fix(auth): harden session restoration guards

Author: Polyterative

src/app/features/backbone/login/user-auth-guard.service.spec.ts

@@ -1,62 +1,144 @@
+import {
+  ActivatedRouteSnapshot,
+  RouterStateSnapshot
+} from '@angular/router';
 import { UserAuthGuard } from './user-auth-guard.service';
 import {
   BehaviorSubject,
-  EMPTY
+  EMPTY,
+  ReplaySubject
 } from 'rxjs';
+import { UserManagementService } from './user-management.service';
+
+
+type UserStub = { id: string } | null;
+
+const route = {} as ActivatedRouteSnapshot;
 
+function state(url: string): RouterStateSnapshot {
+  return {url} as RouterStateSnapshot;
+}
+
+function createSnackRef() {
+  return {
+    onAction: jasmine.createSpy('onAction').and.returnValue(EMPTY),
+    afterDismissed: jasmine.createSpy('afterDismissed').and.returnValue(EMPTY),
+    dismiss: jasmine.createSpy('dismiss')
+  };
+}
 
-function buildGuard(loggedUser: any = null) {
-  const loggedUser$ = new BehaviorSubject<any>(loggedUser);
-  const snackRef = {onAction: jasmine.createSpy('onAction').and.returnValue(EMPTY), _open: jasmine.createSpy('_open')};
+function buildGuard(loggedUser: UserStub = null) {
+  const loggedUser$ = new BehaviorSubject<UserStub>(loggedUser);
+  const authRestored$ = new BehaviorSubject<boolean>(true);
+  const snackRef = createSnackRef();
   const snackBar = jasmine.createSpyObj('MatSnackBar', {open: snackRef});
   const router = jasmine.createSpyObj('Router', ['navigate']);
   const guard = new UserAuthGuard(
     snackBar, router,
-    {loggedUser$} as any
+    {loggedUser$, authRestored$} as unknown as UserManagementService
   );
-  return {guard, snackBar, router, snackRef};
+  return {guard, snackBar, router, snackRef, authRestored$, loggedUser$};
 }
 
 
 describe('UserAuthGuard', () => {
   it('returns true when user is logged in', (done) => {
     const {guard} = buildGuard({id: 'user-1'});
-    guard.canActivate({} as any, {url: '/protected'} as any).subscribe(can => {
+    guard.canActivate(route, state('/protected')).subscribe(can => {
       expect(can).toBeTrue();
       done();
     });
   });
 
   it('returns false when user is not logged in', (done) => {
     const {guard} = buildGuard(null);
-    guard.canActivate({} as any, {url: '/protected'} as any).subscribe(can => {
+    guard.canActivate(route, state('/protected')).subscribe(can => {
       expect(can).toBeFalse();
       done();
     });
   });
 
   it('opens snackbar when user is not logged in', (done) => {
     const {guard, snackBar} = buildGuard(null);
-    guard.canActivate({} as any, {url: '/protected'} as any).subscribe(() => {
+    guard.canActivate(route, state('/protected')).subscribe(() => {
       expect(snackBar.open).toHaveBeenCalledWith('Sign in to use this feature.', 'Sign in', jasmine.anything());
       done();
     });
   });
 
   it('navigates to login with returnUrl when user is not logged in', (done) => {
     const {guard, router} = buildGuard(null);
-    guard.canActivate({} as any, {url: '/my-page'} as any).subscribe(() => {
+    guard.canActivate(route, state('/my-page')).subscribe(() => {
       expect(router.navigate).toHaveBeenCalledWith(['/auth/login'], jasmine.objectContaining({queryParams: {returnUrl: '/my-page'}}));
       done();
     });
   });
 
   it('does not navigate or open snackbar when user is logged in', (done) => {
     const {guard, snackBar, router} = buildGuard({id: 'user-1'});
-    guard.canActivate({} as any, {url: '/protected'} as any).subscribe(() => {
+    guard.canActivate(route, state('/protected')).subscribe(() => {
+      expect(snackBar.open).not.toHaveBeenCalled();
+      expect(router.navigate).not.toHaveBeenCalled();
+      done();
+    });
+  });
+
+  it('waits for auth restoration before allowing a restored user', (done) => {
+    const loggedUser$ = new ReplaySubject<UserStub>(1);
+    const authRestored$ = new BehaviorSubject<boolean>(false);
+    const snackRef = createSnackRef();
+    const snackBar = jasmine.createSpyObj('MatSnackBar', {open: snackRef});
+    const router = jasmine.createSpyObj('Router', ['navigate']);
+    const guard = new UserAuthGuard(snackBar, router, {loggedUser$, authRestored$} as unknown as UserManagementService);
+
+    guard.canActivate(route, state('/protected')).subscribe(can => {
+      expect(can).toBeTrue();
       expect(snackBar.open).not.toHaveBeenCalled();
       expect(router.navigate).not.toHaveBeenCalled();
       done();
     });
+
+    loggedUser$.next({id: 'user-1'});
+    expect(snackBar.open).not.toHaveBeenCalled();
+    expect(router.navigate).not.toHaveBeenCalled();
+
+    authRestored$.next(true);
+  });
+
+  it('waits for auth restoration before rejecting a restored signed-out session', (done) => {
+    const loggedUser$ = new ReplaySubject<UserStub>(1);
+    const authRestored$ = new BehaviorSubject<boolean>(false);
+    const snackRef = createSnackRef();
+    const snackBar = jasmine.createSpyObj('MatSnackBar', {open: snackRef});
+    const router = jasmine.createSpyObj('Router', ['navigate']);
+    const guard = new UserAuthGuard(snackBar, router, {loggedUser$, authRestored$} as unknown as UserManagementService);
+
+    guard.canActivate(route, state('/protected')).subscribe(can => {
+      expect(can).toBeFalse();
+      expect(snackBar.open).toHaveBeenCalledTimes(1);
+      expect(router.navigate).toHaveBeenCalledWith(['/auth/login'], jasmine.objectContaining({queryParams: {returnUrl: '/protected'}}));
+      done();
+    });
+
+    loggedUser$.next(null);
+    expect(snackBar.open).not.toHaveBeenCalled();
+    expect(router.navigate).not.toHaveBeenCalled();
+
+    authRestored$.next(true);
+  });
+
+  it('reuses an active sign-in snackbar across repeated guard denials', (done) => {
+    const {guard, snackBar} = buildGuard(null);
+    let emissions = 0;
+
+    guard.canActivate(route, state('/first')).subscribe(() => {
+      emissions++;
+    });
+    guard.canActivate(route, state('/second')).subscribe(() => {
+      emissions++;
+      expect(emissions).toBe(2);
+      expect(snackBar.open).toHaveBeenCalledTimes(1);
+      done();
+    });
   });
 });

src/app/features/backbone/login/user-auth-guard.service.ts

@@ -2,64 +2,86 @@ import {
   inject,
   Injectable
 } from '@angular/core';
-import { MatSnackBar } from "@angular/material/snack-bar";
+import {
+  MatSnackBar,
+  MatSnackBarRef,
+  TextOnlySnackBar
+} from "@angular/material/snack-bar";
 import {
   ActivatedRouteSnapshot,
   CanActivateFn,
   Router,
   RouterStateSnapshot
 } from '@angular/router';
 import {
+  filter,
   map,
-  of,
   tap
 } from 'rxjs';
 import { UserManagementService } from './user-management.service';
 import {
   switchMap,
-  take,
-  timeout
+  take
 } from "rxjs/operators";
 
 
 @Injectable()
 export class UserAuthGuard {
+  private signInSnack?: MatSnackBarRef<TextOnlySnackBar>;
+
   constructor(
     private snackBar: MatSnackBar,
     private router: Router,
     private authenticationService: UserManagementService
   ) { }
+
+  private showSignInPrompt(returnUrl: string): void {
+    if (!this.signInSnack) {
+      this.signInSnack = this.snackBar.open('Sign in to use this feature.', 'Sign in', {
+        duration: 10000,
+        panelClass: 'snack-info'
+      });
+
+      this.signInSnack.onAction()
+          .pipe(take(1))
+          .subscribe(() => this.router.navigate(['/auth/login'], {queryParams: {returnUrl}}));
+
+      this.signInSnack.afterDismissed()
+          .pipe(take(1))
+          .subscribe(() => {
+            this.signInSnack = undefined;
+          });
+    }
+
+    this.router.navigate(['/auth/login'], {queryParams: {returnUrl}});
+  }
+
+  private dismissSignInPrompt(): void {
+    this.signInSnack?.dismiss();
+    this.signInSnack = undefined;
+  }
 
   canActivate(
     route: ActivatedRouteSnapshot, state: RouterStateSnapshot
   ) {
-    return of(undefined).pipe(
+    return this.authenticationService.authRestored$.pipe(
+      filter(Boolean),
+      take(1),
       switchMap(() => this.authenticationService.loggedUser$.pipe(
-        take(1),
-        timeout({ first: 8000, with: () => of(undefined) })
+        take(1)
       )),
       tap((user) => {
         if (!user) {
-          const snack = this.snackBar.open('Sign in to use this feature.', 'Sign in', {
-            duration: 10000,
-            panelClass: 'snack-info'
-          });
-      
-          snack.onAction()
-               .subscribe(x => this.router.navigate(['/auth/login'], {queryParams: {returnUrl: state.url}}));
-        
-          snack._open();
-          
-          // route to the login page if the user is not logged in
-          this.router.navigate(['/auth/login'], {queryParams: {returnUrl: state.url}});
-        
+          this.showSignInPrompt(state.url);
+        } else {
+          this.dismissSignInPrompt();
         }
-      
+
       }),
       map((user) => !!user)
     );
-  
-  
+
+
   }
 }