v3.0.3: access /account with a timestamp when logged in, to prevent h…

…itting a browser cache
sparkartgroup · Jun 20, 2024 · ca47a6c · ca47a6c
1 parent 87f8a09
commit ca47a6c
Show file tree

Hide file tree

Showing 10 changed files with 85 additions and 13 deletions.
diff --git a/build/universe.js b/build/universe.js
@@ -34,14 +34,14 @@ Universe.prototype.init = function(callback) {
   var data = {};
 
   getFanclub.call(self, function(err, fanclub) {
-    data.fanclub = fanclub;
+    self.fanclub = data.fanclub = fanclub;
     if (err) {
       if (callback) callback(err, data);
       return setTimeout(function() {self.emit('error', err)}, 0);
     }
 
     getCustomer.call(self, function(err, customer) {
-      data.customer = customer;
+      self.customer = data.customer = customer;
       if (callback) callback(err, data);
       if (!err) setTimeout(function() {self.emit('ready', data)}, 0);
     });
@@ -96,8 +96,8 @@ Universe.prototype.linkify = function(scope, processor) {
 // PRIVATE
 
 var getFanclub = function(callback) {
-  if (this.context && this.context.resources && this.context.resources.fanclub) {
-    callback(null, this.context.resources.fanclub.fanclub);
+  if (this.fanclub || (this.context && this.context.resources && this.context.resources.fanclub)) {
+    callback(null, this.fanclub || this.context.resources.fanclub.fanclub);
   } else {
     this.get('/fanclub', function(err, data) {
       callback(err, data ? data.fanclub : null);
@@ -107,7 +107,10 @@ var getFanclub = function(callback) {
 
 var getCustomer = function(callback) {
   if (!this.useJWT || localStorage.getItem('universeAccessToken')) {
-    this.get('/account', function(err, data) {
+    // When logged in, add the login time to the /account query, to prevent the
+    // browser from serving a cached "logged out" response (and vice-versa)
+    this.get(localStorage.getItem('universeLoginTime') ? '/account?t=' + localStorage.getItem('universeLoginTime').toString() : '/account', function(err, data) {
+      if (!err && data && !data.customer) localStorage.removeItem('universeLoginTime');
       callback(err, data ? data.customer : null);
     });
   } else {
@@ -160,6 +163,7 @@ var validateTokens = function(callback) {
     // Valid access token
     return callback();
   } else {
+    // Missing or expired access token
     localStorage.removeItem('universeAccessToken');
     localStorage.removeItem('universeAccessTokenExpiration');
   }
@@ -168,6 +172,7 @@ var validateTokens = function(callback) {
     // Missing or expired refresh token
     localStorage.removeItem('universeRefreshToken');
     localStorage.removeItem('universeRefreshTokenExpiration');
+    localStorage.removeItem('universeLoginTime');
     return callback(true);
   }
 
@@ -179,6 +184,7 @@ var validateTokens = function(callback) {
         // Invalid refresh token
         localStorage.removeItem('universeRefreshToken');
         localStorage.removeItem('universeRefreshTokenExpiration');
+        localStorage.removeItem('universeLoginTime');
       }
       callback(err);
     } else {
@@ -263,12 +269,14 @@ function linkify (fanclub, scope, processor, popup) {
 
     if (url.match('login')) {
       event.preventDefault();
+      localStorage.setItem('universeLoginTime', Date.now());
       module.exports.prompt(fanclub, url, processor, popup);
     } else if (url.match('logout')) {
       localStorage.removeItem('universeAccessToken');
       localStorage.removeItem('universeAccessTokenExpiration');
       localStorage.removeItem('universeRefreshToken');
       localStorage.removeItem('universeRefreshTokenExpiration');
+      localStorage.removeItem('universeLoginTime');
     }
   });
 };

diff --git a/index.js b/index.js
@@ -33,14 +33,14 @@ Universe.prototype.init = function(callback) {
   var data = {};
 
   getFanclub.call(self, function(err, fanclub) {
-    data.fanclub = fanclub;
+    self.fanclub = data.fanclub = fanclub;
     if (err) {
       if (callback) callback(err, data);
       return setTimeout(function() {self.emit('error', err)}, 0);
     }
 
     getCustomer.call(self, function(err, customer) {
-      data.customer = customer;
+      self.customer = data.customer = customer;
       if (callback) callback(err, data);
       if (!err) setTimeout(function() {self.emit('ready', data)}, 0);
     });
@@ -95,8 +95,8 @@ Universe.prototype.linkify = function(scope, processor) {
 // PRIVATE
 
 var getFanclub = function(callback) {
-  if (this.context && this.context.resources && this.context.resources.fanclub) {
-    callback(null, this.context.resources.fanclub.fanclub);
+  if (this.fanclub || (this.context && this.context.resources && this.context.resources.fanclub)) {
+    callback(null, this.fanclub || this.context.resources.fanclub.fanclub);
   } else {
     this.get('/fanclub', function(err, data) {
       callback(err, data ? data.fanclub : null);
@@ -106,7 +106,10 @@ var getFanclub = function(callback) {
 
 var getCustomer = function(callback) {
   if (!this.useJWT || localStorage.getItem('universeAccessToken')) {
-    this.get('/account', function(err, data) {
+    // When logged in, add the login time to the /account query, to prevent the
+    // browser from serving a cached "logged out" response (and vice-versa)
+    this.get(localStorage.getItem('universeLoginTime') ? '/account?t=' + localStorage.getItem('universeLoginTime').toString() : '/account', function(err, data) {
+      if (!err && data && !data.customer) localStorage.removeItem('universeLoginTime');
       callback(err, data ? data.customer : null);
     });
   } else {
@@ -159,6 +162,7 @@ var validateTokens = function(callback) {
     // Valid access token
     return callback();
   } else {
+    // Missing or expired access token
     localStorage.removeItem('universeAccessToken');
     localStorage.removeItem('universeAccessTokenExpiration');
   }
@@ -167,6 +171,7 @@ var validateTokens = function(callback) {
     // Missing or expired refresh token
     localStorage.removeItem('universeRefreshToken');
     localStorage.removeItem('universeRefreshTokenExpiration');
+    localStorage.removeItem('universeLoginTime');
     return callback(true);
   }
 
@@ -178,6 +183,7 @@ var validateTokens = function(callback) {
         // Invalid refresh token
         localStorage.removeItem('universeRefreshToken');
         localStorage.removeItem('universeRefreshTokenExpiration');
+        localStorage.removeItem('universeLoginTime');
       }
       callback(err);
     } else {

diff --git a/login/login.js b/login/login.js
@@ -24,12 +24,14 @@ function linkify (fanclub, scope, processor, popup) {
 
     if (url.match('login')) {
       event.preventDefault();
+      localStorage.setItem('universeLoginTime', Date.now());
       module.exports.prompt(fanclub, url, processor, popup);
     } else if (url.match('logout')) {
       localStorage.removeItem('universeAccessToken');
       localStorage.removeItem('universeAccessTokenExpiration');
       localStorage.removeItem('universeRefreshToken');
       localStorage.removeItem('universeRefreshTokenExpiration');
+      localStorage.removeItem('universeLoginTime');
     }
   });
 };

diff --git a/login/logout.hbs b/login/logout.hbs
@@ -15,6 +15,7 @@
     localStorage.removeItem('universeAccessTokenExpiration');
     localStorage.removeItem('universeRefreshToken');
     localStorage.removeItem('universeRefreshTokenExpiration');
+    localStorage.removeItem('universeLoginTime');
 
     var redirect = document.getElementById('redirect');
     redirect.href = '{{{ fanclub.links.logout }}}' || '/';

diff --git a/login/logout.php b/login/logout.php
@@ -15,6 +15,7 @@
     localStorage.removeItem('universeAccessTokenExpiration');
     localStorage.removeItem('universeRefreshToken');
     localStorage.removeItem('universeRefreshTokenExpiration');
+    localStorage.removeItem('universeLoginTime');
 
     document.getElementById('redirect').click();
 

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "universe-js",
-  "version": "3.0.2",
+  "version": "3.0.3",
   "main": "index.js",
   "author": {
     "name": "Joannic Laborde",

diff --git a/test/config.js b/test/config.js
@@ -61,6 +61,8 @@ module.exports.routes = function (req, res) {
 
   if (req.method === 'OPTIONS') return success();
 
+  req.url = req.url.replace(/^\/api\/v1\/account\?t=\d+&key=12345$/, '/api/v1/account?t=54321&key=12345');
+
   switch ((req.method + ' ' + req.url)
     .replace(/solidus_client_jsonp_callback_\d+/, 'solidus_client_jsonp_callback')
     .replace(/redirect=[^&#$]+/, 'redirect=')) {
@@ -84,6 +86,10 @@ module.exports.routes = function (req, res) {
     success(logged_in ? {customer: 'me!'} : {});
     break;
 
+  case 'GET /api/v1/account?t=54321&key=12345':
+    success(logged_in ? {customer: 'me! not cached'} : {});
+    break;
+
   case 'POST /api/v1/account?key=12345':
     var body = '';
     req.on('data', function(data) {body += data;});

diff --git a/test/tests/universe-js.js b/test/tests/universe-js.js
@@ -41,6 +41,14 @@ describe('Universe', function() {
     Math.random = random;
   });
 
+  beforeEach(function() {
+    localStorage.removeItem('universeLoginTime');
+  })
+
+  afterEach(function() {
+    localStorage.removeItem('universeLoginTime');
+  });
+
   describe('JWTs', function() {
     beforeEach(login);
     afterEach(logout);
@@ -79,6 +87,26 @@ describe('Universe', function() {
         });
       });
 
+      it('after a login state change', function(done) {
+        localStorage.setItem('universeLoginTime', Date.now());
+
+        var callbackCalled;
+        var universe = new Universe({environment: 'test', key: '12345'});
+        universe.init(function(err, data) {
+          assert.ifError(err);
+          assert.deepEqual(data, {fanclub: 'demo!', customer: 'me! not cached'});
+          callbackCalled = true;
+        });
+        universe.on('error', function(err) {
+          assert(false);
+        });
+        universe.on('ready', function(data) {
+          assert(callbackCalled);
+          assert.deepEqual(data, {fanclub: 'demo!', customer: 'me! not cached'});
+          done();
+        });
+      });
+
       it('with no logged in customer', function(done) {
         logout();
         var universe = new Universe({environment: 'test', key: '12345'});
@@ -394,6 +422,26 @@ describe('Universe', function() {
         });
       });
 
+      it('after a login state change', function(done) {
+        localStorage.setItem('universeLoginTime', Date.now());
+
+        var callback_called;
+        var universe = new Universe({apiUrl: config.sameSiteUrlLoggedIn, key: '12345'});
+        universe.init(function(err, data) {
+          assert.ifError(err);
+          assert.deepEqual(data, {fanclub: 'demo!', customer: 'me! not cached'});
+          callback_called = true;
+        });
+        universe.on('error', function(err) {
+          assert(false);
+        });
+        universe.on('ready', function(data) {
+          assert(callback_called);
+          assert.deepEqual(data, {fanclub: 'demo!', customer: 'me! not cached'});
+          done();
+        });
+      });
+
       it('with no logged in customer', function(done) {
         var universe = new Universe({apiUrl: config.sameSiteUrlLoggedOut, key: '12345'});
         universe.init(function(err, data) {

diff --git a/universe-js.php b/universe-js.php
@@ -3,7 +3,7 @@
  * Plugin Name: Universe JS
  * Plugin URI:  https://github.com/sparkartgroup/universe-js
  * Description: Javascript modules and PHP functions for interacting with Sparkart's Universe API.
- * Version:     3.0.2
+ * Version:     3.0.3
  * Author:      Sparkart Group, Inc.
  * Author URI:  http://www.sparkart.com/
  */