createdAt should be deserialized as ISO8601 UTC (not local time)

[adamjmcgrath]

Changes

Fix issue where createdAt from the UserProfile was being interpreted as a local date rather than UTC.

/api/v2/users (and /userinfo for old clients that have OIDC conformant disabled) will issue User Profiles with created_at and updated_at dates in ISO8601 format.

see get_users_by_id

We used SimpleDateFormat through Gson by supplying a dateFormat, but SimpleDateFormat doesn't support ISO8601 until API v24. And since the API put a Z at the end of the date to indicate UTC following ISO8601, we ignored the Z (timezone indicator) by putting it in quotes yyyy-MM-dd'T'HH:mm:ss.SSS'Z' (here https://github.com/google/gson/blob/gson-parent-2.8.9/gson/src/main/java/com/google/gson/internal/bind/DateTypeAdapter.java#L85).

With no timezone information Gson deserialized it as a date time local to the device. If the device is in GMT + 3, it assumes the date is GMT + 3, when it's actually UTC (Z = "UTC")

Gson supports ISO8601 and it's the fallback when no suitable date formats are supplied (see https://github.com/google/gson/blob/gson-parent-2.8.9/gson/src/main/java/com/google/gson/internal/bind/DateTypeAdapter.java#L85). So I've changed the default Gson builder to not use SimpleDateFormat and instead fallback to its ISO8601Utils.

I had to leave the serialization/de-serialization of dates in SecureCredentialsManager the same, because user's devices will have the local time stored with the ISO8601 UTC timezone indicator at the end (the Z) and these still need to be interpreted as local times since this is how they were stored.

References

fixes #553

Testing

Please describe how this can be tested by reviewers. Be specific about anything not tested and reasons why. Since this library has unit testing, tests should be added for new functionality and existing tests should complete without errors.

• This change adds unit test coverage

• This change adds integration test coverage

• This change has been tested on the latest version of the platform/language or why not

Checklist

• I have read the Auth0 general contribution guidelines

• I have read the Auth0 Code of Conduct

• All existing and new tests complete without errors

[adamjmcgrath]

Used the example in #553

[adamjmcgrath]

Will take a look at those failing tests

[poovamraj]

This looks good to me @adamjmcgrath 👍

[poovamraj]

@adamjmcgrath you can update to the latest changes in the vNext branch which has the fix for the flaky CI.

[poovamraj]

+1