chore(async): Refactor auth server routes to async/await #2286

jaredhirsch · 2019-08-21T16:23:50Z

Promises and async/await: an asynchronous adventure

We're going to convert some auth-server routes from promises to async. The hapi route handlers are already async functions, so hopefully this should be pretty straightforward 🤞.

Preliminaries

Bluebird (our promise library) is not compatible with async/await: petkaantonov/bluebird#1434

However, the auth route handlers are already async functions, so we might not need to worry about this for today. At least, the tests passed when I made some changes 😬

Converting Promise code to async/await code

The await keyword unwraps a Promise, converting a resolved promise into its value, and a rejected promise into an error.

The async keyword wraps a function in a Promise: return value becomes a resolved promise, thrown error becomes a rejected promise.

Remember: you can mix async and Promise code, because async functions return Promises. You don't have to convert a whole chain of functions at once.

Some nice things about async/await

Removes promise nesting due to conditional responses to intermediate values
Allows sync and async calls to be handled by the same error handling code
Escape from the 'pyramid of doom'
TODO other nice stuff

Some gotchas:

Things get a little tricky with error handling return foo() (returns rejected promise) vs return await foo() (throws). Simpler to understand if you separate out assigning the awaited value and returning the value.
If you want to parallelize, don't await serially. Instead, assign the promises and await Promise.all(slowThings).

More at MDN: https://mdn.io/asyncawait

A crude replacement algorithm

When you see a promise chain, turn the function outside the then/catch chain into an async function.

If you have a .catch callback, move the .then and .catch callbacks into a try-catch block.

Then, await the promise instead of chaining to get to the next step.

If a value is passed from promise to promise, assign its awaited value.

If the value of the whole promise chain is returned, return foo().then(bar), split this into assignment and returning the awaited value: const result = await foo().then(bar); return result.

Auth server routes: how deeply nested?

We have a few that are 8+ levels deep:

 ]$ echo "8 levels deep: " && ack "                .then"
8 levels deep: 
emails.js
687:                .then(() => {

recovery-key.js
159:                .then(() => db.accountRecord(email))
160:                .then(result => (uid = result.uid));

utils/signin.js
145:                .then(code => {
153:                .then(() => {
165:                    .then(() => {

sign.js
109:                .then(result => {

password.js
68:                .then(match => {
82:                .then(wrapKb => {
90:                    .then(keyFetchToken => {
95:                        .then(passwordChangeToken => {
251:                .then(() => {

account.js
1212:                .then(accountData => (account = accountData));
1238:                .then(result => (wrapKb = result));
1315:                  .then(result => {

Let's walk through one together

I've started hacking on password.js to open this PR. We can make some more changes together.

Do the thing

Grab a file and put your name next to it, let's get to hackin.

Open PRs against this async-conversion branch, not against master 👍

jaredhirsch · 2019-08-22T20:17:29Z

Phil suggested we just land these refactorings as they are completed, since the changes are going to bit rot otherwise. I've copied the checklist into #2305 for future work.

I reviewed the changes other than password.js, could use a review for that one (and any others people have time to glance at).

packages/fxa-auth-server/lib/routes/password.js

bbangert · 2019-08-22T21:53:45Z

packages/fxa-auth-server/lib/routes/totp.js

+            uid,
+          };
+
+          await mailer.sendPostRemoveTwoStepAuthNotification(


Would be good to have @rfk verify this should be waited on here, as previously the promise was not returned to be waited on.

Hrm; to be honest I don't recall. Most of the places where we deliberately don't await a promise have a comment about why. I guess the only reason not to wait here would be to avoid a mail-sending error from "failing" the entire request, making it look like we failed to update the account when we really did. If we're worried about that, I think it would be better to explicitly await and then catch-and-ignore the error.

bbangert · 2019-08-22T22:03:47Z

packages/fxa-auth-server/lib/routes/totp.js

+          // cases where the user started creating a token but never completed.
+          if (!token.verified) {
+            await db.deleteTotpToken(sessionToken.uid);
+          }


Lost the else statement here, exists should only be true if the token is verified.

packages/fxa-auth-server/lib/routes/totp.js

packages/fxa-auth-server/lib/routes/util.js

rfk

This looks OK to me 👍

rfk · 2019-08-22T22:48:29Z

packages/fxa-auth-server/lib/routes/password.js

+            oldAuthPW,
+            emailRecord.authSalt,
+            emailRecord.verifierVersion
+          );


I know it was like this already, but I don't understand why we need to create a second Password instance here with same parameters; could we just re-use the value of password from above?

Sure, I can clean this up (and the other spots you called out). Thanks for the suggestions 👍

rfk · 2019-08-22T22:51:01Z

packages/fxa-auth-server/lib/routes/password.js

-            }
-          });
+          const devices = await request.app.devices;
+          devicesToNotify = devices;


I think we could use devicesToNotify = await request.app.devices directly here rather than using a separate const?

rfk · 2019-08-22T22:52:12Z

packages/fxa-auth-server/lib/routes/password.js

-                  return result;
-                });
-            });
+          const hex = await random.hex(32); // TODO why is this async?


Re: the TODO, crypto.randomBytes has an async mode that IIRC is actually worth doing if you're calling it a lot, to avoid janking the event loop.

rfk · 2019-08-22T22:55:54Z

packages/fxa-auth-server/lib/routes/password.js

-            });
-        }
+          const accountData = await db.account(passwordChangeToken.uid);
+          account = accountData;


As above, I don't think we need to intermediate const here.

rfk · 2019-08-22T23:07:18Z

packages/fxa-auth-server/lib/routes/totp.js

+            uid,
+          };
+
+          await mailer.sendPostRemoveTwoStepAuthNotification(


Hrm; to be honest I don't recall. Most of the places where we deliberately don't await a promise have a comment about why. I guess the only reason not to wait here would be to avoid a mail-sending error from "failing" the entire request, making it look like we failed to update the account when we really did. If we're worried about that, I think it would be better to explicitly await and then catch-and-ignore the error.

packages/fxa-auth-server/lib/routes/util.js

jaredhirsch force-pushed the async-conversion branch from 819ebc8 to 3eda0f6 Compare August 21, 2019 18:12

LZoog mentioned this pull request Aug 21, 2019

refactor(unblock-codes): Convert unblock-codes.js to async/await #2292

Merged

jaredhirsch force-pushed the async-conversion branch from 4be4a7e to d22cc8c Compare August 22, 2019 05:59

philbooth mentioned this pull request Aug 22, 2019

refactor(api): prefer async/await in device/session routes #2301

Merged

jaredhirsch force-pushed the async-conversion branch from 7c01fed to 38427e6 Compare August 22, 2019 20:13

jaredhirsch mentioned this pull request Aug 22, 2019

[Meta] Async/await conversion of auth server routes and libs #2305

Closed

65 tasks

jaredhirsch marked this pull request as ready for review August 22, 2019 20:16

jaredhirsch requested a review from a team August 22, 2019 20:17

jaredhirsch changed the title ~~Async/await workshop PR~~ chore(async): Refactor auth server routes to async/await Aug 22, 2019

bbangert reviewed Aug 22, 2019

View reviewed changes

packages/fxa-auth-server/lib/routes/password.js Outdated Show resolved Hide resolved

packages/fxa-auth-server/lib/routes/password.js Outdated Show resolved Hide resolved

bbangert reviewed Aug 22, 2019

View reviewed changes

packages/fxa-auth-server/lib/routes/password.js Outdated Show resolved Hide resolved

bbangert reviewed Aug 22, 2019

View reviewed changes

packages/fxa-auth-server/lib/routes/totp.js Outdated Show resolved Hide resolved

bbangert reviewed Aug 22, 2019

View reviewed changes

packages/fxa-auth-server/lib/routes/util.js Show resolved Hide resolved

rfk approved these changes Aug 22, 2019

View reviewed changes

jaredhirsch force-pushed the async-conversion branch from ea40561 to 6cda660 Compare August 22, 2019 23:19

chore(async): Convert unblock-code routes to async/await

d0c7840

jaredhirsch force-pushed the async-conversion branch 2 times, most recently from 86e1038 to a65c70b Compare August 26, 2019 21:07

dannycoates and others added 3 commits August 26, 2019 15:25

chore(async): Convert sign route to async/await

2b13d5a

chore(async): Convert routes/util.js to async/await

8997205

chore(async): Convert totp routes to async/await

3268114

jaredhirsch force-pushed the async-conversion branch from a65c70b to 3268114 Compare August 26, 2019 22:26

jaredhirsch merged commit d0c76a8 into master Aug 26, 2019

jaredhirsch deleted the async-conversion branch August 26, 2019 23:50

data-sync-user mentioned this pull request Apr 15, 2022

[Meta] Async/await conversion of auth server routes and libs #12517

Closed

65 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(async): Refactor auth server routes to async/await #2286

chore(async): Refactor auth server routes to async/await #2286

jaredhirsch commented Aug 21, 2019 •

edited

Loading

jaredhirsch commented Aug 22, 2019

bbangert Aug 22, 2019

rfk Aug 22, 2019

bbangert Aug 22, 2019

rfk left a comment

rfk Aug 22, 2019

jaredhirsch Aug 26, 2019

rfk Aug 22, 2019

rfk Aug 22, 2019

rfk Aug 22, 2019

rfk Aug 22, 2019

chore(async): Refactor auth server routes to async/await #2286

chore(async): Refactor auth server routes to async/await #2286

Conversation

jaredhirsch commented Aug 21, 2019 • edited Loading

Promises and async/await: an asynchronous adventure

Preliminaries

Converting Promise code to async/await code

Some nice things about async/await

Some gotchas:

A crude replacement algorithm

Auth server routes: how deeply nested?

Let's walk through one together

Do the thing

jaredhirsch commented Aug 22, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rfk left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jaredhirsch commented Aug 21, 2019 •

edited

Loading