mozilla / mozilla/fxa

Lacking of capabilityManager should not raise error

Open
#21,079 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
685
Forks
237
Avg merge
2d 17h
Merged PRs (30d)
136

Description

Description

When working on self hosting, i found that when generating oauth token, the endpoint will return error about planIdsToClientCapabilities

POST /v1/oauth/token HTTP/1.1
Host: api.fxa.example.local
authorization: Bearer fxs_xxxxx

which returns 500
{"code":500,"errno":998,"error":"Internal Server Error","message":"An internal validation check failed.","info":"https://mozilla.github.io/ecosystem-platform/api#section/Response-format","op":"planIdsToClientCapabilities","data":{}}


some digging and background:

  1. For selfhosting, capabilityManager is not instantiated.

Since these requirements config.subscriptions && config.subscriptions.stripeApiKey and config.cms.enabled || (config.cms.strapiClient && config.cms.strapiClient.graphqlApiUri && config.cms.strapiClient.apiKey && config.cms.strapiClient.firestoreCacheCollectionName in key_server.js prevents capabilityManager being instantiated.

  1. planIdsToClientCapabilities is not skipable too.

According to scope docs , when Firefox browser send scope profile which will definitely hit capabilityService.subscriptionCapabilities in oauth/grant.js:generateAccessToken since profile:subscriptions is a sub-scope of profile
and planIdsToClientCapabilities will be called, and then error happens.

So there's nothing self-hosting side can do (except patching these code).

What should happen?

/v1/oauth/token should return token whether capabilityManager is available or not

Actual result

500 Internal Server Error

Environment

Firefox 154.0

┆Issue is synchronized with this Jira Task

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with packages/fxa-auth-server/bin/key_server.js to understand when capabilityManager is instantiated, then trace generateAccessToken in packages/fxa-auth-server/lib/oauth/grant.js through subscriptionCapabilities and planIdsToClientCapabilities in packages/fxa-auth-server/lib/payments/capability.ts. Reproduce POST /v1/oauth/token in a self-hosted configuration without capabilityManager; done means it returns a token instead of the 500 validation error.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, authentication, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.