Realm Web: Refresh access token #3020

kraenhansen · 2020-07-01T11:05:01Z

What, How & Why?

This fixes the first part of #2965 (refreshing tokens upon the first 401 response.

Note: This should be rebased on v10 once the current base has been merged.

☑️ ToDos

📝 Changelog entry
📝 Compatibility label is updated or copied from previous entry
🚦 Tests
📝 Public documentation PR created or is not necessary
💥 Breaking label has been applied or is not necessary

kneth · 2020-07-02T04:03:21Z

packages/realm-web/src/App.test.ts

+            },
+            { bar: "baz" },
+        ]);
+        // Login with an aanonymous user


Suggested change

// Login with an aanonymous user

// Login with an anonymous user

kneth · 2020-07-02T04:05:59Z

packages/realm-web/src/User.ts

+            this._accessToken = accessToken;
+            this.storage.accessToken = accessToken;
+        } else {
+            throw new Error("Expected a 'access_token' in the response");


Suggested change

throw new Error("Expected a 'access_token' in the response");

throw new Error("Expected an 'access_token' in the response");

steffenagger · 2020-07-02T06:22:40Z

packages/realm-network-transport/src/NetworkTransport.ts

@@ -124,6 +88,8 @@ export class DefaultNetworkTransport implements NetworkTransport {
                contentType.startsWith("application/json")
            ) {
                throw new MongoDBRealmError(
+                    request.method,
+                    request.url,
                    response.status,
                    response.statusText,
                    await response.json(),


(void comment) Is this actually awaited before thrown? I'm more & more impressed with TS.

Is what awaited? (or is your "void comment" because I forced pushed a change? 😺 )

steffenagger · 2020-07-02T06:46:56Z

packages/realm-web/src/App.test.ts

+        const credentials = Credentials.anonymous();
+        await app.logIn(credentials, false);
+        // Send a request (which will fail)
+        try {


I think this try/catch could be simplified with chai-as-promised (not tested though):

expect(app.functions.foo({ bar: "baz" })).eventually.throws(MongoDBRealmError) .property("message", "Request failed (POST http://invalid): invalid session (status 401)");

Yeah I agree, I did have a look at it when writing this. I didn't like the way they're loading in that plugin.

steffenagger · 2020-07-02T06:55:25Z

packages/realm-web/src/User.ts

+        const { access_token: accessToken } = response;
+        if (typeof accessToken === "string") {
+            this._accessToken = accessToken;
+            this.storage.accessToken = accessToken;


Why store it in 2 places? Is this._accessToken to allow continued use in different tabs?

this.storage persists it to local storage. It's very frequently used and I don't want to hit localStorage on every request to the server, so the user stores its token as a property as well, which is hydrated from the storage at its convenience.

steffenagger · 2020-07-02T07:16:19Z

packages/realm-web/src/transports/AuthenticatedTransport.ts

+                user &&
+                retries === 0 &&
+                err instanceof MongoDBRealmError &&
+                err.statusCode === 401


Could there be a case where the endpoint returns 403 (forbidden) from an outdated token - if a user has been granted new/extended access, but the client has not updated its access token yet?
(I guess this depends on how much of the access rights are stored in the JWT).

I don't think so ... it seems to me only 401 are returned when a refresh of the access token would resolve the issue.

steffenagger · 2020-07-02T07:34:52Z

packages/realm-network-transport/src/types.ts

+    fetchAndParse<RequestBody extends any, ResponseBody extends any>(
+        request: Request<RequestBody>,
+    ): Promise<ResponseBody>;
+    fetchWithCallbacks<RequestBody extends any>(


Just wondering why fetch with parsing is promise-based, and fetch without parsing (or limited parsing) is callback-based?

Because when Realm JS is using this, its easier to consume from JS if a handler can be passed when invoked instead of having to call methods on the returned promise. Makes sense?

kraenhansen · 2020-07-09T08:41:05Z

I just published realm-network-transport v0.6.0 off this branch.

kraenhansen requested review from kneth and steffenagger July 1, 2020 11:05

kraenhansen self-assigned this Jul 1, 2020

kraenhansen force-pushed the kh/web/refresh-access-token branch 2 times, most recently from dfbdae6 to 99cc607 Compare July 1, 2020 13:40

kraenhansen force-pushed the kh/web/more-credentials branch from 6d12656 to 98e6ade Compare July 1, 2020 13:45

kraenhansen force-pushed the kh/web/refresh-access-token branch from 99cc607 to 87ca3a9 Compare July 1, 2020 13:45

kneth approved these changes Jul 2, 2020

View reviewed changes

steffenagger reviewed Jul 2, 2020

View reviewed changes

kraenhansen force-pushed the kh/web/refresh-access-token branch from 87ca3a9 to 743b71d Compare July 6, 2020 12:58

kraenhansen force-pushed the kh/web/more-credentials branch 2 times, most recently from 97777a8 to 65e2025 Compare July 8, 2020 08:53

kraenhansen force-pushed the kh/web/refresh-access-token branch from 743b71d to 97731f8 Compare July 8, 2020 08:55

kraenhansen mentioned this pull request Jul 9, 2020

Using realm-network-transport v0.6.0 fixing "process.versions is not an Object" #3046

Merged

5 tasks

kraenhansen force-pushed the kh/web/more-credentials branch from 65e2025 to a9e52ca Compare July 10, 2020 13:44

Base automatically changed from kh/web/more-credentials to v10 July 10, 2020 14:03

Kræn Hansen added 6 commits July 10, 2020 16:12

Refresh access token when a request fails with "invalid session"

3ec8e0c

Fixed the broken tests

da84544

Published realm-network-transport

3c45c70

Adding a note to the changelog

2f20743

Published Realm Web 0.6.0

4094b1c

Published realm-network-transport 0.6.0

0719c04

kraenhansen force-pushed the kh/web/refresh-access-token branch from abd3a52 to 0719c04 Compare July 10, 2020 14:13

Kræn Hansen added 3 commits July 10, 2020 16:20

Fixed the tests

06fb450

Updated realm-network-transport

85a7525

Incorporated feedback

9f94646

kraenhansen merged commit cc11c88 into v10 Jul 10, 2020

kraenhansen deleted the kh/web/refresh-access-token branch July 10, 2020 14:34

github-actions bot locked as resolved and limited conversation to collaborators Mar 16, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Realm Web: Refresh access token #3020

Realm Web: Refresh access token #3020

kraenhansen commented Jul 1, 2020

kneth Jul 2, 2020

kneth Jul 2, 2020

steffenagger Jul 2, 2020

kraenhansen Jul 2, 2020 •

edited

Loading

steffenagger Jul 2, 2020

kraenhansen Jul 2, 2020

steffenagger Jul 2, 2020

kraenhansen Jul 2, 2020

steffenagger Jul 2, 2020

kraenhansen Jul 2, 2020

steffenagger Jul 2, 2020

kraenhansen Jul 2, 2020

kraenhansen commented Jul 9, 2020

	// Login with an aanonymous user
	// Login with an anonymous user

	throw new Error("Expected a 'access_token' in the response");
	throw new Error("Expected an 'access_token' in the response");

Realm Web: Refresh access token #3020

Realm Web: Refresh access token #3020

Conversation

kraenhansen commented Jul 1, 2020

What, How & Why?

☑️ ToDos

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kraenhansen Jul 2, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kraenhansen commented Jul 9, 2020

kraenhansen Jul 2, 2020 •

edited

Loading