The Tor Browser: comparison b2g/components/SignInToWebsite.jsm

--1:000000000000
+:89bd2351e0a5
+/* This Source Code Form is subject to the terms of the Mozilla Public
+* License, v. 2.0. If a copy of the MPL was not distributed with this file,
+* You can obtain one at http://mozilla.org/MPL/2.0/. */
+/*
+* SignInToWebsite.jsm - UX Controller and means for accessing identity
+* cookies on behalf of relying parties.
+*
+* Currently, the b2g security architecture isolates web applications
+* so that each window has access only to a local cookie jar:
+*
+*     To prevent Web apps from interfering with one another, each one is
+*     hosted on a separate domain, and therefore may only access the
+*     resources associated with its domain. These resources include
+*     things such as IndexedDB databases, cookies, offline storage,
+*     and so forth.
+*
+*     -- https://developer.mozilla.org/en-US/docs/Mozilla/Firefox_OS/Security/Security_model
+*
+* As a result, an authentication system like Persona cannot share its
+* cookie jar with multiple relying parties, and so would require a
+* fresh login request in every window.  This would not be a good
+* experience.
+*
+*
+* In order for navigator.id.request() to maintain state in a single
+* cookie jar, we cause all Persona interactions to take place in a
+* content context that is launched by the system application, with the
+* result that Persona has a single cookie jar that all Relying
+* Parties can use.  Since of course those Relying Parties cannot
+* reach into the system cookie jar, the Controller in this module
+* provides a way to get messages and data to and fro between the
+* Relying Party in its window context, and the Persona internal api
+* in its context.
+*
+* On the Relying Party's side, say a web page invokes
+* navigator.id.watch(), to register callbacks, and then
+* navigator.id.request() to request an assertion.  The navigator.id
+* calls are provided by nsDOMIdentity.  nsDOMIdentity messages down
+* to the privileged DOMIdentity code (using cpmm and ppmm message
+* managers).  DOMIdentity stores the state of Relying Party flows
+* using an Identity service (MinimalIdentity.jsm), and emits messages
+* requesting Persona functions (doWatch, doReady, doLogout).
+*
+* The Identity service sends these observer messages to the
+* Controller in this module, which in turn triggers content to open a
+* window to host the Persona js.  If user interaction is required,
+* content will open the trusty UI.  If user interaction is not required,
+* and we only need to get to Persona functions, content will open a
+* hidden iframe.  In either case, a window is opened into which the
+* controller causes the script identity.js to be injected.  This
+* script provides the glue between the in-page javascript and the
+* pipe back down to the Controller, translating navigator.internal
+* function callbacks into messages sent back to the Controller.
+*
+* As a result, a navigator.internal function in the hosted popup or
+* iframe can call back to the injected identity.js (doReady, doLogin,
+* or doLogout).  identity.js callbacks send messages back through the
+* pipe to the Controller.  The controller invokes the corresponding
+* function on the Identity Service (doReady, doLogin, or doLogout).
+* The IdentityService calls the corresponding callback for the
+* correct Relying Party, which causes DOMIdentity to send a message
+* up to the Relying Party through nsDOMIdentity
+* (Identity:RP:Watch:OnLogin etc.), and finally, nsDOMIdentity
+* receives these messages and calls the original callback that the
+* Relying Party registered (navigator.id.watch(),
+* navigator.id.request(), or navigator.id.logout()).
+*/
+"use strict";
+this.EXPORTED_SYMBOLS = ["SignInToWebsiteController"];
+const Ci = Components.interfaces;
+const Cu = Components.utils;
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "getRandomId",
+"resource://gre/modules/identity/IdentityUtils.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "IdentityService",
+"resource://gre/modules/identity/MinimalIdentity.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "Logger",
+"resource://gre/modules/identity/LogUtils.jsm");
+XPCOMUtils.defineLazyModuleGetter(this, "SystemAppProxy",
+"resource://gre/modules/SystemAppProxy.jsm");
+// The default persona uri; can be overwritten with toolkit.identity.uri pref.
+// Do this if you want to repoint to a different service for testing.
+// There's no point in setting up an observer to monitor the pref, as b2g prefs
+// can only be overwritten when the profie is recreated.  So just get the value
+// on start-up.
+let kPersonaUri = "https://firefoxos.persona.org";
+try {
+kPersonaUri = Services.prefs.getCharPref("toolkit.identity.uri");
+} catch(noSuchPref) {
+// stick with the default value
+}
+// JS shim that contains the callback functions that
+// live within the identity UI provisioning frame.
+const kIdentityShimFile = "chrome://b2g/content/identity.js";
+// Type of MozChromeEvents to handle id dialogs.
+const kOpenIdentityDialog = "id-dialog-open";
+const kDoneIdentityDialog = "id-dialog-done";
+const kCloseIdentityDialog = "id-dialog-close-iframe";
+// Observer messages to communicate to shim
+const kIdentityDelegateWatch = "identity-delegate-watch";
+const kIdentityDelegateRequest = "identity-delegate-request";
+const kIdentityDelegateLogout = "identity-delegate-logout";
+const kIdentityDelegateFinished = "identity-delegate-finished";
+const kIdentityDelegateReady = "identity-delegate-ready";
+const kIdentityControllerDoMethod = "identity-controller-doMethod";
+function log(...aMessageArgs) {
+Logger.log.apply(Logger, ["SignInToWebsiteController"].concat(aMessageArgs));
+}
+log("persona uri =", kPersonaUri);
+function sendChromeEvent(details) {
+details.uri = kPersonaUri;
+SystemAppProxy.dispatchEvent(details);
+}
+function Pipe() {
+this._watchers = [];
+}
+Pipe.prototype = {
+init: function pipe_init() {
+Services.obs.addObserver(this, "identity-child-process-shutdown", false);
+Services.obs.addObserver(this, "identity-controller-unwatch", false);
+},
+uninit: function pipe_uninit() {
+Services.obs.removeObserver(this, "identity-child-process-shutdown");
+Services.obs.removeObserver(this, "identity-controller-unwatch");
+},
+observe: function Pipe_observe(aSubject, aTopic, aData) {
+let options = {};
+if (aSubject) {
+options = aSubject.wrappedJSObject;
+}
+switch (aTopic) {
+case "identity-child-process-shutdown":
+log("pipe removing watchers by message manager");
+this._removeWatchers(null, options.messageManager);
+break;
+case "identity-controller-unwatch":
+log("unwatching", options.id);
+this._removeWatchers(options.id, options.messageManager);
+break;
+}
+},
+_addWatcher: function Pipe__addWatcher(aId, aMm) {
+log("Adding watcher with id", aId);
+for (let i = 0; i < this._watchers.length; ++i) {
+let watcher = this._watchers[i];
+if (this._watcher.id === aId) {
+watcher.count++;
+return;
+}
+}
+this._watchers.push({id: aId, count: 1, mm: aMm});
+},
+_removeWatchers: function Pipe__removeWatcher(aId, aMm) {
+let checkId = aId !== null;
+let index = -1;
+for (let i = 0; i < this._watchers.length; ++i) {
+let watcher = this._watchers[i];
+if (watcher.mm === aMm &&
+(!checkId || (checkId && watcher.id === aId))) {
+index = i;
+break;
+}
+}
+if (index !== -1) {
+if (checkId) {
+if (--(this._watchers[index].count) === 0) {
+this._watchers.splice(index, 1);
+}
+} else {
+this._watchers.splice(index, 1);
+}
+}
+if (this._watchers.length === 0) {
+log("No more watchers; clean up persona host iframe");
+let detail = {
+type: kCloseIdentityDialog
+};
+log('telling content to close the dialog');
+// tell content to close the dialog
+sendChromeEvent(detail);
+}
+},
+communicate: function(aRpOptions, aContentOptions, aMessageCallback) {
+let rpID = aRpOptions.id;
+let rpMM = aRpOptions.mm;
+if (rpMM) {
+this._addWatcher(rpID, rpMM);
+}
+log("RP options:", aRpOptions, "\n  content options:", aContentOptions);
+// This content variable is injected into the scope of
+// kIdentityShimFile, where it is used to access the BrowserID object
+// and its internal API.
+let mm = null;
+let uuid = getRandomId();
+let self = this;
+function removeMessageListeners() {
+if (mm) {
+mm.removeMessageListener(kIdentityDelegateFinished, identityDelegateFinished);
+mm.removeMessageListener(kIdentityControllerDoMethod, aMessageCallback);
+}
+}
+function identityDelegateFinished() {
+removeMessageListeners();
+let detail = {
+type: kDoneIdentityDialog,
+showUI: aContentOptions.showUI || false,
+id: kDoneIdentityDialog + "-" + uuid,
+requestId: aRpOptions.id
+};
+log('received delegate finished; telling content to close the dialog');
+sendChromeEvent(detail);
+self._removeWatchers(rpID, rpMM);
+}
+SystemAppProxy.addEventListener("mozContentEvent", function getAssertion(evt) {
+let msg = evt.detail;
+if (!msg.id.match(uuid)) {
+return;
+}
+switch (msg.id) {
+case kOpenIdentityDialog + '-' + uuid:
+if (msg.type === 'cancel') {
+// The user closed the dialog.  Clean up and call cancel.
+SystemAppProxy.removeEventListener("mozContentEvent", getAssertion);
+removeMessageListeners();
+aMessageCallback({json: {method: "cancel"}});
+} else {
+// The window has opened.  Inject the identity shim file containing
+// the callbacks in the content script.  This could be either the
+// visible popup that the user interacts with, or it could be an
+// invisible frame.
+let frame = evt.detail.frame;
+let frameLoader = frame.QueryInterface(Ci.nsIFrameLoaderOwner).frameLoader;
+mm = frameLoader.messageManager;
+try {
+mm.loadFrameScript(kIdentityShimFile, true, true);
+log("Loaded shim", kIdentityShimFile);
+} catch (e) {
+log("Error loading", kIdentityShimFile, "as a frame script:", e);
+}
+// There are two messages that the delegate can send back: a "do
+// method" event, and a "finished" event.  We pass the do-method
+// events straight to the caller for interpretation and handling.
+// If we receive a "finished" event, then the delegate is done, so
+// we shut down the pipe and clean up.
+mm.addMessageListener(kIdentityControllerDoMethod, aMessageCallback);
+mm.addMessageListener(kIdentityDelegateFinished, identityDelegateFinished);
+mm.sendAsyncMessage(aContentOptions.message, aRpOptions);
+}
+break;
+case kDoneIdentityDialog + '-' + uuid:
+// Received our assertion.  The message manager callbacks will handle
+// communicating back to the IDService.  All we have to do is remove
+// this listener.
+SystemAppProxy.removeEventListener("mozContentEvent", getAssertion);
+break;
+default:
+log("ERROR - Unexpected message: id=" + msg.id + ", type=" + msg.type + ", errorMsg=" + msg.errorMsg);
+break;
+}
+});
+// Tell content to open the identity iframe or trusty popup. The parameter
+// showUI signals whether user interaction is needed.  If it is, content will
+// open a dialog; if not, a hidden iframe.  In each case, BrowserID is
+// available in the context.
+let detail = {
+type: kOpenIdentityDialog,
+showUI: aContentOptions.showUI || false,
+id: kOpenIdentityDialog + "-" + uuid,
+requestId: aRpOptions.id
+};
+sendChromeEvent(detail);
+}
+};
+/*
+* The controller sits between the IdentityService used by DOMIdentity
+* and a content process launches an (invisible) iframe or (visible)
+* trusty UI.  Using an injected js script (identity.js), the
+* controller enables the content window to access the persona identity
+* storage in the system cookie jar and send events back via the
+* controller into IdentityService and DOM, and ultimately up to the
+* Relying Party, which is open in a different window context.
+*/
+this.SignInToWebsiteController = {
+/*
+* Initialize the controller.  To use a different content communication pipe,
+* such as when mocking it in tests, pass aOptions.pipe.
+*/
+init: function SignInToWebsiteController_init(aOptions) {
+aOptions = aOptions || {};
+this.pipe = aOptions.pipe || new Pipe();
+Services.obs.addObserver(this, "identity-controller-watch", false);
+Services.obs.addObserver(this, "identity-controller-request", false);
+Services.obs.addObserver(this, "identity-controller-logout", false);
+},
+uninit: function SignInToWebsiteController_uninit() {
+Services.obs.removeObserver(this, "identity-controller-watch");
+Services.obs.removeObserver(this, "identity-controller-request");
+Services.obs.removeObserver(this, "identity-controller-logout");
+},
+observe: function SignInToWebsiteController_observe(aSubject, aTopic, aData) {
+log("observe: received", aTopic, "with", aData, "for", aSubject);
+let options = null;
+if (aSubject) {
+options = aSubject.wrappedJSObject;
+}
+switch (aTopic) {
+case "identity-controller-watch":
+this.doWatch(options);
+break;
+case "identity-controller-request":
+this.doRequest(options);
+break;
+case "identity-controller-logout":
+this.doLogout(options);
+break;
+default:
+Logger.reportError("SignInToWebsiteController", "Unknown observer notification:", aTopic);
+break;
+}
+},
+/*
+* options:    method          required - name of method to invoke
+*             assertion       optional
+*/
+_makeDoMethodCallback: function SignInToWebsiteController__makeDoMethodCallback(aRpId) {
+return function SignInToWebsiteController_methodCallback(aOptions) {
+let message = aOptions.json;
+if (typeof message === 'string') {
+message = JSON.parse(message);
+}
+switch (message.method) {
+case "ready":
+IdentityService.doReady(aRpId);
+break;
+case "login":
+if (message._internalParams) {
+IdentityService.doLogin(aRpId, message.assertion, message._internalParams);
+} else {
+IdentityService.doLogin(aRpId, message.assertion);
+}
+break;
+case "logout":
+IdentityService.doLogout(aRpId);
+break;
+case "cancel":
+IdentityService.doCancel(aRpId);
+break;
+default:
+log("WARNING: wonky method call:", message.method);
+break;
+}
+};
+},
+doWatch: function SignInToWebsiteController_doWatch(aRpOptions) {
+// dom prevents watch from  being called twice
+let contentOptions = {
+message: kIdentityDelegateWatch,
+showUI: false
+};
+this.pipe.communicate(aRpOptions, contentOptions,
+this._makeDoMethodCallback(aRpOptions.id));
+},
+/**
+* The website is requesting login so the user must choose an identity to use.
+*/
+doRequest: function SignInToWebsiteController_doRequest(aRpOptions) {
+log("doRequest", aRpOptions);
+let contentOptions = {
+message: kIdentityDelegateRequest,
+showUI: true
+};
+this.pipe.communicate(aRpOptions, contentOptions,
+this._makeDoMethodCallback(aRpOptions.id));
+},
+/*
+*
+*/
+doLogout: function SignInToWebsiteController_doLogout(aRpOptions) {
+log("doLogout", aRpOptions);
+let contentOptions = {
+message: kIdentityDelegateLogout,
+showUI: false
+};
+this.pipe.communicate(aRpOptions, contentOptions,
+this._makeDoMethodCallback(aRpOptions.id));
+}
+};

The Tor Browser / file comparison

comparison: b2g/components/SignInToWebsite.jsm

b2g/components/SignInToWebsite.jsm