Lacking of capabilityManager should not raise error
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 685
- Forks
- 237
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 136
Description
Description
When working on self hosting, i found that when generating oauth token, the endpoint will return error about planIdsToClientCapabilities
POST /v1/oauth/token HTTP/1.1
Host: api.fxa.example.local
authorization: Bearer fxs_xxxxx
which returns 500
{"code":500,"errno":998,"error":"Internal Server Error","message":"An internal validation check failed.","info":"https://mozilla.github.io/ecosystem-platform/api#section/Response-format","op":"planIdsToClientCapabilities","data":{}}
some digging and background:
- For selfhosting, capabilityManager is not instantiated.
Since these requirements config.subscriptions && config.subscriptions.stripeApiKey and config.cms.enabled || (config.cms.strapiClient && config.cms.strapiClient.graphqlApiUri && config.cms.strapiClient.apiKey && config.cms.strapiClient.firestoreCacheCollectionName in key_server.js prevents capabilityManager being instantiated.
- planIdsToClientCapabilities is not skipable too.
According to scope docs , when Firefox browser send scope profile which will definitely hit capabilityService.subscriptionCapabilities in oauth/grant.js:generateAccessToken since profile:subscriptions is a sub-scope of profile
and planIdsToClientCapabilities will be called, and then error happens.
So there's nothing self-hosting side can do (except patching these code).
What should happen?
/v1/oauth/token should return token whether capabilityManager is available or not
Actual result
500 Internal Server Error
Environment
Firefox 154.0
┆Issue is synchronized with this Jira Task
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with packages/fxa-auth-server/bin/key_server.js to understand when capabilityManager is instantiated, then trace generateAccessToken in packages/fxa-auth-server/lib/oauth/grant.js through subscriptionCapabilities and planIdsToClientCapabilities in packages/fxa-auth-server/lib/payments/capability.ts. Reproduce POST /v1/oauth/token in a self-hosted configuration without capabilityManager; done means it returns a token instead of the 500 validation error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, authentication, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 72/100