From 4eea8ff845b07616cfaa06d2697dc4f267df128c Mon Sep 17 00:00:00 2001
From: Masaharu Hayashi <masaharu.hayashi3@gmail.com>
Date: Fri, 28 Aug 2026 02:17:01 +0000
Subject: [PATCH] =?UTF-8?q?fix(accounts):=20iframe=20=E5=86=85=E3=81=AE?=
 =?UTF-8?q?=E3=83=9A=E3=83=BC=E3=82=B8=E3=82=92=E3=83=AD=E3=82=B0=E3=82=A4?=
 =?UTF-8?q?=E3=83=B3=E7=94=BB=E9=9D=A2=E3=81=B8=E6=88=BB=E3=81=99=20(issue?=
 =?UTF-8?q?62569)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Sec-Fetch-Dest が 'document' 以外なら JSON を返す判定にしていたが、
'iframe' / 'frame' / 'embed' / 'object' もブラウザのナビゲーションで、
枠の中に HTML が描画される。ここに 401 JSON を返すと生の JSON が
表示され、ログインする手立てが無くなる。
invenio-previewer が制限付きファイルを <iframe> で埋め込んでいる。

HTML を描画する遷移を NAVIGATION_DESTS にまとめ、それ以外を
JSON 扱いにした。

実機での確認 (/items/iframe, 未認証):
  Sec-Fetch-Dest 無し / document / iframe / frame / embed / object -> 302
  empty / script                                                   -> 401

あわせて tests/test_unauthorized.py を新設した。この判定にテストが
無く、今回の不備もそこを突かれている。ナビゲーション5種は
NAVIGATION_DESTS から自動でパラメータ化しているので、種類を足せば
テストも増える。HTML フォーム POST がログイン画面へ行くことも
固定した(以前「非GETなら JSON」で壊した箇所)。16 passed。

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019bkXKrjzJ2VNWVwTpDAPuZ
---
 .../weko-accounts/tests/test_unauthorized.py  | 95 +++++++++++++++++++
 .../weko_accounts/unauthorized.py             | 28 +++++-
 2 files changed, 119 insertions(+), 4 deletions(-)
 create mode 100644 modules/weko-accounts/tests/test_unauthorized.py

diff --git a/modules/weko-accounts/tests/test_unauthorized.py b/modules/weko-accounts/tests/test_unauthorized.py
new file mode 100644
index 0000000000..db6b09caa0
--- /dev/null
+++ b/modules/weko-accounts/tests/test_unauthorized.py
@@ -0,0 +1,95 @@
+# -*- coding: utf-8 -*-
+#
+# This file is part of WEKO3.
+# Copyright (C) 2017 National Institute of Informatics.
+#
+# WEKO3 is free software; you can redistribute it
+# and/or modify it under the terms of the GNU General Public License as
+# published by the Free Software Foundation; either version 2 of the
+# License, or (at your option) any later version.
+#
+# WEKO3 is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with WEKO3; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston,
+# MA 02111-1307, USA.
+
+"""未認証時に JSON を返すかどうかの判定。
+
+wants_json() は request しか見ないので、weko のフィクスチャは使わず
+素の Flask で確かめる。
+
+.tox/c1/bin/pytest tests/test_unauthorized.py -v
+"""
+import json
+
+import pytest
+from flask import Flask
+
+from weko_accounts.unauthorized import NAVIGATION_DESTS, wants_json
+
+
+@pytest.fixture()
+def app():
+    return Flask(__name__)
+
+
+def _wants(app, path='/records/1', **kwargs):
+    with app.test_request_context(path, **kwargs):
+        return wants_json()
+
+
+# .tox/c1/bin/pytest tests/test_unauthorized.py::test_api_app_is_always_json -v
+def test_api_app_is_always_json(app):
+    """APIアプリにはログイン画面が無いので常に JSON。"""
+    assert _wants(app, '/api/schemas/') is True
+
+
+# .tox/c1/bin/pytest tests/test_unauthorized.py::test_explicit_json_callers -v
+@pytest.mark.parametrize('kwargs', [
+    {'headers': {'X-Requested-With': 'XMLHttpRequest'}},          # jQuery
+    {'data': json.dumps({}), 'content_type': 'application/json'},  # JSON本文
+    {'headers': {'Sec-Fetch-Dest': 'empty'}},                      # fetch/XHR
+    {'headers': {'Accept': 'application/json'}},                   # Accept
+])
+def test_explicit_json_callers(app, kwargs):
+    assert _wants(app, **kwargs) is True
+
+
+# .tox/c1/bin/pytest tests/test_unauthorized.py::test_navigation_gets_login_screen -v
+@pytest.mark.parametrize('dest', sorted(NAVIGATION_DESTS))
+def test_navigation_gets_login_screen(app, dest):
+    """ブラウザが HTML を描画する遷移はログイン画面へ送る。
+
+    'document' 以外を一律 JSON 扱いにしていたため、@login_required の
+    ページを <iframe> に読み込むと枠の中に生の JSON が表示され、
+    ログイン導線が消えていた(invenio-previewer が制限付きファイルを
+    そうやって埋め込む)。
+    """
+    assert _wants(app, headers={'Sec-Fetch-Dest': dest}) is False
+
+
+# .tox/c1/bin/pytest tests/test_unauthorized.py::test_subresource_gets_json -v
+@pytest.mark.parametrize('dest', ['empty', 'script', 'image', 'style'])
+def test_subresource_gets_json(app, dest):
+    """描画されない読み込みは JSON でよい。"""
+    assert _wants(app, headers={'Sec-Fetch-Dest': dest}) is True
+
+
+# .tox/c1/bin/pytest tests/test_unauthorized.py::test_plain_page_request -v
+def test_plain_page_request(app):
+    """Sec-Fetch-Dest を送らない素の画面要求はログイン画面へ。"""
+    assert _wants(app, headers={'Accept': 'text/html'}) is False
+
+
+# .tox/c1/bin/pytest tests/test_unauthorized.py::test_html_form_post -v
+def test_html_form_post(app):
+    """通常の HTML フォーム POST もログイン画面へ。
+
+    「非GETなら JSON」という規則を置くとここが壊れる。
+    """
+    assert _wants(app, method='POST', headers={'Accept': 'text/html'}) is False
diff --git a/modules/weko-accounts/weko_accounts/unauthorized.py b/modules/weko-accounts/weko_accounts/unauthorized.py
index 1f7a779563..ce3f9995fc 100644
--- a/modules/weko-accounts/weko_accounts/unauthorized.py
+++ b/modules/weko-accounts/weko_accounts/unauthorized.py
@@ -39,6 +39,20 @@
 from werkzeug.exceptions import Unauthorized
 
 
+NAVIGATION_DESTS = frozenset((
+    'document',   # 通常の画面遷移
+    'iframe',     # <iframe>
+    'frame',      # <frame>
+    'embed',      # <embed>
+    'object',     # <object>
+))
+"""Sec-Fetch-Dest のうち、ブラウザが HTML を描画する遷移。
+
+いずれもログイン画面を返すべきもので、JSON を返すとフレームの中に
+生の JSON が表示されてログイン導線が消える。
+"""
+
+
 def wants_json():
     """Tell an API/AJAX call apart from a browser navigating to a page.
 
@@ -56,12 +70,18 @@ def wants_json():
     if request.mimetype == 'application/json':
         return True
 
-    # Sent by current browsers on every request: 'document' for a navigation,
-    # 'empty' for fetch()/XHR. This is what catches the fetch() callers that
-    # send no Accept header of their own (e.g. bucket.js, detail.js).
+    # Sent by current browsers on every request: 'empty' for fetch()/XHR,
+    # which is what catches the fetch() callers that send no Accept header of
+    # their own (e.g. bucket.js, detail.js).
+    #
+    # Every value in NAVIGATION_DESTS is a browser navigation that renders
+    # HTML, so those need the login screen, not JSON. 'document' is a
+    # top-level navigation; the rest are nested ones. Answering an <iframe>
+    # with {"status": 401} paints raw JSON inside the frame and loses the way
+    # to log in -- invenio-previewer embeds restricted files that way.
     dest = request.headers.get('Sec-Fetch-Dest')
     if dest:
-        return dest != 'document'
+        return dest not in NAVIGATION_DESTS
 
     # No "non-GET implies JSON" rule here. Redirecting a state-changing
     # request to a login page is indeed useless for an AJAX caller, but an