Simon-Initiative / oli-torus

Next Generation OLI Authoring and Delivery Platform
https://proton.oli.cmu.edu
MIT License
83 stars 35 forks source link

[FEATURE] [MER-3304] behind the scenes account linking #5001

Closed nicocirio closed 3 weeks ago

nicocirio commented 1 month ago

Link to the ticket

This PR also updated the 2 skipped tests on https://github.com/Simon-Initiative/oli-torus/pull/4987, and updated the routes from /sections/workspace to /workspaces as asked in this comment

Linking when registering

https://github.com/user-attachments/assets/2a7f19de-bd26-417b-8009-e50fba4cfa80

Linking when signing in

https://github.com/user-attachments/assets/a8f2c945-82fb-493a-8af7-5e4f24afdccd

Already linked account

Note that the "Create Account" button on course author is not shown.

https://github.com/user-attachments/assets/7558d803-3559-491a-9e3f-e671278c54d4

Admin login

In all workspaces, the admin account is shown on the user menu (even if a user account is also logged in). Note that, when signing out, the user account (if any) remains logged in. And note that both instructor and student workspaces are not yet developed for the admin user.

https://github.com/user-attachments/assets/0d77f631-c5b9-497c-b078-d65055e06d6d

User menu when logged as instructor

https://github.com/user-attachments/assets/41f0032a-5500-4b24-affa-b7ab81e76114

User menu when logged as author and instructor (or student) simultaneously

https://github.com/user-attachments/assets/f3fee744-4790-46bd-b858-8713a501c1d5

Sign in and Signout

Note that in all cases, the user is redirected back to the workspace where the action (sign-in or sign-out) was triggered

https://github.com/user-attachments/assets/32a51a1f-a033-4fd1-b4f3-d6274698e5a5

gitguardian[bot] commented 1 month ago

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | | | -------------- | ------------------ | ------------------------------ | ---------------- | --------------- | -------------------- | | [10034199](https://dashboard.gitguardian.com/workspace/76369/incidents/10034199?occurrence=162376295) | Triggered | Generic Password | 4b96f446ee5018869ebb5d50d2f17e33d192e76e | config/hound.exs | [View secret](https://github.com/Simon-Initiative/oli-torus/commit/4b96f446ee5018869ebb5d50d2f17e33d192e76e#diff-fee31282487e6c0cc91a1b2da8c3110f34fa650a8b8f4d8e8ac2b6e0edb1c15fL74) |
🛠 Guidelines to remediate hardcoded secrets
1. Understand the implications of revoking this secret by investigating where it is used in your code. 2. Replace and store your secret safely. [Learn here](https://blog.gitguardian.com/secrets-api-management?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment) the best practices. 3. Revoke and [rotate this secret](https://docs.gitguardian.com/secrets-detection/secrets-detection-engine/detectors/generics/generic_password#revoke-the-secret?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment). 4. If possible, [rewrite git history](https://blog.gitguardian.com/rewriting-git-history-cheatsheet?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment). Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data. To avoid such incidents in the future consider - following these [best practices](https://blog.gitguardian.com/secrets-api-management/?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment) for managing and storing secrets including API keys and other credentials - install [secret detection on pre-commit](https://docs.gitguardian.com/ggshield-docs/integrations/git-hooks/pre-commit?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment) to catch secret before it leaves your machine and ease remediation.

🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

eliknebel commented 3 weeks ago

Exceptional job @nicocirio ⭐

I found a few issues not related to this ticket, but they are worth mentioning:

  • There is an overflow issue that occurs when an email exceeds the width of the menu (see the attached image below).
  • The Link a different account link directs to the link_account endpoint, but when attempting to change the account, it doesn't work and doesn't apply the change.

@eliknebel Do you think it would be possible to create some tickets for that?

Screenshot 2024-08-13 at 10 46 29 AM

https://eliterate.atlassian.net/browse/MER-3620