Repository: auth0/auth0.js
Pull request #505 (2017-09-18 23:22:43)

Removing renewSession and keeping only checkSession

lbalmaceda: So if no session is present, the user *must* log in again?
luisrudge: yes, an error is returned `{error: 'login_required'}`

Patch:
diff --git a/example/index.html b/example/index.html
index d3257cd..ec43ff8 100644
--- a/example/index.html
+++ b/example/index.html
@@ -181,10 +181,6 @@
         <h2>Check if you have an active session:</h2>
         <input type="button" class="web-message-check-session" value="Check session" />
       </div>
-      <div>
-        <h2>Renew a session:</h2>
-        <input type="button" class="web-message-renew-session" value="Renew session" />
-      </div>
 
       <div>
         <h2>SSO Logout:</h2>
@@ -381,10 +377,6 @@
       e.preventDefault();
       webAuth.checkSession({}, htmlConsole.dumpCallback.bind(htmlConsole));
     });
-    $('.web-message-renew-session').click(function (e) {
-      e.preventDefault();
-      webAuth.renewSession({}, htmlConsole.dumpCallback.bind(htmlConsole));
-    });
     $(document.body).append($('<div class="loaded">LOADED</div>'));
   </script>
 </body>
diff --git a/src/web-auth/index.js b/src/web-auth/index.js
index 783b057..5bd3e83 100644
--- a/src/web-auth/index.js
+++ b/src/web-auth/index.js
@@ -318,47 +318,6 @@ WebAuth.prototype.renewAuth = function(options, cb) {
 /**
  * Renews an existing session on Auth0's servers using `response_mode=web_message`
  *
- * @method renewSession
- * @param {Object} options
- * @param {String} [options.domain] your Auth0 domain
- * @param {String} [options.clientID] your Auth0 client identifier obtained when creating the client in the Auth0 Dashboard
- * @param {String} [options.redirectUri] url that the Auth0 will redirect after Auth with the Authorization Response
- * @param {String} [options.responseType] type of the response used by OAuth 2.0 flow. It can be any space separated list of the values `code`, `token`, `id_token`. {@link https://openid.net/specs/oauth-v2-multiple-response-types-1_0}
- * @param {String} [options.state] value used to mitigate XSRF attacks. {@link https://auth0.com/docs/protocols/oauth2/oauth-state}
- * @param {String} [options.nonce] value used to mitigate replay attacks when using Implicit Grant. {@link https://auth0.com/docs/api-auth/tutorials/nonce}
- * @param {String} [options.scope] scopes to be requested during Auth. e.g. `openid email`
- * @param {String} [options.audience] identifier of the resource server who will consume the access token issued after Auth
- * @param {String} [options.timeout] value in milliseconds used to timeout when the `/authorize` call is failing as part of the silent authentication with postmessage enabled due to a configuration.
- */
-WebAuth.prototype.renewSession = function(options, cb) {
-  var params = objectHelper
-    .merge(this.baseOptions, [
-      'clientID',
-      'redirectUri',
-      'responseType',
-      'scope',
-      'audience',
-      '_csrf',
-      'state',
-      '_intstate',
-      'nonce'
-    ])
-    .with(options);
-
-  if (!options.nonce) {
-    params = this.transactionManager.process(params);
-  }
-
-  assert.check(params, { type: 'object', message: 'options parameter is not valid' });
-  assert.check(cb, { type: 'function', message: 'cb parameter is not valid' });
-
-  params = objectHelper.blacklist(params, ['usePostMessage', 'tenant', 'postMessageDataType']);
-  this.webMessageHandler.renewSession(params, cb);
-};
-
-/**
- * Checks if there is an existing session on Auth0's servers using `response_mode=web_message`
- *
  * @method checkSession
  * @param {Object} options
  * @param {String} [options.domain] your Auth0 domain
@@ -394,7 +353,6 @@ WebAuth.prototype.checkSession = function(options, cb) {
   assert.check(cb, { type: 'function', message: 'cb parameter is not valid' });
 
   params = objectHelper.blacklist(params, ['usePostMessage', 'tenant', 'postMessageDataType']);
-
   this.webMessageHandler.checkSession(params, cb);
 };
 
diff --git a/src/web-auth/web-message-handler.js b/src/web-auth/web-message-handler.js
index d1c8987..e7102ed 100644
--- a/src/web-auth/web-message-handler.js
+++ b/src/web-auth/web-message-handler.js
@@ -25,7 +25,7 @@ function WebMessageHandler(webAuth) {
   this.webAuth = webAuth;
 }
 
-WebMessageHandler.prototype.renewSession = function(options, cb) {
+WebMessageHandler.prototype.checkSession = function(options, cb) {
   options.responseMode = 'web_message';
   options.prompt = 'none';
   runWebMessageFlow(this.webAuth.client.buildAuthorizeUrl(options), options, function(
@@ -40,19 +40,4 @@ WebMessageHandler.prototype.renewSession = function(options, cb) {
   });
 };
 
-WebMessageHandler.prototype.checkSession = function(options, cb) {
-  options.responseMode = 'web_message';
-  options.prompt = 'none';
-  runWebMessageFlow(this.webAuth.client.buildAuthorizeUrl(options), options, function(
-    err,
-    eventData
-  ) {
-    var error = err || eventData.event.data.response.error;
-    if (error) {
-      cb(error);
-    }
-    cb(null, { hasSession: true });
-  });
-};
-
 module.exports = WebMessageHandler;


Test patch:
diff --git a/test/web-auth/web-auth.test.js b/test/web-auth/web-auth.test.js
index 821adfb..c454191 100644
--- a/test/web-auth/web-auth.test.js
+++ b/test/web-auth/web-auth.test.js
@@ -1253,95 +1253,6 @@ describe('auth0.WebAuth', function() {
     });
   });
 
-  context('renewSession', function() {
-    beforeEach(function() {
-      this.auth0 = new WebAuth({
-        domain: 'me.auth0.com',
-        clientID: '...',
-        redirectUri: 'http://page.com/callback',
-        responseType: 'token',
-        _sendTelemetry: false
-      });
-      stub(TransactionManager.prototype, 'process', function(params) {
-        return Object.assign({}, params, { from: 'transaction-manager' });
-      });
-    });
-    afterEach(function() {
-      TransactionManager.prototype.process.restore();
-      if (IframeHandler.prototype.init.restore) {
-        IframeHandler.prototype.init.restore();
-      }
-    });
-    it('inits IframeHandler with correct params', function(done) {
-      stub(IframeHandler.prototype, 'init', function() {
-        expect(this.url).to.be(
-          'https://me.auth0.com/authorize?client_id=...&response_type=token&redirect_uri=http%3A%2F%2Fpage.com%2Fcallback&from=transaction-manager&response_mode=web_message&prompt=none'
-        );
-        expect(this.eventListenerType).to.be('message');
-        expect(this.timeout).to.be(60000);
-        done();
-      });
-      this.auth0.renewSession({}, function(err, data) {});
-    });
-    it('uses custom timeout when provided', function(done) {
-      var timeout = 1;
-      stub(IframeHandler.prototype, 'init', function() {
-        expect(this.timeout).to.be(timeout);
-        done();
-      });
-      this.auth0.renewSession(
-        {
-          timeout: timeout
-        },
-        function(err, data) {}
-      );
-    });
-    it('eventValidator validates the event data type is `authorization_response`', function(done) {
-      stub(IframeHandler.prototype, 'init', function() {
-        var getEvent = function(type) {
-          return { event: { data: { type: type } } };
-        };
-        expect(this.eventValidator.isValid(getEvent('wrong'))).to.be(false);
-        expect(this.eventValidator.isValid(getEvent('authorization_response'))).to.be(true);
-        done();
-      });
-      this.auth0.renewSession({}, function(err, data) {});
-    });
-    it('timeoutCallback calls callback with error response', function(done) {
-      stub(IframeHandler.prototype, 'init', function() {
-        this.timeoutCallback();
-      });
-      this.auth0.renewSession({}, function(err, data) {
-        expect(err).to.be.eql({
-          error: 'timeout',
-          error_description: 'Timeout during fetching SSO data'
-        });
-        done();
-      });
-    });
-    it('callback handles error response', function(done) {
-      var error = 'the-error';
-      stub(IframeHandler.prototype, 'init', function() {
-        this.callback({ event: { data: { response: { error: error } } } });
-      });
-      this.auth0.renewSession({}, function(err, data) {
-        expect(err).to.be(error);
-        done();
-      });
-    });
-    it('callback handles success response', function(done) {
-      var response = { access_token: 'foobar' };
-      stub(IframeHandler.prototype, 'init', function() {
-        this.callback({ event: { data: { response: response } } });
-      });
-      this.auth0.renewSession({}, function(err, data) {
-        expect(err).to.be(null);
-        expect(data).to.be.eql({ accessToken: 'foobar' });
-        done();
-      });
-    });
-  });
-
   context('checkSession', function() {
     beforeEach(function() {
       this.auth0 = new WebAuth({
@@ -1419,12 +1330,13 @@ describe('auth0.WebAuth', function() {
       });
     });
     it('callback handles success response', function(done) {
+      var response = { access_token: 'foobar' };
       stub(IframeHandler.prototype, 'init', function() {
-        this.callback({ event: { data: { response: 'something' } } });
+        this.callback({ event: { data: { response: response } } });
       });
       this.auth0.checkSession({}, function(err, data) {
         expect(err).to.be(null);
-        expect(data).to.be.eql({ hasSession: true });
+        expect(data).to.be.eql({ accessToken: 'foobar' });
         done();
       });
     });