OpenFn / lightning

OpenFn/Lightning ⚡️ is the newest version of the OpenFn DPG and provides a web UI to visually manage complex workflow automation projects.
https://openfn.github.io/lightning/
GNU Lesser General Public License v3.0
131 stars 36 forks source link

Handle session token expiry #789

Open sentry-io[bot] opened 1 year ago

sentry-io[bot] commented 1 year ago

When a session token expires, the app throws an error because the user isn't being passed into the authorize function. The user still gets redirected to the login page, but we should handle token expiry so that we don't keep getting these errors.

Sentry Issue: LIGHTNING-2V

FunctionClauseError: no function clause matching in Lightning.Policies.Users.authorize/3
  File "lib/lightning/policies/users.ex", line 39, in Lightning.Policies.Users.authorize/3
  File "lib/bodyguard.ex", line 28, in Bodyguard.permit/4
  File "lib/lightning/policies/permissions.ex", line 6, in Lightning.Policies.Permissions.can/4
  File "lib/lightning_web/live/audit_live/index.ex", line 13, in LightningWeb.AuditLive.Index.mount/3
  File "lib/phoenix_live_view/utils.ex", line 348, in anonymous fn/6 in Phoenix.LiveView.Utils.maybe_call_live_view_mount!/5
...
(3 additional frame(s) were not displayed)

(FunctionClauseError no function clause matching in Lightning.Policies.Users.authorize/3)
elias-ba commented 1 year ago

We've investigated this issue. The error seems to show that the argument 1 (socket.assigns.current_user) is nil. However, we've logged the user running the app locally and it works fine. We are unable to reproduce the bug.

Unless we are able to reproduce this error, we cannot move forward. @taylordowns2000 could you confirm if this happened on app.openfn.org or demo.openfn.org? And if it's app could you give us a superuser account so that we can try and reproduce?

amberrignell commented 1 year ago

Update: it looks like the error is coming from an expired session token, which means argument 2 (user) is nil. You can reproduce this by changing the session validity to zero then reloading the audit page. I don't think this error needs to be addressed, since the user gets redirected to the login page.

@taylordowns2000 please close this issue if you agree