Keep Lockr API routing first-party without polling

crates/trusted-server-js/lib/src/integrations/lockr/api_guard.ts

@@ -0,0 +1,42 @@
+let uninstall: (() => void) | undefined;
+
+/**
+ * Keep root-relative Lockr API requests on the page origin, even with an external base URL.
+ */
+export function installLockrApiGuard(): void {
+  if (uninstall || typeof window === 'undefined' || typeof window.XMLHttpRequest === 'undefined') {
+    return;
+  }
+
+  const prototype = window.XMLHttpRequest.prototype;
+  const originalOpen = prototype.open;
+  const open: typeof originalOpen = function (
+    this: XMLHttpRequest,
+    ...args: [
+      method: string,
+      url: string | URL,
+      async?: boolean,
+      username?: string | null,
+      password?: string | null,
+    ]
+  ): void {
+    const url = args[1];
+    if (typeof url === 'string' && /^\/integrations\/lockr\/api(?:[/?#]|$)/.test(url)) {
+      args[1] = `${window.location.origin}${url}`;
+    }
+    Reflect.apply(originalOpen, this, args);
+  };
+
+  prototype.open = open;
+  uninstall = () => {
+    if (prototype.open === open) {
+      prototype.open = originalOpen;
+    }
+  };
+}
+
+/** Restore the original XHR method when this guard still owns it, primarily for tests. */
+export function resetApiGuardState(): void {
+  uninstall?.();
+  uninstall = undefined;
+}

crates/trusted-server-js/lib/src/integrations/lockr/index.ts

@@ -1,107 +1,7 @@
-import { log } from '../../core/log';
-
+import { installLockrApiGuard } from './api_guard';
 import { installLockrGuard } from './script_guard';
 
-// Type definition for Lockr global
-declare const identityLockr: IdentityLockr | undefined;
-
-interface IdentityLockr {
-  host: string;
-  app_id: string;
-  expiryDateKeys: string[];
-  firstPartyCookies: string[];
-  canRefreshToken: boolean;
-  macroDetectionEnabled: boolean;
-  iluiMacroDetection: boolean;
-  gdprApplies: boolean;
-  consentString: string;
-  gppString: string;
-  ccpaString: string;
-  isUTMTagsLoaded: boolean;
-  isFirstPartyCookiesLoaded: boolean;
-  allowedUTMTags: string[];
-  lockrTrackingID: string;
-  panoramaClientId: string;
-  writeToDeviceConsentEUID: boolean;
-  id5JSEnabled: boolean;
-  firstIDPassHEM: boolean;
-  panoramaPassHEM: boolean;
-  firstIDEnabled: boolean;
-  panoramaEnabled: boolean;
-  isAdelphicEnabled: boolean;
-  os: string;
-  browser: string;
-  country: string;
-  city: string;
-  latitude: string;
-  longitude: string;
-  ip: string;
-  hashedUserAgent: string;
-  tokenMappings: Record<string, string>;
-  tokenSourceMappings: Record<string, string>;
-  identitProvidersType: Record<string, string>;
-  identityIdEncryptionSalt: string;
-}
-
-/**
- * Install the Lockr shim to rewrite API endpoints to first-party domain.
- * This function is called after the Lockr SDK has loaded and initialized.
- */
-function installLockrShim() {
-  log.info('Installing Lockr shim - rewriting API host to first-party domain');
-
-  if (typeof identityLockr === 'undefined' || !identityLockr) {
-    log.warn('Lockr shim: identityLockr global not found');
-    return;
-  }
-
-  const host = window.location.host;
-  const protocol = window.location.protocol === 'https:' ? 'https' : 'http';
-
-  // Store original host for debugging
-  const originalHost = identityLockr.host;
-
-  // Rewrite to first-party domain
-  // The Lockr SDK will now make all API calls through our proxy
-  identityLockr.host = `${protocol}://${host}/integrations/lockr/api`;
-
-  log.info('Lockr shim installed', {
-    originalHost,
-    newHost: identityLockr.host,
-    appId: identityLockr.app_id,
-  });
-}
-
-/**
- * Wait for Lockr SDK to be available before installing shim.
- * Polls for SDK availability with a maximum number of attempts.
- *
- * @param callback - Function to call when SDK is available
- * @param maxAttempts - Maximum number of polling attempts (default: 50)
- */
-function waitForLockrSDK(callback: () => void, maxAttempts = 50) {
-  let attempts = 0;
-
-  const check = () => {
-    attempts++;
-
-    // Check if identityLockr global exists and is initialized with host
-    if (typeof identityLockr !== 'undefined' && identityLockr && identityLockr.host) {
-      log.info('Lockr SDK detected, installing shim');
-      callback();
-    } else if (attempts < maxAttempts) {
-      // Check again in 50ms
-      setTimeout(check, 50);
-    } else {
-      log.warn('Lockr SDK not detected after', maxAttempts * 50, 'ms');
-    }
-  };
-
-  check();
-}
-
 if (typeof window !== 'undefined') {
+  installLockrApiGuard();
   installLockrGuard();
-
-  waitForLockrSDK(() => installLockrShim());
 }

crates/trusted-server-js/lib/test/integrations/lockr/api_guard.test.ts

@@ -0,0 +1,177 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import {
+  installLockrApiGuard,
+  resetApiGuardState,
+} from '../../../src/integrations/lockr/api_guard';
+
+describe('Lockr API origin guard', () => {
+  let base: HTMLBaseElement;
+
+  beforeEach(() => {
+    resetApiGuardState();
+    base = document.createElement('base');
+    base.href = 'https://external-base.example/assets/';
+    document.head.appendChild(base);
+  });
+
+  afterEach(() => {
+    resetApiGuardState();
+    vi.restoreAllMocks();
+    vi.unstubAllGlobals();
+    base.remove();
+  });
+
+  it.each([
+    '/integrations/lockr/api',
+    '/integrations/lockr/api?key=value',
+    '/integrations/lockr/api#fragment',
+    '/integrations/lockr/api/publisher/app/v2/identityLockr/settings',
+    '/integrations/lockr/api/publisher/app/v2/identityLockr/page-view?key=value#fragment',
+    '/integrations/lockr/api/publisher/app/v2/identityLockr/revoke-consent',
+  ])('pins %s to the publisher origin', (url) => {
+    const open = vi.spyOn(XMLHttpRequest.prototype, 'open');
+    installLockrApiGuard();
+
+    new XMLHttpRequest().open('POST', url);
+
+    expect(open).toHaveBeenCalledExactlyOnceWith('POST', `${window.location.origin}${url}`);
+  });
+
+  it.each([
+    '/integrations/lockr/apiary',
+    '/integrations/lockr/api-v2/settings',
+    '/integrations/other/api/settings',
+    'integrations/lockr/api/settings',
+    '//vendor.example/integrations/lockr/api/settings',
+    'https://vendor.example/integrations/lockr/api/settings',
+    'https://publisher.example/integrations/lockr/api/settings',
+  ])('does not change unrelated or explicitly addressed URL %s', (url) => {
+    const open = vi.spyOn(XMLHttpRequest.prototype, 'open');
+    installLockrApiGuard();
+
+    new XMLHttpRequest().open('GET', url);
+
+    expect(open).toHaveBeenCalledExactlyOnceWith('GET', url);
+  });
+
+  it('preserves URL objects', () => {
+    const open = vi.spyOn(XMLHttpRequest.prototype, 'open');
+    const url = new URL('/integrations/lockr/api/settings', window.location.origin);
+    installLockrApiGuard();
+
+    new XMLHttpRequest().open('POST', url);
+
+    expect(open).toHaveBeenCalledExactlyOnceWith('POST', url);
+  });
+
+  it('preserves the receiver, sync mode, and authentication arguments', () => {
+    const open = vi.spyOn(XMLHttpRequest.prototype, 'open');
+    installLockrApiGuard();
+    const request = new XMLHttpRequest();
+
+    request.open('POST', '/integrations/lockr/api/settings', false, 'user', 'password');
+
+    expect(open).toHaveBeenCalledExactlyOnceWith(
+      'POST',
+      `${window.location.origin}/integrations/lockr/api/settings`,
+      false,
+      'user',
+      'password'
+    );
+    expect(open.mock.contexts).toEqual([request]);
+  });
+
+  it('preserves explicitly undefined optional arguments', () => {
+    const open = vi.spyOn(XMLHttpRequest.prototype, 'open');
+    installLockrApiGuard();
+
+    new XMLHttpRequest().open('GET', '/integrations/lockr/api/settings', true, undefined, null);
+
+    expect(open).toHaveBeenCalledExactlyOnceWith(
+      'GET',
+      `${window.location.origin}/integrations/lockr/api/settings`,
+      true,
+      undefined,
+      null
+    );
+  });
+
+  it('preserves native argument validation', () => {
+    installLockrApiGuard();
+    const request = new XMLHttpRequest();
+
+    expect(() => Reflect.apply(request.open, request, [])).toThrow('2 arguments required');
+    expect(() => request.open('INVALID METHOD', '/integrations/lockr/api/settings')).toThrow();
+  });
+
+  it('handles an external base added after installation without polling', () => {
+    base.remove();
+    const open = vi.spyOn(XMLHttpRequest.prototype, 'open');
+    vi.useFakeTimers();
+
+    try {
+      installLockrApiGuard();
+      document.head.appendChild(base);
+      vi.advanceTimersByTime(10_000);
+
+      new XMLHttpRequest().open('POST', '/integrations/lockr/api/settings');
+
+      expect(open).toHaveBeenCalledExactlyOnceWith(
+        'POST',
+        `${window.location.origin}/integrations/lockr/api/settings`
+      );
+      expect(vi.getTimerCount()).toBe(0);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('installs only once and restores the previous method on reset', () => {
+    const originalOpen = XMLHttpRequest.prototype.open;
+    installLockrApiGuard();
+    const guardedOpen = XMLHttpRequest.prototype.open;
+
+    installLockrApiGuard();
+
+    expect(guardedOpen).not.toBe(originalOpen);
+    expect(XMLHttpRequest.prototype.open).toBe(guardedOpen);
+
+    resetApiGuardState();
+    resetApiGuardState();
+
+    expect(XMLHttpRequest.prototype.open).toBe(originalOpen);
+
+    installLockrApiGuard();
+    expect(XMLHttpRequest.prototype.open).not.toBe(originalOpen);
+  });
+
+  it('does not overwrite a later XHR interceptor during reset', () => {
+    const originalOpen = XMLHttpRequest.prototype.open;
+    installLockrApiGuard();
+    const laterOpen = vi.fn(originalOpen);
+    XMLHttpRequest.prototype.open = laterOpen;
+
+    try {
+      resetApiGuardState();
+      expect(XMLHttpRequest.prototype.open).toBe(laterOpen);
+    } finally {
+      XMLHttpRequest.prototype.open = originalOpen;
+    }
+  });
+
+  it('does not patch XHR outside a browser', () => {
+    const originalOpen = XMLHttpRequest.prototype.open;
+    vi.stubGlobal('window', undefined);
+
+    installLockrApiGuard();
+
+    expect(XMLHttpRequest.prototype.open).toBe(originalOpen);
+  });
+
+  it('does not require XHR to be available', () => {
+    vi.stubGlobal('XMLHttpRequest', undefined);
+
+    expect(() => installLockrApiGuard()).not.toThrow();
+  });
+});