Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Prefer exact api path match in the middleware #892

Merged
merged 1 commit into from
Jul 26, 2024

Conversation

anku255
Copy link
Contributor

@anku255 anku255 commented Jul 23, 2024

Summary of change

The API request path may or may not include the tenantId. The returnAPIIdIfCanHandleRequest function handles both the cases. Currently, the middleware function simply calls the first recipe it matches. However, there is a chance that other recipes may have an exact match.

This PR updates the middlware such that we prefer an exact match.

Related issues

  • Link to issue1 here
  • Link to issue1 here

Test Plan

(Write your test plan here. If you changed any code, please provide us with clear instructions on how you verified your changes work. Bonus points for screenshots and videos!)

Documentation changes

(If relevant, please create a PR in our docs repo, or create a checklist here highlighting the necessary changes)

Checklist for important updates

  • Changelog has been updated
  • coreDriverInterfaceSupported.json file has been updated (if needed)
    • Along with the associated array in lib/ts/version.ts
  • frontendDriverInterfaceSupported.json file has been updated (if needed)
  • Changes to the version if needed
    • In package.json
    • In package-lock.json
    • In lib/ts/version.ts
  • Had run npm run build-pretty
  • Had installed and ran the pre-commit hook
  • If new thirdparty provider is added,
    • update switch statement in recipe/thirdparty/providers/configUtils.ts file, createProvider function.
    • add an icon on the user management dashboard.
  • Issue this PR against the latest non released version branch.
    • To know which one it is, run find the latest released tag (git tag) in the format vX.Y.Z, and then find the latest branch (git branch --all) whose X.Y is greater than the latest released tag.
    • If no such branch exists, then create one from the latest released branch.
  • If have added a new web framework, update the add-ts-no-check.js file to include that
  • If added a new recipe / api interface, then make sure that the implementation of it uses NON arrow functions only (like someFunc: function () {..}).
  • If added a new recipe, then make sure to expose it inside the recipe folder present in the root of this repo. We also need to expose its types.
  • If added a new entry point, then make sure that it is importable by adding it to the exports in package.json

@anku255 anku255 marked this pull request as draft July 23, 2024 12:39
@anku255 anku255 force-pushed the fix/prefer-exact-api-match branch from 97f2f40 to 81b3c10 Compare July 26, 2024 06:20
@anku255 anku255 changed the base branch from 19.0 to feat/oauth2/base July 26, 2024 06:20
@anku255 anku255 changed the title [WIP] fix: Prefer exact api path match in the middleware fix: Prefer exact api path match in the middleware Jul 26, 2024
@anku255 anku255 marked this pull request as ready for review July 26, 2024 06:20
@porcellus porcellus merged commit 0b39ad9 into feat/oauth2/base Jul 26, 2024
11 of 18 checks passed
@porcellus porcellus deleted the fix/prefer-exact-api-match branch July 26, 2024 10:14
porcellus added a commit that referenced this pull request Oct 3, 2024
#927)

* feat: add boilerplate for oauth2 recipe

* feat: add a temporary solution to query hydra (until core impl) from recipe funcs

* fix: fix temp solution for hydra calls

* feat: Add a recipe function to create OAuth2Client (#859)

* feat: Add recipe functions to update/delete OAuth2Client (#863)

* feat: Add recipe functions to update/delete OAuth2Client

* fix: PR changes

* feat: Add recipe functions to get OAuth2Clients (#865)

* feat: Add recipe functions to update/delete OAuth2Client

* fix: PR changes

* feat: Add recipe functions to get OAuth2Clients

* fix: PR changes

---------

Co-authored-by: Mihaly Lengyel <[email protected]>

* feat: add initial oauth2 client apis (#866)

* feat: add initial oauth2 client apis

* feat: Add an api to get login info

* fix: merge issues and FE path

* fix: WIP fix for CSRF and redirection issues

* fix: OAuth2 fixes and test-server updates (#871)

* feat: update oauth2 login info endpoint types to match our general patterns

* fix: make login flow work

* feat!: improve how we handle changing email addresses and users becoming unverified when account linking requires verification (#869)

* feat: update email and pw change logic and add more security checks

* feat: update error messages

* refactor: improve debug logs and clarify conditions

* chore: update changelog

* chore: empty line from changelog

* refactor: remove duplicated check and bypass mapping for already mapped errcodes

* chore: update changelog

* feat: call isEmailChangeAllowed in pwless updateUser (#875)

* feat: call isEmailChangeAllowed in pwless updateUser

* test: add updateUser to test-server

* chore: remove unnecessary item from changelog

* chore: extend changelog to mention exact function names

* test: add logging to default overrides in test-server (#876)

* fix: circular dependency

* fix: fix types in oauth2 index exposed functions

* feat: add token building callbacks

* test: move the session object and claims to the BE sdk server (#879)

* fixes issue of refresh not clearing tokens

* adding dev-v18.0.2 tag to this commit to ensure building

---------

Co-authored-by: Ankit Tiwari <[email protected]>
Co-authored-by: rishabhpoddar <[email protected]>

* feat: Add OAuth2Client recipe (#877)

* feat: add initial oauth2 client apis

* feat: Add an api to get login info

* fix: merge issues and FE path

* fix: WIP fix for CSRF and redirection issues

* fix: OAuth2 fixes and test-server updates (#871)

* feat: update oauth2 login info endpoint types to match our general patterns

* fix: make login flow work

* fix: circular dependency

* feat: Add OAuth2Client recipe

* fix: PR changes

* fix: PR changes

* fix: PR changes

* fix: use correct userContext type

---------

Co-authored-by: Mihaly Lengyel <[email protected]>

* fix: Remove internal redirects in the OAuth2 flow (#896)

* fix: Remove internal redirects in the OAuth2 flow

* fix: PR changes

* fix: Prefer exact api path match in the middleware (#892)

* feat: Add userInfoGET endpoint (#890)

* feat: add initial oauth2 client apis

* feat: Add an api to get login info

* fix: merge issues and FE path

* fix: WIP fix for CSRF and redirection issues

* fix: OAuth2 fixes and test-server updates (#871)

* feat: update oauth2 login info endpoint types to match our general patterns

* fix: make login flow work

* fix: circular dependency

* feat: Add OAuth2Client recipe

* fix: PR changes

* fix: PR changes

* fix: PR changes

* feat: Add userInfoGET endpoint

* fix: PR changes

* fix: PR changes

* fix: PR changes

---------

Co-authored-by: Mihaly Lengyel <[email protected]>

* feat: add functions to validate oauth2 tokens

* feat: rename OAuth2 to OAuth2Provider

* feat: expose token validation functions

* test: update tests

* fix: add userinfo_endpoint properly

* feat: removed unnecessary props

* fix: add workaround to validate access/idtokens

* fix: OAuth2 fixes (#900)

* feat: review fixes

* feat: remove accessTokenStrategy

* test: update tests

* feat: OAuth2Client interface changes (#904)

* feat: Add token revocation endpoint (#902)

* feat: Add token revocation endpoint

* fix: PR changes

* fix: PR changes

* fix: PR changes

* fix: PR changes

* fix: PR changes

* fix: Add revocation_endpoint

* feat: Add token introspection endpoint (#906)

* feat: Add token revocation endpoint

* fix: PR changes

* fix: PR changes

* fix: PR changes

* fix: PR changes

* feat: Add token introspection endpoint

* fix: PR changes

* fix: Add revocation_endpoint

* fix: PR changes

* fix: merge issue

---------

Co-authored-by: Mihaly Lengyel <[email protected]>

* fix: make clientSecret optional (#908)

* fix: revokeToken input check

* feat: add shouldTryLinkingWithSessionUser flag to auth apis and make overwriteSessionDuringSignInUp deafult to true (#909)

* feat: add shouldTryLinkingWithSessionUser flag

* feat: add tryLinkingWithSessionUser, forceFreshAuth and small test fixes

* fix: test server compatible with 1.17/2.0 (#897)

* fix: test server compatible with 1.17

* fix: pr comments

* fix: mfa claim

* fix: version and changelog

* fix: using version function for comparision

* fix: circle ci scripts

* fix: circle ci testing

* fix: circle ci testing

* fix: circle ci testing

* fix: test server

* fix: circle ci restore

* adding dev-v20.0.1 tag to this commit to ensure building

* fix: config (#905)

* adding dev-v20.0.1 tag to this commit to ensure building

* feat: prompt param fixing

* refactors an exception case

* feat: validate max_age

* fix: make shouldDoAutomaticAccountLinking properly get the primary user when linking to oldest user (#907)

* adding dev-v20.0.2 tag to this commit to ensure building

* feat: make shouldTryLinkingWithSessionUser optional in FDI3.1

* feat: fix tryLinkingImplementation and change degault for overwriteSessionDuringSignInUp

---------

Co-authored-by: Sattvik Chakravarthy <[email protected]>
Co-authored-by: Sattvik Chakravarthy <[email protected]>
Co-authored-by: rishabhpoddar <[email protected]>

* feat: add shouldTryRefresh plus self-review and test related fixes

* feat: Add APIs for rp-initiated logout (#911)

* feat: Add APIs for rp-initiated logout

* fix: PR changes

* fix: PR changes

* feat: integrate with OAuth2 core impl (#926)

* WIP

* WIP

* feat: clean up earlier debugging changes

* feat: expose new revoke functions + update tests

* feat: make the frontend redirection urls overrideable

* feat: update how oauth token payloads work

* fix: Add changes to support unknown type in formField values (#928)

* Add changes to support unknown type in formField values

* Update email/password invalid type error message to be same as go/python sdk

* Add tests for invalid email/password in signup API

* Add tests for invalid email/password in token reset and reset API

* Update some errors to indicate unreachable errors

* Run build to generate build files

* Add detail about breaking change regarding formField value type change to unknown

* feat: make loginGET return the redirection link as a JSON response instead

* ci: add option to run the CI scripts manually (#929)

* ci: experiment with manually runnable ci with pre-set branchnames

* ci: experiment with manually runnable ci with pre-set branchnames

* ci: experiment with manually runnable ci with pre-set branchnames

* ci: experiment with manually runnable ci with pre-set branchnames

* ci: experiment with manually runnable ci with pre-set branchnames

* ci: experiment with manually runnable ci with pre-set branchnames

* ci: experiment with manually runnable ci with pre-set branchnames

* ci: experiment with manually runnable ci with pre-set branchnames

* ci: experiment with manually runnable ci with pre-set branchnames

* ci: experiment with manually runnable ci with pre-set branchnames

* ci: experiment with manually runnable ci with pre-set branchnames

* ci: experiment with manually runnable ci with pre-set branchnames

* ci: experiment with manually runnable ci with pre-set branchnames

* ci: experiment with manually runnable ci with pre-set branchnames

* ci: experiment with manually runnable ci with pre-set branchnames

* ci: experiment with manually runnable ci with pre-set branchnames

* ci: experiment with manually runnable ci with pre-set branchnames

* fix: test fixing

* ci: experiment with manually runnable ci with pre-set branchnames

* test: make integration test server more stable

* ci: update ci runner script

* fix: adding hydra to circleci

* ci: add missing branch mapping

* fix: force script

* fix: update ci config

* fix: update ci config

* fix: update script

* fix: update script

* fix: update script

* fix: ory image

---------

Co-authored-by: Sattvik Chakravarthy <[email protected]>

* feat: make the issuer overrideable + fix new status

* fix: fix handling of CLIENT_NOT_FOUND_ERROR

* feat: error consistency improvements

* feat: error consistency improvements

* refactor: some cleanup and error handling

* fix: set the jwks cacheMaxAge in MS

* test: add more debug options into ci

* feat: added more debug logging

* fix: fix the session loading logic in auth apis

* ci: improve forceRunCI mac compatibility

* ci: add missing env var to test script

* feat: detect email_change_not_allowed earlier to fix tests

* Revert "feat: detect email_change_not_allowed earlier to fix tests"

This reverts commit 47df0a2.

* feat: self-review fixes and general cleanup

* feat: add emails and phoneNumbers as arrays into the id token as well

* feat!: separating the OpenId recipe from the Session recipe

---------

Co-authored-by: Ankit Tiwari <[email protected]>
Co-authored-by: rishabhpoddar <[email protected]>
Co-authored-by: Sattvik Chakravarthy <[email protected]>
Co-authored-by: Sattvik Chakravarthy <[email protected]>
Co-authored-by: Deepjyoti <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants