openvibers/openvibe.locker Commits

Public pages ask the session first: no 401 in a visitor's console (#8)

OP OpenVibers committed 4 days ago · c79f884ce3 · 2 files, +24 −0

Every signed-out visit to openvibe.locker's home called GET /api/v1/me, which answers 401, so each visitor's
console showed a failed request. The home, docs and an opened Send now ask /auth/me first (200 with user null for a
visitor) and stop there; signed-in people and a failed check go on to the account call as before.

Changes

ddiff --git a/public/js/app.js b/public/js/app.js
iindex 6cf9e02..dbbee31 100644
---- a/public/js/app.js
++++ b/public/js/app.js
@@@ -348,6 +348,13 @@
      form('#report-form', async (data) => { await api(`/api/v1/${page.mode === 'send' ? 'sends' : 'files'}/${page.id}/report`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ reason: data.get('reason') }) }); notice('Report received. Thank you.'); });
      state();
      try {
++        // A public page (home, docs, an opened Send) asks the session first: /auth/me answers 200 with user null for a
++        // visitor, so their console no longer shows a 401 from /api/v1/me on every visit. A failed check still tries.
++        if (['send', 'docs', 'home'].includes(page.mode)) {
++            const who = await fetch('/auth/me', { credentials: 'same-origin', headers: { Accept: 'application/json' } })
++                .then((r) => (r.ok ? r.json() : null)).catch(() => null);
++            if (who && who.user === null) return;
++        }
          me = await api('/api/v1/me'); window.OpenVibeLockerConfig.subject = me.subject;
          showStorage();
          await refresh();
ddiff --git a/test/public-pages.test.js b/test/public-pages.test.js
nnew file mode 100644
iindex 0000000..a9e5af3
---- /dev/null
++++ b/test/public-pages.test.js
@@@ -0,0 +1,17 @@
++'use strict';
++const test = require('node:test');
++const assert = require('node:assert/strict');
++const fs = require('node:fs');
++const path = require('node:path');
++
++// 11-09: every signed-out visit to the home page logged "401" from GET /api/v1/me in the visitor's console. Public pages
++// now ask /auth/me first (200 with user null for a visitor) and stop there; a failed check still tries the API.
++test('public pages ask the session before the account API', () => {
++    const js = fs.readFileSync(path.join(__dirname, '..', 'public', 'js', 'app.js'), 'utf8');
++    const at = js.indexOf("me = await api('/api/v1/me'); window.OpenVibeLockerConfig.subject");
++    assert.ok(at > 0, 'the account call is there');
++    const before = js.slice(Math.max(0, at - 700), at);
++    assert.match(before, /\['send', 'docs', 'home'\]\.includes\(page\.mode\)/);
++    assert.match(before, /fetch\('\/auth\/me'/);
++    assert.match(before, /if \(who && who\.user === null\) return;/, 'only an explicit "nobody" skips the account call');
++});