Expire user session when access token expires

In a previous commit we setup to have the AddAddressesToBolt be called
asynchronously via a Job. However, when the first access_token expires
then new one doesn't have write access anymore so the Job fails. To
solve this we are adding a check for the expiration time and signing out
the user, to force them to get a fresh token with write access.

To improve the UX, we are moving this step to before delivery (to avoid
signing out a user right at the end of the checkout flow).

Author: Naokimi

app/decorators/controllers/solidus_bolt/spree_checkout_controller/add_addresses_to_bolt.rb

@@ -3,12 +3,15 @@
 module SolidusBolt
   module SpreeCheckoutController
     module AddAddressesToBolt
-      def finalize_order
-        if session[:bolt_access_token] && current_order.payments.last&.source_type == "SolidusBolt::PaymentSource"
+      def before_delivery
+        if session_refreshed_or_expired?
+          Spree::UserLastUrlStorer.new(self).store_location
+          sign_out(spree_current_user)
+        elsif session[:bolt_access_token]
           spree_current_user.addresses.each do |address|
             SolidusBolt::AddAddressJob.perform_later(
               order: current_order,
-              access_token: SolidusBolt::Users::RefreshAccessTokenService.call(session: session),
+              access_token: session[:bolt_access_token],
               address: address
             )
           end
@@ -18,6 +21,13 @@ def finalize_order
       end
 
       Spree::CheckoutController.prepend self
+
+      private
+
+      def session_refreshed_or_expired?
+        session[:bolt_access_token] &&
+          (session[:bolt_scope] == 'bolt.account.view' || Time.now.utc >= session[:bolt_expiration_time])
+      end
     end
   end
 end

app/decorators/omniauth/strategies/bolt_decorator.rb

@@ -8,6 +8,7 @@ def callback_phase
         session[:bolt_expiration_time] = @expiration_time
         session[:bolt_refresh_token] = @refresh_token
         session[:bolt_refresh_token_scope] = @refresh_token_scope
+        session[:bolt_scope] = @scope
       end
     end
 

app/services/solidus_bolt/users/refresh_access_token_service.rb

@@ -26,6 +26,7 @@ def refresh_access_token
         session[:bolt_refresh_token] = response['refresh_token']
         session[:bolt_refresh_token_scope] = response['refresh_token_scope']
         session[:bolt_access_token] = response['access_token']
+        session[:bolt_scope] = response['scope']
       end
 
       def build_options

spec/requests/spree/checkout_controller_spec.rb

@@ -33,85 +33,121 @@
     end
   end
 
-  describe "GET /checkout/payment" do
-    let(:order) { Spree::TestingSupport::OrderWalkthrough.up_to(:payment) }
-
-    before { allow(SolidusBolt::Users::SyncPaymentSourcesService).to receive(:call) }
-
-    it 'returns a successful response' do
-      get '/checkout/payment'
-
-      expect(response.status).to eq 200
-    end
-
-    it 'calls the service to sync payment sources' do
-      get '/checkout/payment'
-
-      expect(SolidusBolt::Users::SyncPaymentSourcesService).to have_received(:call)
+  describe 'GET /checkout/delivery' do
+    subject(:deliver_order) { get '/checkout/delivery' }
+
+    let(:order) { Spree::TestingSupport::OrderWalkthrough.up_to(:delivery) }
+    let(:bolt_expiration_time) { Time.now.utc - 15.minutes }
+    let(:access_token) { 'access_token' }
+    let(:bolt_scope) { 'bolt.account.view openid' }
+    let!(:session) do
+      { bolt_access_token: access_token, bolt_expiration_time: bolt_expiration_time, bolt_scope: bolt_scope }
     end
-  end
-
-  describe 'PATCH /checkout/update/confirm' do
-    subject(:confirm_order) { patch '/checkout/update/confirm' }
-
-    let(:order) { FactoryBot.create(:order_with_totals) }
-    let(:payment) { create(:payment, amount: order.total, order: order) }
-    let(:session) { { bolt_access_token: access_token } }
-    let(:access_token) { nil }
 
     before do
-      # use test preparation from solidusio/solidus/frontend/spec/controllers/spree/checkout_controller_spec.rb
-      # because Spree::TestingSupport::OrderWalkthrough.up_to(:confirm) doesn't work
       order.update! user: user
-      order.update(state: 'confirm')
-      payment
-      order.create_proposed_shipments
-      order.payments.reload
 
-      # request calls Gateway#authorize - need to stub it to test our action
-      allow(SolidusBolt::Transactions::AuthorizeService).to(receive(:call).and_return({
-        'transaction' => { 'from_credit_card' => { 'id' => 'CreditCardId' } }
-      }))
+      allow(SolidusBolt::Users::SyncPaymentSourcesService).to receive(:call)
 
       # rubocop:disable RSpec/AnyInstance
       allow_any_instance_of(ActionDispatch::Request).to receive(:session).and_return(session)
       # rubocop:enable RSpec/AnyInstance
     end
 
-    it 'redirects to completion route' do
-      confirm_order
-      expect(response).to redirect_to spree.order_path(order)
+    context 'without bolt session' do
+      let(:access_token) { nil }
+
+      it 'returns a successful response' do
+        deliver_order
+
+        expect(response.status).to eq 200
+      end
+
+      it 'skips the job call to add addresses' do
+        expect { deliver_order }.not_to have_enqueued_job(SolidusBolt::AddAddressJob)
+      end
     end
 
-    context 'with logged in Bolt user and Bolt payment' do
-      let(:access_token) { 'accesstoken' }
-      let(:payment) { create(:bolt_payment, amount: order.total, order: order) }
+    context 'with valid bolt_access token' do
+      it 'returns a successful response' do
+        deliver_order
 
-      before { allow(SolidusBolt::Users::RefreshAccessTokenService).to receive(:call).and_return(access_token) }
+        expect(response.status).to eq 200
+      end
 
       it 'calls the job to add addresses' do
-        expect { confirm_order }.to(have_enqueued_job(SolidusBolt::AddAddressJob).twice.with { |hash|
+        expect { deliver_order }.to(have_enqueued_job(SolidusBolt::AddAddressJob).twice.with { |hash|
           expect(hash[:order]).to eq(order)
           expect(hash[:access_token]).to eq(access_token)
           expect(user.addresses).to include(hash[:address])
         })
       end
     end
 
-    context 'with logged in Bolt user' do
-      let(:access_token) { 'accesstoken' }
+    context 'with expired bolt_access token' do
+      include Devise::Test::IntegrationHelpers
+
+      let(:bolt_expiration_time) { Time.now.utc + 15.minutes }
+
+      before { sign_in(order.user) }
+
+      it 'stores the sign in location' do
+        deliver_order
+
+        expect(session[:spree_user_return_to]).to eq('/checkout/delivery')
+      end
+
+      it 'signs out the user' do
+        deliver_order
+
+        expect(controller.spree_user_signed_in?).to be false
+      end
 
       it 'skips the job call to add addresses' do
-        expect { confirm_order }.not_to have_enqueued_job(SolidusBolt::AddAddressJob)
+        expect { deliver_order }.not_to have_enqueued_job(SolidusBolt::AddAddressJob)
       end
     end
 
-    context 'with Bolt payment' do
-      let(:payment) { create(:bolt_payment, amount: order.total, order: order) }
+    context 'with refreshed access_token' do
+      include Devise::Test::IntegrationHelpers
+
+      let(:bolt_scope) { 'bolt.account.view' }
+
+      before { sign_in(order.user) }
+
+      it 'stores the sign in location' do
+        deliver_order
+
+        expect(session[:spree_user_return_to]).to eq('/checkout/delivery')
+      end
+
+      it 'signs out the user' do
+        deliver_order
+
+        expect(controller.spree_user_signed_in?).to be false
+      end
 
       it 'skips the job call to add addresses' do
-        expect { confirm_order }.not_to have_enqueued_job(SolidusBolt::AddAddressJob)
+        expect { deliver_order }.not_to have_enqueued_job(SolidusBolt::AddAddressJob)
       end
     end
   end
+
+  describe "GET /checkout/payment" do
+    let(:order) { Spree::TestingSupport::OrderWalkthrough.up_to(:payment) }
+
+    before { allow(SolidusBolt::Users::SyncPaymentSourcesService).to receive(:call) }
+
+    it 'returns a successful response' do
+      get '/checkout/payment'
+
+      expect(response.status).to eq 200
+    end
+
+    it 'calls the service to sync payment sources' do
+      get '/checkout/payment'
+
+      expect(SolidusBolt::Users::SyncPaymentSourcesService).to have_received(:call)
+    end
+  end
 end