Frontend/revoke tokens - #1790
Open
jsandoval81 wants to merge 4 commits into
Open
Conversation
Contributor
📝 WalkthroughWalkthroughChangesLogout flow
Privilege purchase navigation guard
Test wrapper cleanup
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Logout
participant revokeCognitoRefreshToken
participant Cognito
participant UserStore
Logout->>revokeCognitoRefreshToken: Revoke refresh token
revokeCognitoRefreshToken->>Cognito: POST /oauth2/revoke
Cognito-->>revokeCognitoRefreshToken: Return revocation result
Logout->>UserStore: Dispatch user/logoutRequest
UserStore-->>Logout: Clear auth state and dispatch logoutSuccess
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@webroot/src/pages/Logout/Logout.ts`:
- Around line 131-136: Make revokeTokens treat a failed
revokeCognitoRefreshToken call as a logout failure: retry or report the
secure-login failure and prevent logoutRequest and window.location.replace from
running until revocation succeeds. Add a bounded timeout to the revocation
request in revokeCognitoRefreshToken, and update Logout.spec.ts to cover the
retry/error path instead of asserting that errors are swallowed.
In `@webroot/tests/helpers/setup.ts`:
- Around line 159-182: Update unmountAllWrappers so teardown failures are not
broadly swallowed: only ignore errors verified to indicate the wrapper is
already unmounted, while preserving or reporting all other errors. Continue
processing the remaining mountedWrappers after each attempt, and ensure the
registry removal does not make genuine unmount failures unrecoverable.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 7f2718f2-f506-44b4-bcb6-50e01d7f0efb
📒 Files selected for processing (13)
webroot/src/components/Page/PageContainer/PageContainer.tswebroot/src/locales/en.jsonwebroot/src/locales/es.jsonwebroot/src/pages/Logout/Logout.lesswebroot/src/pages/Logout/Logout.spec.tswebroot/src/pages/Logout/Logout.tswebroot/src/pages/Logout/Logout.vuewebroot/src/pages/PrivilegePurchase/PrivilegePurchase.tswebroot/src/store/user/user.actions.tswebroot/src/store/user/user.spec.tswebroot/src/utils/auth.spec.tswebroot/src/utils/auth.tswebroot/tests/helpers/setup.ts
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
webroot/src/utils/auth.spec.ts (1)
118-130: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winCover retry behavior for HTTP 5xx responses.
This test only exercises errors without
response.status; a regression that removes thestatus >= 500branch would still pass.Proposed test
+ it('should retry server-side revoke failures', async () => { + const serverError = Object.assign(new Error('server'), { response: { status: 503 }}); + axiosPostStub.onCall(0).rejects(serverError); + axiosPostStub.onCall(1).resolves({ data: {} }); + authStorage.setItem(tokens.staff.REFRESH_TOKEN, 'staff-refresh-token'); + + await revokeCognitoRefreshToken(AppModes.JCC, AuthTypes.STAFF); + + expect(axiosPostStub.callCount).to.equal(2); + });🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@webroot/src/utils/auth.spec.ts` around lines 118 - 130, Update the “should successfully retry retryable revoke failures then succeed” test to reject the first two axiosPostStub calls with errors containing response.status values of 500 or higher, then resolve the third call. Keep the existing success assertion and call-count verification so the test specifically covers the HTTP 5xx retry path.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@webroot/src/utils/auth.spec.ts`:
- Around line 118-130: Update the “should successfully retry retryable revoke
failures then succeed” test to reject the first two axiosPostStub calls with
errors containing response.status values of 500 or higher, then resolve the
third call. Keep the existing success assertion and call-count verification so
the test specifically covers the HTTP 5xx retry path.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 9015bb68-7716-43b9-b9b4-719d41bae679
📒 Files selected for processing (6)
webroot/src/pages/Logout/Logout.spec.tswebroot/src/pages/Logout/Logout.tswebroot/src/plugins/Statsig/statsig.plugin.tswebroot/src/utils/auth.spec.tswebroot/src/utils/auth.tswebroot/tests/helpers/setup.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requirements List
Description List
/oauth2/revokecall to Logout page/logoutonly removes cookies on the auth domainTesting List
yarn test:unit:allshould run without errors or warningsyarn serveshould run without errors or warningsyarn buildshould run without errors or warningsCloses #1743
Summary by CodeRabbit