Abdul/logout api

[iamazzeez]

🔩 Description: What code changed, and why?

• After logout user was still able to login, without entering login credentials, in case of stolen id_token from localstorage.

👟 How to Build

• rebuild components/automate-ui
• rebuild components/authn-serivce
• rebuild components/session-service
• rebuild components/automate-deployment

👟 How to Test the Change

✅ First test case (Save id_token in db)

• After rebuilding login into automate and look for chef-automate-user key in localstrage, and copy id_token value
• Save id_token value somewhere(notepad) as such, and enter chef-automate dev psql chef_session_service; command in hab studio
• \d (List tables) command
• select token from blacklisted_id_tokens;
• Check if the id_token value copied from localStorage matches with one in psql db token

✅ Second test case (Validate id_token while login)

• Login into automate
• Copy chef-automate-user key object value from localstrage,
• Stringify the object and save it in a js file.
• Logout from automate
• Add chef-automate-user key in local Storage with value as the stringified object saved in js file. Paste that value
• And refresh the page.
• Automate-ui shouldn’t work.

✅ IdToken Expiry Time Reduced

• Login into automate
• Check for id_token value in LocalStorage --> chef-automate-user --> id_token (copy it's value)
• Paste the value in https://jwt.io/ and check for iat(issued at time) and exp(expiry time) difference it should be 3 minutes, in case of only LDAP or
  Local Logins. exp difference should be 24hrs if there is SAML login.

✅ Session Timeout Test

• https://app.zenhub.com/workspaces/the-delta-quadrant-5fc7c4c3922dc10021323fa6/issues/chef/automate/5381
• Above issue 5381 needs to be tested in combination all above test cases

✅ All above test cases should work with Local user, SAML and LDAP login

✅ Make sure nothing breaks after upgradation

✅ Make sure all the Automate APIs are working with API tokens

✅ Checklist

All PRs must tick these:

• I have read the CONTRIBUTING document.
• All commits signed-off for the Developer Certification of Origin.

With occasional exceptions, all PRs from Progress employees must tick these:

• Is the code clear? (complicated code or lots of comments--subdivide and use well-named methods, meaningful variable names, etc.)
• Consistency checked? (user notifications, user prompts, visual patterns, code patterns, variable names)
• Repeated code blocks eliminated? (adapt and reuse existing components, blocks, functions, etc.)
• Spelling, grammar, typos checked? (at a minimum use make spell in any component directory)
• Code well-formatted? (indents, line breaks, etc. improve rather than hinder readability)

All PRs from Progress employees should tick these if appropriate:

• Tests added/updated? (all new code needs new tests)
• Docs added/updated? (all customer-facing changes)

Please add a note next to any checkbox above if you are NOT ticking it.

📷 Screenshots, if applicable

[netlify]

👷 Deploy Preview for chef-automate processing.

🔨 Explore the source changes: be8e299

🔍 Inspect the deploy log: https://app.netlify.com/sites/chef-automate/deploys/6123b6cda14e7e0007114a49

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
5 Code Smells

32.1% Coverage
0.0% Duplication