diff --git a/docs/configuration.md b/docs/configuration.md index eb34dac9d..5950a0a07 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -42,6 +42,7 @@ Key | Description | Type | Default | Required `resellerId` | The resellerId key is the accountId of your master account, and is needed for some reseller features. For example it won't prompt for a credit card the sub-accounts that have a different resellerId than this resellerId | `String` | | `false` `whitelabel` | Contains all the flags that are whitelabel-able via the Branding app. Setting them in the config file will set the defaults if you don't use any whitelabel. If the domain used is defined in the whitelabel database, we'll override the following settings by what is set in the whitelabel document. | `Object`([#whitelabel](#whitelabel)) | | `true` `allowedExtraDeviceTypes` | Contains types of additional devices corresponding to integrations. | `Array` | | `false` +`allowCrossSiteUsage` | Whether Monster UI supports being embedded into a third-party context (e.g. iframe with different domain). | `Boolean` | `false` | `false` ### `api` diff --git a/src/js/lib/monster.js b/src/js/lib/monster.js index e40ac1c66..c68e130b0 100644 --- a/src/js/lib/monster.js +++ b/src/js/lib/monster.js @@ -29,6 +29,7 @@ define(function(require) { var defaultConfig = { 'api.default': [_.isString, window.location.protocol + '//' + window.location.hostname + ':8000/v2/'], currencyCode: [isCurrencyCode, defaultCurrencyCode], + allowCrossSiteUsage: [_.isBoolean, false], 'developerFlags.showAllCallflows': [_.isBoolean, false], 'developerFlags.showJsErrors': [_.isBoolean, false], 'port.loa': [_.isString, 'http://ui.zswitch.net/Editable.LOA.Form.pdf'], @@ -387,27 +388,7 @@ define(function(require) { error: [] }, - cookies: { - set: function set(key, value, options) { - Cookies.set(key, value, options); - }, - - get: function get(key) { - return this.has(key) ? Cookies.get(key) : null; - }, - - getJson: function getJson(key) { - return this.has(key) ? Cookies.getJSON(key) : null; - }, - - remove: function remove(key) { - Cookies.remove(key); - }, - - has: function has(key) { - return Cookies.get(key) === undefined ? false : true; - } - }, + cookies: getCookiesManager(), css: function(app, href) { $('', { rel: 'stylesheet', href: monster.util.cacheUrl(app, href) }).appendTo('head'); @@ -730,6 +711,56 @@ define(function(require) { getFeatureSet: getFeatureSet }; + /** + * Returns wrapper over cookie management library. + * @private + * @returns {Object} Cookies manager module. + */ + function getCookiesManager() { + var mergeAttributes = function(attributes) { + var allowCrossSiteUsage = monster.config.allowCrossSiteUsage; + var crossSiteAttributes = { + samesite: 'none', + secure: true + }; + return _.merge( + {}, + attributes, + allowCrossSiteUsage && crossSiteAttributes + ); + }; + + return { + set: function set(key, value, attributes) { + var result; + try { + result = JSON.stringify(value); + } catch (e) { + return; + } + Cookies.set(key, result, mergeAttributes(attributes)); + }, + get: _.flow( + Cookies.get, + _.partial(_.defaultTo, _, null) + ), + getJson: function getJson(key) { + if (!this.has(key)) { + return null; + } + var value = Cookies.get(key); + try { + return JSON.parse(value); + } catch (e) {} + }, + remove: Cookies.remove, + has: _.flow( + Cookies.get, + _.negate(_.isUndefined) + ) + }; + } + function getFeatureSet(jwt) { var tokenPayload = monster.util.jwt_decode(jwt); var entitlementsFeatureSet = _ diff --git a/src/js/main.js b/src/js/main.js index f84c7e017..e444f38d6 100644 --- a/src/js/main.js +++ b/src/js/main.js @@ -9,7 +9,7 @@ require.config({ 'chosen': 'js/vendor/jquery.chosen.min', 'clipboard': 'js/vendor/clipboard.min', 'config': 'js/config', - 'cookies': 'js/vendor/js.cookie', + 'cookies': 'js/vendor/js.cookie.min', 'crossroads': 'js/vendor/crossroads.min', 'date-holidays': 'js/vendor/date-holidays.min', 'ddslick': 'js/vendor/jquery.ddslick.min', diff --git a/src/js/vendor/js.cookie.js b/src/js/vendor/js.cookie.js deleted file mode 100644 index c6c397583..000000000 --- a/src/js/vendor/js.cookie.js +++ /dev/null @@ -1,165 +0,0 @@ -/*! - * JavaScript Cookie v2.1.4 - * https://github.com/js-cookie/js-cookie - * - * Copyright 2006, 2015 Klaus Hartl & Fagner Brack - * Released under the MIT license - */ -;(function (factory) { - var registeredInModuleLoader = false; - if (typeof define === 'function' && define.amd) { - define(factory); - registeredInModuleLoader = true; - } - if (typeof exports === 'object') { - module.exports = factory(); - registeredInModuleLoader = true; - } - if (!registeredInModuleLoader) { - var OldCookies = window.Cookies; - var api = window.Cookies = factory(); - api.noConflict = function () { - window.Cookies = OldCookies; - return api; - }; - } -}(function () { - function extend () { - var i = 0; - var result = {}; - for (; i < arguments.length; i++) { - var attributes = arguments[ i ]; - for (var key in attributes) { - result[key] = attributes[key]; - } - } - return result; - } - - function init (converter) { - function api (key, value, attributes) { - var result; - if (typeof document === 'undefined') { - return; - } - - // Write - - if (arguments.length > 1) { - attributes = extend({ - path: '/' - }, api.defaults, attributes); - - if (typeof attributes.expires === 'number') { - var expires = new Date(); - expires.setMilliseconds(expires.getMilliseconds() + attributes.expires * 864e+5); - attributes.expires = expires; - } - - // We're using "expires" because "max-age" is not supported by IE - attributes.expires = attributes.expires ? attributes.expires.toUTCString() : ''; - - try { - result = JSON.stringify(value); - if (/^[\{\[]/.test(result)) { - value = result; - } - } catch (e) {} - - if (!converter.write) { - value = encodeURIComponent(String(value)) - .replace(/%(23|24|26|2B|3A|3C|3E|3D|2F|3F|40|5B|5D|5E|60|7B|7D|7C)/g, decodeURIComponent); - } else { - value = converter.write(value, key); - } - - key = encodeURIComponent(String(key)); - key = key.replace(/%(23|24|26|2B|5E|60|7C)/g, decodeURIComponent); - key = key.replace(/[\(\)]/g, escape); - - var stringifiedAttributes = ''; - - for (var attributeName in attributes) { - if (!attributes[attributeName]) { - continue; - } - stringifiedAttributes += '; ' + attributeName; - if (attributes[attributeName] === true) { - continue; - } - stringifiedAttributes += '=' + attributes[attributeName]; - } - return (document.cookie = key + '=' + value + stringifiedAttributes); - } - - // Read - - if (!key) { - result = {}; - } - - // To prevent the for loop in the first place assign an empty array - // in case there are no cookies at all. Also prevents odd result when - // calling "get()" - var cookies = document.cookie ? document.cookie.split('; ') : []; - var rdecode = /(%[0-9A-Z]{2})+/g; - var i = 0; - - for (; i < cookies.length; i++) { - var parts = cookies[i].split('='); - var cookie = parts.slice(1).join('='); - - if (cookie.charAt(0) === '"') { - cookie = cookie.slice(1, -1); - } - - try { - var name = parts[0].replace(rdecode, decodeURIComponent); - cookie = converter.read ? - converter.read(cookie, name) : converter(cookie, name) || - cookie.replace(rdecode, decodeURIComponent); - - if (this.json) { - try { - cookie = JSON.parse(cookie); - } catch (e) {} - } - - if (key === name) { - result = cookie; - break; - } - - if (!key) { - result[name] = cookie; - } - } catch (e) {} - } - - return result; - } - - api.set = api; - api.get = function (key) { - return api.call(api, key); - }; - api.getJSON = function () { - return api.apply({ - json: true - }, [].slice.call(arguments)); - }; - api.defaults = {}; - - api.remove = function (key, attributes) { - api(key, '', extend(attributes, { - expires: -1 - })); - }; - - api.withConverter = init; - - return api; - } - - return init(function () {}); -})); diff --git a/src/js/vendor/js.cookie.min.js b/src/js/vendor/js.cookie.min.js new file mode 100644 index 000000000..4c00366f2 --- /dev/null +++ b/src/js/vendor/js.cookie.min.js @@ -0,0 +1,2 @@ +/*! js-cookie v3.0.1 | MIT */ +!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e=e||self,function(){var n=e.Cookies,o=e.Cookies=t();o.noConflict=function(){return e.Cookies=n,o}}())}(this,(function(){"use strict";function e(e){for(var t=1;t