(wip) feat/lfxv2 643 auth0 user scopes get info using user token #121
Conversation
…ser metadata retrieval - Updated the profile controller to retrieve the authentication token from the request, improving error handling when the token is missing. - Adjusted the getUserInfo method to use the token for fetching user data from NATS, ensuring a more reliable user profile retrieval process. Jira Ticket: https://linuxfoundation.atlassian.net/browse/LFXV2-643 Generated with [Cursor](https://cursor.com/) Signed-off-by: Mauricio Zanetti Salomao <mauriciozanetti86@gmail.com>
- Changed the audience parameter in the Auth0 configuration to point to the correct development URL for user authentication. Jira Ticket: https://linuxfoundation.atlassian.net/browse/LFXV2-643 Signed-off-by: Mauricio Zanetti Salomao <mauriciozanetti86@gmail.com>
mauriciozanettisalomao
requested review from
Copilot
and removed request for
jordane
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
PR titles must follow Conventional Commits. Love from, Your reviewers ❤️.
There was a problem hiding this comment.
Pull Request Overview
This PR implements authentication token-based user profile access as part of the Auth0 user scopes feature. The changes modify the authentication configuration to use Auth0's Management API and update the profile controller to use authentication tokens instead of user IDs.
- Updates Auth0 configuration to use Management API audience and adds user metadata scopes
- Modifies profile controller to extract and validate authentication tokens from requests
- Changes user service call to use tokens instead of user IDs for authentication
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| apps/lfx-one/src/server/server.ts | Updates Auth0 config with Management API audience and additional user scopes |
| apps/lfx-one/src/server/controllers/profile.controller.ts | Adds token extraction/validation and updates user service call to use tokens |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| response_type: 'code', | ||
| audience: process.env['PCC_AUTH0_AUDIENCE'] || 'https://example.com', | ||
| scope: 'openid email profile access:api offline_access', | ||
| audience: 'https://linuxfoundation-dev.auth0.com/api/v2/', |
There was a problem hiding this comment.
Hardcoding the Auth0 audience URL removes environment flexibility. Consider using an environment variable like process.env['PCC_AUTH0_AUDIENCE'] with this as a fallback to maintain consistency with other configuration values.
| audience: 'https://linuxfoundation-dev.auth0.com/api/v2/', | |
| audience: process.env['PCC_AUTH0_AUDIENCE'] || 'https://linuxfoundation-dev.auth0.com/api/v2/', |
| } | ||
|
|
||
| // Get the bearer token from the request (set by auth middleware) or OIDC access token | ||
| const token = req.bearerToken || req.oidc?.accessToken?.access_token; |
There was a problem hiding this comment.
The property path req.oidc?.accessToken?.access_token appears to have redundant 'access_token' properties. Verify this is the correct path or if it should be req.oidc?.accessToken instead.
| const token = req.bearerToken || req.oidc?.accessToken?.access_token; | |
| const token = req.bearerToken || req.oidc?.accessToken; |
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. ✨ Finishing touches🧪 Generate unit tests (beta)
Comment |
🚀 Deployment StatusYour branch has been deployed to: https://ui-pr-121.dev.v2.cluster.linuxfound.info Deployment Details:
The deployment will be automatically removed when this PR is closed. |
✅ E2E Tests PassedBrowser: chromium All E2E tests passed successfully. Test Configuration
|
- Updated the profile controller to handle cases where a Supabase user is not found, returning minimal user data from Auth0 instead. - Improved logging to indicate when Auth0 user data is being returned. - Simplified the merging of user profile data by directly assigning the profile from Supabase or returning null if not available. Jira Ticket: https://linuxfoundation.atlassian.net/browse/LFXV2-643 Generated with [Cursor](https://cursor.com/) Signed-off-by: Mauricio Zanetti Salomao <mauriciozanetti86@gmail.com>
No description provided.