search

solidusio / solidus_bolt

BSD 3-Clause "New" or "Revised" License
1 stars 2 forks source link

Expire user session when Bolt access token expires #111

Open DanielePalombo opened 2 years ago

DanielePalombo commented 2 years ago

Solidus updates the order address when the order has been placed, in order to do it, Bolt requires an access token with write permission, which is only provided during the Bolt login and cannot be refreshed. This means we should ask the user to log in again whenever the access token is expired

DanielePalombo commented 2 years ago

@Naokimi we need the access token only to update the address on Bolt right?

Naokimi commented 2 years ago

@DanielePalombo we have 3 services with read access (DetailService, SyncPaymentSourcesService and SyncAddressesService) and 1 service with write access (AddAddressService).

Considering the latest message we could change the logic of calling AddAddressService by triggering an update of the access_token synchronously before scheduling the job

DanielePalombo commented 2 years ago

With update of the access_token do you mean, ask the user to log in again?

Naokimi commented 2 years ago

ah, yes, that's what I meant

DanielePalombo commented 2 years ago

At the moment the AddAddressService is performed when the order is finalized. We can move it between the address and delivery checkout step (in the controller) and force the user to log in again when the access token is expired and the address is not present on Bolt Addresses.

Does it make sense for you?

Naokimi commented 2 years ago

An issue found:

A simple solution to the write access would be to move the add_address step to before_delivery and add a condition like session[:bolt_access_token] && session[:bolt_expiration_time] >= Time.now.utc that if true would sign out the user. However just from this condition we won't know if the access_token is the original or refreshed one. But the only way to distinguish between the two is via their scope, which has been removed from https://github.com/nebulab/omniauth-bolt. As such, to solve this task we first need to add @scope = response['scope'] to omniauth-bolt.

stale[bot] commented 1 year ago

This issue has been automatically marked as stale because it has not had recent activity. It might be closed if no further activity occurs. Thank you for your contributions.