https://kolonial.cz/plugins/service-login/plugin.js

1/*
2 * Login-form half of the service login: recognizes an auth-server
3 * AuthorizationPayload token pasted into the username field (base64url CBOR
4 * tag 2015 — always starts with "2Qff") and performs the service login with
5 * it automatically. Also surfaces a failed redirect-flow login, which lands
6 * back on /login?service_login_error=1.
7 */
8GW.override(Pubweb.LoginScreen, {
9	'after:initComponent'() {
10		let params = new URLSearchParams(location.search);
11		if (params.get('service_login_error')) {
12			this.showError(_('Servisní přihlášení se nezdařilo.'));
13		}
14
15		// 'change' fires on every input, including paste
16		this.on('change', () => this.tryServiceLogin(), null, true);
17	},
18
19	isServiceToken(v) {
20		return typeof v == 'string' && v.trim().match(/^2Qff[A-Za-z0-9_-]{100,}$/);
21	},
22
23	async tryServiceLogin() {
24		let data = this.getFormFieldsData();
25		if (!this.isServiceToken(data.email) || this.serviceLoginBusy) {
26			return false;
27		}
28
29		this.serviceLoginBusy = true;
30		this.hideError();
31		let restore = this.setFormDisabled();
32		try {
33			let res = await REST.POST('plugins/service-login/login', {ap: data.email.trim()});
34
35			// don't go through afterLoginSuccess(): its onboarding
36			// computation has no bypass for service sessions and would
37			// push the admin into MFA enrollment on MFA-only instances
38			Application.session = res;
39			Application.onSessionReady();
40
41			this.navigateAfterServiceLogin();
42		} catch (ex) {
43			restore();
44			this.showError(ex.message);
45		} finally {
46			this.serviceLoginBusy = false;
47		}
48
49		return true;
50	},
51
52	/*
53	 * Leave the login page. The plugin is installed on any release since
54	 * 23.11.69: navigateAway()/redirectTarget exist only on MFA-era login
55	 * screens (23.11.115+), older ones handled ?redirect inline in onSave().
56	 * Either way the core falls back to location.href for non-SPA targets,
57	 * which would land on /api/...; those go to the app base instead.
58	 */
59	navigateAfterServiceLogin() {
60		let is_api = ref => !!ref && !!ref.match(/^\/{0,}api\//);
61
62		if (typeof this.navigateAway == 'function') {
63			if (is_api(this.redirectTarget)) {
64				this.redirectTarget = null;
65			}
66
67			this.navigateAway();
68			return;
69		}
70
71		let ref = new URLSearchParams(location.search).get('redirect');
72		if (!ref || is_api(ref)) {
73			ref = APP_BASE;
74		}
75
76		if (Application.findRouteForURL && !Application.findRouteForURL(new URL(ref, location.toString()))) {
77			location.href = ref;
78		} else {
79			Application.replaceRoute(ref);
80		}
81	},
82
83	'wrap:onSubmit'(origFn) {
84		// a token in the email-typed field would fail form validation;
85		// short-circuit before it runs
86		if (this.isServiceToken(this.getFormFieldsData().email)) {
87			return this.tryServiceLogin();
88		}
89
90		return origFn();
91	},
92});