[fix] Call `SIGNED_OUT` event where session is removed #854

bombillazo · 2024-02-16T02:02:58Z

What kind of change does this PR introduce?

This adds the SIGNED_OUT event missing in some logic that clears/logs out the session.

What is the current behavior?

#853

bombillazo · 2024-04-19T12:51:46Z

Any feedback on this @kangmingtay @hf ? We're needing to patch this library whenever a new version is released.

bombillazo · 2024-05-08T20:01:08Z

Any updates here?

kangmingtay · 2024-05-09T09:24:03Z

src/GoTrueClient.ts

+      if (currentSession) {
+        await this._saveSession(currentSession)
+      }


i'm not sure why it's necessary to preserve the existing session when one calls the signup method - we always want to remove the session when signup is called to prevent any possibilities of the user logging in as someone else.

this applies to all the other sign-in methods too - if you're signing in, there won't be any session in the first place, else you'd be logged in already

This truly depends on the UI implementation. We may need to allow logged-in users to switch accounts directly so it is possible to call sign-in/sign-up. Currently, if something fails, the user is kicked out of their current session.

In addition, I don't see how this would log a user into someone else's account. Either the sign-in is successful, and the current session switches to the new one, or it fails, and you keep the existing one. If you were never logged in, you stay logged out.

If the team wanted to go down this path, you could simplify a lot of these methods by moving the _removeSession call to right before the _saveSession calls. There would be a few exceptions to that though.

I've seen more and more discussions about people trying to implement a "switch account" feature; or they already have, but recent changes have broken their implementations.

I agree. I just wasn't sure if some logic was dependent on having no session while executing, so I preferred keeping it and reverting at the end.

Hopefully, we can remove the current limitation, be it by removing _removeSession where not necessary or, as my PR suggests, restoring the session on fail.

This is already working for us in production, we patch this library in our app for this behavior, but we'd prefer if the lib had it working natively.

jczstudios · 2024-05-22T14:56:57Z

Any updates on this, it's breaking our production Electron app, seems that when a request fails, the user just gets signed out entirely.

j4w8n

I appreciate the review tag, but this one will ultimately need to be looked at by kangmingtay or hf. Last I knew, the team's time was limited; so, who knows if/when they'll consider this PR further.

bombillazo · 2024-05-23T12:50:13Z

Ok, I'll mention @hf so they'll be aware and have visibility on this fix request.

kangmingtay · 2024-05-29T12:10:32Z

sorry @bombillazo i was on vacation last week - i'll be looking into this further to see if we can just do away with removing the session prematurely before hitting the underlying auth endpoint - not too sure if it will cause any unintended breaking changes here so we need some time to test this out

kangmingtay · 2024-06-05T13:10:23Z

@bombillazo i've made a separate PR (#915) to address this - would be great if you can take a look at it too

## What kind of change does this PR introduce? * Replaces #854 * Fixes #853, #904 * We don't need to remove the existing session prematurely. This causes some issues when users want to implement some sort of switch-account functionality since the existing session will always be removed regardless of whether the signup / sign-in attempt succeeds. * It's safe to remove `_removeSession` since calling `_saveSession` multiple times will just replace the existing session

…abase-master

bombillazo · 2024-06-18T17:35:56Z

Hey @kangmingtay thanks for the PR, I merged the current repo to my branch and the only thing missing is a few lines of code to emit the SIGNED_OUT event during the _recoverAndRefresh function if the session is ultimately removed.

This means #904 is fixed but #853 is still open.

bombillazo · 2024-07-16T17:33:53Z

Any update here? This fixes #853

bombillazo · 2024-08-06T19:19:53Z

Hey @kangmingtay , any update on this issue?

bombillazo · 2024-09-09T13:42:37Z

Hey @kangmingtay @hf , I know 2.65.0 was released but this is missing to truly close #853

bombillazo · 2024-09-29T01:55:52Z

@kangmingtay @j4w8n @hf Could this be rechecked please? We still need to run auth-js patched on our side due to this. This is needed to resolve #853 which was incorrectly marked as completed

j4w8n · 2024-09-29T02:12:22Z

I see you moved the SIGNED_OUT event trigger into _removeSession. I understand wanting to move it there, but I still think there are one or two cases where calling _removeSession shouldn't necessarily trigger the event.

However, this isn't my party, and the maintainers may be fine with it. I'm not sure it would hurt anything.

j4w8n

This is ultimately up to the maintainers, but I wrote a couple of things.

j4w8n · 2024-09-29T01:59:31Z

src/GoTrueClient.ts

@@ -1891,6 +1891,7 @@ export default class GoTrueClient {
        this._debug(debugName, 'session is not valid')
        if (currentSession !== null) {
          await this._removeSession()
+          await this._notifyAllSubscribers('SIGNED_OUT', null)


If the session isn't valid, then no one should've been signed in to begin with; so I'm not sure if triggering the event here is strictly necessary. Is it causing an issue, or are you just trying to cover all bases?

_recoverAndRefresh could be called with someone already in a signed in state, like from the _onVisibilityChanged function. Also, we may have cookies during the client initialization we need to clear if the session is invalid, and by not triggering this event in the initial "no one is signed in to begin with" state, we get inconsistent issues. This is what is happening in our case. So, the way to avoid this is to trigger the SIGNED_OUT event every moment the session is removed, regardless of why it was removed. We also have logic that depends on reacting to the session that no longer exists in the client. This is also how it is described in the documentation:

j4w8n · 2024-09-29T02:19:45Z

src/GoTrueClient.ts

@@ -2085,11 +2081,11 @@ export default class GoTrueClient {
      // finished and tests run endlessly. This can be prevented by calling
      // `unref()` on the returned object.
      ticker.unref()
-      // @ts-ignore
+      // @ts-expect-error TS has no context of Deno


Is this needed here, since the Deno scenario is covered below? Or maybe the Deno check should happen first?

IMO @ts-expect-error is a much better way to document why a typescript error needs to be ignored compared to @ts-ignore, I simply replaced the existing ts comment with this one.

I don't know of a way to check for Deno without TS complaining

bombillazo · 2024-09-30T17:23:38Z

Thanks @j4w8n for the questions/feedback, hopefully this can be reviewed by the corresponding devs to keep the ball rolling.

kangmingtay

hey @bombillazo, apologies for the delayed review on this PR - the changes look good, thanks for helping to fix this issue!

🤖 I have created a release *beep* *boop* --- ## [2.65.1](v2.65.0...v2.65.1) (2024-10-14) ### Bug Fixes * Call `SIGNED_OUT` event where session is removed ([#854](#854)) ([436fd9f](436fd9f)) * improve `mfa.enroll` return types ([#956](#956)) ([8a1ec06](8a1ec06)) * move MFA sub types to internal file ([#964](#964)) ([4b7455c](4b7455c)) * remove phone mfa deletion, match on error codes ([#963](#963)) ([ef3911c](ef3911c)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

fix: keep existing session on auth functions if they fail

afb0ae8

bombillazo changed the title ~~fix: keep existing session on auth functions if they fail~~ [fix] Keep existing session on auth functions if they fail Feb 16, 2024

bombillazo added 2 commits April 2, 2024 14:23

Merge branch 'supabase:master' into master

09df436

Merge branch 'supabase:master' into master

6f2b4d6

bombillazo added 2 commits April 30, 2024 14:25

Merge branch 'supabase:master' into master

1d5dace

Merge branch 'supabase:master' into master

75b5877

kangmingtay reviewed May 9, 2024

View reviewed changes

bombillazo added 2 commits May 9, 2024 14:49

Merge branch 'supabase:master' into master

b6a0847

chore: update function description comment

88cedd7

bombillazo requested review from kangmingtay and j4w8n May 22, 2024 17:49

j4w8n reviewed May 23, 2024

View reviewed changes

kangmingtay mentioned this pull request Jun 5, 2024

fix: don't call removeSession prematurely #915

Merged

bombillazo added 5 commits June 18, 2024 12:52

Merge branch 'master' of https://github.com/supabase/auth-js into sup…

83716de

…abase-master

Merge branch 'supabase-master'

c84f1b8

chore: update file code styling

72037fe

chore: update file styling

7a68cf7

chore: update file styling

124e5f4

bombillazo changed the title ~~[fix] Keep existing session on auth functions if they fail~~ [fix] Call SIGNED_OUT event where sessino is removed Jun 18, 2024

bombillazo mentioned this pull request Jun 18, 2024

Functions that call _removeSession internally do not trigger SIGNED_OUT event when the function fails #853

Closed

2 tasks

bombillazo changed the title ~~[fix] Call SIGNED_OUT event where sessino is removed~~ [fix] Call SIGNED_OUT event where session is removed Jun 18, 2024

Merge branch 'supabase:master' into master

122145f

bombillazo added 2 commits September 9, 2024 10:36

Merge branch 'supabase:master' into master

f7ffdbc

chore: fix missing space

cff282f

bombillazo requested a review from j4w8n September 29, 2024 01:27

bombillazo added 2 commits September 28, 2024 21:44

Merge remote-tracking branch 'upstream/master'

ef0dd53

fix: send SIGNED_OUT wherever session is removed

b852b59

j4w8n approved these changes Sep 29, 2024

View reviewed changes

kangmingtay approved these changes Oct 14, 2024

View reviewed changes

kangmingtay merged commit 436fd9f into supabase:master Oct 14, 2024
2 checks passed

github-actions bot mentioned this pull request Oct 14, 2024

chore(master): release 2.65.1 #959

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[fix] Call `SIGNED_OUT` event where session is removed #854

[fix] Call `SIGNED_OUT` event where session is removed #854

bombillazo commented Feb 16, 2024 •

edited

Loading

bombillazo commented Apr 19, 2024

bombillazo commented May 8, 2024

kangmingtay May 9, 2024

kangmingtay May 9, 2024

bombillazo May 9, 2024 •

edited

Loading

j4w8n May 10, 2024 •

edited

Loading

bombillazo May 10, 2024 •

edited

Loading

jczstudios commented May 22, 2024

j4w8n left a comment

bombillazo commented May 23, 2024

kangmingtay commented May 29, 2024

kangmingtay commented Jun 5, 2024

bombillazo commented Jun 18, 2024 •

edited

Loading

bombillazo commented Jul 16, 2024 •

edited

Loading

bombillazo commented Aug 6, 2024

bombillazo commented Sep 9, 2024 •

edited

Loading

bombillazo commented Sep 29, 2024 •

edited

Loading

j4w8n commented Sep 29, 2024

j4w8n left a comment

j4w8n Sep 29, 2024

bombillazo Sep 29, 2024 •

edited

Loading

j4w8n Sep 29, 2024

bombillazo Sep 29, 2024 •

edited

Loading

bombillazo Sep 29, 2024

bombillazo commented Sep 30, 2024

kangmingtay left a comment

[fix] Call SIGNED_OUT event where session is removed #854

[fix] Call SIGNED_OUT event where session is removed #854

Conversation

bombillazo commented Feb 16, 2024 • edited Loading

What kind of change does this PR introduce?

What is the current behavior?

bombillazo commented Apr 19, 2024

bombillazo commented May 8, 2024

kangmingtay May 9, 2024

Choose a reason for hiding this comment

kangmingtay May 9, 2024

Choose a reason for hiding this comment

bombillazo May 9, 2024 • edited Loading

Choose a reason for hiding this comment

j4w8n May 10, 2024 • edited Loading

Choose a reason for hiding this comment

bombillazo May 10, 2024 • edited Loading

Choose a reason for hiding this comment

jczstudios commented May 22, 2024

j4w8n left a comment

Choose a reason for hiding this comment

bombillazo commented May 23, 2024

kangmingtay commented May 29, 2024

kangmingtay commented Jun 5, 2024

bombillazo commented Jun 18, 2024 • edited Loading

bombillazo commented Jul 16, 2024 • edited Loading

bombillazo commented Aug 6, 2024

bombillazo commented Sep 9, 2024 • edited Loading

bombillazo commented Sep 29, 2024 • edited Loading

j4w8n commented Sep 29, 2024

j4w8n left a comment

Choose a reason for hiding this comment

j4w8n Sep 29, 2024

Choose a reason for hiding this comment

bombillazo Sep 29, 2024 • edited Loading

Choose a reason for hiding this comment

j4w8n Sep 29, 2024

Choose a reason for hiding this comment

bombillazo Sep 29, 2024 • edited Loading

Choose a reason for hiding this comment

bombillazo Sep 29, 2024

Choose a reason for hiding this comment

bombillazo commented Sep 30, 2024

kangmingtay left a comment

Choose a reason for hiding this comment

[fix] Call `SIGNED_OUT` event where session is removed #854

[fix] Call `SIGNED_OUT` event where session is removed #854

bombillazo commented Feb 16, 2024 •

edited

Loading

bombillazo May 9, 2024 •

edited

Loading

j4w8n May 10, 2024 •

edited

Loading

bombillazo May 10, 2024 •

edited

Loading

bombillazo commented Jun 18, 2024 •

edited

Loading

bombillazo commented Jul 16, 2024 •

edited

Loading

bombillazo commented Sep 9, 2024 •

edited

Loading

bombillazo commented Sep 29, 2024 •

edited

Loading

bombillazo Sep 29, 2024 •

edited

Loading

bombillazo Sep 29, 2024 •

edited

Loading