edx / frontend-auth / 674

100%

master: 100%

push

travis-ci

feat: anonymous access (#82)

This PR allows unauthenticated requests to be made though the apiClient. There are breaking behavior changes. There are also breaking API changes as well as new functionality contained in this refactor.

**New functionality:**

- `getAuthenticatedUser`: a function that gets the jwt token and returns user information. It will return null if the user is not authenticated. It will not perform a redirect, unlike `ensureAuthenticatedUser`.
- `isPublic` and `isCsrfExempt` options have been added to request configuration for axios requests (get, post, patch, etc). Setting these to true will prevent frontend-auth from attempting to refresh the jwt access token or a csrf token respectively.

BREAKING CHANGE: (Behavior Change) Frontend-auth intercepts outbound requests and attempts to refresh the jwt token if it does not exist or is expired. In the case of a 401 response indicating that the user is logged out, frontend auth will not redirect the user to login, and will allow the outbound request to proceed. Prior behavior: Upon receiving a 401 response, frontend-auth would block the request and redirect the user to login.

`ensureAuthenticatedUser` continues to redirect if the user is logged out.

**API Changes**

- `getAuthenticatedAPIClient` has been renamed to `getAuthenticatedApiClient`. Note the capitalization changes: API  > Api.
- `redirectToLogout` (formerly `apiClient.logout`)
- `redirectToLogin` (formerly `apiClient.login`)
- `ensureAuthenticatedUser` (formerly `apiClient.ensureAuthenticatedUser`)

See the updated README for more details.

58 of 58 branches covered (100.0%)

Branch coverage included in aggregate %.

142 of 142 new or added lines in 6 files covered. (100.0%)

203 of 203 relevant lines covered (100.0%)

21.53 hits per line