Oauth in Mac App appears to behave differently than Web

[jdoconnor]

In the Mac App, oAuth tokens are not refreshing the same way as they are in the web.

[jesseditson]

Since we only have one report of this, can we have the reporter generate a minimal repro?

[dchavva]

Minimal repro steps:

1. Add live app to quip document in browser/MAC App
2. Login with user credentials and authenticate
3. Visit live app in MAC app after a day
4. Live app prompts user to login again

Observation: Even though live app prompts user to login again in MAC app, if user opens the quip document in browser, then live app in MAC app doesn't show login prompt instantly.
FYI @jdoconnor

[dchavva]

My assumption for above observation is that live app gets the refresh token for MAC app once the quip doc is opened in browser. @jdoconnor

[jesseditson]

By minimal repro I mean a live app that we can use to test. I have no doubt that the V2MOM app has this issue, but since we don't see the same issue in our own apps, we'll need to see the code causing the issue. By "minimal", I mean not the entire app, just the part that is broken. Part of the reason for this request is that in the majority of cases, the act of reproducing the bug in an isolated environment (a new app) uncovers the issue for the developer.

[dchavva]

@jesseditson I see. I can provide you access to our V2MOM's QA version of live app to test. Does that work?

[jesseditson]

No, I'm asking you to isolate the issue to verify that it is in fact a platform bug rather than just an implementation issue. Our team is small and does not have the bandwidth to manually review entire applications to find bugs in them. Alternatively, we can try to reproduce ourselves but the timeline on that would be longer because it's a good amount of work. Given that this is the only report, I'm sure you understand that this isn't the top priority for us until we can verify that it is a platform bug or until other apps report this issue.

[msasomsub]

Hi @jesseditson - Our login code does not differentiate between whether the login is from the desktop app or from the browser. Since the login is working fine from the browser (Chrome and Safari), do you think this could still be an implementation issue?

[jdoconnor]

I don't think we know, TBH. Our challenge is that this is the only app that we're aware of that behaves this way. We're really interested in getting to the bottom of this issue and ensuring our ability to document solutions to known situations gets better with this experience.

I created a new live app that auths with github using oauth2 and auth'd using the mac app. I'll know tomorrow after 3pm or so if it is still reporting logged in (after 24 hours), but without a reference implementation of what is happening, we're taking uninformed guesses.

[jdoconnor]

I made a very simple app that report logged in status with an oauth2 connection to github, and signed in on the mac app. over 24 hours later, it still reported that it was logged in when using the mac app.
This is based on the template app, and the only changes were in these two files

// main.tsx
import React, {Component} from "react";
import {menuActions, Menu} from "../menus";
import {AppData, RootEntity} from "../model/root";
import quip from "quip-apps-api";

interface MainProps {
    rootRecord: RootEntity;
    menu: Menu;
    isCreation: boolean;
    creationUrl?: string;
}

interface MainState {
    data: AppData;
}
export default class Main extends Component<MainProps, MainState> {
    setupMenuActions_(rootRecord: RootEntity) {
        menuActions.toggleHighlight = () =>
            rootRecord.getActions().onToggleHighlight();
    }

    constructor(props: MainProps) {
        super(props);
        const {rootRecord} = props;
        this.setupMenuActions_(rootRecord);
        const data = rootRecord.getData();
        this.state = {data};
    }

    componentDidMount() {
        // Set up the listener on the rootRecord (RootEntity). The listener
        // will propogate changes to the render() method in this component
        // using setState
        const {rootRecord} = this.props;
        rootRecord.listen(this.refreshData_);
        this.refreshData_();
    }

    componentWillUnmount() {
        const {rootRecord} = this.props;
        rootRecord.unlisten(this.refreshData_);
    }

    /**
     * Update the app state using the RootEntity's AppData.
     * This component will render based on the values of `this.state.data`.
     * This function will set `this.state.data` using the RootEntity's AppData.
     */
    private refreshData_ = () => {
        const {rootRecord, menu} = this.props;
        const data = rootRecord.getData();
        // Update the app menu to reflect most recent app data
        menu.updateToolbar(data);
        this.setState({data: rootRecord.getData()});
    };

    login = () => {
        const auth = quip.apps.auth("github");
        auth.login();
    }

    render() {
        const {data} = this.state;
        const {isHighlighted} = data;
        const auth = quip.apps.auth("github");
        const loggedIn = auth.isLoggedIn() ? "true" : "false";

        return (
            <div className={"root"}>
                <div>
                    <h1>Is the app logged in?: {loggedIn}</h1>
                </div>
            </div>
        );
    }
}

// root.ts
import quip from "quip-apps-api";

export interface AppData {
    isHighlighted: boolean;
}

export class RootEntity extends quip.apps.RootRecord {
    static ID = "example";

    static getProperties() {
        return {};
    }

    private isHighlighted_: boolean = false;

    static getDefaultProperties(): {[property: string]: any} {
        return {};
    }

    getData(): AppData {
        return {isHighlighted: this.isHighlighted_};
    }

    getActions() {
        return {
            onToggleHighlight: () => {
                const auth = quip.apps.auth("github");
                auth.login();
                this.notifyListeners();
            },
        };
    }
}

[dchavva]

@jdoconnor Could you let me know if the oauth settings on github are similar to a salesforce connected app regarding refresh tokens/policies? A slight difference here is, we're using connected app for oauth on our end. I can create users for you guys in our QA orgs and our QA live app so that you can see the issue exactly. Let me know.

[jdoconnor]

Since 24 hours appears to be a thing here, does your connected app (oauth provider) have a token expiry of 24 hours? In SFDC, you can find this when you edit your connected app

[dchavva]

@jdoconnor In our connected app,
IP Relaxation: Relax IP restrictions for activated devices, Refresh Token Policy: Refresh token is valid until revoked