From af31ca758cb8f7057f54bc2d59b194125c41ec96 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?No=C3=A9mie=20Lehuby?= <noemie.lehuby@zaclys.net>
Date: Thu, 18 Apr 2024 10:29:00 +0200
Subject: [PATCH] Switch to OAuth 2.0

https://github.com/openstreetmap/operations/issues/867
---
 assets/osm-auth_2.4.0/osm-auth.iife.min.js.js |  8 +++++
 config.js                                     | 35 +++++++++++--------
 index.html                                    |  2 +-
 3 files changed, 30 insertions(+), 15 deletions(-)
 create mode 100644 assets/osm-auth_2.4.0/osm-auth.iife.min.js.js

diff --git a/assets/osm-auth_2.4.0/osm-auth.iife.min.js.js b/assets/osm-auth_2.4.0/osm-auth.iife.min.js.js
new file mode 100644
index 0000000..2819b65
--- /dev/null
+++ b/assets/osm-auth_2.4.0/osm-auth.iife.min.js.js
@@ -0,0 +1,8 @@
+/**
+ * Skipped minification because the original files appears to be already minified.
+ * Original file: /npm/osm-auth@2.4.0/dist/osm-auth.iife.js
+ *
+ * Do NOT use SRI with dynamically generated files! More information: https://www.jsdelivr.com/using-sri-with-dynamic-files
+ */
+var osmAuth=(function(){var v=Object.defineProperty;var M=Object.getOwnPropertyDescriptor;var P=Object.getOwnPropertyNames;var T=Object.prototype.hasOwnProperty;var U=function(t,e){for(var s in e)v(t,s,{get:e[s],enumerable:!0})},k=function(t,e,s,d){if(e&&typeof e=="object"||typeof e=="function")for(var a=P(e),h=0,p=a.length,f;h<p;h++)f=a[h],!T.call(t,f)&&f!==s&&v(t,f,{get:function(n){return e[n]}.bind(null,f),enumerable:!(d=M(e,f))||d.enumerable});return t};var R=function(t){return k(v({},"__esModule",{value:!0}),t)};var E={};U(E,{osmAuth:function(){return x}});function x(t){var e={},s=null;try{s=window.localStorage}catch(n){var d=new Map;s={isMocked:!0,hasItem:function(r){return d.has(r)},getItem:function(r){return d.get(r)},setItem:function(r,o){return d.set(r,o)},removeItem:function(r){return d.delete(r)},clear:function(){return d.clear()}}}function a(n,r){if(arguments.length===1)return s.getItem(t.url+n);if(arguments.length===2)return s.setItem(t.url+n,r)}e.authenticated=function(){return!!a("oauth2_access_token")},e.logout=function(){return a("oauth2_access_token",""),a("oauth_token",""),a("oauth_token_secret",""),a("oauth_request_token_secret",""),e},e.authenticate=function(n){if(e.authenticated()){n(null,e);return}e.logout(),h(function(r,o){r?n(r):C(function(u){p(u,o,n)})})},e.authenticateAsync=function(){return e.authenticated()?Promise.resolve(e):(e.logout(),new Promise(function(n,r){var o=function(u,i){u?r(u):n(i)};h(function(u,i){u?o(u):C(function(c){return p(c,i,o)})})}))};function h(n){if(t.singlepage){n(null,void 0);return}var r=550,o=610,u=[["width",r],["height",o],["left",window.screen.width/2-r/2],["top",window.screen.height/2-o/2]].map(function(l){return l.join("=")}).join(","),i=window.open("about:blank","oauth_window",u);if(i)n(null,i);else{var c=new Error("Popup was blocked");c.status="popup-blocked",n(c)}}function p(n,r,o){var u=W(),i=t.url+"/oauth2/authorize?"+A({client_id:t.client_id,redirect_uri:t.redirect_uri,response_type:"code",scope:t.scope,state:u,code_challenge:n.code_challenge,code_challenge_method:n.code_challenge_method});if(t.singlepage){if(s.isMocked){var c=new Error("localStorage unavailable, but required in singlepage mode");c.status="pkce-localstorage-unavailable",o(c);return}var l=m(window.location.search.slice(1));l.code?e.bootstrapToken(l.code,o):(a("oauth2_state",u),a("oauth2_pkce_code_verifier",n.code_verifier),window.location=i)}else e.popupWindow=r,r.location=i;window.authComplete=function(_){var g=m(_.split("?")[1]);if(g.state!==u){c=new Error("Invalid state"),c.status="invalid-state",o(c);return}f(g.code,n.code_verifier,w),delete window.authComplete};function w(_,g){if(t.done(),_){o(_);return}var S=JSON.parse(g.response);a("oauth2_access_token",S.access_token),o(null,e)}}function f(n,r,o){var u=t.url+"/oauth2/token?"+A({client_id:t.client_id,redirect_uri:t.redirect_uri,grant_type:"authorization_code",code:n,code_verifier:r});e.rawxhr("POST",u,null,null,null,o),t.loading()}return e.bringPopupWindowToFront=function(){var n=!1;try{e.popupWindow&&!e.popupWindow.closed&&(e.popupWindow.focus(),n=!0)}catch(r){}return n},e.bootstrapToken=function(n,r){var o=a("oauth2_state");a("oauth2_state","");var u=m(window.location.search.slice(1));if(u.state!==o){var i=new Error("Invalid state");i.status="invalid-state",r(i);return}var c=a("oauth2_pkce_code_verifier");a("oauth2_pkce_code_verifier",""),f(n,c,l);function l(w,_){if(t.done(),w){r(w);return}var g=JSON.parse(_.response);a("oauth2_access_token",g.access_token),r(null,e)}},e.fetch=function(n,r){if(e.authenticated())return o();return t.auto?e.authenticateAsync().then(o):Promise.reject(new Error("not authenticated"));function o(){return r=r||{},r.headers||(r.headers={"Content-Type":"application/x-www-form-urlencoded"}),r.headers.Authorization="Bearer "+a("oauth2_access_token"),fetch(n,r)}},e.xhr=function(n,r){if(e.authenticated())return o();if(t.auto){e.authenticate(o);return}else{r("not authenticated",null);return}function o(){var i=n.prefix!==!1?t.apiUrl+n.path:n.path;return e.rawxhr(n.method,i,a("oauth2_access_token"),n.content,n.headers,u)}function u(i,c){i?r(i):c.responseXML?r(i,c.responseXML):r(i,c.response)}},e.rawxhr=function(n,r,o,u,i,c){i=i||{"Content-Type":"application/x-www-form-urlencoded"},o&&(i.Authorization="Bearer "+o);var l=new XMLHttpRequest;l.onreadystatechange=function(){l.readyState===4&&l.status!==0&&(/^20\d$/.test(l.status)?c(null,l):c(l,null))},l.onerror=function(_){c(_,null)},l.open(n,r,!0);for(var w in i)l.setRequestHeader(w,i[w]);return l.send(u),l},e.preauth=function(n){return n&&n.access_token&&a("oauth2_access_token",n.access_token),e},e.options=function(n){return arguments.length?(t=n,t.apiUrl=t.apiUrl||"https://api.openstreetmap.org",t.url=t.url||"https://www.openstreetmap.org",t.auto=t.auto||!1,t.singlepage=t.singlepage||!1,t.loading=t.loading||function(){},t.done=t.done||function(){},e.preauth(t)):t},e.options(t),e}function A(t){return Object.keys(t).filter(function(e){return t[e]!==void 0}).sort().map(function(e){return encodeURIComponent(e)+"="+encodeURIComponent(t[e])}).join("&")}function m(t){for(var e=0;e<t.length&&(t[e]==="?"||t[e]==="#");)e++;return t=t.slice(e),t.split("&").reduce(function(s,d){var a=d.split("=");return a.length===2&&(s[a[0]]=decodeURIComponent(a[1])),s},{})}function I(){return window&&window.crypto&&window.crypto.getRandomValues&&window.crypto.subtle&&window.crypto.subtle.digest}function C(t){var e;if(I()){var s=window.crypto.getRandomValues(new Uint8Array(32));e=y(s.buffer);var d=Uint8Array.from(Array.from(e).map(function(p){return p.charCodeAt(0)}));window.crypto.subtle.digest("SHA-256",d).then(function(p){var f=y(p);t({code_challenge:f,code_verifier:e,code_challenge_method:"S256"})})}else{var a="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";e="";for(var h=0;h<64;h++)e+=a[Math.floor(Math.random()*a.length)];t({code_verifier:e,code_challenge:e,code_challenge_method:"plain"})}}function W(){var t;if(I()){var e=window.crypto.getRandomValues(new Uint8Array(32));t=y(e.buffer)}else{var s="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";t="";for(var d=0;d<64;d++)t+=s[Math.floor(Math.random()*s.length)]}return t}function y(t){return btoa(String.fromCharCode.apply(null,new Uint8Array(t))).replace(/\//g,"_").replace(/\+/g,"-").replace(/[=]/g,"")}return R(E);})();
+//# sourceMappingURL=osm-auth.iife.js.map
diff --git a/config.js b/config.js
index 7919cf5..edface7 100644
--- a/config.js
+++ b/config.js
@@ -1,4 +1,4 @@
-var editorName = 'Sidewalker'
+var editorName = 'Luke Sidewalker'
 var version = '0.0.1'
 
 var useTestServer = false;
@@ -7,24 +7,31 @@ var urlOverpass = 'https://overpass-api.de/api/interpreter?data=';
 var urlJosm = 'http://127.0.0.1:8111/import?url=';
 var urlID = 'https://www.openstreetmap.org/edit?editor=id';
 
-var urlOsmTest = useTestServer
+var urlOsm = useTestServer
     ? 'https://master.apis.dev.openstreetmap.org'
     : 'https://www.openstreetmap.org';
 
 var redirectPath = window.location.origin + window.location.pathname;
+console.log(redirectPath)
 var auth = useTestServer
-    ? osmAuth({
-        url: urlOsmTest,
-        oauth_consumer_key: '',
-        oauth_secret: '',
-        auto: true,
-        //singlepage: true
+    ? osmAuth.osmAuth({
+        url: urlOsm,
+        client_id: "luke_sidewalker",
+        redirect_uri: redirectPath + "land.html",
+        scope: "read_prefs write_api",
+        singlepage: false
     })
-    : osmAuth({
-        url: urlOsmTest,
-        oauth_consumer_key: 'a9CFoAHkYhEZY5G42NjdqsHKXazAZoJ1jtVn0fBV',
-        oauth_secret: 'sTeC2rplH0RZtyQVl6t2Qtoy8bOU4EFbv8p8rP5x',
+    : osmAuth.osmAuth({
+        url: urlOsm,
+        client_id: "A5-wd3saMmeWsH__bVeSTP1Qv4AmMz5_BheZ7-7Fk8g",
         redirect_uri: redirectPath + "land.html",
-        auto: true,
-        //singlepage: true
+        scope: "read_prefs write_api",
+        singlepage: false
+    });
+
+if (window.location.search.slice(1).split('&').some(function(p) { return p.indexOf('code=') === 0; })) {
+    auth.authenticate(function() {
+        history.pushState({}, null, window.location.pathname);
+        checkOSMAuth();
     });
+}
\ No newline at end of file
diff --git a/index.html b/index.html
index f1b25d4..fa88978 100644
--- a/index.html
+++ b/index.html
@@ -19,7 +19,7 @@
     <script src="https://cdn.rawgit.com/mlevans/leaflet-hash/master/leaflet-hash.js"></script>
     <script src="https://cdn.jsdelivr.net/npm/leaflet.locatecontrol@0.62.0/src/L.Control.Locate.min.js"></script>
     <script src="https://cdn.rawgit.com/tyrasd/jxon/master/jxon.min.js"></script>
-    <script src="https://cdn.jsdelivr.net/npm/osm-auth@1.1.2/osmauth.js"></script>
+    <script src="assets/osm-auth_2.4.0/osm-auth.iife.min.js.js"></script>
     <script src="assets/leaflet-sidebar_v2-0.4.0/leaflet-sidebar.min.js"></script>