Public channel - Can not login via Google SSO to a public channel

[lanitochka17]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Action Performed:

1. Go to https://new.expensify.com/r/5408450846930023
2. Click om Sign in
3. Click on Google
4. Select an account to sign in

Expected Result:

User is signed in to Expensify

Actual Result:

An error message is shown and user is still logged out

Workaround:

Unknown

Platforms:

Which of our officially supported platforms is this issue occurring on?

• Android / native
• Android / Chrome
• iOS / native
• iOS / Safari
• MacOS / Chrome / Safari
• MacOS / Desktop

Version Number: 1.3.72-6

Reproducible in staging?: Yes

Reproducible in production?: Yes

If this was caught during regression testing, add the test name, ID and link from TestRail:

Email or phone of affected tester (no customers):

Logs: https://stackoverflow.com/c/expensify/questions/4856

Notes/Photos/Videos: Any additional supporting documentation

Bug6208650_Recording__335a.mp4

Expensify/Expensify Issue URL:

Issue reported by: Applause - Internal Team

Slack conversation:

View all open jobs on GitHub

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~019ae7b315de0f271b
• Upwork Job ID: 1705134681028284416
• Last Price Increase: 2023-09-22

[melvin-bot]

Triggered auto assignment to @joekaufmanexpensify (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details.

[melvin-bot]

Bug0 Triage Checklist (Main S/O)

• This "bug" occurs on a supported platform (ensure Platforms in OP are ✅)
• This bug is not a duplicate report (check E/App issues and #expensify-bugs)
  • If it is, comment with a link to the original report, close the issue and add any novel details to the original issue instead
• This bug is reproducible using the reproduction steps in the OP. S/O
  • If the reproduction steps are clear and you're unable to reproduce the bug, check with the reporter and QA first, then close the issue.
  • If the reproduction steps aren't clear and you determine the correct steps, please update the OP.
• This issue is filled out as thoroughly and clearly as possible
  • Pay special attention to the title, results, platforms where the bug occurs, and if the bug happens on staging/production.
• I have reviewed and subscribed to the linked Slack conversation to ensure Slack/Github stay in sync

[joekaufmanexpensify]

Reproduced!

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~019ae7b315de0f271b

[melvin-bot]

Current assignee @joekaufmanexpensify is eligible for the External assigner, not assigning anyone new.

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @aimane-chnaif (External)

[b4s36t4]

Proposal

Please re-state the problem that we are trying to solve in this issue.

Public channel - Can not login via Google SSO to a public channel

What is the root cause of that problem?

Well the way we handle Signing parts of the application is different from flow we're doing in this issue.

When we open any public room openReport command sends us temporary session token, in which we merge that token with Onyx.

We have session token saved in Onyx.

Now when we try to login via google we are sending authToken + token (from google) backend Auth Layer should be confusing on what to because authToken is for the API which are authenticated but we're sending both from frontend (one need to login, one say we're authenticated :/)

Why it doesn't happen with nrml auth flow?

Because we skip authToken param from BeginSignIn command API & that BeginSignIn replace the old session token (if any) with latest token received from backend.

What changes do you think we should make in order to solve the problem?

When sending SignInWithGoogle API we need to omit two params (email & authToken) which we're adding here in this function

App/src/libs/Network/enhanceParameters.js

Line 24 in a07bb15

export default function enhanceParameters(command, parameters) {

1. Omit authToken

We need to add SignInWithGoogle to this function

App/src/libs/Network/enhanceParameters.js

Lines 13 to 15 in a07bb15

	function isAuthTokenRequired(command) {
	return !_.contains(['Log', 'Authenticate', 'BeginSignIn', 'SetPassword'], command);
	}

so that authToken parameter would skipped for this request

2. Return email param if we're coming from SignInWithGoogle command.

   App/src/libs/Network/enhanceParameters.js

   Line 47 in a07bb15

   finalParameters.email = lodashGet(parameters, 'email', NetworkStore.getCurrentUserEmail());

Same changes should apply for Apple Auth As well (not tested though), but 100% sure 99% these are the only changes required for apple auth well.

Points to Note Before

1. On Apple/google login All the reports of logged in account won't appear, because backend not sending all the onyx data that it sends for SigninUser for command.

2. On Refresh, App asks user to login again, there is already an existing issue thinking to close (internally handling it).

What alternative solutions did you explore? (Optional)

Backend could handle this edge case if token and authToken coming form params, that's a solution.

[b4s36t4]

@aimane-chnaif Friendly bump ^^ on above proposal :)

[joekaufmanexpensify]

Still pending review of proposal

[joekaufmanexpensify]

@aimane-chnaif mind taking a look at the proposal here?

[joekaufmanexpensify]

Pending review of proposals

[joekaufmanexpensify]

Bumped in Slack

[aimane-chnaif]

On Refresh, App asks user to login again, there is already an existing issue thinking to close (internally handling it).

@b4s36t4 can you please share link to discussion?

[aimane-chnaif]

@marcochavezf do we currently support Google / Apple sign in from anonymous user in backend?

[b4s36t4]

@aimane-chnaif #27198 I think there are few other issues (maybe 2-3) but this can do the work.

[b4s36t4]

do we currently support Google / Apple sign in from anonymous user in backend?

Is there any difference between nrml login & with ThirdParty logins?

[aimane-chnaif]

We may need to hold this for #27198

[b4s36t4]

@aimane-chnaif But why?

On Refresh, App asks user to login again, there is already an existing issue thinking to close (internally handling it).

for this issue? or any other reason?

[aimane-chnaif]

Successful signin means app keeps working even after refresh app upon signin, doesn't it?

[b4s36t4]

Yes, also this requires backend changes as well as I mentioned backend is not sending all onyx data on login. Either we need to call ReconnectApp command or backend should solve this.

[joekaufmanexpensify]

@aimane-chnaif do you think this will be fixed by the issue you referenced above?

[b4s36t4]

Ok, understood. But I feel backend changes are not required here.

I think excluding the particular command SignInWithGoogle is what should we do, that's what we're doing with normal login. the only thing I feel a work-around is removing email from the parameters conditionally.

I request you to check the things again, I feel backend is nothing related to this issue.

[aimane-chnaif]

So google signin should work the same way normal login works on anonymous user

[b4s36t4]

Yes, it works same as normal signin by just doing the two changes.

[aimane-chnaif]

Normal signin didn't require those patches

[joekaufmanexpensify]

@srikarparsi will you have a chance to look into this this week?

[joekaufmanexpensify]

Pending review from @srikarparsi

[joekaufmanexpensify]

@srikarparsi mind taking a look at this and whether you think this is a backend issue?

[joekaufmanexpensify]

Bumped Srikar 1:1

[srikarparsi]

Hi! Sorry, It's finals period at school and I've been meaning to look at this but don't have too much familiarity with Google SSO and have been a bit busy with tests. I spent some time looking through the code today though and also think that this is a backend fix. I'll check again tomorrow to make sure the backend change won't affect any other sign ins, mark this internal, and take it from there

[srikarparsi]

Hey @aimane-chnaif, do you think you could clarify why you feel like this proposal is a workaround? It looks like we're excluding regular sign in as well and I think a natural extension of that would be to remove GoogleSignIn and AppleSignIn as well.

Also @b4s36t4, do you think you could clarify step 2 of your proposal. Why do we need to remove email from the parameters conditionally?

[b4s36t4]

Also @b4s36t4, do you think you could clarify step 2 of your proposal. Why do we need to remove email from the parameters conditionally?

If we send email parameter that's not working. Maybe backend is expecting a list of parameters only. I tried just excluding the token param i.e step 1 still it didn't worked. Maybe sending email in params make the request logged in kind? not sure.

@srikarparsi

[aimane-chnaif]

Hey @aimane-chnaif, do you think you could clarify why you feel like this proposal is a workaround? It looks like we're excluding regular sign in as well and I think a natural extension of that would be to remove GoogleSignIn and AppleSignIn as well.

yes, this is the only thing to fix in frontend. Rest should be handled in backend same as normal login.

As @b4s36t4 said, if we send email param, backend rejects login.
Also even if we omit email param in frontend, backend doesn't send full data from SignInWithGoogle api response, unlike SigninUser api so app is still useless even after google signin success.

bug.mov

[joekaufmanexpensify]

Still pending further discussion

[joekaufmanexpensify]

Same

[joekaufmanexpensify]

@srikarparsi is the next step here for you to work on the backend changes?

[joekaufmanexpensify]

Pending input from @srikarparsi

[joekaufmanexpensify]

Bump @srikarparsi mind confirming here if the next step for this one is your backend changes?

[joekaufmanexpensify]

Bumped Srikar 1:1

[srikarparsi]

Hi! Yes, this would be the backend change I need to make. And on the frontend, we would need to exclude Google and Apple Sign in. I'll get started on this tomorrow and should have a PR by the end of the week.

[joekaufmanexpensify]

Great. TY! LMK if anything comes up you need help with as you work on the PR.

[joekaufmanexpensify]

@srikarparsi is the PR still pending here?

[srikarparsi]

Just retested since I saw some changes made to SSO and it looks like its working now. Closing this out but @joekaufmanexpensify if you notice anything not working please re-open and I can take a look.