Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes broken SoftLogout UX for homeservers that support both Password and SSO #5398

Merged
merged 49 commits into from Jul 1, 2022

Conversation

ericdecanini
Copy link
Contributor

@ericdecanini ericdecanini commented Mar 2, 2022

Type of change

  • Feature
  • Bugfix
  • Technical
  • Other :

Content

Fixes an error in SoftLogout where if your LoginMode was SsoAndPassword, no form would show up on the soft logout screen.

This was done by adding a new field LoginType in SessionParamsEntity which remembers the method the user used to log in.

Motivation and context

Merging this PR closes #5311

I also took this as an opportunity to refactor some classes around the session creation in order to make them easier to read and more testable & maintainable.

I did try to add tests for this too, but due to hardware constraints I couldn't test them on my local machine and using the CI didn't give me the info I need to properly write them to pass (failing because of MockkException, NoClassDefFoundException, etc) so I removed them in this commit and added an issue to get back to this as soon as I'm able to.

Lastly, this PR also fixes a bug where SSO login after a soft logout would crash the app. I would believe the SSO journey to be fixed but currently there's no true way to test this with both the client and server knowing that the user had soft logged out. The closest we can achieve is to throw a global error on the client side as per the test instructions below.

I attached a gif showing this journey which ultimately ends back in the soft logout screen (assumably because the global error gets thrown again or there's no log in actually happen because the user is already logged in according to the server) so we can only base this fix off of assumptions here

Screenshots / GIFs

Password SSO
image image

SSO Journey:

SVID_20220309_121237_1

Tests

There is no current way to properly test this without mocking the situation with a few code changes.

  1. In SoftLogoutController above line 155 add this line:
    globalErrorReceiver.handleGlobalError(GlobalError.InvalidToken(softLogout = true))

  2. Run the app and login. You'll immediately be taken to the Soft Logout screen as shown above (though the server doesn't know of any logout happening, it only shows in the app)

  3. Test this with a password account and an SSO account

Tested devices

  • Physical
  • Emulator
  • OS version(s): Android 10

Checklist

@ericdecanini ericdecanini marked this pull request as draft March 2, 2022 11:33
@github-actions
Copy link

github-actions bot commented Mar 2, 2022

Unit Test Results

126 files  +4  126 suites  +4   2m 26s ⏱️ -1s
208 tests +3  208 ✔️ +3  0 💤 ±0  0 ±0 
696 runs  +6  696 ✔️ +6  0 💤 ±0  0 ±0 

Results for commit fe27451. ± Comparison against base commit 424fb55.

♻️ This comment has been updated with latest results.

@ericdecanini
Copy link
Contributor Author

Thx eric, good work. I added a few comments after a static review.

It should be tested against a real setup before beeing merged, please reach out in internal room to see how to setup a sandbox homeserver with SSO and ways to revocate tokens.

From the user point of view, I think that we should probably remember the social login used if possible instead and just show that social login button instead of sending back to the raw fallback. Do you think it's possible?

Thanks for the comments, I pushed some changes addressing them.

Regarding testing against a real setup, I agree that this would be ideal to do before merging. I'll try tomorrow if I can get this sandbox homeserver set up.

As for remembering social login used, I tried this but this needs much more consideration from a technical standpoint. We could persist which social was used in the database but I think this is the wrong way to go about it. I can see in the code that a recover session through SSO has been set up but not fully implemented. I tried to use this but the implementation was too unclear for me to extend

…gout-ux-broken

# Conflicts:
#	vector/src/main/java/im/vector/app/features/login/LoginActivity.kt
#	vector/src/main/java/im/vector/app/features/signout/soft/SoftLogoutController.kt
@mikhail5555
Copy link

mikhail5555 commented Apr 15, 2022

@ericdecanini I tried this out, and it no longer crashes but it also doesnt fully solve the issue. It now continues in a login loop.
I did find a very easy way of testing it, set session_lifetime: 1m an re-login. This will give you a session which expires within one minute.
Screenrecord: https://cloud.mehome.dev/s/2jP7p6wHSzGK6tG

edit: I just also read your last comment, it seems that the not actually login in is somewhat intended. I think this PR already helpes to solve a lot (Aka the not crashing) and the login issue itself might ned fixing in a seperate PR.

@ericdecanini
Copy link
Contributor Author

ericdecanini commented Apr 20, 2022

@ericdecanini I tried this out, and it no longer crashes but it also doesnt fully solve the issue. It now continues in a login loop. I did find a very easy way of testing it, set session_lifetime: 1m an re-login. This will give you a session which expires within one minute. Screenrecord: https://cloud.mehome.dev/s/2jP7p6wHSzGK6tG

edit: I just also read your last comment, it seems that the not actually login in is somewhat intended. I think this PR already helpes to solve a lot (Aka the not crashing) and the login issue itself might ned fixing in a seperate PR.

@mikhail5555 Thanks for testing it! Yeah setting a low session_lifetime is exactly the way to test this, and your screen record does give very much good insight. Unfortunately I'm still struggling to look into this deeper as setting up a test sso server on our side is taking ages (you'd think it would be quicker for us). Is there any way you could provide a test sso account on your server, or allow me to register one of my own on your server? Or would you rather we continue trying to set up our own server to test this? (I can't guarantee how quick that would happen though)

@mikhail5555
Copy link

@ericdecanini can you contact me on matrix at @mikhail:mehome.dev, I will do my best to help you where ever i can, and maybe just setup a second instance with SSO.

@mikhail5555
Copy link

@ericdecanini I managed to setup a test server for you which i can provide you with a test account. With the only (major) config difference being the the session time is extreme short (1m). Please contact me through matrix and we can exchange some credentials and other info ;)

Copy link
Member

@bmarty bmarty left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR would deserve another fresh review. Can you fix the conflicts first? Thanks

…gout-ux-broken

# Conflicts:
#	matrix-sdk-android/src/main/java/org/matrix/android/sdk/internal/auth/db/SessionParamsMapper.kt
#	matrix-sdk-android/src/main/java/org/matrix/android/sdk/internal/auth/registration/DefaultRegistrationWizard.kt
#	vector/src/main/java/im/vector/app/features/login/LoginActivity.kt
#	vector/src/main/java/im/vector/app/features/signout/soft/SoftLogoutController.kt
#	vector/src/main/java/im/vector/app/features/signout/soft/SoftLogoutViewModel.kt
@ericdecanini ericdecanini requested a review from bmarty May 17, 2022 12:46
@ericdecanini
Copy link
Contributor Author

It must be known that nobody in the team has the capacity at the moment to take care of the issue of SSO login after soft logout causing an infinite loop. After a discussion with @bmarty we determined that this is at least a better outcome than the previous crashing the app had (which also covered soft logout with password which should now be working on this branch) so we'll work towards getting this merged.

We can then open a new issue to address the sso infinite loop in isolation

Copy link
Member

@bmarty bmarty left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks.
@BillCarsonFr can you also review so that we can merge this PR? Thanks!

@@ -252,7 +253,7 @@ open class LoginActivity : VectorBaseActivity<ActivityLoginBinding>(), UnlockedA
// It depends on the LoginMode
when (state.loginMode) {
LoginMode.Unknown,
is LoginMode.Sso -> error("Developer error")
is LoginMode.Sso -> launchSsoFlow()
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, good catch @BillCarsonFr !

Copy link
Member

@BillCarsonFr BillCarsonFr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok to merge after rebase

…gout-ux-broken

# Conflicts:
#	matrix-sdk-android/src/main/java/org/matrix/android/sdk/internal/auth/DefaultAuthenticationService.kt
#	matrix-sdk-android/src/main/java/org/matrix/android/sdk/internal/auth/registration/DefaultRegistrationWizard.kt
#	vector/src/main/java/im/vector/app/features/login/LoginActivity.kt
#	vector/src/main/java/im/vector/app/features/signout/soft/SoftLogoutController.kt
@ericdecanini ericdecanini force-pushed the bugfix/eric/softlogout-ux-broken branch from 0ccc8ba to 4cf97d4 Compare June 29, 2022 14:03
@ericdecanini
Copy link
Contributor Author

Force pushed after failed rebase (resulting in 1.8k files changed)

@sonarcloud
Copy link

sonarcloud bot commented Jul 1, 2022

SonarCloud Quality Gate failed.    Quality Gate failed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

32.9% 32.9% Coverage
0.0% 0.0% Duplication

@ericdecanini ericdecanini merged commit bdb49f5 into develop Jul 1, 2022
@ericdecanini ericdecanini deleted the bugfix/eric/softlogout-ux-broken branch July 1, 2022 14:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

SoftLogout UX is broken if the homeserver supports both password and SSO
4 participants