oauth params confusion

[rosano]

remotestorage.js/src/authorize.ts

Lines 299 to 307 in 3ff3b17

	if (params.state) {
	location = Authorize.getLocation();
	Authorize.setLocation(location.href.split('#')[0]+'#'+params.state);
	}
	if (params.code) { // OAuth2 code or PKCE flow
	fetchTokens(params.code); // remote.configure() called asynchronously
	authParamsUsed = true;
	}

I suspect these lines are creating an issue when I try to implement the oauth dance in my app. I'm only using remoteStorage to save app data in anonymous mode, so I thought the code and state params would be ignored by this library; not sure why these params are consumed if I have not attempted to connect any storage.

Using version 2.0.0-beta.7 consumes these params: https://remit-serve.rosano.ca/https://raw.githubusercontent.com/rosano/far/56d8ae4bf78b123f0bc26eba297a214379c738cf/index.html?code=alfa&state=bravo

Using version 1.2.3 does not: https://remit-serve.rosano.ca/https://raw.githubusercontent.com/rosano/far/f11090eb28665e5ef15792d6d26ca3671fb2fa5d/index.html?code=alfa&state=bravo

[raucao]

I think that's from adding PKCE for Dropbox auth?

[DougReeder]

Lines through 303 appear to date back to 2020. Lines 304–308 [if (params.code)... ] were added or changed for PKCE.

IIRC, there's no automated test for when parameters are passed in anonymous mode.

[rosano]

IIRC, there's no automated test for when parameters are passed in anonymous mode.

I think these two tests are related, but perhaps not specific to anon mode:

remotestorage.js/test/unit/authorize.test.mjs

Line 115 in 3ff3b17

it("when it sees a code but no code verifier, doesn't call remote.configure()", async () => {

remotestorage.js/test/unit/authorize.test.mjs

Line 131 in 3ff3b17

it("when it sees a code & code verifier, calls the token endpoint & sets the access token", async () => {

For some reason the second one seemed to pass when I first ran the mocha tests, but now it doesn't 🤔.