pryv 3.13.0 → 3.14.2

package/src/lib/pollUrls.js

@@ -0,0 +1,71 @@
+/**
+ * @license
+ * [BSD-3-Clause](https://github.com/pryv/lib-js/blob/master/LICENSE)
+ */
+
+/**
+ * The poll URL the server issued for each auth request started in this
+ * process, by key.
+ *
+ * A pending auth request lives on the core that created it, and its poll URL
+ * points at that core. The service's `access` URL may reach any core of a
+ * multi-core platform, so polling `access + key` can land on a core that does
+ * not know the request. Polling by key therefore uses the server-issued URL
+ * when this process started the request, and falls back to `access + key`
+ * only for a key it never saw.
+ *
+ * Keys are long random server values, so one process-wide map (like the
+ * hand-off cache) serves every Service.
+ */
+
+/** Most entries kept (oldest dropped first), sized for a busy Node service. */
+const MAX_ENTRIES = 1000;
+/** How long an entry is kept: well beyond any auth request's lifetime. */
+const TTL_MS = 60 * 60 * 1000;
+
+/** key -> { pollUrl, expiresAt }, in insertion order */
+const pollUrls = new Map();
+
+/** Drop expired entries (called on every remember). */
+function sweep () {
+  const now = Date.now();
+  for (const [key, entry] of pollUrls) {
+    if (now > entry.expiresAt) pollUrls.delete(key);
+  }
+}
+
+/**
+ * Remember the poll URL of an auth request (ignored unless both look valid).
+ * @param {string} key
+ * @param {string} pollUrl
+ */
+function remember (key, pollUrl) {
+  if (typeof key !== 'string' || key === '' || typeof pollUrl !== 'string' || !/^https?:\/\//.test(pollUrl)) return;
+  sweep();
+  pollUrls.delete(key);
+  pollUrls.set(key, { pollUrl, expiresAt: Date.now() + TTL_MS });
+  while (pollUrls.size > MAX_ENTRIES) pollUrls.delete(pollUrls.keys().next().value);
+}
+
+/**
+ * The server-issued poll URL of `key`, or null when this process did not
+ * start that request (or it expired).
+ * @param {string} key
+ * @returns {string|null}
+ */
+function lookup (key) {
+  const entry = pollUrls.get(key);
+  if (entry == null) return null;
+  if (Date.now() > entry.expiresAt) {
+    pollUrls.delete(key);
+    return null;
+  }
+  return entry.pollUrl;
+}
+
+/** Forget every entry. */
+function clear () {
+  pollUrls.clear();
+}
+
+module.exports = { remember, lookup, clear, MAX_ENTRIES, TTL_MS };

package/src/utils.js

@@ -303,7 +303,13 @@ const utils = module.exports = {
     url.replace(QUERY_REGEXP,
       // @ts-ignore - replace callback is used for side effects
       function (m, key, value) {
-        vars[key] = decodeURIComponent(value);
+        // a malformed escape (`%` not followed by hex) is kept as is rather
+        // than throwing: any page URL reaches this parser
+        try {
+          vars[key] = decodeURIComponent(value);
+        } catch (e) {
+          vars[key] = value;
+        }
       });
     return vars;
   }

package/test/AuthController.test.js

@@ -7,6 +7,7 @@
 const AuthController = require('../src/Auth/AuthController');
 const AuthStates = require('../src/Auth/AuthStates');
 const Service = require('../src/Service');
+const PryvError = require('../src/lib/PryvError');
 
 describe('[ACNX] AuthController', function () {
   this.timeout(15000);
@@ -243,6 +244,55 @@ describe('[ACNX] AuthController', function () {
       expect(reloaded.accountUrl()).to.equal(profile('https://ui.example.com'));
     });
 
+    it('[ACAT] autologin skips a stored sign-in without a token (legacy and multi-account shapes)', async function () {
+      const cases = [
+        [{ username: 'u', apiEndpoint: 'https://u.example.com/' }, AuthStates.INITIALIZED],
+        [{ username: 'u', apiEndpoint: 'https://t@u.example.com/' }, AuthStates.AUTHORIZED],
+        [{ username: 'u', apiEndpoint: 'https://u.example.com/', profiles: [{ username: 'u', apiEndpoint: 'https://u.example.com/' }] }, AuthStates.INITIALIZED],
+        [{ username: 'u', apiEndpoint: 'https://t@u.example.com/', profiles: [{ username: 'u', apiEndpoint: 'https://t@u.example.com/' }] }, AuthStates.AUTHORIZED]
+      ];
+      for (const [stored, expected] of cases) {
+        const button = {
+          getAuthorizationData: () => stored,
+          onStateChange: async () => {},
+          onClick: () => {}
+        };
+        const auth = new AuthController({ authRequest: { requestingAppId: 'test-app', requestedPermissions: [] } }, service, button);
+        await auth.init();
+        expect(auth.state.status, JSON.stringify(stored)).to.equal(expected);
+      }
+    });
+
+    it('[ACAU] autologin forgets the stored sign-ins without a token and keeps the usable ones', async function () {
+      let saved = {
+        username: 'u',
+        apiEndpoint: 'https://t@u.example.com/',
+        profiles: [
+          { username: 'u', apiEndpoint: 'https://t@u.example.com/' },
+          { username: 'stale', apiEndpoint: 'https://stale.example.com/' }
+        ]
+      };
+      let deleted = 0;
+      const button = {
+        getAuthorizationData: () => saved,
+        saveAuthorizationData: (d) => { saved = d; },
+        deleteAuthorizationData: () => { deleted++; saved = null; },
+        onStateChange: async () => {},
+        onClick: () => {}
+      };
+      const auth = new AuthController({ authRequest: { requestingAppId: 'test-app', requestedPermissions: [] } }, service, button);
+      await auth.init();
+      expect(auth.state.status).to.equal(AuthStates.AUTHORIZED);
+      expect(saved.profiles.map((p) => p.username)).to.deep.equal(['u']);
+
+      // only token-less sign-ins stored: all forgotten, not signed in
+      saved = { username: 'stale', apiEndpoint: 'https://stale.example.com/' };
+      const auth2 = new AuthController({ authRequest: { requestingAppId: 'test-app', requestedPermissions: [] } }, service, button);
+      await auth2.init();
+      expect(auth2.state.status).to.equal(AuthStates.INITIALIZED);
+      expect(deleted).to.equal(1);
+    });
+
     it('[ACUE] a button with showMenu gets the click instead of SIGNOUT, unless it declines', async function () {
       for (const [answer, expectSignout] of [[true, false], [undefined, false], [false, true]]) {
         const states = [];
@@ -266,8 +316,8 @@ describe('[ACNX] AuthController', function () {
     });
   });
 
-  describe('[ACSX] stopAuthRequest', function () {
-    it('[ACSA] sets error state with message', async function () {
+  describe('[ASRX] stopAuthRequest', function () {
+    it('[ASRA] sets error state with message', async function () {
       const auth = new AuthController({
         authRequest: {
           requestingAppId: 'test-app',
@@ -283,8 +333,8 @@ describe('[ACNX] AuthController', function () {
     });
   });
 
-  describe('[ACRX] returnURL', function () {
-    it('[ACRA] throws on invalid returnURL trailer', function () {
+  describe('[ARUX] returnURL', function () {
+    it('[ARUA] throws on invalid returnURL trailer', function () {
       const auth = new AuthController({
         authRequest: {
           requestingAppId: 'test-app',
@@ -295,7 +345,7 @@ describe('[ACNX] AuthController', function () {
       expect(() => auth.getReturnURL('http://example.com')).to.throw('Last character');
     });
 
-    it('[ACRB] handles null/undefined returnURL', function () {
+    it('[ARUB] handles null/undefined returnURL', function () {
       const auth = new AuthController({
         authRequest: {
           requestingAppId: 'test-app',
@@ -307,6 +357,26 @@ describe('[ACNX] AuthController', function () {
       const result = auth.getReturnURL(undefined, 'http://test.com', { userAgent: 'Safari' });
       expect(result).to.equal(false);
     });
+
+    it('[ACNV] auto mode reads the browser navigator when no mock is given', function () {
+      const auth = new AuthController({
+        authRequest: {
+          requestingAppId: 'test-app',
+          requestedPermissions: []
+        }
+      }, service);
+      const saved = Object.getOwnPropertyDescriptor(globalThis, 'navigator');
+      const iPhone = 'Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 Mobile/15E148';
+      try {
+        Object.defineProperty(globalThis, 'navigator', { value: { userAgent: iPhone }, configurable: true, writable: true });
+        expect(auth.getReturnURL('auto#', 'http://test.com/app')).to.equal('http://test.com/app#');
+        Object.defineProperty(globalThis, 'navigator', { value: { userAgent: 'Safari' }, configurable: true, writable: true });
+        expect(auth.getReturnURL('auto#', 'http://test.com/app')).to.equal(false);
+      } finally {
+        if (saved) Object.defineProperty(globalThis, 'navigator', saved);
+        else delete globalThis.navigator;
+      }
+    });
   });
 
   describe('[AIST] State', function () {
@@ -474,4 +544,40 @@ describe('[ACNX] AuthController', function () {
       expect(auth.state.token).to.equal(undefined);
     });
   });
+
+  describe('[ACQX] a refused access request', function () {
+    let realFetch;
+
+    afterEach(function () {
+      if (realFetch) global.fetch = realFetch;
+      realFetch = null;
+    });
+
+    it('[ACQ1] the error carries the server message, id and status; the answer stays out of the message', async function () {
+      const SECRET = 'S3CRET-stream-id';
+      const body = { error: { id: 'invalid-parameters-format', message: 'The parameters are not valid.', data: { requestedPermissions: [{ streamId: SECRET }] } } };
+      realFetch = global.fetch;
+      global.fetch = async function () {
+        return { ok: false, status: 400, json: async () => body };
+      };
+      const auth = new AuthController({
+        authRequest: { requestingAppId: 'test-app', requestedPermissions: [{ streamId: SECRET, level: 'read' }] }
+      }, service);
+      auth.serviceInfo = { access: 'https://reg.test.local/access', register: 'https://reg.test.local/' };
+      let error = null;
+      try {
+        await auth.startAuthRequest();
+      } catch (e) {
+        error = e;
+      }
+      expect(error).to.be.instanceOf(PryvError);
+      expect(error.message).to.equal('The parameters are not valid.');
+      expect(error.message).to.not.include(SECRET);
+      expect(error.id).to.equal('invalid-parameters-format');
+      expect(error.status).to.equal(400);
+      expect(error.response.body).to.deep.equal(body);
+      expect(auth.state.status).to.equal(AuthStates.ERROR);
+      expect(auth.state.error).to.equal(error);
+    });
+  });
 });

package/test/Connection.apiOneError.test.js

@@ -0,0 +1,105 @@
+/**
+ * @license
+ * [BSD-3-Clause](https://github.com/pryv/lib-js/blob/master/LICENSE)
+ */
+/* global describe, it, expect, pryv */
+
+/**
+ * [CAEX] `apiOne()` errors never carry the call's params in their message.
+ *
+ * Params can hold passwords and tokens, and error messages end up in logs and
+ * on screen. The message names the method and the server's error; the full
+ * error (or result) stays on `innerObject`. `api()` is stubbed: no server.
+ */
+
+const SECRET = 'pa55-S3CRET-value';
+
+function connWithResult (result) {
+  const conn = new pryv.Connection('https://sometoken@alice.example.test/');
+  conn.api = async () => result;
+  return conn;
+}
+
+async function caught (promise) {
+  try {
+    await promise;
+  } catch (e) {
+    return e;
+  }
+  throw new Error('expected a rejection');
+}
+
+describe('[CAEX] apiOne() error message', function () {
+  it('[CAEA] an error answer: method and server error in the message, params left out', async () => {
+    const serverError = { id: 'invalid-credentials', message: 'The given username/password pair is invalid.' };
+    const conn = connWithResult([{ error: serverError }]);
+    const e = await caught(conn.apiOne('auth.login', { username: 'alice', password: SECRET }));
+    expect(e).to.be.instanceOf(pryv.PryvError);
+    expect(e.message).to.include('"auth.login"');
+    expect(e.message).to.include('invalid-credentials');
+    expect(e.message).to.include('The given username/password pair is invalid.');
+    expect(e.message).to.not.include(SECRET);
+    expect(e.message).to.not.include('alice');
+    expect(e.innerObject).to.equal(serverError);
+  });
+
+  it('[CAEB] expected key missing: named in the message, result data left out', async () => {
+    const result = [{ access: { token: SECRET } }];
+    const conn = connWithResult(result);
+    const e = await caught(conn.apiOne('accesses.create', { name: 'x', token: SECRET }, 'accessX'));
+    expect(e).to.be.instanceOf(pryv.PryvError);
+    expect(e.message).to.include('"accesses.create"');
+    expect(e.message).to.include('"accessX" missing in result');
+    expect(e.message).to.not.include(SECRET);
+    expect(e.innerObject).to.equal(result);
+  });
+
+  it('[CAEC] no result at all', async () => {
+    const conn = connWithResult([]);
+    const e = await caught(conn.apiOne('events.get', { token: SECRET }));
+    expect(e).to.be.instanceOf(pryv.PryvError);
+    expect(e.message).to.include('"events.get"');
+    expect(e.message).to.include('no result');
+    expect(e.message).to.not.include(SECRET);
+  });
+
+  it('[CAED] an error answer without id or message', async () => {
+    const serverError = {};
+    const conn = connWithResult([{ error: serverError }]);
+    const e = await caught(conn.apiOne('events.get', { token: SECRET }));
+    expect(e.message).to.include('"events.get"');
+    expect(e.message).to.include('error answer');
+    expect(e.message).to.not.include('undefined');
+    expect(e.innerObject).to.equal(serverError);
+  });
+});
+
+/**
+ * [CAEY] A batch answer that breaks the protocol: the answer rides on
+ * `innerObject`, never in the message (results can hold tokens).
+ */
+describe('[CAEY] api() protocol-violation errors', function () {
+  function connWithAnswer (answer) {
+    const conn = new pryv.Connection('https://sometoken@alice.example.test/');
+    conn.post = async () => answer;
+    return conn;
+  }
+
+  it('[CAEE] an answer without results', async () => {
+    const answer = { error: { id: 'x', message: 'y', data: { token: SECRET } } };
+    const e = await caught(connWithAnswer(answer).api([{ method: 'events.get', params: {} }]));
+    expect(e).to.be.instanceOf(pryv.PryvError);
+    expect(e.message).to.include('not an Array');
+    expect(e.message).to.not.include(SECRET);
+    expect(e.innerObject).to.equal(answer);
+  });
+
+  it('[CAEF] results that do not match the calls', async () => {
+    const answer = { results: [{ access: { token: SECRET } }, {}] };
+    const e = await caught(connWithAnswer(answer).api([{ method: 'accesses.create', params: {} }]));
+    expect(e).to.be.instanceOf(pryv.PryvError);
+    expect(e.message).to.include('does not match');
+    expect(e.message).to.not.include(SECRET);
+    expect(e.innerObject).to.equal(answer);
+  });
+});

package/test/LoginButton.test.js

@@ -273,7 +273,9 @@ describe('[LBTX] LoginButton', function () {
       loginBtn.saveAuthorizationData({ apiEndpoint: 'https://tok@menu-user.example.com/', username: 'menu-user' });
       loginBtn.showMenu();
       dialog().querySelector('.pryv-menu-logout').click();
-      await new Promise((resolve) => setTimeout(resolve, 50));
+      // the re-init after a logout is exposed as `pending`: wait for it, not
+      // for a fixed delay (a slow re-init was still LOADING after 50 ms)
+      await loginBtn.pending;
       expect(states.filter((s) => s === AuthStates.SIGNOUT)).to.have.lengthOf(1);
       expect(confirms).to.equal(0);
       expect(dialog()).to.equal(null);