pryv 3.12.1 → 3.14.2

package/src/utils.js

@@ -303,7 +303,13 @@ const utils = module.exports = {
     url.replace(QUERY_REGEXP,
       // @ts-ignore - replace callback is used for side effects
       function (m, key, value) {
-        vars[key] = decodeURIComponent(value);
+        // a malformed escape (`%` not followed by hex) is kept as is rather
+        // than throwing: any page URL reaches this parser
+        try {
+          vars[key] = decodeURIComponent(value);
+        } catch (e) {
+          vars[key] = value;
+        }
       });
     return vars;
   }

package/test/AuthController.test.js

@@ -7,6 +7,7 @@
 const AuthController = require('../src/Auth/AuthController');
 const AuthStates = require('../src/Auth/AuthStates');
 const Service = require('../src/Service');
+const PryvError = require('../src/lib/PryvError');
 
 describe('[ACNX] AuthController', function () {
   this.timeout(15000);
@@ -59,6 +60,20 @@ describe('[ACNX] AuthController', function () {
         authRequest: { requestingAppId: 'test-app' }
       }, service)).to.throw('Missing settings.authRequest.requestedPermissions');
     });
+
+    it('[ACVE] defaults the request to shared-secret credential hand-off', function () {
+      const settings = { authRequest: { requestingAppId: 'test-app', requestedPermissions: [] } };
+      // eslint-disable-next-line no-new
+      new AuthController(settings, service);
+      expect(settings.authRequest.credentialHandoff).to.equal('shared-secret');
+    });
+
+    it('[ACVF] credentialHandoff:\'inline\' opts out and sends no field', function () {
+      const settings = { authRequest: { requestingAppId: 'test-app', requestedPermissions: [], credentialHandoff: 'inline' } };
+      // eslint-disable-next-line no-new
+      new AuthController(settings, service);
+      expect(settings.authRequest).to.not.have.property('credentialHandoff');
+    });
   });
 
   describe('[ACLX] Listeners', function () {
@@ -133,8 +148,176 @@ describe('[ACNX] AuthController', function () {
     });
   });
 
-  describe('[ACSX] stopAuthRequest', function () {
-    it('[ACSA] sets error state with message', async function () {
+  describe('[ACUX] account app URL and signOut', function () {
+    function controller (extraSettings) {
+      return new AuthController(Object.assign({
+        authRequest: { requestingAppId: 'test-app', requestedPermissions: [] }
+      }, extraSettings), service);
+    }
+    const profile = (base) => base + '/account/profile?pryvServiceInfoUrl=' + encodeURIComponent(testData.serviceInfoUrl);
+
+    it('[ACUA] resolves settings.accountUrl, then the service account, then the auth page URL', async function () {
+      const auth = controller({ accountUrl: 'https://own.example.com/' });
+      await auth.init();
+      auth.serviceInfo = Object.assign({}, auth.serviceInfo, { account: 'https://account.example.com' });
+      auth._authUrl = 'https://ui.example.com/auth?key=abc';
+      expect(auth.accountUrl()).to.equal(profile('https://own.example.com'));
+      delete auth.settings.accountUrl;
+      expect(auth.accountUrl()).to.equal(profile('https://account.example.com'));
+      delete auth.serviceInfo.account;
+      expect(auth.accountUrl()).to.equal(profile('https://ui.example.com'));
+    });
+
+    it('[ACUB] is null when nothing names the account app', async function () {
+      const auth = controller();
+      await auth.init();
+      auth.serviceInfo = Object.assign({}, auth.serviceInfo);
+      delete auth.serviceInfo.account;
+      expect(auth.accountUrl()).to.equal(null);
+      for (const authUrl of ['https://ui.example.com/access/login?key=x', 'not a url', 'https://ui.example.com/authorize']) {
+        auth._authUrl = authUrl;
+        expect(auth.accountUrl(), authUrl).to.equal(null);
+      }
+    });
+
+    it('[ACUC] openAccountApp opens the profile page in a new tab without an opener', async function () {
+      const auth = controller({ accountUrl: 'https://own.example.com' });
+      await auth.init();
+      const opened = [];
+      const original = window.open;
+      window.open = (...args) => { opened.push(args); return null; };
+      try {
+        expect(auth.openAccountApp()).to.equal(profile('https://own.example.com'));
+      } finally { window.open = original; }
+      expect(opened).to.deep.equal([[profile('https://own.example.com'), '_blank', 'noopener']]);
+    });
+
+    it('[ACUD] signOut emits SIGNOUT once, clears the stored credentials and re-initializes', async function () {
+      const states = [];
+      let deleted = 0;
+      const button = {
+        getAuthorizationData: () => null,
+        deleteAuthorizationData: async () => { deleted++; },
+        onStateChange: async () => {},
+        onClick: () => {}
+      };
+      const auth = new AuthController({
+        authRequest: { requestingAppId: 'test-app', requestedPermissions: [] },
+        onStateChange: (s) => states.push(s.status)
+      }, service, button);
+      await auth.init();
+      auth._state = { status: AuthStates.AUTHORIZED, username: 'u' };
+      states.length = 0;
+      await auth.signOut();
+      expect(states.filter((s) => s === AuthStates.SIGNOUT)).to.have.lengthOf(1);
+      expect(deleted).to.equal(1);
+      expect(auth.state.status).to.equal(AuthStates.INITIALIZED);
+    });
+
+    it('[ACUF] the auth page URL of a sign-in locates the account app, and survives a reload', async function () {
+      const utils = require('../src/utils');
+      const { fetchPost, fetchGet } = utils;
+      utils.fetchPost = async () => ({ response: { ok: true }, body: { status: AuthStates.NEED_SIGNIN, key: 'k1', poll: 'https://core.example.com/reg/access/k1', poll_rate_ms: 1, authUrl: 'https://ui.example.com/auth?key=k1' } });
+      utils.fetchGet = async () => ({ response: { status: 200 }, body: { status: AuthStates.AUTHORIZED, username: 'u', token: 't', apiEndpoint: 'https://t@u.example.com/' } });
+      let saved = null;
+      const button = {
+        getAuthorizationData: () => saved,
+        saveAuthorizationData: (d) => { saved = d; },
+        onStateChange: async (state) => {
+          if (state.status === AuthStates.AUTHORIZED) saved = { apiEndpoint: state.apiEndpoint, username: state.username, authUrl: auth._authUrl };
+        },
+        onClick: () => {}
+      };
+      const auth = new AuthController({ authRequest: { requestingAppId: 'test-app', requestedPermissions: [] } }, service, button);
+      try {
+        await auth.init();
+        auth.serviceInfo = Object.assign({}, auth.serviceInfo, { account: undefined });
+        await auth.startAuthRequest();
+      } finally { utils.fetchPost = fetchPost; utils.fetchGet = fetchGet; }
+      expect(auth.accountUrl()).to.equal(profile('https://ui.example.com'));
+
+      // a new page load: only the stored data is known
+      const reloaded = new AuthController({ authRequest: { requestingAppId: 'test-app', requestedPermissions: [] } }, service, button);
+      await reloaded.init();
+      reloaded.serviceInfo = Object.assign({}, reloaded.serviceInfo, { account: undefined });
+      expect(reloaded.state.status).to.equal(AuthStates.AUTHORIZED);
+      expect(reloaded.accountUrl()).to.equal(profile('https://ui.example.com'));
+    });
+
+    it('[ACAT] autologin skips a stored sign-in without a token (legacy and multi-account shapes)', async function () {
+      const cases = [
+        [{ username: 'u', apiEndpoint: 'https://u.example.com/' }, AuthStates.INITIALIZED],
+        [{ username: 'u', apiEndpoint: 'https://t@u.example.com/' }, AuthStates.AUTHORIZED],
+        [{ username: 'u', apiEndpoint: 'https://u.example.com/', profiles: [{ username: 'u', apiEndpoint: 'https://u.example.com/' }] }, AuthStates.INITIALIZED],
+        [{ username: 'u', apiEndpoint: 'https://t@u.example.com/', profiles: [{ username: 'u', apiEndpoint: 'https://t@u.example.com/' }] }, AuthStates.AUTHORIZED]
+      ];
+      for (const [stored, expected] of cases) {
+        const button = {
+          getAuthorizationData: () => stored,
+          onStateChange: async () => {},
+          onClick: () => {}
+        };
+        const auth = new AuthController({ authRequest: { requestingAppId: 'test-app', requestedPermissions: [] } }, service, button);
+        await auth.init();
+        expect(auth.state.status, JSON.stringify(stored)).to.equal(expected);
+      }
+    });
+
+    it('[ACAU] autologin forgets the stored sign-ins without a token and keeps the usable ones', async function () {
+      let saved = {
+        username: 'u',
+        apiEndpoint: 'https://t@u.example.com/',
+        profiles: [
+          { username: 'u', apiEndpoint: 'https://t@u.example.com/' },
+          { username: 'stale', apiEndpoint: 'https://stale.example.com/' }
+        ]
+      };
+      let deleted = 0;
+      const button = {
+        getAuthorizationData: () => saved,
+        saveAuthorizationData: (d) => { saved = d; },
+        deleteAuthorizationData: () => { deleted++; saved = null; },
+        onStateChange: async () => {},
+        onClick: () => {}
+      };
+      const auth = new AuthController({ authRequest: { requestingAppId: 'test-app', requestedPermissions: [] } }, service, button);
+      await auth.init();
+      expect(auth.state.status).to.equal(AuthStates.AUTHORIZED);
+      expect(saved.profiles.map((p) => p.username)).to.deep.equal(['u']);
+
+      // only token-less sign-ins stored: all forgotten, not signed in
+      saved = { username: 'stale', apiEndpoint: 'https://stale.example.com/' };
+      const auth2 = new AuthController({ authRequest: { requestingAppId: 'test-app', requestedPermissions: [] } }, service, button);
+      await auth2.init();
+      expect(auth2.state.status).to.equal(AuthStates.INITIALIZED);
+      expect(deleted).to.equal(1);
+    });
+
+    it('[ACUE] a button with showMenu gets the click instead of SIGNOUT, unless it declines', async function () {
+      for (const [answer, expectSignout] of [[true, false], [undefined, false], [false, true]]) {
+        const states = [];
+        let menus = 0;
+        const button = {
+          getAuthorizationData: () => null,
+          onStateChange: async () => {},
+          onClick: () => {},
+          showMenu: () => { menus++; return answer; }
+        };
+        const auth = new AuthController({
+          authRequest: { requestingAppId: 'test-app', requestedPermissions: [] },
+          onStateChange: (s) => states.push(s.status)
+        }, service, button);
+        await auth.init();
+        auth._state = { status: AuthStates.AUTHORIZED };
+        await auth.handleClick();
+        expect(menus).to.equal(1);
+        expect(states.includes(AuthStates.SIGNOUT), 'showMenu returned ' + answer).to.equal(expectSignout);
+      }
+    });
+  });
+
+  describe('[ASRX] stopAuthRequest', function () {
+    it('[ASRA] sets error state with message', async function () {
       const auth = new AuthController({
         authRequest: {
           requestingAppId: 'test-app',
@@ -150,8 +333,8 @@ describe('[ACNX] AuthController', function () {
     });
   });
 
-  describe('[ACRX] returnURL', function () {
-    it('[ACRA] throws on invalid returnURL trailer', function () {
+  describe('[ARUX] returnURL', function () {
+    it('[ARUA] throws on invalid returnURL trailer', function () {
       const auth = new AuthController({
         authRequest: {
           requestingAppId: 'test-app',
@@ -162,7 +345,7 @@ describe('[ACNX] AuthController', function () {
       expect(() => auth.getReturnURL('http://example.com')).to.throw('Last character');
     });
 
-    it('[ACRB] handles null/undefined returnURL', function () {
+    it('[ARUB] handles null/undefined returnURL', function () {
       const auth = new AuthController({
         authRequest: {
           requestingAppId: 'test-app',
@@ -174,6 +357,26 @@ describe('[ACNX] AuthController', function () {
       const result = auth.getReturnURL(undefined, 'http://test.com', { userAgent: 'Safari' });
       expect(result).to.equal(false);
     });
+
+    it('[ACNV] auto mode reads the browser navigator when no mock is given', function () {
+      const auth = new AuthController({
+        authRequest: {
+          requestingAppId: 'test-app',
+          requestedPermissions: []
+        }
+      }, service);
+      const saved = Object.getOwnPropertyDescriptor(globalThis, 'navigator');
+      const iPhone = 'Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 Mobile/15E148';
+      try {
+        Object.defineProperty(globalThis, 'navigator', { value: { userAgent: iPhone }, configurable: true, writable: true });
+        expect(auth.getReturnURL('auto#', 'http://test.com/app')).to.equal('http://test.com/app#');
+        Object.defineProperty(globalThis, 'navigator', { value: { userAgent: 'Safari' }, configurable: true, writable: true });
+        expect(auth.getReturnURL('auto#', 'http://test.com/app')).to.equal(false);
+      } finally {
+        if (saved) Object.defineProperty(globalThis, 'navigator', saved);
+        else delete globalThis.navigator;
+      }
+    });
   });
 
   describe('[AIST] State', function () {
@@ -264,4 +467,117 @@ describe('[ACNX] AuthController', function () {
       expect(last.message).to.equal('boom');
     });
   });
+
+  describe('[ACGX] credential hand-off polling', function () {
+    let realFetch;
+    let handoffKeyCounter = 0;
+
+    /** Stub the whole flow: access POST -> NEED_SIGNIN, poll GET -> pollBody,
+     *  shared-secrets/retrieve -> retrieveResponse. */
+    function stubFlow (pollBody, retrieveResponse) {
+      realFetch = global.fetch;
+      global.fetch = async function (url, options) {
+        const u = String(url);
+        if (u.includes('shared-secrets/retrieve')) {
+          return {
+            ok: retrieveResponse.ok !== false,
+            status: retrieveResponse.status || 200,
+            json: async () => retrieveResponse.body
+          };
+        }
+        if (options && options.method === 'POST' && u.includes('/access')) {
+          return {
+            ok: true,
+            status: 201,
+            json: async () => ({
+              status: 'NEED_SIGNIN',
+              key: 'ho-key-' + (++handoffKeyCounter),
+              poll: 'https://reg.test.local/access/pk' + handoffKeyCounter,
+              poll_rate_ms: 5
+            })
+          };
+        }
+        if (u.includes('/access/')) { // the poll GET
+          return { ok: true, status: 200, json: async () => pollBody };
+        }
+        return { ok: true, status: 200, json: async () => ({}) };
+      };
+    }
+
+    afterEach(function () {
+      if (realFetch) global.fetch = realFetch;
+      realFetch = null;
+    });
+
+    function makeAuth () {
+      const auth = new AuthController({
+        authRequest: { requestingAppId: 'test-app', requestedPermissions: [] }
+      }, service);
+      // Skip init() (asset loading): set the service info the flow needs.
+      auth.serviceInfo = { access: 'https://reg.test.local/access', register: 'https://reg.test.local/' };
+      return auth;
+    }
+
+    it('[ACGA] redeems a hand-off ACCEPTED body and rewrites the internal state to the legacy shape (token, no handoff)', async function () {
+      stubFlow(
+        { status: 'ACCEPTED', username: 'eve', apiEndpoint: 'https://eve.test.local/', handoff: { type: 'shared-secret', key: 'evt.' + 'e'.repeat(40) } },
+        { body: { secret: { username: 'eve', token: 'tok-eve', apiEndpoint: 'https://eve.test.local/' } } }
+      );
+      const auth = makeAuth();
+      await auth.startAuthRequest();
+      expect(auth.state.status).to.equal(AuthStates.AUTHORIZED);
+      expect(auth.state.token).to.equal('tok-eve');
+      expect(auth.state.apiEndpoint).to.contain('tok-eve@');
+      expect(auth.state.apiEndpoint).to.contain('eve.test.local');
+      // The one-time key must not survive into the state the cookie/listener see.
+      expect(auth.state.handoff).to.equal(undefined);
+    });
+
+    it('[ACGB] a failed hand-off retrieve puts the controller in ERROR, not a broken AUTHORIZED', async function () {
+      stubFlow(
+        { status: 'ACCEPTED', username: 'frank', apiEndpoint: 'https://frank.test.local/', handoff: { type: 'shared-secret', key: 'evt.' + 'f'.repeat(40) } },
+        { ok: false, status: 403, body: { error: { id: 'forbidden', message: 'used', data: { id: 'shared-secret-unavailable' } } } }
+      );
+      const auth = makeAuth();
+      await auth.startAuthRequest();
+      expect(auth.state.status).to.equal(AuthStates.ERROR);
+      expect(auth.state.token).to.equal(undefined);
+    });
+  });
+
+  describe('[ACQX] a refused access request', function () {
+    let realFetch;
+
+    afterEach(function () {
+      if (realFetch) global.fetch = realFetch;
+      realFetch = null;
+    });
+
+    it('[ACQ1] the error carries the server message, id and status; the answer stays out of the message', async function () {
+      const SECRET = 'S3CRET-stream-id';
+      const body = { error: { id: 'invalid-parameters-format', message: 'The parameters are not valid.', data: { requestedPermissions: [{ streamId: SECRET }] } } };
+      realFetch = global.fetch;
+      global.fetch = async function () {
+        return { ok: false, status: 400, json: async () => body };
+      };
+      const auth = new AuthController({
+        authRequest: { requestingAppId: 'test-app', requestedPermissions: [{ streamId: SECRET, level: 'read' }] }
+      }, service);
+      auth.serviceInfo = { access: 'https://reg.test.local/access', register: 'https://reg.test.local/' };
+      let error = null;
+      try {
+        await auth.startAuthRequest();
+      } catch (e) {
+        error = e;
+      }
+      expect(error).to.be.instanceOf(PryvError);
+      expect(error.message).to.equal('The parameters are not valid.');
+      expect(error.message).to.not.include(SECRET);
+      expect(error.id).to.equal('invalid-parameters-format');
+      expect(error.status).to.equal(400);
+      expect(error.response.body).to.deep.equal(body);
+      expect(auth.state.status).to.equal(AuthStates.ERROR);
+      expect(auth.state.error).to.equal(error);
+    });
+  });
 });

package/test/Connection.apiOneError.test.js

@@ -0,0 +1,105 @@
+/**
+ * @license
+ * [BSD-3-Clause](https://github.com/pryv/lib-js/blob/master/LICENSE)
+ */
+/* global describe, it, expect, pryv */
+
+/**
+ * [CAEX] `apiOne()` errors never carry the call's params in their message.
+ *
+ * Params can hold passwords and tokens, and error messages end up in logs and
+ * on screen. The message names the method and the server's error; the full
+ * error (or result) stays on `innerObject`. `api()` is stubbed: no server.
+ */
+
+const SECRET = 'pa55-S3CRET-value';
+
+function connWithResult (result) {
+  const conn = new pryv.Connection('https://sometoken@alice.example.test/');
+  conn.api = async () => result;
+  return conn;
+}
+
+async function caught (promise) {
+  try {
+    await promise;
+  } catch (e) {
+    return e;
+  }
+  throw new Error('expected a rejection');
+}
+
+describe('[CAEX] apiOne() error message', function () {
+  it('[CAEA] an error answer: method and server error in the message, params left out', async () => {
+    const serverError = { id: 'invalid-credentials', message: 'The given username/password pair is invalid.' };
+    const conn = connWithResult([{ error: serverError }]);
+    const e = await caught(conn.apiOne('auth.login', { username: 'alice', password: SECRET }));
+    expect(e).to.be.instanceOf(pryv.PryvError);
+    expect(e.message).to.include('"auth.login"');
+    expect(e.message).to.include('invalid-credentials');
+    expect(e.message).to.include('The given username/password pair is invalid.');
+    expect(e.message).to.not.include(SECRET);
+    expect(e.message).to.not.include('alice');
+    expect(e.innerObject).to.equal(serverError);
+  });
+
+  it('[CAEB] expected key missing: named in the message, result data left out', async () => {
+    const result = [{ access: { token: SECRET } }];
+    const conn = connWithResult(result);
+    const e = await caught(conn.apiOne('accesses.create', { name: 'x', token: SECRET }, 'accessX'));
+    expect(e).to.be.instanceOf(pryv.PryvError);
+    expect(e.message).to.include('"accesses.create"');
+    expect(e.message).to.include('"accessX" missing in result');
+    expect(e.message).to.not.include(SECRET);
+    expect(e.innerObject).to.equal(result);
+  });
+
+  it('[CAEC] no result at all', async () => {
+    const conn = connWithResult([]);
+    const e = await caught(conn.apiOne('events.get', { token: SECRET }));
+    expect(e).to.be.instanceOf(pryv.PryvError);
+    expect(e.message).to.include('"events.get"');
+    expect(e.message).to.include('no result');
+    expect(e.message).to.not.include(SECRET);
+  });
+
+  it('[CAED] an error answer without id or message', async () => {
+    const serverError = {};
+    const conn = connWithResult([{ error: serverError }]);
+    const e = await caught(conn.apiOne('events.get', { token: SECRET }));
+    expect(e.message).to.include('"events.get"');
+    expect(e.message).to.include('error answer');
+    expect(e.message).to.not.include('undefined');
+    expect(e.innerObject).to.equal(serverError);
+  });
+});
+
+/**
+ * [CAEY] A batch answer that breaks the protocol: the answer rides on
+ * `innerObject`, never in the message (results can hold tokens).
+ */
+describe('[CAEY] api() protocol-violation errors', function () {
+  function connWithAnswer (answer) {
+    const conn = new pryv.Connection('https://sometoken@alice.example.test/');
+    conn.post = async () => answer;
+    return conn;
+  }
+
+  it('[CAEE] an answer without results', async () => {
+    const answer = { error: { id: 'x', message: 'y', data: { token: SECRET } } };
+    const e = await caught(connWithAnswer(answer).api([{ method: 'events.get', params: {} }]));
+    expect(e).to.be.instanceOf(pryv.PryvError);
+    expect(e.message).to.include('not an Array');
+    expect(e.message).to.not.include(SECRET);
+    expect(e.innerObject).to.equal(answer);
+  });
+
+  it('[CAEF] results that do not match the calls', async () => {
+    const answer = { results: [{ access: { token: SECRET } }, {}] };
+    const e = await caught(connWithAnswer(answer).api([{ method: 'accesses.create', params: {} }]));
+    expect(e).to.be.instanceOf(pryv.PryvError);
+    expect(e.message).to.include('does not match');
+    expect(e.message).to.not.include(SECRET);
+    expect(e.innerObject).to.equal(answer);
+  });
+});