pryv 3.7.1 → 3.8.0

package/README.md

@@ -651,7 +651,7 @@ There is a possibility that you would like to register the user in another page.
 
 You can find HTML examples in the [`./examples`](https://github.com/pryv/lib-js/blob/master/examples) directory. You can run them in two ways:
 
-1. With [backloop.dev](https://github.com/pryv/backloop.dev), which allows to run local code with a valid SSL certificate (you must have run `just build` beforehand):
+1. With [backloop.dev](https://backloop.dev), which allows to run local code with a valid SSL certificate (you must have run `just build` beforehand):
    ```
    just serve
    ```
@@ -702,7 +702,7 @@ just test <component> [...params]
 - Extra parameters at the end are passed on to [Mocha](https://mochajs.org/) (default settings are defined in `.mocharc.js` files)
 - Replace `test` with `test-debug`, `test-cover` for common presets
 
-By default, tests are run against [Pryv Lab](https://www.pryv.com/pryvlab/) with service information URL `https://reg.pryv.me/service/info`.
+By default, tests are run against Pryv Lab with service information URL `https://reg.pryv.me/service/info`.
 
 To run the tests against another Pryv.io platform, set the `TEST_PRYVLIB_SERVICEINFO_URL` environment variable; for example:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pryv",
-  "version": "3.7.1",
+  "version": "3.8.0",
   "description": "Pryv JavaScript library",
   "keywords": [
     "Pryv",
@@ -15,7 +15,7 @@
     "url": "git://github.com/pryv/lib-js.git"
   },
   "license": "BSD-3-Clause",
-  "author": "Pryv S.A. <info@pryv.com> (https://pryv.com)",
+  "author": "Pryv <info@pryv.com> (https://pryv.com)",
   "main": "src/index.js",
   "types": "src/index.d.ts",
   "dependencies": {},

package/src/Browser/LoginButton.js

@@ -112,7 +112,8 @@ class LoginButton {
     // this step should be applied only for the browser
     if (!utils.isBrowser()) return;
 
-    // 3. Check if there is a prYvkey as result of "out of page login"
+    // 3. Check if there is a pryvKey / pryvPoll (or legacy prYvkey /
+    //    prYvpoll) as result of "out of page login"
     const url = window.location.href;
     const pollUrl = retrievePollUrl(url);
     if (pollUrl !== null) {
@@ -126,21 +127,27 @@ class LoginButton {
           error: e
         };
       }
-      // The prYv* params are one-shot; leaving them in the visible URL
-      // puts stale auth state into bookmarks / copied links.
+      // These params are one-shot; leaving them in the visible URL puts
+      // stale auth state into bookmarks / copied links.
       if (window.history && typeof window.history.replaceState === 'function') {
         window.history.replaceState(null, '', utils.cleanURLFromPrYvParams(url));
       }
     }
 
     function retrievePollUrl (url) {
+      // Modern lowercase form (pryvKey / pryvPoll) is preferred; the
+      // capital-Y form (prYvkey / prYvpoll) is accepted for back-compat
+      // with apps emitting the legacy URL contract — see
+      // [DEPRECATED] notes on cleanURLFromPrYvParams.
       const params = utils.getQueryParamsFromURL(url);
       let pollUrl = null;
-      if (params.prYvkey) { // deprecated method - To be removed
-        pollUrl = authController.serviceInfo.access + params.prYvkey;
+      const key = params.pryvKey || params.prYvkey;
+      if (key) {
+        pollUrl = authController.serviceInfo.access + key;
       }
-      if (params.prYvpoll) {
-        pollUrl = params.prYvpoll;
+      const poll = params.pryvPoll || params.prYvpoll;
+      if (poll) {
+        pollUrl = poll;
       }
       return pollUrl;
     }

package/src/index.d.ts

@@ -1132,15 +1132,11 @@ declare module 'pryv' {
       setupAuth: SetupAuth;
       serviceInfoFromUrl: getServiceInfoFromURL;
     };
-    utils: {
-      isBrowser(): boolean;
-      extractTokenAndAPIEndpoint(apiEndpoint: string): TokenAndAPIEndpoint;
-      buildAPIEndpoint(tokenAndAPI: TokenAndAPIEndpoint): string;
-      decomposeAPIEndpoint(apiEndpoint: string, serviceInfoApi: string): DecomposedAPIEndpoint;
-      browserIsMobileOrTablet(navigator?: string | Navigator): boolean;
-      cleanURLFromPrYvParams(url: string): string;
-      getQueryParamsFromURL(url: string): KeyValue;
-    };
+    // Reference the named export's type — a duplicated inline shape here
+    // drifted from it once already (the deprecated aliases were missing),
+    // which broke structural typing for add-ons taking the default export
+    // (e.g. @pryv/socket.io's PryvLibrary).
+    utils: typeof utils;
     PryvError: typeof PryvError;
     MfaRequiredError: typeof MfaRequiredError;
     ERRORS: typeof ERRORS;

package/src/utils.js

@@ -215,14 +215,29 @@ const utils = module.exports = {
   },
 
   /**
-   * Remove Pryv-specific query parameters from URL
+   * Remove the one-shot Pryv auth-completion query parameters from a URL,
+   * keeping any long-lived `pryv*` params intact.
+   *
+   * Both casings are stripped:
+   *   - Modern lowercase: `pryvKey`, `pryvPoll`
+   *   - Legacy capital-Y: `prYv<anything>` (anything starting with `prYv`)
+   *
+   * `pryv*` params that are NOT in the modern allowlist (e.g.
+   * `pryvServiceInfoUrl`, `pryvApiEndpoint`) are intentionally preserved —
+   * they are not one-shot.
+   *
    * @memberof pryv.utils
    * @param {string} url - URL to clean
-   * @returns {string} URL without prYv* parameters
+   * @returns {string} URL without the one-shot auth-completion params
    */
   cleanURLFromPrYvParams: function (url) {
-    const PRYV_REGEXP = /[?#&]+prYv([^=&]+)=([^&]*)/g;
-    return url.replace(PRYV_REGEXP, '');
+    // Legacy form: kept for back-compat with apps still emitting
+    // `prYv<anything>=...` (notably app-web-auth3's close_or_redirect).
+    const LEGACY = /[?#&]+prYv([^=&]+)=([^&]*)/g;
+    // Modern form: an explicit allowlist of one-shot params so we never
+    // wipe long-lived camelCase `pryv*` params by accident.
+    const MODERN = /[?#&]+(pryvKey|pryvPoll)=([^&]*)/g;
+    return url.replace(LEGACY, '').replace(MODERN, '');
   },
 
   /**

package/test/utils.test.js

@@ -104,6 +104,36 @@ describe('[UTLX] utils', function () {
     expect(err.name).to.equal('StaleAccessIdError');
   });
 
+  describe('[UTLN] cleanURLFromPrYvParams', function () {
+    it('[UTLNA] strips legacy capital-Y prYv* params', function () {
+      const out = pryv.utils.cleanURLFromPrYvParams(
+        'http://example.com/page?keep=1&prYvkey=abc&prYvpoll=http%3A%2F%2Fpoll&prYvstatus=ACCEPTED'
+      );
+      expect(out).to.equal('http://example.com/page?keep=1');
+    });
+    it('[UTLNB] strips modern lowercase one-shot params (pryvKey, pryvPoll)', function () {
+      const out = pryv.utils.cleanURLFromPrYvParams(
+        'http://example.com/page?keep=1&pryvKey=abc&pryvPoll=http%3A%2F%2Fpoll'
+      );
+      expect(out).to.equal('http://example.com/page?keep=1');
+    });
+    it('[UTLNC] PRESERVES long-lived modern params (pryvServiceInfoUrl, pryvApiEndpoint)', function () {
+      const out = pryv.utils.cleanURLFromPrYvParams(
+        'http://example.com/page?pryvServiceInfoUrl=https%3A%2F%2Freg.pryv.me%2Fservice%2Finfo&pryvApiEndpoint=https%3A%2F%2Fuser.pryv.me%2F&pryvKey=abc'
+      );
+      // pryvKey is stripped (one-shot), the other two stay (long-lived).
+      expect(out).to.contain('pryvServiceInfoUrl=');
+      expect(out).to.contain('pryvApiEndpoint=');
+      expect(out).not.to.contain('pryvKey=');
+    });
+    it('[UTLND] strips both forms in a single URL', function () {
+      const out = pryv.utils.cleanURLFromPrYvParams(
+        'http://example.com/page?keep=1&prYvkey=legacy&pryvKey=modern&prYvpoll=oldpoll&pryvPoll=newpoll'
+      );
+      expect(out).to.equal('http://example.com/page?keep=1');
+    });
+  });
+
   describe('[UTLM] decomposeAPIEndpoint', function () {
     it('[UTLMA] subdomain template — host strips the {username}. prefix', function () {
       const r = pryv.utils.decomposeAPIEndpoint(