paulononato/backstage
1
0
Fork 0
Code Issues Pull Requests Actions 41 Packages Projects Releases Wiki Activity

allow refresh session when client requests instant popup

Browse Source 
Signed-off-by: Gasan Guseinov <gasan.guseinov@ing.com>
This commit is contained in:
Gasan Guseinov
2025-01-31 15:28:55 +01:00
committed by Gasan.Guseinov
parent 58c4ce203d
commit ad23eb9ff4
2 changed files with 8 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/core-app-api/src/lib/AuthSessionManager/RefreshingAuthSessionManager.test.ts
+2 -2
View File
@@ -138,7 +138,7 @@ describe('RefreshingAuthSessionManager', () => {
expect(refreshSession).toHaveBeenCalledWith({ scopes: new Set() });
});
it('should forward option to instantly show auth popup and not attempt refresh', async () => {
it('should forward option to instantly show auth popup after attempting refresh', async () => {
const createSession = jest.fn();
const refreshSession = jest.fn().mockRejectedValue(new Error('NOPE'));
const manager = new RefreshingAuthSessionManager({
@@ -152,7 +152,7 @@ describe('RefreshingAuthSessionManager', () => {
scopes: new Set(),
instantPopup: true,
});
expect(refreshSession).toHaveBeenCalledTimes(0);
expect(refreshSession).toHaveBeenCalledTimes(1);
});
it('should remove session straight away', async () => {
packages/core-app-api/src/lib/AuthSessionManager/RefreshingAuthSessionManager.ts
+6 -13
View File
@@ -91,14 +91,6 @@ export class RefreshingAuthSessionManager<T> implements SessionManager<T> {
if (options.optional) {
return undefined;
}
if (options.instantPopup) {
// if `instantPopup`, then can't continue because
// we are in asynchronous control flow. Therefore, the application must not try to
// open the popup later in `connector#createSession(...)` because the browser may block the popup.
// Immediately return error.
throw error;
}
// If the refresh attempt fails we assume we don't have a session, so continue to create one
}
}
@@ -106,11 +98,12 @@ export class RefreshingAuthSessionManager<T> implements SessionManager<T> {
// The user may still have a valid refresh token in their cookies. Attempt to
// initiate a fresh session through the backend using that refresh token.
//
// We skip this check if an instant login popup is requested, as we need to
// stay in a synchronous call stack from the user interaction. The downside
// is that the user will sometimes be requested to log in even if they
// already had an existing session.
if (!options.instantPopup && !alreadyTriedToRefreshSession) {
// We can still try to refresh even if client requested instant popup.
// With instant popup option, the client is responsible for providing the user login prompt modal window.
// If control flow executes this code and client requested instant popup, it means that
// must have clicked sign in on the login prompt. The browser allows asynchronous code to open a popup
// if it is caused by a user interaction, clicking on a sign-in button, for example.
if (!alreadyTriedToRefreshSession) {
try {
const newSession = await this.collapsedSessionRefresh(options.scopes);
this.currentSession = newSession;