pryv 3.13.0 → 3.15.0

package/src/index.d.ts

@@ -160,7 +160,8 @@ declare module 'pryv' {
    */
   export class PryvError extends globalThis.Error {
     constructor(message: string, innerObject?: globalThis.Error | object);
-    name: 'PryvError';
+    /** `'PryvError'`, or the subclass name (`'MfaRequiredError'`, ...). */
+    name: string;
     innerObject?: globalThis.Error | object;
     id?: string;
     status?: number;
@@ -890,11 +891,20 @@ declare module 'pryv' {
       pollRateMs: number;
       /** Echoed only by a core that understood `authRequest.consent`. */
       consent?: AuthRequestConsentForm;
+      /** Echoed only by a core that understood `authRequest.cmcInvites`. */
+      cmcInvites?: AuthCmcInvite[];
     }>;
+    /**
+     * Poll an access request once, by its full poll URL (recommended) or its
+     * `key`. A key started in this process polls the poll URL the server issued
+     * for it (the core holding the request); an unknown key polls
+     * `access + key`, which may miss the request on a multi-core platform.
+     */
     pollAccessRequest(keyOrPollUrl: string): Promise<any>;
     /**
      * Resolve an auth-flow polling `key` (from {@link Service.startAccessRequest})
-     * into a working {@link Connection}. Polls the access request once; throws a
+     * into a working {@link Connection}. Polls the access request once (as
+     * {@link Service.pollAccessRequest} does with a key); throws a
      * {@link PryvError} unless the access is `ACCEPTED`.
      */
     connectFromKey(key: string): Promise<Connection>;
@@ -974,6 +984,35 @@ declare module 'pryv' {
     >;
   };
 
+  /**
+   * A cross-account messaging invite the user is asked to answer in the same
+   * authorisation request (`authRequest.cmcInvites`): the capability URL the
+   * app received, whether declining it refuses the whole request, and for
+   * which account it is accepted (`'target'`: the account the access is
+   * granted for, when the user acts for an account it manages).
+   */
+  export type AuthRequestCmcInvite = {
+    capabilityUrl: string;
+    mandatory?: boolean;
+    for?: 'self' | 'target';
+  };
+
+  /** An invite as the core echoes it back, with its defaults filled in. */
+  export type AuthCmcInvite = {
+    capabilityUrl: string;
+    mandatory: boolean;
+    for: 'self' | 'target';
+  };
+
+  /**
+   * What the auth page did with one invite, in the ACCEPTED body (one per
+   * invite, in order). A hint: the requester learns the truth from its inbox.
+   */
+  export type AuthCmcInviteOutcome =
+    | { acceptEventId: string; dataGrantAccessId?: string; acceptedFor?: 'self' }
+    | { declined: true }
+    | { reason: string };
+
   export type States =
     | 'ERROR'
     | 'LOADING'
@@ -1017,8 +1056,10 @@ declare module 'pryv' {
         defaultName: string;
       }>;
       consent?: AuthRequestConsentForm;
+      /** Present only when the request carried `cmcInvites` the core understood. */
+      cmcInvites?: AuthCmcInvite[];
       requestingAppId: string;
-      returnUrl?: string | null;
+      returnURL?: string | null;
       serviceInfo?: ServiceInfo;
     };
     ACCEPTED: {
@@ -1032,6 +1073,10 @@ declare module 'pryv' {
        * `connectFromKey`). Absent when the account comes from stored
        * credentials: page load, an account switch without sign-in, or the
        * return to the previous account after a switch that did not complete.
+       * Also absent on the return from a sign-in by redirection (`returnURL`,
+       * including `'auto#'` on a phone or tablet): that state carries
+       * `apiEndpoint` with its token instead. Handle both:
+       * `state.key ? connectFromKey(state.key) : new Connection(state.apiEndpoint)`.
        */
       key?: string;
       /** Display hint posted by the auth page for a grant on a controlled account; `accessInfo().delegation` is authoritative. */
@@ -1043,6 +1088,8 @@ declare module 'pryv' {
       profile?: AuthProfile;
       /** One-time credential hand-off key (shared-secret delivery), in place of `token`. */
       handoff?: { type: 'shared-secret'; key: string };
+      /** What the auth page did with each invite of the request (a hint). */
+      cmcInvites?: AuthCmcInviteOutcome[];
     };
     SIGNOUT: {};
     SWITCHING: {
@@ -1077,6 +1124,7 @@ declare module 'pryv' {
     requestingAppId: string;
     requestedPermissions: AuthRequestedPermission[];
     consent?: AuthRequestConsentForm;
+    cmcInvites?: AuthCmcInvite[];
     lang?: string;
     returnURL?: string;
     clientData?: KeyValue;
@@ -1099,7 +1147,6 @@ declare module 'pryv' {
   export type AuthSettings = {
     spanButtonID?: string;
     onStateChange?: (state: StateChange<States>) => void;
-    returnURL?: string;
     /**
      * Account menu shown when the signed-in button is clicked (default: on).
      * `false` restores the plain logout confirmation.
@@ -1114,7 +1161,29 @@ declare module 'pryv' {
       languageCode?: string;
       requestedPermissions: AuthRequestedPermission[];
       consent?: AuthRequestConsent;
-      returnUrl?: string | boolean;
+      /**
+       * Cross-account messaging invites the user answers in the same
+       * sign-in (1 to 8). The ACCEPTED state carries one outcome per invite;
+       * a declined mandatory invite ends the request REFUSED with
+       * `reasonId: 'REFUSED_MANDATORY_CONSENT'`. An older core ignores the field.
+       */
+      cmcInvites?: AuthRequestCmcInvite[];
+      /**
+       * Where the sign-in happens: `'auto#'` (default, also when unset or
+       * `false`) opens a popup on desktop and redirects on a phone or tablet;
+       * `'self#'` always redirects and comes back to the current page; a URL
+       * always redirects and comes back to that URL. Must end with `#`, `?`
+       * or `&`.
+       */
+      returnURL?: string | false;
+      /**
+       * Your own auth page for this request (query parameters allowed, e.g. a
+       * `username` hint or `backUrl` / `backLabel`). The platform honours it
+       * only when it matches one of its `access:trustedAuthUrls` entries and
+       * refuses the request otherwise; unset, the platform's default auth page
+       * is used.
+       */
+      authUrl?: string;
       referer?: string;
       clientData?: KeyValue;
       deviceName?: string;
@@ -1248,9 +1317,9 @@ declare module 'pryv' {
     stopAuthRequest(msg: string): void;
     handleClick(): Promise<void>;
     getReturnURL(
-      returnURL?: string,
+      returnURL?: string | false,
       windowLocationForTest?: string,
-      navigatorForTests?: string,
+      navigatorForTests?: string | Navigator,
     ): string | boolean;
     /** `overrides`: auth request fields for this request only; `previous`: state to return to if an account switch does not complete. */
     startAuthRequest(overrides?: Partial<AuthSettings['authRequest']>, previous?: AuthStatePayload): Promise<AuthRequestResponse>;

package/src/lib/MfaRequiredError.js

@@ -41,6 +41,8 @@ class MfaRequiredError extends PryvError {
     this.id = (apiErr && apiErr.id) || 'mfa-required';
     this.status = response && response.status;
     this.response = { body, status: response && response.status };
+    // Read by name, but not printed with the error (like `innerObject`).
+    Object.defineProperty(this, 'mfaToken', { enumerable: false });
 
     if (Error.captureStackTrace) {
       Error.captureStackTrace(this, MfaRequiredError);

package/src/lib/PryvError.js

@@ -35,6 +35,10 @@ class PryvError extends Error {
     this.status = undefined;
     /** @type {{ body: any, status: number }|undefined} Raw response */
     this.response = undefined;
+    // `innerObject` and `response` hold raw platform answers: still readable and
+    // writable, but not enumerable, so `console.log(err)` does not print them.
+    Object.defineProperty(this, 'innerObject', { enumerable: false });
+    Object.defineProperty(this, 'response', { enumerable: false });
 
     if (Error.captureStackTrace) {
       Error.captureStackTrace(this, PryvError);

package/src/lib/pollUrls.js

@@ -0,0 +1,71 @@
+/**
+ * @license
+ * [BSD-3-Clause](https://github.com/pryv/lib-js/blob/master/LICENSE)
+ */
+
+/**
+ * The poll URL the server issued for each auth request started in this
+ * process, by key.
+ *
+ * A pending auth request lives on the core that created it, and its poll URL
+ * points at that core. The service's `access` URL may reach any core of a
+ * multi-core platform, so polling `access + key` can land on a core that does
+ * not know the request. Polling by key therefore uses the server-issued URL
+ * when this process started the request, and falls back to `access + key`
+ * only for a key it never saw.
+ *
+ * Keys are long random server values, so one process-wide map (like the
+ * hand-off cache) serves every Service.
+ */
+
+/** Most entries kept (oldest dropped first), sized for a busy Node service. */
+const MAX_ENTRIES = 1000;
+/** How long an entry is kept: well beyond any auth request's lifetime. */
+const TTL_MS = 60 * 60 * 1000;
+
+/** key -> { pollUrl, expiresAt }, in insertion order */
+const pollUrls = new Map();
+
+/** Drop expired entries (called on every remember). */
+function sweep () {
+  const now = Date.now();
+  for (const [key, entry] of pollUrls) {
+    if (now > entry.expiresAt) pollUrls.delete(key);
+  }
+}
+
+/**
+ * Remember the poll URL of an auth request (ignored unless both look valid).
+ * @param {string} key
+ * @param {string} pollUrl
+ */
+function remember (key, pollUrl) {
+  if (typeof key !== 'string' || key === '' || typeof pollUrl !== 'string' || !/^https?:\/\//.test(pollUrl)) return;
+  sweep();
+  pollUrls.delete(key);
+  pollUrls.set(key, { pollUrl, expiresAt: Date.now() + TTL_MS });
+  while (pollUrls.size > MAX_ENTRIES) pollUrls.delete(pollUrls.keys().next().value);
+}
+
+/**
+ * The server-issued poll URL of `key`, or null when this process did not
+ * start that request (or it expired).
+ * @param {string} key
+ * @returns {string|null}
+ */
+function lookup (key) {
+  const entry = pollUrls.get(key);
+  if (entry == null) return null;
+  if (Date.now() > entry.expiresAt) {
+    pollUrls.delete(key);
+    return null;
+  }
+  return entry.pollUrl;
+}
+
+/** Forget every entry. */
+function clear () {
+  pollUrls.clear();
+}
+
+module.exports = { remember, lookup, clear, MAX_ENTRIES, TTL_MS };

package/src/utils.js

@@ -303,7 +303,13 @@ const utils = module.exports = {
     url.replace(QUERY_REGEXP,
       // @ts-ignore - replace callback is used for side effects
       function (m, key, value) {
-        vars[key] = decodeURIComponent(value);
+        // a malformed escape (`%` not followed by hex) is kept as is rather
+        // than throwing: any page URL reaches this parser
+        try {
+          vars[key] = decodeURIComponent(value);
+        } catch (e) {
+          vars[key] = value;
+        }
       });
     return vars;
   }

package/test/AuthController.test.js

@@ -7,6 +7,7 @@
 const AuthController = require('../src/Auth/AuthController');
 const AuthStates = require('../src/Auth/AuthStates');
 const Service = require('../src/Service');
+const PryvError = require('../src/lib/PryvError');
 
 describe('[ACNX] AuthController', function () {
   this.timeout(15000);
@@ -243,6 +244,55 @@ describe('[ACNX] AuthController', function () {
       expect(reloaded.accountUrl()).to.equal(profile('https://ui.example.com'));
     });
 
+    it('[ACAT] autologin skips a stored sign-in without a token (legacy and multi-account shapes)', async function () {
+      const cases = [
+        [{ username: 'u', apiEndpoint: 'https://u.example.com/' }, AuthStates.INITIALIZED],
+        [{ username: 'u', apiEndpoint: 'https://t@u.example.com/' }, AuthStates.AUTHORIZED],
+        [{ username: 'u', apiEndpoint: 'https://u.example.com/', profiles: [{ username: 'u', apiEndpoint: 'https://u.example.com/' }] }, AuthStates.INITIALIZED],
+        [{ username: 'u', apiEndpoint: 'https://t@u.example.com/', profiles: [{ username: 'u', apiEndpoint: 'https://t@u.example.com/' }] }, AuthStates.AUTHORIZED]
+      ];
+      for (const [stored, expected] of cases) {
+        const button = {
+          getAuthorizationData: () => stored,
+          onStateChange: async () => {},
+          onClick: () => {}
+        };
+        const auth = new AuthController({ authRequest: { requestingAppId: 'test-app', requestedPermissions: [] } }, service, button);
+        await auth.init();
+        expect(auth.state.status, JSON.stringify(stored)).to.equal(expected);
+      }
+    });
+
+    it('[ACAU] autologin forgets the stored sign-ins without a token and keeps the usable ones', async function () {
+      let saved = {
+        username: 'u',
+        apiEndpoint: 'https://t@u.example.com/',
+        profiles: [
+          { username: 'u', apiEndpoint: 'https://t@u.example.com/' },
+          { username: 'stale', apiEndpoint: 'https://stale.example.com/' }
+        ]
+      };
+      let deleted = 0;
+      const button = {
+        getAuthorizationData: () => saved,
+        saveAuthorizationData: (d) => { saved = d; },
+        deleteAuthorizationData: () => { deleted++; saved = null; },
+        onStateChange: async () => {},
+        onClick: () => {}
+      };
+      const auth = new AuthController({ authRequest: { requestingAppId: 'test-app', requestedPermissions: [] } }, service, button);
+      await auth.init();
+      expect(auth.state.status).to.equal(AuthStates.AUTHORIZED);
+      expect(saved.profiles.map((p) => p.username)).to.deep.equal(['u']);
+
+      // only token-less sign-ins stored: all forgotten, not signed in
+      saved = { username: 'stale', apiEndpoint: 'https://stale.example.com/' };
+      const auth2 = new AuthController({ authRequest: { requestingAppId: 'test-app', requestedPermissions: [] } }, service, button);
+      await auth2.init();
+      expect(auth2.state.status).to.equal(AuthStates.INITIALIZED);
+      expect(deleted).to.equal(1);
+    });
+
     it('[ACUE] a button with showMenu gets the click instead of SIGNOUT, unless it declines', async function () {
       for (const [answer, expectSignout] of [[true, false], [undefined, false], [false, true]]) {
         const states = [];
@@ -266,8 +316,8 @@ describe('[ACNX] AuthController', function () {
     });
   });
 
-  describe('[ACSX] stopAuthRequest', function () {
-    it('[ACSA] sets error state with message', async function () {
+  describe('[ASRX] stopAuthRequest', function () {
+    it('[ASRA] sets error state with message', async function () {
       const auth = new AuthController({
         authRequest: {
           requestingAppId: 'test-app',
@@ -283,8 +333,8 @@ describe('[ACNX] AuthController', function () {
     });
   });
 
-  describe('[ACRX] returnURL', function () {
-    it('[ACRA] throws on invalid returnURL trailer', function () {
+  describe('[ARUX] returnURL', function () {
+    it('[ARUA] throws on invalid returnURL trailer', function () {
       const auth = new AuthController({
         authRequest: {
           requestingAppId: 'test-app',
@@ -295,7 +345,7 @@ describe('[ACNX] AuthController', function () {
       expect(() => auth.getReturnURL('http://example.com')).to.throw('Last character');
     });
 
-    it('[ACRB] handles null/undefined returnURL', function () {
+    it('[ARUB] handles null/undefined returnURL', function () {
       const auth = new AuthController({
         authRequest: {
           requestingAppId: 'test-app',
@@ -307,6 +357,26 @@ describe('[ACNX] AuthController', function () {
       const result = auth.getReturnURL(undefined, 'http://test.com', { userAgent: 'Safari' });
       expect(result).to.equal(false);
     });
+
+    it('[ACNV] auto mode reads the browser navigator when no mock is given', function () {
+      const auth = new AuthController({
+        authRequest: {
+          requestingAppId: 'test-app',
+          requestedPermissions: []
+        }
+      }, service);
+      const saved = Object.getOwnPropertyDescriptor(globalThis, 'navigator');
+      const iPhone = 'Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 Mobile/15E148';
+      try {
+        Object.defineProperty(globalThis, 'navigator', { value: { userAgent: iPhone }, configurable: true, writable: true });
+        expect(auth.getReturnURL('auto#', 'http://test.com/app')).to.equal('http://test.com/app#');
+        Object.defineProperty(globalThis, 'navigator', { value: { userAgent: 'Safari' }, configurable: true, writable: true });
+        expect(auth.getReturnURL('auto#', 'http://test.com/app')).to.equal(false);
+      } finally {
+        if (saved) Object.defineProperty(globalThis, 'navigator', saved);
+        else delete globalThis.navigator;
+      }
+    });
   });
 
   describe('[AIST] State', function () {
@@ -474,4 +544,40 @@ describe('[ACNX] AuthController', function () {
       expect(auth.state.token).to.equal(undefined);
     });
   });
+
+  describe('[ACQX] a refused access request', function () {
+    let realFetch;
+
+    afterEach(function () {
+      if (realFetch) global.fetch = realFetch;
+      realFetch = null;
+    });
+
+    it('[ACQ1] the error carries the server message, id and status; the answer stays out of the message', async function () {
+      const SECRET = 'S3CRET-stream-id';
+      const body = { error: { id: 'invalid-parameters-format', message: 'The parameters are not valid.', data: { requestedPermissions: [{ streamId: SECRET }] } } };
+      realFetch = global.fetch;
+      global.fetch = async function () {
+        return { ok: false, status: 400, json: async () => body };
+      };
+      const auth = new AuthController({
+        authRequest: { requestingAppId: 'test-app', requestedPermissions: [{ streamId: SECRET, level: 'read' }] }
+      }, service);
+      auth.serviceInfo = { access: 'https://reg.test.local/access', register: 'https://reg.test.local/' };
+      let error = null;
+      try {
+        await auth.startAuthRequest();
+      } catch (e) {
+        error = e;
+      }
+      expect(error).to.be.instanceOf(PryvError);
+      expect(error.message).to.equal('The parameters are not valid.');
+      expect(error.message).to.not.include(SECRET);
+      expect(error.id).to.equal('invalid-parameters-format');
+      expect(error.status).to.equal(400);
+      expect(error.response.body).to.deep.equal(body);
+      expect(auth.state.status).to.equal(AuthStates.ERROR);
+      expect(auth.state.error).to.equal(error);
+    });
+  });
 });

package/test/Connection.apiOneError.test.js

@@ -0,0 +1,105 @@
+/**
+ * @license
+ * [BSD-3-Clause](https://github.com/pryv/lib-js/blob/master/LICENSE)
+ */
+/* global describe, it, expect, pryv */
+
+/**
+ * [CAEX] `apiOne()` errors never carry the call's params in their message.
+ *
+ * Params can hold passwords and tokens, and error messages end up in logs and
+ * on screen. The message names the method and the server's error; the full
+ * error (or result) stays on `innerObject`. `api()` is stubbed: no server.
+ */
+
+const SECRET = 'pa55-S3CRET-value';
+
+function connWithResult (result) {
+  const conn = new pryv.Connection('https://sometoken@alice.example.test/');
+  conn.api = async () => result;
+  return conn;
+}
+
+async function caught (promise) {
+  try {
+    await promise;
+  } catch (e) {
+    return e;
+  }
+  throw new Error('expected a rejection');
+}
+
+describe('[CAEX] apiOne() error message', function () {
+  it('[CAEA] an error answer: method and server error in the message, params left out', async () => {
+    const serverError = { id: 'invalid-credentials', message: 'The given username/password pair is invalid.' };
+    const conn = connWithResult([{ error: serverError }]);
+    const e = await caught(conn.apiOne('auth.login', { username: 'alice', password: SECRET }));
+    expect(e).to.be.instanceOf(pryv.PryvError);
+    expect(e.message).to.include('"auth.login"');
+    expect(e.message).to.include('invalid-credentials');
+    expect(e.message).to.include('The given username/password pair is invalid.');
+    expect(e.message).to.not.include(SECRET);
+    expect(e.message).to.not.include('alice');
+    expect(e.innerObject).to.equal(serverError);
+  });
+
+  it('[CAEB] expected key missing: named in the message, result data left out', async () => {
+    const result = [{ access: { token: SECRET } }];
+    const conn = connWithResult(result);
+    const e = await caught(conn.apiOne('accesses.create', { name: 'x', token: SECRET }, 'accessX'));
+    expect(e).to.be.instanceOf(pryv.PryvError);
+    expect(e.message).to.include('"accesses.create"');
+    expect(e.message).to.include('"accessX" missing in result');
+    expect(e.message).to.not.include(SECRET);
+    expect(e.innerObject).to.equal(result);
+  });
+
+  it('[CAEC] no result at all', async () => {
+    const conn = connWithResult([]);
+    const e = await caught(conn.apiOne('events.get', { token: SECRET }));
+    expect(e).to.be.instanceOf(pryv.PryvError);
+    expect(e.message).to.include('"events.get"');
+    expect(e.message).to.include('no result');
+    expect(e.message).to.not.include(SECRET);
+  });
+
+  it('[CAED] an error answer without id or message', async () => {
+    const serverError = {};
+    const conn = connWithResult([{ error: serverError }]);
+    const e = await caught(conn.apiOne('events.get', { token: SECRET }));
+    expect(e.message).to.include('"events.get"');
+    expect(e.message).to.include('error answer');
+    expect(e.message).to.not.include('undefined');
+    expect(e.innerObject).to.equal(serverError);
+  });
+});
+
+/**
+ * [CAEY] A batch answer that breaks the protocol: the answer rides on
+ * `innerObject`, never in the message (results can hold tokens).
+ */
+describe('[CAEY] api() protocol-violation errors', function () {
+  function connWithAnswer (answer) {
+    const conn = new pryv.Connection('https://sometoken@alice.example.test/');
+    conn.post = async () => answer;
+    return conn;
+  }
+
+  it('[CAEE] an answer without results', async () => {
+    const answer = { error: { id: 'x', message: 'y', data: { token: SECRET } } };
+    const e = await caught(connWithAnswer(answer).api([{ method: 'events.get', params: {} }]));
+    expect(e).to.be.instanceOf(pryv.PryvError);
+    expect(e.message).to.include('not an Array');
+    expect(e.message).to.not.include(SECRET);
+    expect(e.innerObject).to.equal(answer);
+  });
+
+  it('[CAEF] results that do not match the calls', async () => {
+    const answer = { results: [{ access: { token: SECRET } }, {}] };
+    const e = await caught(connWithAnswer(answer).api([{ method: 'accesses.create', params: {} }]));
+    expect(e).to.be.instanceOf(pryv.PryvError);
+    expect(e.message).to.include('does not match');
+    expect(e.message).to.not.include(SECRET);
+    expect(e.innerObject).to.equal(answer);
+  });
+});

package/test/LoginButton.test.js

@@ -273,7 +273,9 @@ describe('[LBTX] LoginButton', function () {
       loginBtn.saveAuthorizationData({ apiEndpoint: 'https://tok@menu-user.example.com/', username: 'menu-user' });
       loginBtn.showMenu();
       dialog().querySelector('.pryv-menu-logout').click();
-      await new Promise((resolve) => setTimeout(resolve, 50));
+      // the re-init after a logout is exposed as `pending`: wait for it, not
+      // for a fixed delay (a slow re-init was still LOADING after 50 ms)
+      await loginBtn.pending;
       expect(states.filter((s) => s === AuthStates.SIGNOUT)).to.have.lengthOf(1);
       expect(confirms).to.equal(0);
       expect(dialog()).to.equal(null);