Add HCA signin #684
Add HCA signin #684
Conversation
![sentry[bot]](https://avatars.githubusercontent.com/u/1396951?s=60&v=4){kind=small}
|
|
||
| # update scopes if user exists | ||
| @user.update(hca_scopes: identity["scopes"], hca_id: identity["id"]) if @user | ||
|
|
||
| # if no user, create one | ||
| @user ||= begin | ||
| u = User.create!(hca_id: identity["id"], slack_uid: identity["slack_id"], hca_scopes: identity["scopes"]) | ||
| EmailAddress.create!(email: identity["email"], user: u) unless identity["email"].blank? | ||
| u | ||
| end | ||
| end |
There was a problem hiding this comment.
Bug: hca_access_token is retrieved but not persisted to the User object in from_hca_token(), causing future HCA API calls to fail.
Severity: CRITICAL | Confidence: High
🔍 Detailed Analysis
The hca_access_token is retrieved from the OAuth response but is never stored on the User object during either update() or create!() calls within the from_hca_token() method. This token is discarded after a single use to fetch user identity, leading to future HCA API calls failing due to a missing token. This behavior is inconsistent with how slack_access_token and github_access_token are persistently stored.
💡 Suggested Fix
Add hca_access_token: access_token to both the update() and create!() calls within the from_hca_token() method to ensure the token is stored.
🤖 Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: app/models/user.rb#L369-L404
Potential issue: The `hca_access_token` is retrieved from the OAuth response but is
never stored on the `User` object during either `update()` or `create!()` calls within
the `from_hca_token()` method. This token is discarded after a single use to fetch user
identity, leading to future HCA API calls failing due to a missing token. This behavior
is inconsistent with how `slack_access_token` and `github_access_token` are persistently
stored.
Did we get this right? 👍 / 👎 to inform future reviews.
Reference ID: 5281691
There was a problem hiding this comment.
intentionally left out for now while testing-- these changes aren't shown to the front-end user for now
For now this is hidden under
hca_authurl param so users don't test it out while it's unfinished