feat(auth): persist cookie based apiKey in document.cookie

Refs #8683

Author: char0n

src/core/plugins/auth/actions.js

@@ -273,11 +273,12 @@ export function restoreAuthorization(payload) {
 
 export const persistAuthorizationIfNeeded = () => ( { authSelectors, getConfigs } ) => {
   const configs = getConfigs()
-  if (configs.persistAuthorization)
-  {
-    const authorized = authSelectors.authorized()
-    localStorage.setItem("authorized", JSON.stringify(authorized.toJS()))
-  }
+
+  if (!configs.persistAuthorization) return
+
+  // persist authorization to local storage
+  const authorized = authSelectors.authorized().toJS()
+  localStorage.setItem("authorized", JSON.stringify(authorized))
 }
 
 export const authPopup = (url, swaggerUIRedirectOauth2) => ( ) => {

src/core/plugins/auth/config-extensions/wrap-actions.js

@@ -0,0 +1,19 @@
+/**
+ * @prettier
+ */
+export const loaded = (oriAction, system) => (payload) => {
+  const { getConfigs, authActions } = system
+  const configs = getConfigs()
+
+  oriAction(payload)
+
+  // check if we should restore authorization data from localStorage
+  if (configs.persistAuthorization) {
+    const authorized = localStorage.getItem("authorized")
+    if (authorized) {
+      authActions.restoreAuthorization({
+        authorized: JSON.parse(authorized),
+      })
+    }
+  }
+}

src/core/plugins/auth/index.js

@@ -1,7 +1,9 @@
 import reducers from "./reducers"
 import * as actions from "./actions"
 import * as selectors from "./selectors"
-import * as specWrapActionReplacements from "./spec-wrap-actions"
+import { execute as wrappedExecuteAction } from "./spec-extensions/wrap-actions"
+import { loaded as wrappedLoadedAction } from "./config-extensions/wrap-actions"
+import { authorize as wrappedAuthorizeAction, logout as wrappedLogoutAction } from "./wrap-actions"
 
 export default function() {
   return {
@@ -15,11 +17,22 @@ export default function() {
       auth: {
         reducers,
         actions,
-        selectors
+        selectors,
+        wrapActions: {
+          authorize: wrappedAuthorizeAction,
+          logout: wrappedLogoutAction,
+        }
+      },
+      configs: {
+        wrapActions: {
+          loaded: wrappedLoadedAction,
+        },
       },
       spec: {
-        wrapActions: specWrapActionReplacements
-      }
+        wrapActions: {
+          execute: wrappedExecuteAction,
+        },
+      },
     }
   }
 }

src/core/plugins/auth/spec-wrap-actions.js renamed to src/core/plugins/auth/spec-extensions/wrap-actions.js

@@ -0,0 +1,64 @@
+/**
+ * @prettier
+ */
+
+/**
+ * `authorize` and `logout` wrapped actions provide capacity
+ * to persist cookie based apiKey in document.cookie.
+ *
+ * `persistAuthorization` SwaggerUI options needs to set to `true`
+ * for document.cookie persistence to work.
+ */
+export const authorize = (oriAction, system) => (payload) => {
+  oriAction(payload)
+
+  const configs = system.getConfigs()
+
+  if (!configs.persistAuthorization) return
+
+  // create cookie
+  try {
+    const [{ schema, value }] = Object.values(payload)
+    const isApiKeyAuth = schema.get("type") === "apiKey"
+    const isInCookie = schema.get("in") === "cookie"
+    const isApiKeyInCookie = isApiKeyAuth && isInCookie
+
+    if (isApiKeyInCookie) {
+      document.cookie = `${schema.get("name")}=${value}; SameSite=None; Secure`
+    }
+  } catch (error) {
+    console.error(
+      "Error persisting cookie based apiKey in document.cookie.",
+      error
+    )
+  }
+}
+
+export const logout = (oriAction, system) => (payload) => {
+  const configs = system.getConfigs()
+  const authorized = system.authSelectors.authorized()
+
+  // dispose of cookie
+  try {
+    if (configs.persistAuthorization && Array.isArray(payload)) {
+      payload.forEach((authorizedName) => {
+        const auth = authorized.get(authorizedName, {})
+        const isApiKeyAuth = auth.getIn(["schema", "type"]) === "apiKey"
+        const isInCookie = auth.getIn(["schema", "in"]) === "cookie"
+        const isApiKeyInCookie = isApiKeyAuth && isInCookie
+
+        if (isApiKeyInCookie) {
+          const cookieName = auth.getIn(["schema", "name"])
+          document.cookie = `${cookieName}=; Max-Age=-99999999`
+        }
+      })
+    }
+  } catch (error) {
+    console.error(
+      "Error deleting cookie based apiKey from document.cookie.",
+      error
+    )
+  }
+
+  oriAction(payload)
+}

src/core/plugins/auth/wrap-actions.js

@@ -21,17 +21,6 @@ export function toggle(configName) {
 
 
 // Hook
-export const loaded = () => ({getConfigs, authActions}) => {
-  // check if we should restore authorization data from localStorage
-  const configs = getConfigs()
-  if (configs.persistAuthorization)
-  { 
-    const authorized = localStorage.getItem("authorized")                
-    if(authorized)
-    {      
-      authActions.restoreAuthorization({      
-        authorized: JSON.parse(authorized)
-      })                
-    }
-  }
+export const loaded = () => () => {
+  // noop
 }