feat(authorization): add initiateImplicitGrant function for OAuth Implicit Grant flow #4070
Conversation
|
Warning There were issues while running some tools. Please review the errors and either fix the tool’s configuration or disable the tool if it’s a critical failure. 🔧 eslint
warning [email protected]: This version is no longer supported. Please see https://eslint.org/version-support for other options. (For a CapTP with native promises, see @endo/eventual-send and @endo/captp) 📝 WalkthroughWalkthroughThe pull request introduces modifications to the OAuth login process across multiple files in the Webex authorization browser plugin. Key changes include enhancements to the ✨ Finishing Touches
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
arun3528
force-pushed
the
iframewindow
branch
from
10aa5cf to
b7d89d9
Compare
|
This pull request is automatically being deployed by Amplify Hosting (learn more). |
| defaultWindowSettings, | ||
| typeof options.separateWindow === 'object' ? options.separateWindow : {} | ||
| ); | ||
| console.error('windowFeatures112232'); |
There was a problem hiding this comment.
Do we need this log??
There was a problem hiding this comment.
no just removed it can you check again i added more code in another package as well
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
packages/@webex/plugin-authorization-browser/src/authorization.js (1)
150-166: Consider adding security implications to documentation.While the documentation is comprehensive, consider adding a note about potential security implications of opening the login in a new window, such as:
- Popup blockers potentially blocking the window
- The importance of proper origin validation in the OAuth flow
packages/@webex/plugin-authorization-browser-first-party/test/unit/spec/authorization.js (1)
454-488: Consider adding more edge cases to test suite.The current tests cover the basic functionality well, but consider adding tests for:
- Window opening failures (popup blockers)
- Invalid window settings
- Security token validation in the new window context
packages/@webex/plugin-authorization-browser-first-party/src/authorization.js (1)
227-247: Consider extracting window handling logic to a shared utility.The window handling logic is duplicated between this file and the main authorization plugin. Consider extracting it to a shared utility function to maintain consistency and reduce code duplication.
+ // In a new shared utility file (e.g., window-utils.js) + export const openLoginWindow = (webex, loginUrl, options) => { + if (options?.separateWindow) { + const defaultWindowSettings = { + width: 600, + height: 800 + }; + const windowSettings = Object.assign( + defaultWindowSettings, + typeof options.separateWindow === 'object' ? options.separateWindow : {} + ); + const windowFeatures = Object.entries(windowSettings) + .map(([key, value]) => `${key}=${value}`) + .join(','); + return webex.getWindow().open(loginUrl, '_blank', windowFeatures); + } + webex.getWindow().location = loginUrl; + };
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
packages/@webex/plugin-authorization-browser-first-party/src/authorization.js(1 hunks)packages/@webex/plugin-authorization-browser-first-party/test/unit/spec/authorization.js(1 hunks)packages/@webex/plugin-authorization-browser/src/authorization.js(2 hunks)
🧰 Additional context used
🪛 Biome (1.9.4)
packages/@webex/plugin-authorization-browser/src/authorization.js
[error] 167-167: expected , but instead found {
Remove {
(parse)
[error] 169-169: expected : but instead found .
Remove .
(parse)
[error] 169-169: expected , but instead found ;
Remove ;
(parse)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: Initialize Project
- GitHub Check: AWS Amplify Console Web Preview
🔇 Additional comments (1)
packages/@webex/plugin-authorization-browser/src/authorization.js (1)
116-135: Well-documented function signature!The JSDoc comments are comprehensive and clearly explain the function's purpose, parameters, return type, and possible errors.
| if (options?.separateWindow) { | ||
| // Default window settings | ||
| const defaultWindowSettings = { | ||
| width: 600, | ||
| height: 800 | ||
| }; | ||
|
|
||
| // Merge user provided settings with defaults | ||
| const windowSettings = Object.assign( | ||
| defaultWindowSettings, | ||
| typeof options.separateWindow === 'object' ? options.separateWindow : {} | ||
| ); | ||
| // Convert settings object to window.open features string | ||
| const windowFeatures = Object.entries(windowSettings) | ||
| .map(([key, value]) => `${key}=${value}`) | ||
| .join(','); | ||
| this.webex.getWindow().open(loginUrl, '_blank', windowFeatures); | ||
| } else { | ||
| // Default behavior - open in same window | ||
| this.webex.getWindow().location = loginUrl; | ||
| } |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Add validation and error handling for window operations.
Consider these improvements:
- Validate user-provided window settings to prevent security issues
- Add error handling for cases where window.open fails (e.g., popup blockers)
if (options?.separateWindow) {
// Default window settings
const defaultWindowSettings = {
width: 600,
height: 800
};
+ // Validate user settings
+ const validateSettings = (settings) => {
+ const allowedProps = ['width', 'height', 'menubar', 'toolbar'];
+ return Object.fromEntries(
+ Object.entries(settings).filter(([key, value]) =>
+ allowedProps.includes(key) &&
+ typeof value === 'number' || typeof value === 'string'
+ )
+ );
+ };
// Merge user provided settings with defaults
const windowSettings = Object.assign(
defaultWindowSettings,
- typeof options.separateWindow === 'object' ? options.separateWindow : {}
+ typeof options.separateWindow === 'object' ? validateSettings(options.separateWindow) : {}
);
// Convert settings object to window.open features string
const windowFeatures = Object.entries(windowSettings)
.map(([key, value]) => `${key}=${value}`)
.join(',');
- this.webex.getWindow().open(loginUrl, '_blank', windowFeatures);
+ const newWindow = this.webex.getWindow().open(loginUrl, '_blank', windowFeatures);
+ if (!newWindow) {
+ throw new Error('Failed to open login window. Please check if popup blockers are enabled.');
+ }
} else {
// Default behavior - open in same window
this.webex.getWindow().location = loginUrl;
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if (options?.separateWindow) { | |
| // Default window settings | |
| const defaultWindowSettings = { | |
| width: 600, | |
| height: 800 | |
| }; | |
| // Merge user provided settings with defaults | |
| const windowSettings = Object.assign( | |
| defaultWindowSettings, | |
| typeof options.separateWindow === 'object' ? options.separateWindow : {} | |
| ); | |
| // Convert settings object to window.open features string | |
| const windowFeatures = Object.entries(windowSettings) | |
| .map(([key, value]) => `${key}=${value}`) | |
| .join(','); | |
| this.webex.getWindow().open(loginUrl, '_blank', windowFeatures); | |
| } else { | |
| // Default behavior - open in same window | |
| this.webex.getWindow().location = loginUrl; | |
| } | |
| if (options?.separateWindow) { | |
| // Default window settings | |
| const defaultWindowSettings = { | |
| width: 600, | |
| height: 800 | |
| }; | |
| // Validate user settings | |
| const validateSettings = (settings) => { | |
| const allowedProps = ['width', 'height', 'menubar', 'toolbar']; | |
| return Object.fromEntries( | |
| Object.entries(settings).filter(([key, value]) => | |
| allowedProps.includes(key) && | |
| typeof value === 'number' || typeof value === 'string' | |
| ) | |
| ); | |
| }; | |
| // Merge user provided settings with defaults | |
| const windowSettings = Object.assign( | |
| defaultWindowSettings, | |
| typeof options.separateWindow === 'object' ? validateSettings(options.separateWindow) : {} | |
| ); | |
| // Convert settings object to window.open features string | |
| const windowFeatures = Object.entries(windowSettings) | |
| .map(([key, value]) => `${key}=${value}`) | |
| .join(','); | |
| const newWindow = this.webex.getWindow().open(loginUrl, '_blank', windowFeatures); | |
| if (!newWindow) { | |
| throw new Error('Failed to open login window. Please check if popup blockers are enabled.'); | |
| } | |
| } else { | |
| // Default behavior - open in same window | |
| this.webex.getWindow().location = loginUrl; | |
| } |
COMPLETES #< INSERT LINK TO ISSUE >
This pull request addresses
Introduced the
initiateImplicitGrantfunction to facilitate the Implicit Grant flow for user authorization. The function constructs a login URL and handles the redirection either in a new window or the current window, based on the providedoptions.Parameters:
options: Configures the login flow.options.separateWindow: Determines if the login should open in a separate window. Can be a boolean or an object specifying window features. Iftrue, opens a new window with default dimensions; if an object, allows custom window settings (e.g.,{width: 800, height: 600}).Returns: A
Promise<void>that resolves immediately after initiating the login flow.Error Handling: Throws an error if the login URL cannot be constructed or if there are issues opening a new window.
This function is typically invoked via
AuthorizationBrowser#initiateLogin.by making the following changes
< DESCRIBE YOUR CHANGES >
Change Type
The following scenarios were tested
< ENUMERATE TESTS PERFORMED, WHETHER MANUAL OR AUTOMATED >
I certified that
I have read and followed contributing guidelines
I discussed changes with code owners prior to submitting this pull request
I have not skipped any automated checks
All existing and new tests passed
I have updated the documentation accordingly
Make sure to have followed the contributing guidelines before submitting.