[WIP] Handle session expiration gracefully

[marcoow]

This will eventually fix #2092, however it's currently missing correct handling of some edge cases, tests etc. Whenever a 401 response is detected (which most likely means that the session is expired), a modal signin window is opened that lets the user sign in again to retry the action that triggered the 401 response.

That, together with Ember Simple Auth's automatic token refresh should resolve all problems with expired sessions and lost data.

Missing:

• tests
• when 401 is triggered by a transition the modal is opened before the redirect to the signing page which looks ugly
• the modal itself needs to be styled

[ErisDS]

Hi @marcoow, are you planning on working on this any further? I'm really excited to get this into core :)

We can style the modal as a follow up task, so is there much else left to do?

[marcoow]

I'd like wot finish this but didn't find any time at all recently - hopefully next week.

The problem currently is that the current solution does actually fix that one case but also introduces some other problems. For example it will always open the modal also if you are already on an error page where it really doesn't make sense. I'm not sure yet how a better approach would look.

Besides that some tests are the only thing that's missing (given the styling of the modal in done in a follow up issue).

[marcoow]

I dropped the global approach where every invocation of authorizationFailed would open the signin modal and explicitly handle that case only for the editor.edit route now which seems to work quite well. The only 2 things that are missing are

• tests
• design for the signin modal

I definitely can't do the design and it'd also be nice if someone could step in and add a test as I don't have a lot of time currently - functionality should be good though.

[jaswilli]

So I pulled this PR down and gave it a run through but I don't ever see the sign-in modal popup when authorization fails, I only get the "are you sure you want to leave?" modal dialog.

[marcoow]

You should see it when you're on the editor page, change sth., delete the token from your db and click save.

[jaswilli]

That's what I'm doing and I can't seem to make it happen.

Sign in -> edit existing post -> delete token -> click save.

Then I get the "are you sure you want to leave?" modal, and if I hit "leave" I get the 401 and redirected to sign in. If I hit "stay" I just get dumped back to the editor.

Maybe someone else can test it and see if it works for them.

[marcoow]

Hm, you're right - not sure what's wrong - I'll check

[marcoow]

...and now it works again for me - without (consciously) having changed anything...

[jaswilli]

I was having the exact same problems when I was working on #3873, which is why I eventually just put the authorizationFailed action handler on the Application route. It's the only place I could get it to fire reliably.

[marcoow]

Very strange - guess we should find out what's going on though.

[ErisDS]

I was having exactly the same problem, sorry I should have commented but I assumed I was doing something wrong!

[ErisDS]

Any news?

[marcoow]

I don't really understand why the action is sometimes triggered on the application route and sometimes (which I think is correct) on editor.edit. Maybe someone from the Ember team could help here... Not sure but I'd say this might as well be a bug in Ember itself. @rwjblue you seem to have been involved with Ghost a bit already?

Steps to reproduce for the working case:

1. go to edit page for an entry (editor.edit route)
2. reload the page
3. delete the access token from the DB
4. edit and save the entry -> authorizationFailed is triggered on editor.edit route (login modal shows)

Failing case:

1. edit an entry, don't save
2. delete the access token from the DB
3. save the entry -> authorizationFailed is triggered on application route while it should be on editor.edit ("do you want to leave this page" shows)

[jaswilli]

This should be unblocked when mainmatter/ember-simple-auth#367 lands.

[ErisDS]

I saw that mainmatter/ember-simple-auth#367 landed - would be awesome to get this in!

[marcoow]

Ember Simple Auth 0.7.2 including the above fix was released earlier today.

[ErisDS]

Does this mean that if this PR is rebased it'll be good to merge?

[jaswilli]

I have it rebased and working locally. I can do the usual and open a new PR while preserving this commit so that the UX and other details can be worked out.

[ErisDS]

@jaswilli that would be awesome

[jaswilli]

I've moved this commit into #4602 so that we can iron out the details and merge all at once.