feat: add myaccount apis #1158

shuowu · 2022-03-29T21:44:49Z

In this PR:

adds myaccount API methods to SDK layer, entry point is @okta/okta-auth-js/myaccount
adds integration tests to verify responses via snapshots
adds unit tests
generate myaccount docs via typedoc
moves react-oie test app to samples/generated/react-embedded-auth-with-sdk
add lintstaged to run scripts against staged files (lint, update docs), it's much faster than standalone lint command as it only run against the changes.

jaredperreault-okta · 2022-03-30T14:27:01Z

lib/http/request.ts

+
+  if (sdk.options.httpRequestInterceptors) {
+    for (const interceptor of sdk.options.httpRequestInterceptors) {
+      interceptor(options);


What is the purpose of the interceptors? To allow for manipulation of the RequestOptions?

Yep, seems like there is no proper way to manipulate the url (RequestOptions) after moving the logic to sdk layer. Before ciamx fix the browser cors issue, we still need a way to proxy the request. We can keep it as an internal feature first.

codecov-commenter · 2022-04-04T14:29:57Z

Codecov Report

Merging #1158 (e11442f) into master (74cd01c) will decrease coverage by 1.54%.
The diff coverage is 66.19%.

@@            Coverage Diff             @@
##           master    #1158      +/-   ##
==========================================
- Coverage   93.46%   91.91%   -1.55%     
==========================================
  Files         159      173      +14     
  Lines        4679     4957     +278     
  Branches     1081     1116      +35     
==========================================
+ Hits         4373     4556     +183     
- Misses        288      378      +90     
- Partials       18       23       +5

Impacted Files	Coverage Δ
lib/options/index.ts	`100.00% <ø> (ø)`
lib/myaccount/transactions/Base.ts	`9.09% <9.09%> (ø)`
lib/myaccount/transactions/EmailTransaction.ts	`10.71% <10.71%> (ø)`
lib/myaccount/transactions/PhoneTransaction.ts	`13.04% <13.04%> (ø)`
...yaccount/transactions/EmailChallengeTransaction.ts	`17.64% <17.64%> (ø)`
...b/myaccount/transactions/EmailStatusTransaction.ts	`20.00% <20.00%> (ø)`
lib/myaccount/transactions/ProfileTransaction.ts	`25.00% <25.00%> (ø)`
...myaccount/transactions/ProfileSchemaTransaction.ts	`40.00% <40.00%> (ø)`
lib/OktaAuth.ts	`89.24% <75.00%> (-0.22%)`	⬇️
lib/http/request.ts	`96.34% <85.71%> (-2.21%)`	⬇️
... and 9 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 74cd01c...e11442f. Read the comment docs.

jaredperreault-okta · 2022-04-06T16:53:59Z

test/e2e/specs/login.js

@@ -85,7 +85,8 @@ describe('E2E login', () => {
        await TestApp.logoutRedirect();
      });

-      it('can login to social idp using signin widget (with redirect)', async () => {
+      // eslint-disable-next-line jasmine/no-disabled-tests
+      xit('can login to social idp using signin widget (with redirect)', async () => {


This there a ticket to track this and re-enable the test?

https://oktainc.atlassian.net/browse/OKTA-486720

jaredperreault-okta · 2022-04-06T16:54:03Z

test/e2e/specs/login.js

@@ -99,7 +100,8 @@ describe('E2E login', () => {
        await TestApp.logoutRedirect();
      });

-      it('can login to social idp using signin widget (no redirect)', async () => {
+      // eslint-disable-next-line jasmine/no-disabled-tests
+      xit('can login to social idp using signin widget (no redirect)', async () => {


This there a ticket to track this and re-enable the test?

https://oktainc.atlassian.net/browse/OKTA-486720

vijetmahabaleshwar-okta · 2022-04-08T21:39:56Z

lib/myaccount/request.ts

+      if (error?.error?.includes('insufficient_authentication_context')) {
+        const scopes = decodeToken(accessToken).payload.scp!;
+        // reauthentication - this call triggers redirect
+        await getWithRedirect(


This seems incorrect. According to this JIRA - https://oktainc.atlassian.net/browse/OKTA-460659,

When a response includes insufficient_authentication_context that should trigger a new interact/authorize request including the max_age parameter as defined in the response

In our case, we need to call interact again instead of the getWithRedirect
The current experience redirects the user to okta hosted page which is undesired behavior.

Updated to throw error from SDK layer, and handle it via different re-authentication approaches at sample app layer.

jaredperreault-okta · 2022-06-15T15:12:54Z

lib/myaccount/README.md

+
+## Introduction
+
+MyAccount APIs enables everything needed for the customer's end user to manage one's account. The API assumes the access token is obtained through the OAuth2 either by the classic or IDX flow.


Suggested change

MyAccount APIs enables everything needed for the customer's end user to manage one's account. The API assumes the access token is obtained through the OAuth2 either by the classic or IDX flow.

MyAccount APIs enables end user account management in SPA applications. The API requires an access token obtained via OAuth flows with additional [scopes](#scopes)

jaredperreault-okta · 2022-06-15T15:14:14Z

lib/myaccount/README.md

+
+## Scopes
+
+Certain token scopes will be needed to gain the permission to read/manage the account resources:


Suggested change

Certain token scopes will be needed to gain the permission to read/manage the account resources:

The following scopes are required for permission to read/write the resources exposed by the MyAccount API:

jaredperreault-okta · 2022-06-15T15:14:39Z

lib/myaccount/README.md

+<script src="https://global.oktacdn.com/okta-auth-js/6.7.0/okta-auth-js.min.js" type="text/javascript"></script>
+```
+
+> :warning: The version shown in this sample may be older than the current version. We recommend using the highest version available


Move this warning into the html snippet above as a comment, or move it above the snippet. I think if it's below it's easy to miss

jaredperreault-okta · 2022-06-15T15:26:15Z

lib/myaccount/README.md

+
+## Handling `insufficient_authentication_context` error
+
+Re-Authentication will be needed when request requires higher assurance than provided by the access token. MyAccount API methods throws `AuthApiError` with `insufficient_authentication_context` in `errorSummary` and `max_age` in `meta` field to indicate the downstream applications to start a re-authentication flow.


Suggested change

Re-Authentication will be needed when request requires higher assurance than provided by the access token. MyAccount API methods throws `AuthApiError` with `insufficient_authentication_context` in `errorSummary` and `max_age` in `meta` field to indicate the downstream applications to start a re-authentication flow.

For additional security, the MyAccount API requires a higher assurance level to protect the end user's account from being manipulated by malicious actors. If the `access token` provided does not meet the required assurance level, an error will be thrown to prompt the user to re-authenticate. Applications consuming the MyAccount API will need to handle this error condition. When this occurs, `myaccount` methods will throw an `AuthApiError` with `insufficient_authentication_context` in `errorSummary` and `max_age` in `meta` field, like so:

jaredperreault-okta · 2022-06-15T15:27:46Z

lib/myaccount/README.md

+
+Re-Authentication will be needed when request requires higher assurance than provided by the access token. MyAccount API methods throws `AuthApiError` with `insufficient_authentication_context` in `errorSummary` and `max_age` in `meta` field to indicate the downstream applications to start a re-authentication flow.
+
+### AuthApiError example:


remove this header

jaredperreault-okta · 2022-06-15T15:28:18Z

lib/myaccount/README.md

+}
+```
+
+Re-authentication Approaches:


Suggested change

Re-authentication Approaches:

## Re-authentication Approaches:

jaredperreault-okta · 2022-06-15T15:31:25Z

samples/generated/react-embedded-auth-with-sdk/README.md


-`App.jsx` is the entry point of the whole app, it manages the transaction state of the whole app and shares it via React context. Based on the current transaction status, it also redirects the app to the proper routes.
+This sample app demostrates the best practices for integrating Authentication into your React SAP via the embedded Auth SDK (@okta/okta-auth-js). It dynamically renders the form by following responses from [Okta's Identity Engine][]. Policy changes, like adding extra authenticator for MFA, can be reflected in this sample app with no code change.


Suggested change

This sample app demostrates the best practices for integrating Authentication into your React SAP via the embedded Auth SDK (@okta/okta-auth-js). It dynamically renders the form by following responses from [Okta's Identity Engine][]. Policy changes, like adding extra authenticator for MFA, can be reflected in this sample app with no code change.

This sample app demonstrates the best practices for integrating Authentication into your React SPA via the embedded Auth SDK (@okta/okta-auth-js). It dynamically renders the form by following responses from [Okta's Identity Engine][]. Policy changes, like adding extra authenticator for MFA, can be reflected in this sample app with no code change.

aarongranick-okta · 2022-06-15T21:58:52Z

.husky/pre-commit

+#!/bin/sh
+. "$(dirname "$0")/_/husky.sh"
+
+npx lint-staged


Why are we adding this with this PR? Is this required for myaccount? I'd prefer to have a separate conversation about pre-commit hooks and handle it in a separate PR. Also why npx instead of yarn?

I feel we will want to take doc/code consistency as the first priority. In this PR, docs for myaccount is generated from code/types, and it's easy to miss to run doc update script when code changes happen. This pre-commit hook here is a solution to keep things in sync.

I understand it may affect a bit devex, but here I would prefer to take consistency over devex.

Could this be done as a pre-push step instead of pre-commit? When rebasing we do a lot of commits, but there is only one push at the end.

pre-push cannot just handle staged files, this lint staged won't run scripts when no file matches the regex.

aarongranick-okta · 2022-06-15T22:06:15Z

scripts/integration.sh

@@ -6,7 +6,7 @@ export TEST_SUITE_TYPE="junit"
 export TEST_RESULT_FILE_DIR="${REPO}/build2/reports/unit"

 export CI=true
-export ISSUER=https://oie-signin-widget.okta.com/oauth2/default
+export ISSUER=https://oie-signin-widget.okta.com


does myaccount only work with org auth server?

what about our other integration tests? Are we introducing a gap by not testing against custom auth server?

does myaccount only work with org auth server?

Yes, sadly it is what current how myaccount api works

what about our other integration tests? Are we introducing a gap by not testing against custom auth server?

I don't think we are testing any custom AS specific features, @vijetmahabaleshwar-okta maybe you can share some insights

No, we aren't testing any custom AS specific features. Org AS should work for our tests.

aarongranick-okta · 2022-06-15T22:09:26Z

lib/myaccount/index.ts

@@ -0,0 +1,3 @@
+export * from './profileApi';
+export * from './emailApi';
+export * from './phoneApi';


should also export types here?

looks like types have been generated under build/lib/myaccount

I will add some assertion in test/types with importing from @okta/okta-auth-js (build package)

yes they are build there from the source file "types.ts". Don't you want export * from './types' in the index file?

added, also added tsd to verify types

aarongranick-okta · 2022-06-15T22:10:10Z

jest.esm.mjs

@@ -15,6 +15,9 @@
 const OktaAuth = process.env.BUNDLE_ENV === 'browser' ? 
  `<rootDir>/build/esm/browser/index.js` : 
  `<rootDir>/build/esm/node/index.js`;
+const MyaccountEntry = process.env.BUNDLE_ENV === 'browser' ? 


nit: prefer "MyAccountEntry"

aarongranick-okta · 2022-06-15T22:12:34Z

lib/.eslintrc.js

@@ -18,6 +18,8 @@ module.exports = {
  },
  rules: {
    "node/no-unsupported-features/es-syntax": 0,
+    "@typescript-eslint/no-non-null-assertion": 0,
+    "no-use-before-define": 0,


are there many instances of this? we are currently disabling the rule on a case by case basis since this could be hiding an error. particularly the non-null assertion could be better handled with some code refactor, so I see it as mostly a debt item to refactor the code to have early return or type guard functions so that TS knows whether a variable can be null or not

good call, will take a closer look

removed, and replaced with comment in code

aarongranick-okta · 2022-06-15T22:14:21Z

lib/options/index.ts

@@ -87,6 +88,7 @@ export function buildOptions(args: OktaAuthOptions = {}): OktaAuthOptions {
    ignoreSignature: !!args.ignoreSignature,

    // Server-side web applications
-    clientSecret: args.clientSecret
+    clientSecret: args.clientSecret,
+    setLocation: args.setLocation


should add documentation in README for these new options

readme option added

aarongranick-okta · 2022-06-21T17:38:33Z

lib/OktaAuth.ts

@@ -201,7 +201,7 @@ class OktaAuth implements OktaAuthInterface, SigninAPI, SignoutAPI {
    };

    // Add shims for compatibility, these will be removed in next major version. OKTA-362589
-    Object.assign(this.options.storageUtil, {
+    Object.assign(this.options.storageUtil || {}, {


under what condition can options.storageUtil be undefined?

required after typescript upgrade

aarongranick-okta · 2022-06-21T17:41:13Z

lib/http/request.ts

@@ -69,7 +76,13 @@ export function httpRequest(sdk: OktaAuthHttpInterface, options: RequestOptions)
      if (res && isString(res)) {
        res = JSON.parse(res);
        if (res && typeof res === 'object' && !res.headers) {
-          res.headers = resp.headers;
+          if (Array.isArray(res)) {


Which response is returning an array at the top-level?

/idp/myaccount/emails and /idp/myaccount/phones

aarongranick-okta · 2022-06-21T17:44:23Z

lib/util/console.ts

@@ -23,6 +23,8 @@ export function getNativeConsole() {

 export function getConsole() {
  var nativeConsole = getNativeConsole();
+  // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+  // @ts-ignore


why needed?

after typescript upgrade

aarongranick-okta · 2022-06-21T17:44:57Z

package.json

@@ -46,7 +64,7 @@
    "test:server": "jest --config ./jest.server.js",
    "test:report": "yarn test --ci --silent || true",
    "test:samples": "yarn workspace @okta/test.e2e.samples start",
-    "test:integration": "jest --config ./jest.integration.js",
+    "test:integration": "jest --runInBand --config ./jest.integration.js",


is there a reason these tests cannot run in parallel?

myaccount api need to be tested in a crud flow, run it in parallel causes flakiness.

OKTA-486697 <<<Jenkins Check-In of Tested SHA: e8ddce4 for [email protected]>>> Artifact: okta-auth-js Files changed count: 208 PR Link: #1158

jaredperreault-okta reviewed Mar 30, 2022

View reviewed changes

shuowu-okta force-pushed the sw-move-myaccount-api-to-sdk-OKTA-479699 branch from 7adf860 to ee92e70 Compare March 30, 2022 14:52

shuowu-okta changed the base branch from sw-add-cucumber-tests-for-my-account-sample-OKTA-479691 to master March 30, 2022 14:52

shuowu marked this pull request as draft March 30, 2022 14:53

shuowu-okta force-pushed the sw-move-myaccount-api-to-sdk-OKTA-479699 branch from 22fc103 to f012819 Compare April 4, 2022 02:38

shuowu-okta force-pushed the sw-move-myaccount-api-to-sdk-OKTA-479699 branch from 5d984a5 to bc57586 Compare April 4, 2022 15:32

shuowu-okta marked this pull request as ready for review April 6, 2022 15:39

jaredperreault-okta approved these changes Apr 6, 2022

View reviewed changes

shuowu-okta force-pushed the sw-move-myaccount-api-to-sdk-OKTA-479699 branch 2 times, most recently from dc5b7ea to 8b9ea19 Compare April 6, 2022 22:15

vijetmahabaleshwar-okta reviewed Apr 8, 2022

View reviewed changes

shuowu-okta force-pushed the sw-move-myaccount-api-to-sdk-OKTA-479699 branch 2 times, most recently from 653f3f7 to 9876a83 Compare May 10, 2022 20:13

shuowu-okta force-pushed the sw-move-myaccount-api-to-sdk-OKTA-479699 branch 2 times, most recently from 80e63ac to c6a97d0 Compare May 20, 2022 19:57

shuowu-okta force-pushed the sw-move-myaccount-api-to-sdk-OKTA-479699 branch from e15ab14 to 9dd11c1 Compare June 10, 2022 18:17

feat: add myaccount apis

91f08a3

shuowu-okta force-pushed the sw-move-myaccount-api-to-sdk-OKTA-479699 branch from 9dd11c1 to 91f08a3 Compare June 10, 2022 19:48

shuowu added 5 commits June 13, 2022 12:00

fix lint

ac8faa3

fix build script

73c8846

fix myaccount entry

e11442f

add widget re-auth flow in sap sample

7178af8

update docs

5a8ea4d

jaredperreault-okta requested changes Jun 15, 2022

View reviewed changes

resolve comments

94a91e3

shuowu-okta requested a review from jaredperreault-okta June 15, 2022 18:03

aarongranick-okta reviewed Jun 15, 2022

View reviewed changes

shuowu added 5 commits June 16, 2022 16:29

update precommit hook

5c1249d

resolve types issue

0c01a1a

fix tests

5a798ee

changelog

301aee3

docs entry change

028f63a

shuowu-okta requested a review from aarongranick-okta June 17, 2022 18:36

shuowu added 3 commits June 17, 2022 17:08

update precommit hook script

b5a254d

remove pkg script

d6ed88c

remove _http response field

a67f4c9

aarongranick-okta reviewed Jun 21, 2022

View reviewed changes

remove lint-staged

e8ddce4

shuowu-okta requested a review from aarongranick-okta June 21, 2022 18:43

aarongranick-okta approved these changes Jun 21, 2022

View reviewed changes

jaredperreault-okta approved these changes Jun 21, 2022

View reviewed changes

eng-prod-CI-bot-okta pushed a commit that referenced this pull request Jun 21, 2022

feat: add myaccount apis

59ccec6

OKTA-486697 <<<Jenkins Check-In of Tested SHA: e8ddce4 for [email protected]>>> Artifact: okta-auth-js Files changed count: 208 PR Link: #1158

eng-services-aperture-github-bot-okta closed this Jun 21, 2022


		## Introduction

		MyAccount APIs enables everything needed for the customer's end user to manage one's account. The API assumes the access token is obtained through the OAuth2 either by the classic or IDX flow.

	MyAccount APIs enables everything needed for the customer's end user to manage one's account. The API assumes the access token is obtained through the OAuth2 either by the classic or IDX flow.
	MyAccount APIs enables end user account management in SPA applications. The API requires an access token obtained via OAuth flows with additional [scopes](#scopes)


		## Scopes

		Certain token scopes will be needed to gain the permission to read/manage the account resources:

	Certain token scopes will be needed to gain the permission to read/manage the account resources:
	The following scopes are required for permission to read/write the resources exposed by the MyAccount API:


		## Handling `insufficient_authentication_context` error

		Re-Authentication will be needed when request requires higher assurance than provided by the access token. MyAccount API methods throws `AuthApiError` with `insufficient_authentication_context` in `errorSummary` and `max_age` in `meta` field to indicate the downstream applications to start a re-authentication flow.


		Re-Authentication will be needed when request requires higher assurance than provided by the access token. MyAccount API methods throws `AuthApiError` with `insufficient_authentication_context` in `errorSummary` and `max_age` in `meta` field to indicate the downstream applications to start a re-authentication flow.

		### AuthApiError example:

	Re-authentication Approaches:
	## Re-authentication Approaches:


		`App.jsx` is the entry point of the whole app, it manages the transaction state of the whole app and shares it via React context. Based on the current transaction status, it also redirects the app to the proper routes.
		This sample app demostrates the best practices for integrating Authentication into your React SAP via the embedded Auth SDK (@okta/okta-auth-js). It dynamically renders the form by following responses from [Okta's Identity Engine][]. Policy changes, like adding extra authenticator for MFA, can be reflected in this sample app with no code change.

	This sample app demostrates the best practices for integrating Authentication into your React SAP via the embedded Auth SDK (@okta/okta-auth-js). It dynamically renders the form by following responses from [Okta's Identity Engine][]. Policy changes, like adding extra authenticator for MFA, can be reflected in this sample app with no code change.
	This sample app demonstrates the best practices for integrating Authentication into your React SPA via the embedded Auth SDK (@okta/okta-auth-js). It dynamically renders the form by following responses from [Okta's Identity Engine][]. Policy changes, like adding extra authenticator for MFA, can be reflected in this sample app with no code change.

feat: add myaccount apis #1158

feat: add myaccount apis #1158

Conversation

shuowu commented Mar 29, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov-commenter commented Apr 4, 2022 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vijetmahabaleshwar-okta Apr 8, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

shuowu Jun 16, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

shuowu commented Mar 29, 2022 •

edited

Loading

codecov-commenter commented Apr 4, 2022 •

edited

Loading

vijetmahabaleshwar-okta Apr 8, 2022 •

edited

Loading

shuowu Jun 16, 2022 •

edited

Loading