walnut.js/lib/com.daplie.walnut.current/daplie-scripts/therapy-session.js

908 lines
27 KiB
JavaScript
Raw Permalink Normal View History

(function (exports) {
'use strict';
var TherapySession;
var Oauth3 = (exports.OAUTH3 || require('./oauth3'));
//
// Pure convenience / utility funcs
//
function createSession() {
return { logins: [], accounts: [] };
}
function removeItem(array, item) {
var i = array.indexOf(item);
if (-1 !== i) {
array.splice(i, 1);
}
}
var TLogins = {};
var TAccounts = {};
var InternalApi;
var api;
function create(opts) {
var myInstance = {};
var conf = {
session: createSession()
, sessionKey: opts.namespace + '.' + opts.sessionKey // 'session'
, cache: opts.cache
, config: opts.config
, usernameMinLength: opts.usernameMinLength
, secretMinLength: opts.secretMinLength
};
Object.keys(TherapySession.api).forEach(function (key) {
myInstance[key] = function () {
var args = Array.prototype.slice.call(arguments);
args.unshift(conf);
return TherapySession.api[key].apply(null, args);
};
});
myInstance.getId = TherapySession.getId;
myInstance.openAuthorizationDialog = function () {
// TODO guarantee that this happens assignment happens before initialization?
return (opts.invokeLogin || opts.config.invokeLogin).apply(null, arguments);
};
myInstance.usernameMinLength = opts.usernameMinLength;
myInstance.secretMinLength = opts.secretMinLength;
myInstance.api = api;
myInstance._conf = conf;
return myInstance;
}
// TODO track and compare granted scopes locally
function save(conf, updates) {
// TODO make sure session.logins[0] is most recent
api.updateSession(conf, updates.login, updates.accounts);
// TODO should this be done by the LocalApiStorage?
// TODO how to have different accounts selected in different tabs?
localStorage.setItem(conf.sessionKey, JSON.stringify(conf.session));
return Oauth3.PromiseA.resolve(conf.session);
}
function restore(conf) {
// Being very careful not to trigger a false onLogin or onLogout via $watch
var storedSession;
if (conf.session.token) {
return api.sanityCheckAccounts(conf);
// return Oauth3.PromiseA.resolve(conf.session);
}
storedSession = JSON.parse(localStorage.getItem(conf.sessionKey) || null) || createSession();
if (storedSession.token) {
conf.session = storedSession;
return api.sanityCheckAccounts(conf);
//return Oauth3.PromiseA.resolve(conf.session);
} else {
return Oauth3.PromiseA.reject(new Error("No Session"));
}
}
function destroy(conf) {
conf.session = createSession();
localStorage.removeItem(conf.sessionKey);
return conf.cache.destroy(conf).then(function (session) {
return session;
});
}
function accounts(conf, login) {
return Oauth3.request({
url: conf.config.apiBaseUri + conf.config.apiPrefix + '/accounts'
, method: 'GET'
, headers: { 'Authorization': 'Bearer ' + login.token }
}).then(function (resp) {
var accounts = resp.data && (resp.data.accounts || resp.data.result || resp.data.results)
|| resp.data || { error: { message: "Unknown Error when retrieving accounts" } }
;
if (accounts.error) {
console.error("[ERROR] couldn't fetch accounts", accounts);
return Oauth3.PromiseA.reject(new Error("Could not verify login:" + accounts.error.message));
}
if (!Array.isArray(accounts)) {
console.error("[Uknown ERROR] couldn't fetch accounts, no proper error", accounts);
// TODO destroy(conf);
return Oauth3.PromiseA.reject(new Error("could not verify login")); // destroy(conf);
}
return accounts;
});
}
// TODO move to LocalApiLogin?
function testLoginAccounts(conf, login) {
// TODO cache this also, but with a shorter shelf life?
return TherapySession.api.accounts(conf, login).then(function (accounts) {
return { login: login, accounts: accounts };
}, function (err) {
console.error("[Error] couldn't get accounts (might not be linked)");
console.warn(err);
return { login: login, accounts: [] };
});
}
function logout(conf) {
console.log('DEBUG logout', conf);
return Oauth3.logout(conf.config.providerUri, {}).then(function () {
console.log('DEBUG Oauth3.logout');
return destroy(conf);
}, function () {
return destroy(conf);
});
}
function backgroundLogin(conf, opts) {
opts = opts || {};
opts.background = true;
return TherapySession.api.login(conf, opts);
}
function login(conf, opts) {
console.log('##### DEBUG TherapySession');
console.log(conf);
console.log(opts);
// this should work first party and third party
var promise;
var providerUri = (opts && opts.providerUri) || conf.config.providerUri;
opts = opts || {};
//opts.redirectUri = conf.config.appUri + '/oauth3.html';
// TODO note that this must be called on a click event
// otherwise the browser will block the popup
function forceLogin() {
opts.appId = opts.appId || conf.config.appId;
opts.clientUri = opts.clientUri || conf.config.clientUri;
opts.clientAgreeTos = opts.clientAgreeTos || conf.config.clientAgreeTos;
var username = opts.username;
// TODO why is login modifying the opts?
return Oauth3.login(providerUri, opts).then(function (params) {
return TLogins.getLoginFromTokenParams(conf, providerUri, username, params).then(function (login) {
return testLoginAccounts(conf, login).then(function (updates) {
return save(conf, updates);
});
});
});
}
if (!opts.force) {
promise = restore(conf, opts.scope);
} else {
promise = Oauth3.PromiseA.reject();
}
// TODO check for scope in session
return promise.then(function (session) {
if (!session.appScopedId || opts && opts.force) {
return forceLogin();
}
var promise = Oauth3.PromiseA.resolve();
// TODO check expirey
session.logins.forEach(function (login) {
promise = promise.then(function () {
return testLoginAccounts(conf, login).then(function (updates) {
return save(conf, updates);
});
});
});
return promise;
}, forceLogin).then(function (session) {
// testLoginAccounts().then(save);
return session;
});
}
function requireSession(conf, opts) {
var promise = Oauth3.PromiseA.resolve(opts);
// TODO create middleware stack
return promise.then(function () {
return TLogins.requireLogin(conf, opts);
}).then(function () {
return TAccounts.requireAccount(conf, opts);
});
// .then(selectAccount).then(verifyAccount)
}
function onLogin(conf, _scope, fn) {
// This is better than using a promise.notify
// because the watches will unwatch when the controller is destroyed
_scope.__stsessionshared__ = conf;
_scope.$watch('__stsessionshared__.session', function (newValue, oldValue) {
if (newValue.accountId && oldValue.accountId !== newValue.accountId) {
fn(conf.session);
}
}, true);
}
function onLogout(conf, _scope, fn) {
_scope.__stsessionshared__ = conf;
_scope.$watch('__stsessionshared__.session', function (newValue, oldValue) {
if (!newValue.accountId && oldValue.accountId) {
fn(null);
}
}, true);
}
function getToken(conf, accountId) {
var session = conf.session;
var logins = [];
var login;
accountId = TAccounts.getId(accountId) || accountId;
// search logins first because we know we're actually
// logged in with said login, y'know?
session.logins.forEach(function (login) {
login.accounts.forEach(function (account) {
if (TAccounts.getId(account) === accountId) {
logins.push(login);
}
});
});
login = logins.sort(function (a, b) {
// b - a // most recent first
return (new Date(b.expiresAt).value || 0) - (new Date(a.expiresAt).value || 0);
})[0];
return login && login.token;
}
// this should be done at every login
// even an existing login may gain new accounts
function addAccountsToSession(conf, login, accounts) {
var now = Date.now();
login.accounts = accounts.map(function (account) {
account.addedAt = account.addedAt || now;
return {
id: TAccounts.getId(account)
, addedAt: now
};
});
accounts.forEach(function (newAccount) {
if (!conf.session.accounts.some(function (other, i) {
if (TAccounts.getId(other) === TAccounts.getId(newAccount)) {
conf.session.accounts[i] = newAccount;
return true;
}
})) {
conf.session.accounts.push(newAccount);
}
});
conf.session.accounts.sort(function (a, b) {
return b.addedAt - a.addedAt;
});
}
// this should be done on login and logout
// an old login may have lost or gained accounts
function pruneAccountsFromSession(conf) {
var session = conf.session;
var accounts = session.accounts.slice(0);
// remember, you can't modify an array while it's in-loop
// well, you can... but it would be bad!
accounts.forEach(function (account) {
if (!session.logins.some(function (login) {
return login.accounts.some(function (a) {
return TAccounts.getId(a) === TAccounts.getId(account);
});
})) {
removeItem(session.accounts, account);
}
});
}
function refreshCurrentAccount(conf) {
var session = conf.session;
// select a default session
if (1 === session.accounts.length) {
session.accountId = TAccounts.getId(session.accounts[0]);
session.id = session.accountId;
session.appScopedId = session.accountId;
session.token = session.accountId && api.getToken(conf, session.accountId) || null;
session.userVerifiedAt = session.accounts[0].userVerifiedAt;
return;
}
if (!session.logins.some(function (account) {
if (session.accountId === TAccounts.getId(account)) {
session.accountId = TAccounts.getId(account);
session.id = session.accountId;
session.appScopedId = session.accountId;
session.token = session.accountId && api.getToken(conf, session.accountId) || null;
session.userVerifiedAt = account.userVerifiedAt;
}
})) {
session.accountId = null;
session.id = null;
session.appScopedId = null;
session.token = null;
session.userVerifiedAt = null;
}
}
function updateSession(conf, login, accounts) {
var session = conf.session;
login.addedAt = login.addedAt || Date.now();
// sanity check login
if (0 === accounts.length) {
login.selectedAccountId = null;
}
else if (1 === accounts.length) {
login.selectedAccountId = TAccounts.getId(accounts[0]);
}
else if (accounts.length >= 1) {
login.selectedAccountId = null;
}
else {
throw new Error("[SANITY CHECK FAILED] bad account length'");
}
api.addAccountsToSession(conf, login, accounts);
// update login if it exists
// (or add it if it doesn't)
if (!session.logins.some(function (other, i) {
if ((login.loginId && other.loginId === login.loginId) || (other.token === login.token)) {
session.logins[i] = login;
return true;
}
})) {
session.logins.push(login);
}
api.pruneAccountsFromSession(conf);
api.refreshCurrentAccount(conf);
session.logins.sort(function (a, b) {
return b.addedAt - a.addedAt;
});
}
function sanityCheckAccounts(conf) {
var promise;
var session = conf.session;
// XXX this is just a bugfix for previously deployed code
// it probably only affects about 10 users and can be deleted
// at some point in the future (or left as a sanity check)
if (session.accounts.every(function (account) {
if (account.appScopedId) {
return true;
}
})) {
return Oauth3.PromiseA.resolve(session);
}
promise = Oauth3.PromiseA.resolve();
session.logins.forEach(function (login) {
promise = promise.then(function () {
return testLoginAccounts(conf, login).then(function (updates) {
return save(conf, updates);
});
});
});
return promise.then(function (session) {
return session;
}, function () {
// this is just bad news...
return conf.cache.destroy(conf).then(function () {
window.alert("Sorry, but an error occurred which can only be fixed by logging you out"
+ " and refreshing the page.\n\nThis will happen automatically.\n\nIf you get this"
+ " message even after the page refreshes, please contact support@betopool.com."
);
window.location.reload();
return Oauth3.PromiseA.reject(new Error("A session error occured. You must log out and log back in."));
});
});
}
// TODO is this more logins or accounts or session? session?
function handleOrphanLogins(conf) {
var promise;
var session = conf.session;
promise = Oauth3.PromiseA.resolve();
if (session.logins.some(function (login) {
return !login.accounts.length;
})) {
if (session.accounts.length > 1) {
throw new Error("[Not Implemented] can't yet attach new social logins when more than one local account is in the session."
+ " Please logout and sign back in with your Local Account only. Then attach the other login.");
}
session.logins.forEach(function (login) {
if (!login.accounts.length) {
promise = promise.then(function () {
return TAccounts.attachLoginToAccount(conf, session.accounts[0], login);
});
}
});
}
return promise.then(function () {
return session;
});
}
TLogins.getLoginFromTokenParams = function (conf, providerUri, username, params) {
var err;
var accessToken;
var refreshToken;
var expiresAt;
var match;
var data;
var login;
var now = Date.now();
if (!params) {
err = new Error("[Developer Error] No params were passed to the token parser");
err.code = 'E_DEV_ERROR';
err.uri = 'https://oauth3.org/docs/errors/#E_DEV_ERROR';
return Oauth3.PromiseA.reject(err);
}
console.log('[DEBUG] params', params);
accessToken = (params.oauth3_token || params.oauth3Token || params.jwt || params.access_token || params.accessToken || params.token);
refreshToken = (params.oauth3Refresh || params.oauth3_refresh || params.jwt_refresh || params.refresh_token || params.refreshToken);
if (!accessToken) {
if (!(params.error || params.error_description)) {
err = new Error("[Server Error] The server did not grant access nor give an error message");
err.code = "E_SERVER_ERROR";
err.uri = params.error_uri || '';
return Oauth3.PromiseA.reject(err);
}
err = new Error(params.error_description || ": invalid username or secret");
err.code = params.error || "_access_denied";
err.uri = params.error_uri || '';
return Oauth3.PromiseA.reject(err);
}
// JWT <<base64>>.<<base64>>.<<base64>>
// pass yada.yada.yada
// fail yada yada.yada
// fail y?da.yada.yada
match = accessToken.match(/^[A-Za-z0-9+=_\/\-]+\.([A-Za-z0-9+=_\/\-]+)\.[A-Za-z0-9+=_\/\-]+$/);
if (match) {
try {
data = JSON.parse(atob(match[1]));
} catch(e) {
data = {};
}
} else {
data = {};
}
// TODO support fewer expiry methods
expiresAt = [
params.expires_at, params.expiresAt, params.expires_in, params.expiresIn, params.expires, data.exp
].map(function (exp) {
exp = parseInt(exp, 10) || 0;
var year = 365 * 24 * 60 * 60 * 1000;
var min = now - (1 * year);
var max = now + (2 * year);
// date of expiration, already in ms
if (exp > min && exp < max) {
return exp;
}
// date of expiration in seconds
if (exp > (min / 1000) && exp < (max / 1000)) {
return exp * 1000;
}
// time remaining in seconds
if (exp > 1 && exp < (2 * year)) {
return now + (exp * 1000);
}
}).filter(function (exp) {
return exp;
})[0] || (Date.now() + 1 * 60 * 60 * 1000);
// TODO drop prefixes everywhere
providerUri = providerUri.replace(/^(https?:\/\/)?(www\.)?/, '');
login = {
token: accessToken
, refreshToken: refreshToken
, expiresAt: expiresAt
, appScopedId: params.app_scoped_id || params.appScopedId
|| data.idx || data.usr || username
|| null
, loginId: params.loginId || params.login_id
|| data.id || data.usr
, accountId: params.accountId || params.account_id
|| data.acx || data.acc
// TODO app_name in oauth3.json "AJ on Facebook"
, comment: data.sub || data.com ||
(
(username && (username + ' via ') || '')
+ (providerUri)
)
, loginType: ('password' === data.grt || username) ? 'localaccount' : null
, providerUri: providerUri
};
return Oauth3.PromiseA.resolve(login);
};
TLogins.requireLogin = function (conf, opts) {
return restore(conf).then(function (session) {
return session;
}, function (/*err*/) {
return conf.config.invokeLogin(opts);
});
};
TLogins.create = function (conf, username, type, secret, kdf, mfa) {
// secret is optional (for server-side requirement checking)
// kdf is mandatory (
return Oauth3.request({
url: conf.config.apiBaseUri + '/api'
+ '/org.oauth3.provider'
+ '/logins/'
, method: 'POST'
, data: {
id: username
, type: type
, secret: secret
, kdf: kdf
, mfa: mfa
}
});
};
TLogins.softTestUsername = function (conf, username) {
if ('string' !== typeof username) {
throw new Error("[Developer Error] username should be a string");
}
/*
if (!/^[0-9a-z\.\-_]+$/i.test(username)) {
// TODO validate this is true on the server
return new Error("Only alphanumeric characters, '-', '_', and '.' are allowed in usernames.");
}
*/
if (!/^[^@]+@[^\.]+\.[^\.]+$/i.test(username)) {
// TODO validate this is true on the server
return new Error("You must use an email address.");
}
if (username.length < conf.usernameMinLength) {
// TODO validate this is true on the server
return new Error('Username too short. Use at least '
+ conf.usernameMinLength + ' characters.');
}
return true;
};
TLogins.getMeta = function (conf, username) {
// TODO support username as type
var type = null;
// TODO update backend to /api/promoonlyonline/username/:username?
return Oauth3.request({
url: conf.config.apiBaseUri + '/api'
+ '/org.oauth3.provider'
+ '/logins/meta/' + type + '/' + username
, method: 'GET'
}).then(function (resp) {
if (!resp.data.kdf) {
return Oauth3.PromiseA.reject(new Error("metadata for username does not exist"));
}
return resp.data;
}, function (err) {
if (/does not exist/.test(err.message)) {
return Oauth3.PromiseA.reject(err);
}
throw err;
});
};
TLogins.meta = function (conf, username, type) {
// TODO support username as type
// TODO update backend to /api/promoonlyonline/username/:username?
return Oauth3.request({
url: conf.config.apiBaseUri + '/api'
+ '/org.oauth3.provider'
+ '/logins/meta/' + type + '/' + username
, method: 'GET'
}).then(function (resp) {
// TODO better check
if (!resp.data.salt) {
return Oauth3.PromiseA.reject(new Error("data for username does not exist"));
}
return resp.data;
}, function (err) {
if (/does not exist/.test(err.message)) {
return Oauth3.PromiseA.reject(err);
}
throw err;
});
};
TLogins.hardTestUsername = function (conf, username) {
// TODO support username as type
var type = null;
// TODO update backend to /api/promoonlyonline/username/:username?
return Oauth3.request({
url: conf.config.apiBaseUri + '/api'
+ '/org.oauth3.provider'
+ '/logins/check/' + type + '/' + username
, method: 'GET'
}).then(function (result) {
if (!result.data.exists) {
return Oauth3.PromiseA.reject(new Error("username does not exist"));
}
}, function (err) {
if (/does not exist/.test(err.message)) {
return Oauth3.PromiseA.reject(err);
}
throw err;
});
};
TAccounts.getId = function (o, p) {
// object
if (!o) {
return null;
}
// prefix
if (!p) {
return o.appScopedId || o.app_scoped_id || o.id || null;
} else {
return o[p + 'AppScopedId'] || o[p + '_app_scoped_id'] || o[p + 'Id'] || o[p + '_id'] || null;
}
};
TAccounts.realCreateAccount = function (conf, login) {
return Oauth3.request({
url: conf.config.apiBaseUri + '/api'
+ '/org.oauth3.provider'
+ '/accounts'
, method: 'POST'
, data: { account: {}
, logins: [{
// TODO make appScopedIds even for root app
id: login.appScopedId || login.app_scoped_id || login.loginId || login.login_id || login.id
, token: login.token || login.accessToken || login.accessToken
}]
}
, headers: {
Authorization: 'Bearer ' + login.token
}
}).then(function (resp) {
return resp.data;
}, function (err) {
return Oauth3.PromiseA.reject(err);
});
};
// TODO move to LocalApiLogin ?
TAccounts.attachLoginToAccount = function (conf, account, newLogin) {
var url = conf.config.apiBaseUri + '/api'
+ '/org.oauth3.provider'
+ '/accounts/' + account.appScopedId + '/logins';
var token = TherapySession.api.getToken(conf, account);
return Oauth3.request({
url: url
, method: 'POST'
, data: { logins: [{
id: newLogin.appScopedId || newLogin.app_scoped_id || newLogin.loginId || newLogin.login_id || newLogin.id
, token: newLogin.token || newLogin.accessToken || newLogin.access_token
}] }
, headers: { 'Authorization': 'Bearer ' + token }
}).then(function (resp) {
if (!resp.data) {
return Oauth3.PromiseA.reject(new Error("no response when linking login to account"));
}
if (resp.data.error) {
return Oauth3.PromiseA.reject(resp.data.error);
}
// return nothing
}, function (err) {
console.error('[Error] failed to attach login to account');
console.warn(err.message);
console.warn(err.stack);
return Oauth3.PromiseA.reject(err);
});
};
TAccounts.requireAccountHelper = function (conf) {
var session = conf.session;
var promise;
var locallogins;
var err;
if (session.accounts.length) {
return Oauth3.PromiseA.resolve(session);
}
if (!session.logins.length) {
console.error("doesn't have any logins");
return Oauth3.PromiseA.reject(new Error("[Developer Error] do not call requireAccount when you have not called requireLogin."));
}
locallogins = session.logins.filter(function (login) {
return 'localaccount' === login.loginType;
});
if (!locallogins.length) {
console.error("no local accounts");
err = new Error("Login with your Local Account at least once before linking other accounts.");
err.code = "E_NO_LOCAL_ACCOUNT";
return Oauth3.PromiseA.reject(err);
}
// at this point we have a valid locallogin, but still no localaccount
promise = Oauth3.PromiseA.resolve();
locallogins.forEach(function (login) {
promise = promise.then(function () {
return TAccounts.realCreateAccount(conf, login).then(function (account) {
login.accounts.push(account);
return save(conf, { login: login, accounts: login.accounts });
});
});
});
return promise.then(function (session) {
return session;
});
};
TAccounts.requireAccount = function (conf) {
return TAccounts.requireAccountHelper(conf).then(function () {
return api.handleOrphanLogins(conf);
});
};
// TODO move to LocalApiAccount ?
TAccounts.cloneAccount = function (conf, account) {
// retrieve the most fresh token of all associated logins
var token = TherapySession.api.getToken(conf, account);
var id = TAccounts.getId(account);
// We don't want to modify the original object and end up
// with potentially whole stakes in the local storage session key
account = JSON.parse(JSON.stringify(account));
account.token = token;
account.accountId = account.accountId || account.appScopedId || id;
account.appScopedId = account.appScopedId || id;
return account;
};
// TODO check for account and account create if not exists in requireSession
// TODO move to LocalApiAccount ?
TAccounts.selectAccount = function (conf, accountId) {
var session = conf.session;
// needs to return the account with a valid login
var account;
if (!accountId) {
accountId = session.accountId;
}
if (!session.accounts.some(function (a) {
if (!accountId || accountId === TAccounts.getId(a)) {
account = a;
return true;
}
})) {
account = session.accounts[0];
}
if (!account) {
console.error("Developer Error: require session before selecting an account");
console.error(session);
throw new Error("Developer Error: require session before selecting an account");
}
account = TAccounts.cloneAccount(conf, account);
session.accountId = account.accountId;
session.id = account.accountId;
session.appScopedId = account.accountId;
session.token = account.token;
// XXX really?
conf.account = account;
return account;
};
InternalApi = {
accounts: accounts
, login: login
, getToken: getToken
};
api = {
save: save
, restore: restore
, checkSession: restore
, destroy: destroy
, require: requireSession
, accounts: accounts
, requireSession: requireSession
, getToken: getToken
, addAccountsToSession: addAccountsToSession
, pruneAccountsFromSession: pruneAccountsFromSession
, refreshCurrentAccount: refreshCurrentAccount
, updateSession: updateSession
, sanityCheckAccounts: sanityCheckAccounts
, handleOrphanLogins: handleOrphanLogins
, validateUsername: TLogins.softTestUsername
, checkUsername: TLogins.hardTestUsername
, getMeta: TLogins.meta
, createLogin: TLogins.create
, login: login
// this is intended for the resourceOwnerPassword strategy
, backgroundLogin: backgroundLogin
, logout: logout
, onLogin: onLogin
, onLogout: onLogout
, requireAccount: TAccounts.requireAccount
, selectAccount: TAccounts.selectAccount // TODO nix this 'un
, account: TAccounts.selectAccount
, testLoginAccounts: testLoginAccounts
, cloneAccount: TAccounts.cloneAccount
//, getId: TAccounts.getId
};
TherapySession = {
create: create
, api: api
, getId: TAccounts.getId
};
// XXX
// These are underscore prefixed because they aren't official API yet
// I need more time to figure out the proper separation
TherapySession._logins = TLogins;
TherapySession._accounts = TAccounts;
exports.TherapySession = TherapySession.TherapySession = TherapySession;
if ('undefined' !== typeof module) {
module.exports = TherapySession;
}
}('undefined' !== typeof exports ? exports : window));