401 unauthorized firing 'complete' instead of 'error' or 'denied'

[colinskow]

I want my app to send the user back to the login screen when a live replication fails due to a 401 unauthorized response.

Based on your documentation: "In a live replication, only cancelling the replication should trigger this [complete] event." I would expect this to be handled by either 'error' or 'denied'.

With the 'complete' event, I have to iterate through the errors on both 'push' and 'pull' properties to tell if an unauthorized occurred... more complicated than it should be.

[daleharvey]

Can you describe the situation a little more? I believe this may be due to the fact that replication can reject writes with a 401 and replication will carry on by design, people may have a validate_doc_update to do per document authorisation which will reject some writes but not others.

You mentioned the denied event, that is supposed to be fired in this situation are you not seeing it? a 'denied' event isnt a completion one and the complete event will still fire after denied does

[colinskow]

As a security feature, when a user logs out I remove them from the _security doc of their database. This means that replication will fail with 401 unauthorized on any other sessions that user has opened (intended behavior). This sets off the 'complete' event and nothing else.

In contrast, a validate_doc_update failure should result in 403 forbidden and replication continues.

I am listening for the 'denied' event but it does not fire in the case of 401 unauthorized. Although I am using PouchDB 4.0.0 because 4.0.1 hasn't been firing events at all.

[colinskow]

So I did a bit of further testing. When PouchDB live replication receives an unauthorized or forbidden error from the process of attempting to find or write a checkpoint (/_local) then replication is terminated and the complete event is fired. This seems like rational behavior because CouchDB doesn't like the credentials. Although based on your documentation, it should be firing the error event instead.

When a normal validate_doc_update fails with unauthorized or forbidden then the denied event correctly fires and replication continues.

[colinskow]

By the way, here is the source code that I'm working on that sets up 3-way sync and tracks events...
https://github.com/colinskow/ng-pouch-mirror

[daleharvey]

@colinskow It seems like you are wanting to get your bugs fixed fairly quickly and fixing them yourself, so thanks :), and leaving these here in case you are looking to take a look at this (or anyone else)

https://github.com/pouchdb/pouchdb/blob/master/tests/integration/test.retry.js#L543 Is a test that overrides the ajax handler so you can customise whatever you want to return, this should hopefully help in generating a test for this condition.

We dont trigger denied on checkpoint failures and seems like 50 / 50 on whether we should, but we definitely should be firing the error event if a replication fails due to a bunch of 401s, and I think thats the case that this bug should focus on. most of that code is handled @ https://github.com/pouchdb/pouchdb/blob/master/lib/replicate/replicate.js#L58

[daleharvey]

So I wrote a test for this, however fixing it is tricky, we have some not so perfect state handling code in the replicator so I may need to do a few refactorings before getting to the fix

https://gist.github.com/daleharvey/09d273f5d8502c8aa37a

[nolanlawson]

Leaving this open unless @daleharvey thinks 31cdcf8 solves the original issue.

[daleharvey]

Yup this fixes the issue, previously complete was getting fired because we werent tracking the cancelled state properly, test ensures we do now

[srikanth235]

I just wanted to check whether this fix has gone into latest i.e. 5.3.2 release. I'm still seeing the same error in 5.3.2.

[nolanlawson]

Reopening since apparently 31cdcf8 doesn't solve the issue.

[daleharvey]

@srikanth235 do you have any further information on the issue you are seeing? we identified the bug and landed the fix with a passing test so if you are seeing something related broken it would help to know exactly what that was. Thanks

[coderroggie]

So, I guess I'm not clear as to what should happen when my session with couchdb expires as it relates to a live sync that is currently happening. Should that only fire the "complete" event or should it also fire an "error" event? I'm not sure that the docs are completely clear there. Or I missed something in the docs...

[colinskow]

@coderroggie 401/unauthorized should fire the "denied" event.

[daleharvey]

Closing as a dupe of #5172