imterah/element-portable
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add a prompt when interacting with an identity server without terms

Browse source 
This adds a prompt whenever we are about to perform some action on a default identity
server (from homeserver .well-known or Riot app config) without terms. This
allows the user to abort or trust the server (storing it in account data).

Fixes https://github.com/vector-im/riot-web/issues/10557
This commit is contained in:
J. Ryan Stinnett 2019-10-31 11:58:31 +00:00
parent 54cea6a5e3
commit 0fc5108817
4 changed files with 81 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

54
src/IdentityAuthClient.js
View file

@ -17,7 +17,18 @@ limitations under the License.
import { createClient, SERVICE_TYPES } from 'matrix-js-sdk';
import MatrixClientPeg from './MatrixClientPeg';
import Modal from './Modal';
import sdk from './index';
import { _t } from './languageHandler';
import { Service, startTermsFlow, TermsNotSignedError } from './Terms';
import {
doesAccountDataHaveIdentityServer,
doesIdentityServerHaveTerms,
useDefaultIdentityServer,
} from './utils/IdentityServerUtils';
import { abbreviateUrl } from './utils/UrlUtils';
export class AbortedIdentityActionError extends Error {}
export default class IdentityAuthClient {
/**
@ -89,7 +100,10 @@ export default class IdentityAuthClient {
try {
await this._checkToken(token);
} catch (e) {
if (e instanceof TermsNotSignedError) {
if (
e instanceof TermsNotSignedError ||
e instanceof AbortedIdentityActionError
) {
// Retrying won't help this
throw e;
}
@ -106,6 +120,8 @@ export default class IdentityAuthClient {
}
async _checkToken(token) {
const identityServerUrl = this._matrixClient.getIdentityServerUrl();
try {
await this._matrixClient.getIdentityAccount(token);
} catch (e) {
@ -113,7 +129,7 @@ export default class IdentityAuthClient {
console.log("Identity Server requires new terms to be agreed to");
await startTermsFlow([new Service(
SERVICE_TYPES.IS,
this._matrixClient.getIdentityServerUrl(),
identityServerUrl,
token,
)]);
return;
@ -121,6 +137,40 @@ export default class IdentityAuthClient {
throw e;
}
if (
!this.tempClient &&
!doesAccountDataHaveIdentityServer() &&
!await doesIdentityServerHaveTerms(identityServerUrl)
) {
const QuestionDialog = sdk.getComponent("dialogs.QuestionDialog");
const { finished } = Modal.createTrackedDialog('Default identity server terms warning', '',
QuestionDialog, {
title: _t("Identity server has no terms of service"),
description: <div>
<p>{_t(
"This action requires accessing the default identity server " +
"<server /> to validate an email address or phone number, but the server " +
"does not have any terms of service.", {},
{
server: () => <b>{abbreviateUrl(identityServerUrl)}</b>,
},
)}</p>
<p>{_t(
"Only continue if you trust the owner of the server.",
)}</p>
</div>,
button: _t("Trust"),
});
const [confirmed] = await finished;
if (confirmed) {
useDefaultIdentityServer();
} else {
throw new AbortedIdentityActionError(
"User aborted identity server action without terms",
);
}
}
// We should ensure the token in `localStorage` is cleared
// appropriately. We already clear storage on sign out, but we'll need
// additional clearing when changing ISes in settings as part of future