com/' });
+      let posted = stubAuthRequest({ response: { status: 200 }, body: { status: 'ACCEPTED', username: KIM, apiEndpoint: 'https://tok2@kim.example.com/', delegation: hint } });
+      await loginBtn.auth.addAccount();
+      await settle();
+      expect(posted[0].actAs).to.equal('allow');
+      expect(posted[0].requestingAppId).to.equal('test-app-profiles');
+      expect(states.map((s) => s.status)).to.deep.equal([AuthStates.SWITCHING, AuthStates.NEED_SIGNIN, AuthStates.AUTHORIZED]);
+      expect(states[0]).to.include({ from: PARENT, to: null });
+      // the app's own setting is not changed by a switch
+      expect(loginBtn.authSettings.authRequest.actAs).to.equal(undefined);
+      posted = stubAuthRequest({ response: { status: 200 }, body: { status: 'ACCEPTED', username: 'lou-doe', apiEndpoint: 'https://tok3@lou.example.com/' } });
+      await loginBtn.auth.switchTo('lou-doe');
+      await settle();
+      expect(posted[0].actAs).to.equal('lou-doe');
+      expect(loginBtn.auth.currentProfile().username).to.equal('lou-doe');
+    });
+
+    it('[LBPC] switching to a remembered account whose access is valid needs no sign-in', async function () {
+      const { loginBtn, states } = await button(null, {
+        username: KIM,
+        apiEndpoint: 'https://tok2@kim.example.com/',
+        actingAs: { username: KIM, delegate: PARENT },
+        profiles: [{ username: testData.username, apiEndpoint: testData.apiEndpointWithToken }]
+      });
+      utils.fetchPost = async () => { throw new Error('no auth request expected'); };
+      await loginBtn.auth.switchTo(testData.username);
+      expect(states.map((s) => s.status)).to.deep.equal([AuthStates.SWITCHING, AuthStates.AUTHORIZED]);
+      expect(states[0]).to.include({ from: KIM, to: testData.username });
+      expect(loginBtn.auth.currentProfile()).to.deep.equal({ username: testData.username });
+      expect(loginBtn.getAuthorizationData().username).to.equal(testData.username);
+    });
+
+    it('[LBPD] "switch back" re-activates the delegate\'s own account', async function () {
+      const { loginBtn } = await button(null, {
+        username: KIM,
+        apiEndpoint: 'https://tok2@kim.example.com/',
+        actingAs: { username: KIM, delegate: testData.username },
+        profiles: [{ username: 'someone-else', apiEndpoint: 'https://t@else.example.com/' }, { username: testData.username, apiEndpoint: testData.apiEndpointWithToken }]
+      });
+      await loginBtn.auth.switchTo(null);
+      expect(loginBtn.auth.currentProfile()).to.deep.equal({ username: testData.username });
+      // already on the own account: nothing to do
+      await loginBtn.auth.switchTo(null);
+      expect(loginBtn.auth.currentProfile().username).to.equal(testData.username);
+    });
+
+    it('[LBPE] a revoked account is marked "no longer available" and asked for again', async function () {
+      const revoked = testData.apiEndpointWithToken.replace(/\/\/[^@]+@/, '//revoked-token-x@');
+      const { loginBtn } = await button(null, {
+        username: PARENT,
+        apiEndpoint: 'https://tok1@parent.example.com/',
+        profiles: [{ username: testData.username, apiEndpoint: revoked, actingAs: { username: testData.username, delegate: PARENT } }]
+      });
+      const posted = stubAuthRequest({ response: { status: 403 }, body: { status: 'REFUSED' } });
+      await loginBtn.auth.switchTo(testData.username);
+      await settle();
+      expect(posted[0].actAs).to.equal(testData.username);
+      const listed = loginBtn.auth.profiles().find((p) => p.username === testData.username);
+      expect(listed.available).to.equal(false);
+      // the sign-in was refused: back on the previous account, not signed out
+      expect(loginBtn.auth.state.status).to.equal(AuthStates.AUTHORIZED);
+      expect(loginBtn.auth.currentProfile().username).to.equal(PARENT);
+      loginBtn.showMenu();
+      const item = Array.from(dialog().querySelectorAll('.pryv-menu-profile')).find((b) => b.textContent.startsWith(testData.username));
+      expect(item.textContent).to.include('no longer available');
+    });
+
+    it('[LBPF] the menu offers the remembered accounts, "another account" with delegation, and "Log out of all accounts"', async function () {
+      const { loginBtn } = await button(null, {
+        username: PARENT,
+        apiEndpoint: 'https://tok1@parent.example.com/',
+        profiles: [{ username: KIM, apiEndpoint: 'https://tok2@kim.example.com/', actingAs: { username: KIM, delegate: PARENT } }]
+      });
+      loginBtn.serviceInfo = Object.assign({}, loginBtn.serviceInfo, { features: { delegation: true } });
+      loginBtn.showMenu();
+      const items = Array.from(dialog().querySelectorAll('.pryv-menu-profile'));
+      expect(items.map((b) => b.textContent)).to.deep.equal([PARENT + ' (me)', KIM + ' via ' + PARENT]);
+      expect(items[0].getAttribute('aria-current')).to.equal('true');
+      expect(dialog().querySelector('.pryv-menu-switch-title').textContent).to.equal('Use this app for');
+      expect(dialog().querySelector('.pryv-menu-add-account')).to.exist;
+      expect(dialog().querySelector('.pryv-menu-logout-all')).to.exist;
+      loginBtn.closeMenu();
+      // hidden with the option; nothing to offer without delegation and a single account
+      const { loginBtn: hidden } = await button({ menu: { hide: ['switch'] } }, { username: PARENT, apiEndpoint: 'https://tok1@parent.example.com/', profiles: [{ username: KIM, apiEndpoint: 'https://tok2@kim.example.com/' }] });
+      hidden.showMenu();
+      expect(dialog().querySelector('.pryv-menu-switch')).to.equal(null);
+      hidden.closeMenu();
+      const { loginBtn: single } = await button(null, { username: PARENT, apiEndpoint: 'https://tok1@parent.example.com/' });
+      single.serviceInfo = Object.assign({}, single.serviceInfo, { features: { delegation: false } });
+      single.showMenu();
+      expect(dialog().querySelector('.pryv-menu-switch')).to.equal(null);
+      expect(dialog().querySelector('.pryv-menu-logout-all')).to.equal(null);
+    });
+
+    it('[LBPG] acting for an account: the menu says so and offers "Switch back"', async function () {
+      const { loginBtn } = await button(null, {
+        username: KIM,
+        apiEndpoint: 'https://tok2@kim.example.com/',
+        actingAs: { username: KIM, delegate: testData.username },
+        profiles: [{ username: testData.username, apiEndpoint: testData.apiEndpointWithToken }]
+      });
+      loginBtn.showMenu();
+      expect(dialog().querySelector('.pryv-menu-username').textContent).to.equal(KIM + ' (acting as, via ' + testData.username + ')');
+      expect(dialog().querySelector('.pryv-menu-account').textContent).to.include("Manage kim-doe's account");
+      expect(dialog().querySelector('.pryv-menu-profile')).to.equal(null);
+      dialog().querySelector('.pryv-menu-switch-back').click();
+      expect(dialog()).to.equal(null);
+      await loginBtn.pending;
+      expect(loginBtn.auth.currentProfile()).to.deep.equal({ username: testData.username });
+    });
+
+    it('[LBPH] "Log out" keeps the other accounts without signing in to one; "Log out of all accounts" forgets them', async function () {
+      const stored = {
+        username: KIM,
+        apiEndpoint: 'https://tok2@kim.example.com/',
+        profiles: [{ username: PARENT, apiEndpoint: 'https://tok1@parent.example.com/' }]
+      };
+      const { loginBtn, states } = await button(null, stored);
+      loginBtn.showMenu();
+      dialog().querySelector('.pryv-menu-logout').click();
+      await loginBtn.pending;
+      expect(states.filter((s) => s.status === AuthStates.SIGNOUT)).to.have.lengthOf(1);
+      expect(loginBtn.auth.state.status).to.equal(AuthStates.INITIALIZED);
+      const kept = loginBtn.getAuthorizationData();
+      expect(kept.username).to.equal(undefined);
+      expect(kept.profiles.map((p) => p.username)).to.deep.equal([PARENT]);
+
+      const { loginBtn: all } = await button(null, stored);
+      all.showMenu();
+      dialog().querySelector('.pryv-menu-logout-all').click();
+      await all.pending;
+      const cleared = all.getAuthorizationData();
+      expect(cleared == null || cleared.deleted === true).to.equal(true);
+    });
+
+    it('[LBPI] a failed re-initialization after a dismissed "Log out?" is handled, not left rejected', async function () {
+      const { loginBtn } = await button({ menu: false }, { username: PARENT, apiEndpoint: 'https://tok1@parent.example.com/' });
+      loginBtn.onClick();
+      await settle();
+      loginBtn.auth.init = async () => { throw new Error('offline'); };
+      await loginBtn.closeMenu();
+    });
+    it('[LBPJ] "switch back" never activates another remembered account: without the delegate\'s own, it asks for a sign-in', async function () {
+      const { loginBtn } = await button(null, {
+        username: KIM,
+        apiEndpoint: 'https://tok2@kim.example.com/',
+        actingAs: { username: KIM, delegate: PARENT },
+        profiles: [{ username: 'someone-else', apiEndpoint: testData.apiEndpointWithToken }]
+      });
+      let probed = 0;
+      loginBtn.auth._accessInfo = async () => { probed++; return { user: {} }; };
+      const posted = stubAuthRequest({ response: { status: 200 }, body: { status: 'ACCEPTED', username: PARENT, apiEndpoint: 'https://tok1@parent.example.com/' } });
+      await loginBtn.auth.switchTo(null);
+      await settle();
+      expect(probed).to.equal(0);
+      expect(posted).to.have.lengthOf(1);
+      expect(posted[0].actAs).to.equal('deny');
+      expect(loginBtn.auth.currentProfile().username).to.equal(PARENT);
+    });
+
+    it('[LBPK] a refused switch returns to the previous account without the key of its consumed sign-in', async function () {
+      const { loginBtn, states } = await button(null, { username: PARENT, apiEndpoint: 'https://tok1@parent.example.com/' });
+      loginBtn.auth.state = { status: AuthStates.AUTHORIZED, username: PARENT, apiEndpoint: 'https://tok1@parent.example.com/', key: 'k-consumed', profile: { username: PARENT, apiEndpoint: 'https://tok1@parent.example.com/' } };
+      states.length = 0;
+      stubAuthRequest({ response: { status: 403 }, body: { status: 'REFUSED' } });
+      await loginBtn.auth.addAccount();
+      await settle();
+      const last = states[states.length - 1];
+      expect(last.status).to.equal(AuthStates.AUTHORIZED);
+      expect(last.key).to.equal(undefined);
+      expect(last.username).to.equal(PARENT);
+      expect(loginBtn.auth.state.key).to.equal(undefined);
+    });
+
+    it('[LBPL] a switch abandoned by a log out cannot sign back in when its request is answered later', async function () {
+      const { loginBtn } = await button(null, { username: PARENT, apiEndpoint: 'https://tok1@parent.example.com/' });
+      let answer;
+      utils.fetchPost = async () => ({ response: { ok: true }, body: { status: 'NEED_SIGNIN', key: 'k2', poll: 'https://reg.example.com/access/k2', poll_rate_ms: 10, authUrl: 'https://ui.example.com/auth' } });
+      utils.fetchGet = (url, ...rest) => url === 'https://reg.example.com/access/k2'
+        ? new Promise((resolve) => { answer = resolve; })
+        : originals.fetchGet(url, ...rest);
+      const switching = loginBtn.auth.addAccount();
+      await settle();
+      await loginBtn.auth.signOut();
+      expect(loginBtn.auth.state.status).to.equal(AuthStates.INITIALIZED);
+      // a late grant of the abandoned request must not sign anyone in
+      answer({ response: { status: 200 }, body: { status: 'ACCEPTED', username: KIM, apiEndpoint: 'https://tok2@kim.example.com/' } });
+      await switching;
+      await settle();
+      expect(loginBtn.auth.state.status).to.equal(AuthStates.INITIALIZED);
+      const stored = loginBtn.getAuthorizationData();
+      expect(stored == null || stored.deleted === true || stored.username == null).to.equal(true);
+    });
+
+    it('[LBPN] a log out during the access check of a switch ends the switch', async function () {
+      const { loginBtn } = await button(null, {
+        username: PARENT,
+        apiEndpoint: 'https://tok1@parent.example.com/',
+        profiles: [{ username: KIM, apiEndpoint: 'https://tok2@kim.example.com/', actingAs: { username: KIM, delegate: PARENT } }]
+      });
+      let answer;
+      loginBtn.auth._accessInfo = () => new Promise((resolve) => { answer = resolve; });
+      const switching = loginBtn.auth.switchTo(KIM);
+      await settle();
+      await loginBtn.auth.signOut({ all: true });
+      answer({ user: { username: KIM } });
+      await switching;
+      expect(loginBtn.auth.state.status).to.equal(AuthStates.INITIALIZED);
+      const stored = loginBtn.getAuthorizationData();
+      expect(stored == null || stored.deleted === true || stored.username == null).to.equal(true);
+    });
+
+    it('[LBPO] the main cookie only ever holds the active account: an older version never reads the remembered list as signed in', async function () {
+      const Cookies = require('../src/Browser/CookieUtils');
+      const { loginBtn } = await button(null, {
+        username: KIM,
+        apiEndpoint: 'https://tok2@kim.example.com/',
+        authUrl: 'https://ui.example.com/auth',
+        profiles: [{ username: PARENT, apiEndpoint: 'https://tok1@parent.example.com/' }]
+      });
+      const key = loginBtn._cookieKey;
+      // what versions without account switching read
+      const main = Cookies.get(key);
+      expect(main.username).to.equal(KIM);
+      expect(main.profiles).to.equal(undefined);
+      expect(Cookies.get(key + '-profiles').profiles.map((p) => p.username)).to.deep.equal([KIM, PARENT]);
+      // log out of the active account: nothing left for them to sign in with
+      loginBtn.showMenu();
+      document.querySelector('.pryv-menu-logout').click();
+      await loginBtn.pending;
+      const after = Cookies.get(key);
+      expect(after == null || after.deleted === true).to.equal(true);
+      const remembered = loginBtn.getAuthorizationData();
+      expect(remembered.username).to.equal(undefined);
+      expect(remembered.profiles.map((p) => p.username)).to.deep.equal([PARENT]);
+      expect(remembered.authUrl).to.equal('https://ui.example.com/auth');
+      // log out of all: both cookies gone
+      await loginBtn.auth.signOut({ all: true });
+      const none = loginBtn.getAuthorizationData();
+      expect(none == null || none.deleted === true).to.equal(true);
+      const list = Cookies.get(key + '-profiles');
+      expect(list == null || list.deleted === true).to.equal(true);
+    });
+
+    it('[LBPQ] the remembered accounts are trimmed, least recent first, to fit in a cookie', async function () {
+      const Cookies = require('../src/Browser/CookieUtils');
+      const profiles = [];
+      for (let i = 0; i < 20; i++) {
+        profiles.push({ username: 'user-' + i, apiEndpoint: 'https://' + 'x'.repeat(120) + i + '@user-' + i + '.example.com/' });
+      }
+      const { loginBtn } = await button({ maxProfiles: 50 }, null);
+      loginBtn.saveAuthorizationData({ username: 'user-0', apiEndpoint: profiles[0].apiEndpoint, profiles });
+      const stored = Cookies.get(loginBtn._cookieKey + '-profiles');
+      expect(stored).to.exist;
+      expect(stored.profiles.length).to.be.below(20);
+      expect(stored.profiles.length).to.be.above(5);
+      expect(stored.profiles[0].username).to.equal('user-0');
+      expect(stored.profiles[stored.profiles.length - 1].username).to.equal('user-' + (stored.profiles.length - 1));
+    });
+
+    it('[LBPP] a stopped auth request no longer changes the state when its poll answers', async function () {
+      const { loginBtn } = await button(null, null);
+      let answer;
+      utils.fetchPost = async () => ({ response: { ok: true }, body: { status: 'NEED_SIGNIN', key: 'k3', poll: 'https://reg.example.com/access/k3', poll_rate_ms: 10, authUrl: 'https://ui.example.com/auth' } });
+      utils.fetchGet = (url, ...rest) => url === 'https://reg.example.com/access/k3'
+        ? new Promise((resolve) => { answer = resolve; })
+        : originals.fetchGet(url, ...rest);
+      const request = loginBtn.auth.startAuthRequest();
+      await settle();
+      loginBtn.auth.stopAuthRequest('stopped by the app');
+      answer({ response: { status: 200 }, body: { status: 'ACCEPTED', username: PARENT, apiEndpoint: 'https://tok1@parent.example.com/' } });
+      await request;
+      await settle();
+      expect(loginBtn.auth.state.status).to.equal(AuthStates.ERROR);
+      expect(loginBtn.auth.state.message).to.equal('stopped by the app');
+    });
+
+    it('[LBPM] only a refused access marks an account unavailable; a server error or a network failure keeps the previous account', async function () {
+      const stored = {
+        username: PARENT,
+        apiEndpoint: 'https://tok1@parent.example.com/',
+        profiles: [{ username: KIM, apiEndpoint: 'https://tok2@kim.example.com/', actingAs: { username: KIM, delegate: PARENT } }]
+      };
+      const { loginBtn } = await button(null, stored);
+      utils.fetchPost = async () => { throw new Error('no auth request expected'); };
+      for (const probe of [async () => ({ error: { id: 'unexpected-error' } }), async () => { throw new Error('offline'); }]) {
+        loginBtn.auth._accessInfo = probe;
+        let failed = false;
+        try { await loginBtn.auth.switchTo(KIM); } catch (e) { failed = true; }
+        expect(failed).to.equal(true);
+        expect(loginBtn.auth.currentProfile().username).to.equal(PARENT);
+        expect(loginBtn.auth.profiles().find((p) => p.username === KIM).available).to.equal(true);
+      }
+      // a refused token does mark it
+      loginBtn.auth._accessInfo = async () => ({ error: { id: 'invalid-access-token' } });
+      stubAuthRequest({ response: { status: 403 }, body: { status: 'REFUSED' } });
+      await loginBtn.auth.switchTo(KIM);
+      await settle();
+      expect(loginBtn.auth.profiles().find((p) => p.username === KIM).available).to.equal(false);
+    });
+  });
+
   describe('[LBWX] Without spanButtonID', function () {
     it('[LBWA] init works without span (logs warning)', async function () {
       const settings = {

package/test/LoginMessages.test.js

@@ -45,4 +45,12 @@ describe('[MSGX] LoginMessages', function () {
     const msgs = Messages('fr', customDefs);
     expect(msgs.TEST).to.equal('English only');
   });
+
+  it('[MSGF] keys a service does not define keep their default text', function () {
+    // a service's message asset written before the account menu existed
+    const msgs = Messages('fr', { LOADING: { en: 'Loading...' } });
+    expect(msgs.LOADING).to.equal('Loading...');
+    expect(msgs.LOGOUT).to.equal('Se déconnecter');
+    expect(msgs.MANAGE_ACCOUNT).to.equal('Gérer mon compte');
+  });
 });