TEST_CASE("app: call function with expired access token", "[sync][app][function][baas]") {
auto base_path = util::make_temp_dir();
test_util::TestDirGuard tdg(base_path);
AppConfig app_config;
set_app_config_defaults(app_config, instance_of<SynchronousTestTransport>);
app_config.app_id = "...";
app_config.base_url = "https://realm.mongodb.com";
app_config.base_file_path = tdg.c_str();
app_config.metadata_mode = AppConfig::MetadataMode::NoEncryption;
bson::BsonArray args{"hello, world!"};
const auto checkFn = [](Optional<std::string>&& ret, Optional<AppError>&& error) {
REQUIRE(!error);
REQUIRE(ret);
REQUIRE(*ret == "HELLO");
};
{
auto app = App::get_app(App::CacheMode::Disabled, app_config);
auto user =
log_in(app, AppCredentials::api_key("..."));
app->call_function<std::string>("Function_0", args, checkFn);
}
auto logger = util::Logger::get_default_logger();
{
logger->info("*** GETTING APP AGAIN ***");
auto app = App::get_app(App::CacheMode::Disabled, app_config);
auto user = app->current_user();
logger->info("*** INVALIDATING ACCESS TOKEN ***");
user->update_data_for_testing([](UserData& data) {
data.access_token = RealmJWT(ENCODE_FAKE_JWT("fake_access_token"));
});
logger->info("*** CALLING FUNCTION ***");
app->call_function<std::string>("Function_0", args, checkFn);
}
}
The second time we try to call the function, we'll first refresh our location, then we'll try to refresh the access token, and then we'll try to call the function. The retry logic for refreshing the access token doesn't know that the base url changed while processing the request, and so will send it to the original (wrong) server if you're in a LOCAL deployment and get a 401 unauthorized in response, and won't be able to recover from that.
Given the following test case:
The second time we try to call the function, we'll first refresh our location, then we'll try to refresh the access token, and then we'll try to call the function. The retry logic for refreshing the access token doesn't know that the base url changed while processing the request, and so will send it to the original (wrong) server if you're in a LOCAL deployment and get a 401 unauthorized in response, and won't be able to recover from that.