summaryrefslogtreecommitdiffstats
path: root/toolkit/identity/RelyingParty.jsm
diff options
context:
space:
mode:
authorMatt A. Tobin <mattatobin@localhost.localdomain>2018-02-02 04:16:08 -0500
committerMatt A. Tobin <mattatobin@localhost.localdomain>2018-02-02 04:16:08 -0500
commit5f8de423f190bbb79a62f804151bc24824fa32d8 (patch)
tree10027f336435511475e392454359edea8e25895d /toolkit/identity/RelyingParty.jsm
parent49ee0794b5d912db1f95dce6eb52d781dc210db5 (diff)
downloadUXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.gz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.lz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.xz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.zip
Add m-esr52 at 52.6.0
Diffstat (limited to 'toolkit/identity/RelyingParty.jsm')
-rw-r--r--toolkit/identity/RelyingParty.jsm367
1 files changed, 367 insertions, 0 deletions
diff --git a/toolkit/identity/RelyingParty.jsm b/toolkit/identity/RelyingParty.jsm
new file mode 100644
index 000000000..5996383ca
--- /dev/null
+++ b/toolkit/identity/RelyingParty.jsm
@@ -0,0 +1,367 @@
+/* -*- js-indent-level: 2; indent-tabs-mode: nil -*- */
+/* vim: set ft=javascript ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+const Cu = Components.utils;
+const Ci = Components.interfaces;
+const Cc = Components.classes;
+const Cr = Components.results;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/identity/LogUtils.jsm");
+Cu.import("resource://gre/modules/identity/IdentityStore.jsm");
+
+this.EXPORTED_SYMBOLS = ["RelyingParty"];
+
+XPCOMUtils.defineLazyModuleGetter(this, "objectCopy",
+ "resource://gre/modules/identity/IdentityUtils.jsm");
+
+XPCOMUtils.defineLazyModuleGetter(this,
+ "jwcrypto",
+ "resource://gre/modules/identity/jwcrypto.jsm");
+
+function log(...aMessageArgs) {
+ Logger.log.apply(Logger, ["RP"].concat(aMessageArgs));
+}
+function reportError(...aMessageArgs) {
+ Logger.reportError.apply(Logger, ["RP"].concat(aMessageArgs));
+}
+
+function IdentityRelyingParty() {
+ // The store is a singleton shared among Identity, RelyingParty, and
+ // IdentityProvider. The Identity module takes care of resetting
+ // state in the _store on shutdown.
+ this._store = IdentityStore;
+
+ this.reset();
+}
+
+IdentityRelyingParty.prototype = {
+ QueryInterface: XPCOMUtils.generateQI([Ci.nsISupports, Ci.nsIObserver]),
+
+ observe: function observe(aSubject, aTopic, aData) {
+ switch (aTopic) {
+ case "quit-application-granted":
+ Services.obs.removeObserver(this, "quit-application-granted");
+ this.shutdown();
+ break;
+
+ }
+ },
+
+ reset: function RP_reset() {
+ // Forget all documents that call in. (These are sometimes
+ // referred to as callers.)
+ this._rpFlows = {};
+ },
+
+ shutdown: function RP_shutdown() {
+ this.reset();
+ Services.obs.removeObserver(this, "quit-application-granted");
+ },
+
+ /**
+ * Register a listener for a given windowID as a result of a call to
+ * navigator.id.watch().
+ *
+ * @param aCaller
+ * (Object) an object that represents the caller document, and
+ * is expected to have properties:
+ * - id (unique, e.g. uuid)
+ * - loggedInUser (string or null)
+ * - origin (string)
+ *
+ * and a bunch of callbacks
+ * - doReady()
+ * - doLogin()
+ * - doLogout()
+ * - doError()
+ * - doCancel()
+ *
+ */
+ watch: function watch(aRpCaller) {
+ this._rpFlows[aRpCaller.id] = aRpCaller;
+ let origin = aRpCaller.origin;
+ let state = this._store.getLoginState(origin) || { isLoggedIn: false, email: null };
+
+ log("watch: rpId:", aRpCaller.id,
+ "origin:", origin,
+ "loggedInUser:", aRpCaller.loggedInUser,
+ "loggedIn:", state.isLoggedIn,
+ "email:", state.email);
+
+ // If the user is already logged in, then there are three cases
+ // to deal with:
+ //
+ // 1. the email is valid and unchanged: 'ready'
+ // 2. the email is null: 'login'; 'ready'
+ // 3. the email has changed: 'login'; 'ready'
+ if (state.isLoggedIn) {
+ if (state.email && aRpCaller.loggedInUser === state.email) {
+ this._notifyLoginStateChanged(aRpCaller.id, state.email);
+ return aRpCaller.doReady();
+
+ } else if (aRpCaller.loggedInUser === null) {
+ // Generate assertion for existing login
+ let options = {loggedInUser: state.email, origin: origin};
+ return this._doLogin(aRpCaller, options);
+ }
+ // A loggedInUser different from state.email has been specified.
+ // Change login identity.
+
+ let options = {loggedInUser: state.email, origin: origin};
+ return this._doLogin(aRpCaller, options);
+
+ // If the user is not logged in, there are two cases:
+ //
+ // 1. a logged in email was provided: 'ready'; 'logout'
+ // 2. not logged in, no email given: 'ready';
+
+ }
+ if (aRpCaller.loggedInUser) {
+ return this._doLogout(aRpCaller, {origin: origin});
+ }
+ return aRpCaller.doReady();
+ },
+
+ /**
+ * A utility for watch() to set state and notify the dom
+ * on login
+ *
+ * Note that this calls _getAssertion
+ */
+ _doLogin: function _doLogin(aRpCaller, aOptions, aAssertion) {
+ log("_doLogin: rpId:", aRpCaller.id, "origin:", aOptions.origin);
+
+ let loginWithAssertion = function loginWithAssertion(assertion) {
+ this._store.setLoginState(aOptions.origin, true, aOptions.loggedInUser);
+ this._notifyLoginStateChanged(aRpCaller.id, aOptions.loggedInUser);
+ aRpCaller.doLogin(assertion);
+ aRpCaller.doReady();
+ }.bind(this);
+
+ if (aAssertion) {
+ loginWithAssertion(aAssertion);
+ } else {
+ this._getAssertion(aOptions, function gotAssertion(err, assertion) {
+ if (err) {
+ reportError("_doLogin:", "Failed to get assertion on login attempt:", err);
+ this._doLogout(aRpCaller);
+ } else {
+ loginWithAssertion(assertion);
+ }
+ }.bind(this));
+ }
+ },
+
+ /**
+ * A utility for watch() to set state and notify the dom
+ * on logout.
+ */
+ _doLogout: function _doLogout(aRpCaller, aOptions) {
+ log("_doLogout: rpId:", aRpCaller.id, "origin:", aOptions.origin);
+
+ let state = this._store.getLoginState(aOptions.origin) || {};
+
+ state.isLoggedIn = false;
+ this._notifyLoginStateChanged(aRpCaller.id, null);
+
+ aRpCaller.doLogout();
+ aRpCaller.doReady();
+ },
+
+ /**
+ * For use with login or logout, emit 'identity-login-state-changed'
+ *
+ * The notification will send the rp caller id in the properties,
+ * and the email of the user in the message.
+ *
+ * @param aRpCallerId
+ * (integer) The id of the RP caller
+ *
+ * @param aIdentity
+ * (string) The email of the user whose login state has changed
+ */
+ _notifyLoginStateChanged: function _notifyLoginStateChanged(aRpCallerId, aIdentity) {
+ log("_notifyLoginStateChanged: rpId:", aRpCallerId, "identity:", aIdentity);
+
+ let options = {rpId: aRpCallerId};
+ Services.obs.notifyObservers({wrappedJSObject: options},
+ "identity-login-state-changed",
+ aIdentity);
+ },
+
+ /**
+ * Initiate a login with user interaction as a result of a call to
+ * navigator.id.request().
+ *
+ * @param aRPId
+ * (integer) the id of the doc object obtained in .watch()
+ *
+ * @param aOptions
+ * (Object) options including privacyPolicy, termsOfService
+ */
+ request: function request(aRPId, aOptions) {
+ log("request: rpId:", aRPId);
+ let rp = this._rpFlows[aRPId];
+
+ // Notify UX to display identity picker.
+ // Pass the doc id to UX so it can pass it back to us later.
+ let options = {rpId: aRPId, origin: rp.origin};
+ objectCopy(aOptions, options);
+
+ // Append URLs after resolving
+ let baseURI = Services.io.newURI(rp.origin, null, null);
+ for (let optionName of ["privacyPolicy", "termsOfService"]) {
+ if (aOptions[optionName]) {
+ options[optionName] = baseURI.resolve(aOptions[optionName]);
+ }
+ }
+
+ Services.obs.notifyObservers({wrappedJSObject: options}, "identity-request", null);
+ },
+
+ /**
+ * Invoked when a user wishes to logout of a site (for instance, when clicking
+ * on an in-content logout button).
+ *
+ * @param aRpCallerId
+ * (integer) the id of the doc object obtained in .watch()
+ *
+ */
+ logout: function logout(aRpCallerId) {
+ log("logout: RP caller id:", aRpCallerId);
+ let rp = this._rpFlows[aRpCallerId];
+ if (rp && rp.origin) {
+ let origin = rp.origin;
+ log("logout: origin:", origin);
+ this._doLogout(rp, {origin: origin});
+ } else {
+ log("logout: no RP found with id:", aRpCallerId);
+ }
+ // We don't delete this._rpFlows[aRpCallerId], because
+ // the user might log back in again.
+ },
+
+ getDefaultEmailForOrigin: function getDefaultEmailForOrigin(aOrigin) {
+ let identities = this.getIdentitiesForSite(aOrigin);
+ let result = identities.lastUsed || null;
+ log("getDefaultEmailForOrigin:", aOrigin, "->", result);
+ return result;
+ },
+
+ /**
+ * Return the list of identities a user may want to use to login to aOrigin.
+ */
+ getIdentitiesForSite: function getIdentitiesForSite(aOrigin) {
+ let rv = { result: [] };
+ for (let id in this._store.getIdentities()) {
+ rv.result.push(id);
+ }
+ let loginState = this._store.getLoginState(aOrigin);
+ if (loginState && loginState.email)
+ rv.lastUsed = loginState.email;
+ return rv;
+ },
+
+ /**
+ * Obtain a BrowserID assertion with the specified characteristics.
+ *
+ * @param aCallback
+ * (Function) Callback to be called with (err, assertion) where 'err'
+ * can be an Error or NULL, and 'assertion' can be NULL or a valid
+ * BrowserID assertion. If no callback is provided, an exception is
+ * thrown.
+ *
+ * @param aOptions
+ * (Object) An object that may contain the following properties:
+ *
+ * "audience" : The audience for which the assertion is to be
+ * issued. If this property is not set an exception
+ * will be thrown.
+ *
+ * Any properties not listed above will be ignored.
+ */
+ _getAssertion: function _getAssertion(aOptions, aCallback) {
+ let audience = aOptions.origin;
+ let email = aOptions.loggedInUser || this.getDefaultEmailForOrigin(audience);
+ log("_getAssertion: audience:", audience, "email:", email);
+ if (!audience) {
+ throw "audience required for _getAssertion";
+ }
+
+ // We might not have any identity info for this email
+ if (!this._store.fetchIdentity(email)) {
+ this._store.addIdentity(email, null, null);
+ }
+
+ let cert = this._store.fetchIdentity(email)['cert'];
+ if (cert) {
+ this._generateAssertion(audience, email, function generatedAssertion(err, assertion) {
+ if (err) {
+ log("ERROR: _getAssertion:", err);
+ }
+ log("_getAssertion: generated assertion:", assertion);
+ return aCallback(err, assertion);
+ });
+ }
+ },
+
+ /**
+ * Generate an assertion, including provisioning via IdP if necessary,
+ * but no user interaction, so if provisioning fails, aCallback is invoked
+ * with an error.
+ *
+ * @param aAudience
+ * (string) web origin
+ *
+ * @param aIdentity
+ * (string) the email we're logging in with
+ *
+ * @param aCallback
+ * (function) callback to invoke on completion
+ * with first-positional parameter the error.
+ */
+ _generateAssertion: function _generateAssertion(aAudience, aIdentity, aCallback) {
+ log("_generateAssertion: audience:", aAudience, "identity:", aIdentity);
+
+ let id = this._store.fetchIdentity(aIdentity);
+ if (! (id && id.cert)) {
+ let errStr = "Cannot generate an assertion without a certificate";
+ log("ERROR: _generateAssertion:", errStr);
+ aCallback(errStr);
+ return;
+ }
+
+ let kp = id.keyPair;
+
+ if (!kp) {
+ let errStr = "Cannot generate an assertion without a keypair";
+ log("ERROR: _generateAssertion:", errStr);
+ aCallback(errStr);
+ return;
+ }
+
+ jwcrypto.generateAssertion(id.cert, kp, aAudience, aCallback);
+ },
+
+ /**
+ * Clean up references to the provisioning flow for the specified RP.
+ */
+ _cleanUpProvisionFlow: function RP_cleanUpProvisionFlow(aRPId, aProvId) {
+ let rp = this._rpFlows[aRPId];
+ if (rp) {
+ delete rp['provId'];
+ } else {
+ log("Error: Couldn't delete provision flow ", aProvId, " for RP ", aRPId);
+ }
+ },
+
+};
+
+this.RelyingParty = new IdentityRelyingParty();