9112463412

Committed 16 May 2024 12:41PM UTC coverage: 31.856% (-0.006%) from 31.862%

Build # 9112463412

Build Type

Pull #9211

github

Committed by

oetherington

Commit Message

Revert "Revert un-delaying client startup in E2E tests"

This reverts commit 06c9b68ab.

Pull Request Pull Request #9211: Replace Cypress with Playwright

Run Details

4800 of 39189 branches covered (12.25%)

Branch coverage included in aggregate %.

32 of 78 new or added lines in 21 files covered. (41.03%)

6 existing lines in 5 files now uncovered.

27839 of 63270 relevant lines covered (44.0%)

179.75 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

15.27

/packages/lesswrong/server/authentication/auth0.ts

import { DatabaseServerSetting } from "../databaseSettings";
import {
  AppMetadata,
  AuthenticationClient,
  ManagementClient,
  UpdateUserData,
  User,
  UserMetadata,
} from "auth0";
import Profile from "passport-auth0/lib/Profile";
import { getAuth0Id } from "../../lib/collections/users/helpers";
import { Profile as Auth0Profile } from 'passport-auth0';
import { getOrCreateForumUserAsync } from "./getOrCreateForumUser";
import { auth0ProfilePath, idFromAuth0Profile, userFromAuth0Profile } from "./auth0Accounts";
import { auth0ClientSettings } from "../../lib/publicSettings";
import { UsersRepo } from "../repos";
import { isE2E } from "../../lib/executionEnvironment";

type Auth0Settings = {
  appId: string;
  secret: string;
  domain: string;
  originalDomain: string;
}

export const AUTH0_SCOPE = "profile email openid offline_access";

type Auth0User = User<AppMetadata, UserMetadata>;

abstract class IAuth0Client {
  abstract getUserById(userId: string): Promise<Auth0User>;
  abstract updateUserById(userId: string, data: UpdateUserData): Promise<Auth0User>;
  abstract signupUser(email: string, password: string): Promise<void>;
  abstract loginUser(email: string, password: string): Promise<string | null>;
}

class MockAuth0Client extends IAuth0Client {
  getUserById(_userId: string): Promise<Auth0User> {
    throw new Error("getUserById not implemented for tests");
  }

  updateUserById(_userId: string, _data: UpdateUserData): Promise<Auth0User> {
    throw new Error("updateUserById not implemented for tests");
  }

  async signupUser(_email: string, _password: string): Promise<void> {}

  async loginUser(email: string, _password: string): Promise<string | null> {
    return `access-token-${email}`;
  }
}

/**
 * Auth0 Management API Client
 * For this to work, we must authorize the forum application in Auth0:
 * Applications -> APIs -> Auth0 Management API -> Machine to Machine Applications
 */
class Auth0Client extends IAuth0Client {
  private settings = new DatabaseServerSetting<Auth0Settings|null>("oAuth.auth0", null);
  private managementClient?: ManagementClient;
  private authClient?: AuthenticationClient;

  private getSettings() {
    const {
      appId: clientId,
      secret: clientSecret,
      originalDomain: domain,
    } = this.settings?.get() ?? {};
    if (!clientId || !clientSecret || !domain) {
      throw new Error("Missing auth0 environment settings");
    }
    return {clientId, clientSecret, domain};
  }

  private getManagementClient() {
    if (!this.managementClient) {
      this.managementClient = new ManagementClient({
        ...this.getSettings(),
        scope: "read:users update:users",
      });
    }
    return this.managementClient;
  }

  private getAuthClient() {
    if (!this.authClient) {
      this.authClient = new AuthenticationClient(this.getSettings());
    }
    return this.authClient;
  }

  getUserById(userId: string): Promise<Auth0User> {
    const client = this.getManagementClient();
    return client.getUser({id: userId});
  }

  updateUserById(userId: string, data: UpdateUserData): Promise<Auth0User> {
    const client = this.getManagementClient();
    return client.updateUser({id: userId}, data);
  }

  async signupUser(email: string, password: string): Promise<void> {
    const client = this.getAuthClient();
    if (!client.database) {
      throw new Error("Database authenticator not initialized");
    }
    await client.database.signUp({
      email,
      password,
      connection: getAuth0Connection(),
    });
  }

  async loginUser(email: string, password: string): Promise<string | null> {
    const client = this.getAuthClient();
    const grant = await client.passwordGrant({
      username: email,
      password,
      realm: getAuth0Connection(),
      scope: AUTH0_SCOPE,
    });
    return grant?.access_token ?? null;
  }
}

const auth0Client: IAuth0Client = isE2E
  ? new MockAuth0Client()
  : new Auth0Client();

// TODO: Probably good to fix this, IM(JP)O. It works because we only use it in
// a context where we're guaranteed to have an email/password user.
/** Warning! Only returns profiles of users who do not use OAuth */
export const getAuth0Profile = async (user: DbUser) => {
  const result = await auth0Client.getUserById(getAuth0Id(user));
  return new Profile(result, JSON.stringify(result));
}

export const updateAuth0Email = (user: DbUser, newEmail: string) => {
  return auth0Client.updateUserById(getAuth0Id(user), {email: newEmail});
}

class Auth0Error extends Error {
  constructor(message: string, public policy?: string) {
    super(message);
  }
}

const getAuthError = async (
  e: AnyBecauseIsInput,
  defaultMessage: string,
  email: string,
): Promise<Auth0Error> => {
  let message: string;
  let policy: string | undefined;
  try {
    // If a user attempts to sign up with a weak password the error is returned
    // is a special format which we have to handle separately
    const parsedError = JSON.parse(e.originalError.response.text);
    if (parsedError.name === "PasswordStrengthError") {
      policy = parsedError.policy;
    } else if (parsedError.code === "invalid_signup") {
      // If a user tries to sign up with an email that is already in use auth0
      // gives us an extremely unhelpful "invalid signup" error - check if this
      // is the case here and give a better message if so
      const existingUser = await new UsersRepo().getUserByEmail(email);
      if (existingUser) {
        return new Auth0Error("A user with this email already exists");
      }
    }
    // eslint-disable-next-line no-empty
  } catch (_) {}
  try {
    const data = JSON.parse(e.message);
    message = data.error_description
      || data.description
      || data.message
      || e.description
      || e.message
      || defaultMessage;
  } catch (_e) {
    message = e.description || e.message || defaultMessage;
  }
  // Remove the ugly full-stop that auth0 appends to its error messages
  if (message[message.length - 1] === ".") {
    message = message.slice(0, -1);
  }
  return new Auth0Error(message, policy);
}

export type ProfileFromAccessToken = (token: string) => Promise<Auth0Profile|undefined>;

/**
 * Note that some Auth0 endpoints call this the `connection`, and others call
 * it the `realm` for reasons that aren't entirely obvious. The default value
 * for a new Auth0 tenant is "Username-Password-Authentication".
 */
const getAuth0Connection = (): string => {
  const {connection} = auth0ClientSettings.get() ?? {};
  if (!connection) {
    throw new Error("Auth0 connection not configured");
  }
  return connection;
}

/**
 * Login a user using an email and password.
 * For this to work, you must manually enable the "password" grant type in
 * the Auth0 dashboard.
 */
export const loginAuth0User = async (
  profileFromAccessToken: ProfileFromAccessToken,
  email: string,
  password: string,
): Promise<{user: DbUser, token: string}> => {
  try {
    const accessToken = await auth0Client.loginUser(email, password);

    // This should never happen, but better be safe
    if (!accessToken) {
      throw new Error("Incorrect email or password");
    }

    const profile = await profileFromAccessToken(accessToken);
    if (!profile) {
      throw new Error("Profile not found");
    }

    const user = await getOrCreateForumUserAsync(
      auth0ProfilePath,
      profile,
      idFromAuth0Profile,
      userFromAuth0Profile,
    );
    if (!user) {
      throw new Error("User not found");
    }

    return {
      user,
      token: accessToken,
    };
  } catch (e) {
    throw await getAuthError(e, "Login failed", email);
  }
}

/**
 * Signup a new user using an email and password.
 * For this to work, you must manually enable the "password" grant type in
 * the Auth0 dashboard.
 * Specifically go to `Dashboard > Applications > Your App > Show Advanced Settings > Grant Types`
 */
export const signupAuth0User = async (
  profileFromAccessToken: ProfileFromAccessToken,
  email: string,
  password: string,
): Promise<{user: DbUser, token: string}> => {
  try {
    await auth0Client.signupUser(email, password);
    return loginAuth0User(profileFromAccessToken, email, password);
  } catch (e) {
    throw await getAuthError(e, "Signup failed", email);
  }
}

1	import { DatabaseServerSetting } from "../databaseSettings";	54✔
2	import {
3	AppMetadata,
4	AuthenticationClient,
5	ManagementClient,
6	UpdateUserData,
7	User,
8	UserMetadata,
9	} from "auth0";	18✔
10	import Profile from "passport-auth0/lib/Profile";	18✔
11	import { getAuth0Id } from "../../lib/collections/users/helpers";	18✔
12	import { Profile as Auth0Profile } from 'passport-auth0';
13	import { getOrCreateForumUserAsync } from "./getOrCreateForumUser";	18✔
14	import { auth0ProfilePath, idFromAuth0Profile, userFromAuth0Profile } from "./auth0Accounts";	18✔
15	import { auth0ClientSettings } from "../../lib/publicSettings";	18✔
16	import { UsersRepo } from "../repos";	18✔
17	import { isE2E } from "../../lib/executionEnvironment";	18✔
18
19	type Auth0Settings = {
20	appId: string;
21	secret: string;
22	domain: string;
23	originalDomain: string;
24	}
25
26	export const AUTH0_SCOPE = "profile email openid offline_access";	18✔
27
28	type Auth0User = User<AppMetadata, UserMetadata>;
29
30	abstract class IAuth0Client {
31	abstract getUserById(userId: string): Promise<Auth0User>;
32	abstract updateUserById(userId: string, data: UpdateUserData): Promise<Auth0User>;
33	abstract signupUser(email: string, password: string): Promise<void>;
34	abstract loginUser(email: string, password: string): Promise<string \| null>;
35	}
36
37	class MockAuth0Client extends IAuth0Client {
38	getUserById(_userId: string): Promise<Auth0User> {
NEW 39	throw new Error("getUserById not implemented for tests");	×
40	}
41
42	updateUserById(_userId: string, _data: UpdateUserData): Promise<Auth0User> {
NEW 43	throw new Error("updateUserById not implemented for tests");	×
44	}
45
46	async signupUser(_email: string, _password: string): Promise<void> {}
47
48	async loginUser(email: string, _password: string): Promise<string \| null> {
NEW 49	return `access-token-${email}`;	×
50	}
51	}
52
53	/**
54	* Auth0 Management API Client
55	* For this to work, we must authorize the forum application in Auth0:
56	* Applications -> APIs -> Auth0 Management API -> Machine to Machine Applications
57	*/
58	class Auth0Client extends IAuth0Client {	18✔
59	private settings = new DatabaseServerSetting<Auth0Settings\|null>("oAuth.auth0", null);	18✔
60	private managementClient?: ManagementClient;
61	private authClient?: AuthenticationClient;
62
63	private getSettings() {
64	const {
65	appId: clientId,
66	secret: clientSecret,
67	originalDomain: domain,
68	} = this.settings?.get() ?? {};	×
69	if (!clientId \|\| !clientSecret \|\| !domain) {	×
70	throw new Error("Missing auth0 environment settings");	×
71	}
72	return {clientId, clientSecret, domain};	×
73	}
74
75	private getManagementClient() {
76	if (!this.managementClient) {	×
77	this.managementClient = new ManagementClient({	×
78	...this.getSettings(),
79	scope: "read:users update:users",
80	});
81	}
82	return this.managementClient;	×
83	}
84
85	private getAuthClient() {
86	if (!this.authClient) {	×
87	this.authClient = new AuthenticationClient(this.getSettings());	×
88	}
89	return this.authClient;	×
90	}
91
92	getUserById(userId: string): Promise<Auth0User> {
NEW 93	const client = this.getManagementClient();	×
NEW 94	return client.getUser({id: userId});	×
95	}
96
97	updateUserById(userId: string, data: UpdateUserData): Promise<Auth0User> {
NEW 98	const client = this.getManagementClient();	×
NEW 99	return client.updateUser({id: userId}, data);	×
100	}
101
102	async signupUser(email: string, password: string): Promise<void> {
NEW 103	const client = this.getAuthClient();	×
NEW 104	if (!client.database) {	×
NEW 105	throw new Error("Database authenticator not initialized");	×
106	}
NEW 107	await client.database.signUp({	×
108	email,
109	password,
110	connection: getAuth0Connection(),
111	});
112	}
113
114	async loginUser(email: string, password: string): Promise<string \| null> {
NEW 115	const client = this.getAuthClient();	×
NEW 116	const grant = await client.passwordGrant({	×
117	username: email,
118	password,
119	realm: getAuth0Connection(),
120	scope: AUTH0_SCOPE,
121	});
NEW 122	return grant?.access_token ?? null;	×
123	}
124	}
125
126	const auth0Client: IAuth0Client = isE2E	18✔
127	? new MockAuth0Client()	18!
128	: new Auth0Client();
129
130	// TODO: Probably good to fix this, IM(JP)O. It works because we only use it in
131	// a context where we're guaranteed to have an email/password user.
132	/** Warning! Only returns profiles of users who do not use OAuth */
133	export const getAuth0Profile = async (user: DbUser) => {	18✔
NEW 134	const result = await auth0Client.getUserById(getAuth0Id(user));	×
135	return new Profile(result, JSON.stringify(result));	×
136	}
137
138	export const updateAuth0Email = (user: DbUser, newEmail: string) => {	18✔
NEW 139	return auth0Client.updateUserById(getAuth0Id(user), {email: newEmail});	×
140	}
141
142	class Auth0Error extends Error {
143	constructor(message: string, public policy?: string) {	×
144	super(message);	×
145	}
146	}
147
148	const getAuthError = async (	18✔
149	e: AnyBecauseIsInput,
150	defaultMessage: string,
151	email: string,
152	): Promise<Auth0Error> => {
153	let message: string;
154	let policy: string \| undefined;
155	try {	×
156	// If a user attempts to sign up with a weak password the error is returned
157	// is a special format which we have to handle separately
158	const parsedError = JSON.parse(e.originalError.response.text);	×
159	if (parsedError.name === "PasswordStrengthError") {	×
160	policy = parsedError.policy;	×
161	} else if (parsedError.code === "invalid_signup") {	×
162	// If a user tries to sign up with an email that is already in use auth0
163	// gives us an extremely unhelpful "invalid signup" error - check if this
164	// is the case here and give a better message if so
165	const existingUser = await new UsersRepo().getUserByEmail(email);	×
166	if (existingUser) {	×
167	return new Auth0Error("A user with this email already exists");	×
168	}
169	}
170	// eslint-disable-next-line no-empty
171	} catch (_) {}
172	try {	×
173	const data = JSON.parse(e.message);	×
174	message = data.error_description	×
175	\|\| data.description
176	\|\| data.message
177	\|\| e.description
178	\|\| e.message
179	\|\| defaultMessage;
180	} catch (_e) {
181	message = e.description \|\| e.message \|\| defaultMessage;	×
182	}
183	// Remove the ugly full-stop that auth0 appends to its error messages
184	if (message[message.length - 1] === ".") {	×
185	message = message.slice(0, -1);	×
186	}
187	return new Auth0Error(message, policy);	×
188	}
189
190	export type ProfileFromAccessToken = (token: string) => Promise<Auth0Profile\|undefined>;
191
192	/**
193	* Note that some Auth0 endpoints call this the `connection`, and others call
194	* it the `realm` for reasons that aren't entirely obvious. The default value
195	* for a new Auth0 tenant is "Username-Password-Authentication".
196	*/
197	const getAuth0Connection = (): string => {	18✔
198	const {connection} = auth0ClientSettings.get() ?? {};	×
199	if (!connection) {	×
200	throw new Error("Auth0 connection not configured");	×
201	}
202	return connection;	×
203	}
204
205	/**
206	* Login a user using an email and password.
207	* For this to work, you must manually enable the "password" grant type in
208	* the Auth0 dashboard.
209	*/
210	export const loginAuth0User = async (	18✔
211	profileFromAccessToken: ProfileFromAccessToken,
212	email: string,
213	password: string,
214	): Promise<{user: DbUser, token: string}> => {
215	try {	×
NEW 216	const accessToken = await auth0Client.loginUser(email, password);	×
217
218	// This should never happen, but better be safe
NEW 219	if (!accessToken) {	×
220	throw new Error("Incorrect email or password");	×
221	}
222
NEW 223	const profile = await profileFromAccessToken(accessToken);	×
224	if (!profile) {	×
225	throw new Error("Profile not found");	×
226	}
227
228	const user = await getOrCreateForumUserAsync(	×
229	auth0ProfilePath,
230	profile,
231	idFromAuth0Profile,
232	userFromAuth0Profile,
233	);
234	if (!user) {	×
235	throw new Error("User not found");	×
236	}
237
238	return {	×
239	user,
240	token: accessToken,
241	};
242	} catch (e) {
243	throw await getAuthError(e, "Login failed", email);	×
244	}
245	}
246
247	/**
248	* Signup a new user using an email and password.
249	* For this to work, you must manually enable the "password" grant type in
250	* the Auth0 dashboard.
251	* Specifically go to `Dashboard > Applications > Your App > Show Advanced Settings > Grant Types`
252	*/
253	export const signupAuth0User = async (	18✔
254	profileFromAccessToken: ProfileFromAccessToken,
255	email: string,
256	password: string,
257	): Promise<{user: DbUser, token: string}> => {
258	try {	×
NEW 259	await auth0Client.signupUser(email, password);	×
260	return loginAuth0User(profileFromAccessToken, email, password);	×
261	} catch (e) {
262	throw await getAuthError(e, "Signup failed", email);	×
263	}
264	}

ForumMagnum / ForumMagnum / 9112463412

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous