salte-auth / salte-auth Goto Github PK

View Code? Open in Web Editor NEW

106.0 6.0 15.0 11.68 MB

💻🗝 Authentication for the modern web!

License: MIT License

JavaScript 59.23% TypeScript 39.95% SCSS 0.68% CSS 0.15%

authentication oauth2 openid

salte-auth's Introduction

NOTE: This repository is currently in maintenance mode and won't receive any new features!

Authentication for the modern web!

API • Docs • Demo

Install

$ npm install @salte-auth/salte-auth

Usage

import { SalteAuth } from '@salte-auth/salte-auth';
import { Auth0 } from '@salte-auth/auth0';
import { Tab } from '@salte-auth/tab';

// Configure SalteAuth with Auth0's url and client id.
const auth = new SalteAuth({
  providers: [
    new Auth0({
      url: 'https://salte-os.auth0.com',
      clientID: '9JTBXBREtckkFHTxTNBceewrnn7NeDd0'
    })
  ],

  handlers: [
    new Tab({
      default: true
    })
  ]
});

// Display an iframe to the user that allows them to login
auth.login('auth0');

Known Issues

These are issues that we know about, but don't have a clear fix for!

There are currently no known issues, thanks for checking!

salte-auth's People

Contributors

Stargazers

Watchers

Forkers

kpitzen jangolano cbrungraeber elingan rschick rishabh62 ducharmemp tomordina abhishektiwari abdulkereem mfinity168 is0merlntalt stefanvrecic torocruzand

salte-auth's Issues

Convert salte-auth to a ES6 Class

Description

Convert salte-auth to ES6

Hash Parsing Not Always Working

Description

AngularJS 1.6.0+ prefixes the callback URL with a hash/bang combination with no trailing slash between the hash/bang and the fragment sent back with the access token (e.g. #!#access_token=...). Some identity providers support including the hash/bang in the callback URL and then they exclude the hash from the fragment. Other identity providers support including the hash/bang in the callback URL but still include the hash in the fragment. The bottom line is that there are a lot of Identity provider inconsistencies in handling the fragment-portion of the URL and its relationship to other hashes that might be included in the callback URL or added by the front-end JavaScript framework prior to an interceptor parsing it. As a result, we need to be much more flexible in our approach to parsing the fragment sent back from the identity provider.

Session Keep-Alive Feature

Description

Research the feasibility and implications of preventing the web-based application's session from timing out. This could be useful while an application is under development or allows the user to manage large client-side updates before invoking server-side code. If the latter applies than it is assumed that the application is running in a secured environment where the display device has a timeout and lock-screen of its own.

An in-range update of karma-webpack is breaking the build 🚨

☝️ Greenkeeper’s updated Terms of Service will come into effect on April 6th, 2018.

Version 2.0.10 of karma-webpack was just published.

Branch	Build failing 🚨
Dependency	karma-webpack
Current Version	2.0.9
Type	devDependency

This version is covered by your current version range and after updating it in your project the build failed.

karma-webpack is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build failed Details

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

@salte-auth/salte-auth: Add support for directly linking to the forgot password url for a given provider

Description

OAuth 2.0 validation information needs to be passed to the forgotPassword url, as such trying to implement this on the end-developer side is a bit difficult.

Instead we should implement a function that either generates a forgotPassword url if it can or it throws an error saying it isn't support for the given provider.

Example

https://some-user-pool.auth.us-east-1.amazoncognito.com/forgotPassword?state=cb9bb075-58c8-4c71-93ff-f605baa913fe&nonce=1d0c3f15-2e89-4dd2-a1e7-92ccee7734f3&response_type=token&redirect_uri=<my-redirect-uri>&client_id=<my-client-id>&scope=openid

An in-range update of webpack-dev-server is breaking the build 🚨

Version 2.10.1 of webpack-dev-server was just published.

Branch	Build failing 🚨
Dependency	webpack-dev-server
Current Version	2.10.0
Type	devDependency

This version is covered by your current version range and after updating it in your project the build failed.

webpack-dev-server is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build failed Details

Commits

The new version differs by 2 commits.

3e220fe 2.10.1
aaf7fce rollback yargs to 6.6.0

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

Tests should be completely isolated

Description

Certain tests will fail when executed on their own and pass when executed with others.

Browsers Affected

Salte Auth should utilize Promises instead of callback functions

Description

Currently salte-auth utilizes callbacks to let the user know
when a request is done. Instead we should use Promises.

`salte-auth` shouldn't be a singleton

Description

Currently having salte-auth be a singleton is forcing users to utilize it in a certain way.

By revoking its singleton status we put the control in the hands of the developers.

EDIT (April 8th, 2019)

Effectively this was making it impossible to create multiple instances of SalteAuth since it would reference the global version of giving the user a new instance.

While this functionality has been removed in v3.0.0 it also isn't entirely relevant anymore since users can register multiple providers.

@salte-auth/iframe: Add detection for Identity Providers that block iFrames

Description

When you attempt to login to renew your access token on an IDP that doesn't support iFrames the request never resolves.

Expected outcome

salte.auth.login().catch((error) => {
  console.log(error); 
  /*
   * {
   *    code: 'login_iframe_blocked',
   *    description: 'The identity provider is blocking login requests via iFrames.'
   * }
   */
});

Actual outcome

salte.auth.login().catch((error) => {
  // The login promise falls into limbo as theres no way for it to resolve
});

Browsers Affected

References

https://stackoverflow.com/questions/7950184/is-there-a-client-side-way-to-detect-x-frame-options#answer-37979701

Replace `_guid` with `node-uuid`

Description

Simplify the code by replacing the wheel reinventing _guid function with node-uuid.

An in-range update of html-loader is breaking the build 🚨

Version 0.5.5 of html-loader was just published.

Branch	Build failing 🚨
Dependency	html-loader
Current Version	0.5.4
Type	devDependency

This version is covered by your current version range and after updating it in your project the build failed.

html-loader is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build failed Details

Release Notes

v0.5.5

2018-01-17

`Bug Fixes`

index: don't prepend ./ to the URL on interpolate=require (options.interpolate) (#165) (9515410)

Commits

The new version differs by 3 commits.

27026d2 chore(release): 0.5.5
9515410 fix(index): don't prepend ./ to the URL on interpolate=require (options.interpolate) (#165)
5af6884 docs(CHANGELOG): rm redundant entries

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

An in-range update of webpack is breaking the build 🚨

Version 3.1.0 of webpack just got published.

Branch	Build failing 🚨
Dependency	webpack
Current Version	3.0.0
Type	devDependency

This version is covered by your current version range and after updating it in your project the build failed.

As webpack is “only” a devDependency of this project it might not break production or downstream projects, but “only” your build or test tools – preventing new deploys or publishes.

I recommend you give this issue a high priority. I’m sure you can resolve this 💪

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build failed Details

Release Notes

v3.1.0

Features:

Allow different library names for UMD
Support for passing a defined identifier as this in a IIFE
Use the new resolve performance option cacheWithContext: false by default when it's safe
Support array of functions as configuration
add sortModules to Chunk which is required in extract-text-plugin to support webpack 3

Bugfixes:

! with truthy webpack identifier will evaluate correctly
assets and dependencies are preserved in concatenated modules
Fix some internal usage of deprecated APIs

Commits

The new version differs by 95 commits.

4bb3018 3.1.0
7e757cd Merge pull request #5194 from webpack/feature/hoist_regex_literals
2879fb3 Merge pull request #5225 from hulkish/feature/added-chunk-sortModules-method
5f08aa4 removed default params for node 4
cadf9f7 added sortModules method to Chunk class
70b7d2f fix(sp): spelling mistake in const name
0ab36c4 Merge pull request #5196 from AndersDJohnson/multi-compiler-functions
2eccb19 Merge pull request #5081 from KTruong888/4099_es6_refactor_lib_hot_module_replacement_plugin
e365b2e Merge pull request #5210 from ematipico/master
7913789 Merge pull request #5220 from liuyuanyangscript/master
15becbd README.md bugfix
2ccc1fd Changed statement 'var' to 'const'
a589a6c Merge pull request #5183 from kahwee/patch-1
c2fa5d4 feat(perf): remove unneded regexp escape
987a9f3 feat(perf): hoist final regexp

There are 95 commits in total.

See the full diff

Not sure how things should work exactly?

There is a collection of frequently asked questions and of course you may always ask my humans.

Your Greenkeeper Bot 🌴

Drop support for Bower

Pros

~~No longer need to deploy to latest branch~~
Ability to utilize .npmrc
~~Ability to upgrade to semantic-release 13+~~

Cons

Dropped support for Polymer 1 - 2

`loginWithNewTab` doesn't close after login

Description

This seems to be linked to how we're opening the new tab.
salte-auth isn't recognizing it as a window owned by us.

https://github.com/salte-io/salte-auth/blob/533569282222a72b66c047791bfdede7df981e6c/src/salte-auth.utilities.js#L258-L263

This is due to us having to name the window _blank in order to initiate a new tab rather then a popup.

https://github.com/salte-io/salte-auth/blob/533569282222a72b66c047791bfdede7df981e6c/src/salte-auth.utilities.js#L168-L174

Expected outcome

The new tab closes after we're redirected to our site.

Actual outcome

The new tab stays open after redirecting.

Live Demo

https://glitch.com/edit/#!/remix/salte-auth-demo

Browsers Affected

Add cacheLocation to Code Documentation

Description

By default, this component uses sessionStorage to store state information. However, it will also allow the consuming application to specify that localStorage be used instead by passing the following key/value pair to the init function: cacheLocation: 'localStorage'. This capability should be made more prominent by adding it to the documentation at the top of salte-auth.js.

An in-range update of babel-core is breaking the build 🚨

Version 6.24.1 of babel-core just got published.

Branch	Build failing 🚨
Dependency	babel-core
Current Version	6.24.0
Type	devDependency

This version is covered by your current version range and after updating it in your project the build failed.

As babel-core is “only” a devDependency of this project it might not break production or downstream projects, but “only” your build or test tools – preventing new deploys or publishes.

I recommend you give this issue a high priority. I’m sure you can resolve this 💪

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build failed Details

Not sure how things should work exactly?

There is a collection of frequently asked questions and of course you may always ask my humans.

Your Greenkeeper Bot 🌴

An in-range update of webpack is breaking the build 🚨

☝️ Greenkeeper’s updated Terms of Service will come into effect on April 6th, 2018.

Version 4.0.1 of webpack was just published.

Branch	Build failing 🚨
Dependency	webpack
Current Version	4.0.0
Type	devDependency

This version is covered by your current version range and after updating it in your project the build failed.

webpack is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build failed Details

Release Notes

v4.0.1

Features

add version property to webpack exports

Bugfixes

import() with CJS now gives correct exports
Module concatenation bailout messages now point to correct module

Commits

The new version differs by 8 commits.

5044762 4.0.1
7fd5c6f Merge pull request #6585 from webpack/bugfix/bailout-messages
8e592bf Merge pull request #6575 from nveenjain/addVersion
e7aba18 fix incorrect optimization bailout messages
9f9c3d1 Merge pull request #6583 from webpack/bugfix/import-cjs
8bf1574 CJS fake namespace object contains exports now
d50fa68 add newlines
05174ae Added version to webpack's export property

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

Add Tests to Cover a Non-Blank hashPrefix Value

Description

AngularJS 1.6 changed the default hashPrefix value to the bang symbol. As a result, we had to expose the hashPrefix through the configuration object to enable the consuming application to provide it.

Update User Documentation and Publish

Description

This was originally forked from the Azure Active Directory Authentication Library but has been dramatically revamped to support additional OpenID Connect and OAuth 2.0 Identity providers (as well as continuing to support AADAL). Even so, the usage instructions will be very much the same with a few minor tweaks.

Add support for listeners

Description

Sometimes users want to know when salte-auth fires off a login or logout event.

This should be facilitated via a new listeners api.

Proposed API

/**
 * Listens for an event to be invoked.
 * @param {('login'|'logout')} eventType the event to listen for.
 * @param {Function} callback A callback that fires when the specified event occurs.
 */
salte.auth.on(eventType, callback);

/**
 * Deregister a callback previously registered.
 * @param {('login'|'logout')} eventType the event to deregister.
 * @param {Function} callback A callback that fires when the specified event occurs.
 */
salte.auth.off(eventType, callback);

Add Configuration Option to Support ID_Token as Query Parameter

Description

WSO2's implementation if the id_token flow sends the ID token back as a query parameter instead of a URL fragment. This is not in alignment with the OpenID Connect specification and is generally considered to be a bad practice because of security concerns. As a result, we need to force the user to explicitly state that they want this behavior to be enabled.

Code Coverage

Description

Setup coverage reporting

References

https://github.com/istanbuljs/babel-plugin-istanbul

Popup doesn't execute callback when using `salte-auth-angular`

Description

Callback doesn't get executed when logging in with a popup via salte-auth-angular.

Expected outcome

Callback gets executed when logging in with a popup via salte-auth-angular.

Actual outcome

Callback doesn't get executed when logging in with a popup via salte-auth-angular.

Browsers Affected

An in-range update of yargs is breaking the build 🚨

Version 10.1.1 of yargs was just published.

Branch	Build failing 🚨
Dependency	yargs
Current Version	10.1.0
Type	devDependency

This version is covered by your current version range and after updating it in your project the build failed.

yargs is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build failed Details

Commits

The new version differs by 4 commits.

232f9ca chore(release): 10.1.1
e87f487 docs: fix middlware docs (#1037)
331d103 fix: Add dirname sanity check on findUp (#1036)
0942a15 chore: use chai 4.x (#1033)

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

API rewrite for 2.0

Description

This issue is here to facilitate discussion regarding the structure of the API for 2.0

Proposed API

/**
 * Authenticates using the iframe-based OAuth flow.
 * @return {Promise} a promise that resolves when we finish authenticating
 */
salte.auth.signInWithIframe();

/**
 * Authenticates using the popup-based OAuth flow.
 * @return {Promise} a promise that resolves when we finish authenticating
 */
salte.auth.signInWithPopup();

/**
 * Authenticates using the redirect-based OAuth flow.
 */
salte.auth.signInWithRedirect();

/**
 * Unauthenticates using the iframe-based OAuth flow.
 * @return {Promise} a promise that resolves when we finish deauthenticating
 */
salte.auth.signOutWithIframe();

/**
 * Unauthenticates using the popup-based OAuth flow.
 * @return {Promise} a promise that resolves when we finish deauthenticating
 */
salte.auth.signOutWithPopup();

/**
 * Unauthenticates using the redirect-based OAuth flow.
 */
salte.auth.signOutWithRedirect();

/**
 * Whether the user is currently authenticated
 */
salte.auth.profile.authenticated;

/**
 * The date and time that the access token will expire in unix time
 */
salte.auth.profile.expiration;

/**
 * The url that we will redirect to when signInWithRedirect is used
 */
salte.auth.profile.redirectUrl;

Add support for Okta

Description

Add support for Okta's Identity Provider.

Remove window-level bindings

Description

Replace window-level bindings with class properties

An in-range update of mocha is breaking the build 🚨

Version 4.1.0 of mocha was just published.

Branch	Build failing 🚨
Dependency	mocha
Current Version	4.0.1
Type	devDependency

This version is covered by your current version range and after updating it in your project the build failed.

mocha is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build failed Details

Release Notes

v4.1.0

4.1.0 / 2017-12-28

This is mainly a "housekeeping" release.

Welcome @Bamieh and @xxczaki to the team!

🐛: Fixes

#2661: progress reporter now accepts reporter options (@canoztokmak)
#3142: xit in bdd interface now properly returns its Test object (@Bamieh)
#3075: Diffs now computed eagerly to avoid misinformation when reported (@abrady0)
#2745: --help will now help you even if you have a mocha.opts (@Zarel)

🎉 Enhancements

#2514: The --no-diff flag will completely disable diff output (@CapacitorSet)
#3058: All "setters" in Mocha's API are now also "getters" if called without arguments (@makepanic)

📖 Documentation

#3170: Optimization and site speed improvements (@Munter)
#2987: Moved the old site repo into the main repo under docs/ (@boneskull)
#2896: Add maintainer guide (@boneskull)
Various fixes and updates (@xxczaki, @maty21, @leedm777)

🔩 Other

Test improvements and fixes (@eugenet8k, @ngeor, @38elements, @Gerhut, @ScottFreeCode, @boneskull)
Refactoring and cruft excision (@38elements, @Bamieh, @finnigantime, @boneskull)

Commits

The new version differs by 409 commits.

6b9ddc6 Release v4.1.0
3c4b116 update CHANGELOG for v4.1.0
5be22b2 options.reporterOptions are used for progress reporter
ea96b18 add .fossaignore [ci skip]
adc67fd Revert "[ImgBot] optimizes images (#3175)"
ae3712c [ImgBot] optimizes images (#3175)
33db6b1 Use x64 node on appveyor
4a6e095 Run appveyor tests on x64 platform. Might enable sharp installation
3abed9b Lint netlify-headers script
119543e Add preconnect for doubleclick domain that google analytics results in contacting
bd5109e Remove crossorigin='anonymous' from preconnect hints. Only needed for fonts, xhr and es module loads
123ee4f Handle the case where all avatars are already loaded at the time when the script exexecutes
64deadc Specific value for inlining htmlimages to guarantee logo is inlined
8f1ded4 https urls where possible
d5a5125 Be explicit about styling of screenshot images

There are 250 commits in total.

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

An in-range update of babel-loader is breaking the build 🚨

☝️ Greenkeeper’s updated Terms of Service will come into effect on April 6th, 2018.

Version 7.1.4 of babel-loader was just published.

Branch	Build failing 🚨
Dependency	babel-loader
Current Version	7.1.3
Type	devDependency

This version is covered by your current version range and after updating it in your project the build failed.

babel-loader is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build could not complete due to an error Details

Release Notes

7.1.4

🐛 Bug Fix

Update code to read filename

Commits

The new version differs by 2 commits.

8fe5da3 7.1.4
4d14079 Update resolving of filename

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

don't authenticate a secure route during a login

Description

This a followup to #135. This is a very similar issue.

I'm getting a state mismatch error and an additional authorize call to get the access token during a loginWithRedirect call.

This is due to having all routes secure and $onRouteChanged being triggered on the initial route

Expected outcome

loginWithRedirect returns no state mismatch error and makes no extra authorize calls during the login process

Actual outcome

loginWithRedirect returns a state mismatch error during the login process and makes an extra authorize call

Proposal

Don't authenticate a secure route during a login. I will open a PR with a proposed solution to resolve this issue.

Add support for login and logout with a new tab

Description

Currently we support logging in via a popup, iframe, and redirect.

However we do not have an option to explicitly login via a new tab.

Proposed API

/**
 * Authenticates using the new-tab-based OAuth flow.
 * @return {Promise} a promise that resolves when we finish authenticating
 */
salte.auth.loginWithNewTab();

/**
 * Authenticates using the new-tab-based OAuth flow.
 * @return {Promise} a promise that resolves when we finish authenticating
 */
salte.auth.logoutWithNewTab();

Unable to run tests multiple times.

Description

When running yarn run tdd the command will fail when any files are changed.

Browsers Affected

Add a build for the development version of the code

An in-range update of nps is breaking the build 🚨

☝️ Greenkeeper’s updated Terms of Service will come into effect on April 6th, 2018.

Version 5.8.0 of nps was just published.

Branch	Build failing 🚨
Dependency	nps
Current Version	5.7.1
Type	devDependency

This version is covered by your current version range and after updating it in your project the build failed.

nps is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build failed Details

Release Notes

v5.8.0

5.8.0 (2018-02-26)

Features

add help style support (#164) (9338d72c)

Commits

The new version differs by 8 commits.

b5769c9 chore(release): fix release issues
85b89b9 docs: removed codeSponsor (#166)
9338d72 feat: add help style support (#164)
fc7e660 docs(maintaining): update maintaining.md
23a7c43 docs: Utils documentation fix (#163)
a4ce471 test: Use jest mock instead of sinon spy (#162)
49a56a2 docs: add sponsor.io
f1568e8 chore(package): Bump dev deps (#161)

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

Salte Auth should detect route changes

Description

Rather then utilizing route change functionality within various
frameworks we should implement a central set of functionality
within salte-auth.

References

https://github.com/PolymerElements/iron-location/blob/faaa959813d1dfa5defc5db30e55e799c89ec903/iron-location.html#L185-L188

Add Support for Shared API Token Configuration

Description

You are currently required to list the API endpoints that require authentication to a list of endpoints in the configuration. This, in turn, results in the component making a round-trip to the identity provider the first time each of the API endpoints listed is called. This needs to be enhanced so that any API calls not explicitly listed in the endpoints list or a new anonymous list are enriched with a shared access_token.

Drop support for automatic login via Popup

Description

Most browsers don't support opening a popup without a user event.

Expected outcome

The browser opens a popup.

Actual outcome

The browser doesn't open a popup.

Live Demo

https://salte-auth-144.glitch.me

Browsers Affected

An in-range update of uuid is breaking the build 🚨

Version 3.2.0 of uuid was just published.

Branch	Build failing 🚨
Dependency	uuid
Current Version	3.1.0
Type	devDependency

This version is covered by your current version range and after updating it in your project the build failed.

uuid is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build failed Details

Commits

The new version differs by 14 commits.

c0d44fd Publish v3.2.0 (#240)
eaa9f4e Use standard-version for release (#246)
67d697c Fix #248 (#251)
1fef18b fix: use msCrypto if available. Fixes #241 (#247)
815daa3 eslint (#224)
bba9402 eslint (#219)
0ea33e6 use typeof to check for crypto rather than global. Fixes #185 (#221)
c1f720d Defer random initialization of node and clockseq. Fixes #189 (#220)
dc02a76 UUID v3 Support (#217)
72fbabb Corrected version from v4->v5 in README_js.md (#215)
962c80a Use runmd to build README (#204)
e2389b3 Fix parentheses typo in README.md (#203)
880d24e Update README.md (#208)
8e23981 Fix buffer not being modified (uuid v5) (#201)

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴

An in-range update of coveralls is breaking the build 🚨

Version 2.12.0 of coveralls just got published.

Branch	Build failing 🚨
Dependency	coveralls
Current Version	2.11.16
Type	devDependency

This version is covered by your current version range and after updating it in your project the build failed.

As coveralls is “only” a devDependency of this project it might not break production or downstream projects, but “only” your build or test tools – preventing new deploys or publishes.

I recommend you give this issue a high priority. I’m sure you can resolve this 💪

Status Details

✅ continuous-integration/travis-ci/push The Travis CI build passed Details
❌ coverage/coveralls First build on greenkeeper/coveralls-2.12.0 at 83.086% Details

Release Notes

Branch coverage support

Adds branch coverage data to Coveralls API post.

Commits

The new version differs by 2 commits .

d571dac merge, version bump
1575050 branching WIP

See the full diff.

Not sure how things should work exactly?

There is a collection of frequently asked questions and of course you may always ask my humans.

Your Greenkeeper Bot 🌴

Expose Token Callback Timeout

Description

The callback timeout is currently hard-coded to 6 seconds, which may not be long enough depending upon the performance of the token provider being used, network latency issues, etc. As a result, we will expose this through the config object so the consumer can provide their own timeout value. If not provided we will default the value to 6 seconds.

Request Enhancement causes certain Fetch Requests to fail

Description

If you use the fetch api with the URL / Request object then the request fails.

Expected outcome

The request succeeds.

Actual outcome

The request fails.

Browsers Affected

Run tests on multiple browsers

Description

The tests should be run via Sauce Labs on the following browsers:

Microsoft Edge
Chrome
Firefox
IE 10 to 11
Safari 7 to 9

Compile `node-uuid` into our code

Description

node-uuid doesn't support being pulled in via a <script> tag, so we need to compile it with our code.

Related Issues

defunctzombie/node-uuid#23

loginWithRedirect with routes : true triggers loginWithIframe causing invalid_state error

Description

I'm trying to use the latest 2.x version of SalteAuth with Angular. Calling loginWithRedirect with all routes secure returns the invalid_state error code "State provided by identity provider did not match local state."

Debugging SalteAuth I found the following occurs in this order:

$$onRouteChanged is getting called during the login. I'm not sure why. Maybe changing from nothing to the initial route?
Since all routes are secured it calls retrieveAccessToken
The user isn't logged in yet so the idToken is expired. This results in loginWithIframe being called
This results in a new call to $loginUrl. This changes the profile's $localState because $loginUrl always sets the $localState to a new uuid
This causes the state mismatch as the loginWithRedirect url passes a different state than what is in profile.$localState

Expected outcome

SalteAuth.loginWithRedirect only calls loginWithRedirect internally and passes the correct state

Actual outcome

SalteAuth.loginWithRedirect passes the wrong state due to both loginWithRedirect and loginWithIframe being called internally

Steps to reproduce

Angular 5 app. I don't know if this matters.
Call loginWithRedirect with a config similar to the one below, routes: true seems particularly important.

this.auth = new SalteAuth({
  provider: 'wso2',
  clientId: authConfig.clientId,
  providerUrl: authConfig.provider,
  responseType: 'id_token token',
  redirectUrl: location.origin + '/authorize',
  redirectLoginCallback: this.handleRedirect.bind(this),
  scope: 'openid',
  routes: true,
  endpoints: ['/api'],
});

Convert tests from Jasmine to Mocha

Description

Convert tests to use Mocha and Chai.

Implement Query Parameter to Support Passing WSO2 tenantDomain

Description

Authorizing against a multi-tenant instance of WSO2 Identity Server requires the tenant domain that the user wishes to authenticate against to be passed as a query parameter called "tenantDomain."

Add Greenkeeper

Description

Add Greenkeeper to keep dependencies up to date

References

https://greenkeeper.io

Remove the `_decode` function

Description

We have no intention of support IE9 or below, therefore polyfilling the atob function is unnecessary.

An in-range update of sinon is breaking the build 🚨

Version 4.1.5 of sinon was just published.

Branch	Build failing 🚨
Dependency	sinon
Current Version	4.1.4
Type	devDependency

This version is covered by your current version range and after updating it in your project the build failed.

sinon is a devDependency of this project. It might not break your production code or affect downstream projects, but probably breaks your build or test tools, which may prevent deploying or publishing.

Status Details

❌ continuous-integration/travis-ci/push The Travis CI build failed Details

Release Notes

Fix issue with `useFakeServer`

This release fixes an issue, where the server type from useFakeServer is unexpected (#1534)

Commits

The new version differs by 6 commits.

706ac9e Update docs/changelog.md and set new release id in docs/_config.yml
dd9c75c 4.1.5
81fb949 Update History.md and AUTHORS for new release
ec2496d Run mochify with --allow-chrome-as-root on travis
bb5529b Use nise.fakeServer as the sandbox serverPrototype
ef81c37 Update package-lock.json

See the full diff

FAQ and help

There is a collection of frequently asked questions. If those don’t help, you can always ask the humans behind Greenkeeper.

Your Greenkeeper Bot 🌴