@uppy/companion-client - npm Package Compare versions

Comparing version 3.2.2 to 3.3.0

CHANGELOG.md

 # @uppy/companion-client
 
+## 3.3.0
+
+Released: 2023-08-15
+Included in: Uppy v3.14.0
+
+- @uppy/companion-client,@uppy/provider-views: make authentication optional (Dominik Schmidt / #4556)
+
 ## 3.1.2
@@ -4,0 +11,0 @@

lib/Provider.js

@@ -11,2 +11,19 @@ 'use strict';
 };
+function getOrigin() {
+  // eslint-disable-next-line no-restricted-globals
+  return location.origin;
+}
+function getRegex(value) {
+  if (typeof value === 'string') {
+    return new RegExp(`^${value}$`);
+  }
+  if (value instanceof RegExp) {
+    return value;
+  }
+  return undefined;
+}
+function isOriginAllowed(origin, allowedOrigin) {
+  const patterns = Array.isArray(allowedOrigin) ? allowedOrigin.map(getRegex) : [getRegex(allowedOrigin)];
+  return patterns.some(pattern => (pattern == null ? void 0 : pattern.test(origin)) || (pattern == null ? void 0 : pattern.test(`${origin}/`))); // allowing for trailing '/'
+}
 var _refreshingTokenPromise = /*#__PURE__*/_classPrivateFieldLooseKey("refreshingTokenPromise");
@@ -81,3 +98,8 @@ var _getAuthToken = /*#__PURE__*/_classPrivateFieldLooseKey("getAuthToken");
     }
-    const params = new URLSearchParams(queries);
+    const params = new URLSearchParams({
+      state: btoa(JSON.stringify({
+        origin: getOrigin()
+      })),
+      ...queries
+    });
     if (this.preAuthToken) {
@@ -88,2 +110,46 @@ params.set('uppyPreAuthToken', this.preAuthToken);
   }
+  async login(queries) {
+    await this.ensurePreAuth();
+    return new Promise((resolve, reject) => {
+      const link = this.authUrl(queries);
+      const authWindow = window.open(link, '_blank');
+      const handleToken = e => {
+        if (e.source !== authWindow) {
+          this.uppy.log.warn('ignoring event from unknown source', e);
+          return;
+        }
+        const {
+          companionAllowedHosts
+        } = this.uppy.getPlugin(this.pluginId).opts;
+        if (!isOriginAllowed(e.origin, companionAllowedHosts)) {
+          reject(new Error(`rejecting event from ${e.origin} vs allowed pattern ${companionAllowedHosts}`));
+          return;
+        }
+
+        // Check if it's a string before doing the JSON.parse to maintain support
+        // for older Companion versions that used object references
+        const data = typeof e.data === 'string' ? JSON.parse(e.data) : e.data;
+        if (data.error) {
+          const {
+            uppy
+          } = this;
+          const message = uppy.i18n('authAborted');
+          uppy.info({
+            message
+          }, 'warning', 5000);
+          reject(new Error('auth aborted'));
+          return;
+        }
+        if (!data.token) {
+          reject(new Error('did not receive token from auth window'));
+          return;
+        }
+        authWindow.close();
+        window.removeEventListener('message', handleToken);
+        this.setAuthToken(data.token);
+        resolve();
+      };
+      window.addEventListener('message', handleToken);
+    });
+  }
   refreshTokenUrl() {
@@ -90,0 +156,0 @@ return `${this.hostname}/${this.id}/refresh-token`;

lib/RequestClient.js

@@ -11,3 +11,3 @@ 'use strict';
 const packageJson = {
-  "version": "3.2.2"
+  "version": "3.3.0"
 }; // Remove the trailing slash so we can always safely append /xyz.
@@ -14,0 +14,0 @@ function stripSlash(url) {

package.json

 {
   "name": "@uppy/companion-client",
   "description": "Client library for communication with Companion. Intended for use in Uppy plugins.",
-  "version": "3.2.2",
+  "version": "3.3.0",
   "license": "MIT",
@@ -25,3 +25,3 @@ "main": "lib/index.js",
   "dependencies": {
-    "@uppy/utils": "^5.4.2",
+    "@uppy/utils": "^5.4.3",
     "namespace-emitter": "^2.0.1"
@@ -28,0 +28,0 @@ },

src/Provider.js

@@ -10,2 +10,22 @@ 'use strict'
 
+function getOrigin () {
+  // eslint-disable-next-line no-restricted-globals
+  return location.origin
+}
+
+function getRegex (value) {
+  if (typeof value === 'string') {
+    return new RegExp(`^${value}$`)
+  } if (value instanceof RegExp) {
+    return value
+  }
+  return undefined
+}
+
+function isOriginAllowed (origin, allowedOrigin) {
+  const patterns = Array.isArray(allowedOrigin) ? allowedOrigin.map(getRegex) : [getRegex(allowedOrigin)]
+  return patterns
+    .some((pattern) => pattern?.test(origin) || pattern?.test(`${origin}/`)) // allowing for trailing '/'
+}
+
 export default class Provider extends RequestClient {
@@ -76,3 +96,6 @@ #refreshingTokenPromise
   authUrl (queries = {}) {
-    const params = new URLSearchParams(queries)
+    const params = new URLSearchParams({
+      state: btoa(JSON.stringify({ origin: getOrigin() })),
+      ...queries,
+    })
     if (this.preAuthToken) {
@@ -85,2 +108,46 @@ params.set('uppyPreAuthToken', this.preAuthToken)
 
+  async login (queries) {
+    await this.ensurePreAuth()
+
+    return new Promise((resolve, reject) => {
+      const link = this.authUrl(queries)
+      const authWindow = window.open(link, '_blank')
+      const handleToken = (e) => {
+        if (e.source !== authWindow) {
+          this.uppy.log.warn('ignoring event from unknown source', e)
+          return
+        }
+
+        const { companionAllowedHosts } = this.uppy.getPlugin(this.pluginId).opts
+        if (!isOriginAllowed(e.origin, companionAllowedHosts)) {
+          reject(new Error(`rejecting event from ${e.origin} vs allowed pattern ${companionAllowedHosts}`))
+          return
+        }
+
+        // Check if it's a string before doing the JSON.parse to maintain support
+        // for older Companion versions that used object references
+        const data = typeof e.data === 'string' ? JSON.parse(e.data) : e.data
+
+        if (data.error) {
+          const { uppy } = this
+          const message = uppy.i18n('authAborted')
+          uppy.info({ message }, 'warning', 5000)
+          reject(new Error('auth aborted'))
+          return
+        }
+
+        if (!data.token) {
+          reject(new Error('did not receive token from auth window'))
+          return
+        }
+
+        authWindow.close()
+        window.removeEventListener('message', handleToken)
+        this.setAuthToken(data.token)
+        resolve()
+      }
+      window.addEventListener('message', handleToken)
+    })
+  }
+
   refreshTokenUrl () {
@@ -87,0 +154,0 @@ return `${this.hostname}/${this.id}/refresh-token`

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

98068

increased by10.23%

Lines of code

1323

increased by10.16%

Dependency changes

• Updated@uppy/utils@^5.4.3