Merge branch 'update-existing-identity-fix' into 'main'

fix(server): correctly update existing oauth identities

See merge request !76

src/models/identity/identity.controller.js

@@ -31,6 +31,17 @@ const getDefaultIdentity = async userId => {
   }
 }
 
+const hasValidRefreshToken = identity => {
+  const { oauthRefreshTokenExpiration, oauthRefreshToken } = identity
+  const UTCNowTimestamp = moment().utc().toDate().getTime()
+
+  return (
+    !!oauthRefreshToken &&
+    !!oauthRefreshTokenExpiration &&
+    oauthRefreshTokenExpiration.getTime() > UTCNowTimestamp
+  )
+}
+
 /**
  * Authorise user OAuth.
  * Save OAuth access and refresh tokens.
@@ -41,7 +52,7 @@ const createOAuthIdentity = async (userId, provider, sessionState, code) => {
   try {
     let identity = await Identity.findOne({ userId, provider })
 
-    if (identity) {
+    if (identity && hasValidRefreshToken(identity)) {
       return identity
     }
 
@@ -56,17 +67,22 @@ const createOAuthIdentity = async (userId, provider, sessionState, code) => {
       Buffer.from(authData.oauthAccessToken.split('.')[1], 'base64').toString(),
     )
 
-    identity = await Identity.insert({
-      email,
-      provider,
-      userId,
-      profileData: {
-        givenNames,
-        surname,
-        providerUserId,
-      },
-      ...authData,
-    })
+    if (!identity) {
+      identity = await Identity.insert({
+        email,
+        provider,
+        userId,
+        profileData: {
+          givenNames,
+          surname,
+          providerUserId,
+        },
+        ...authData,
+      })
+    } else {
+      identity = await Identity.patchAndFetchById(identity.id, { ...authData })
+    }
+
     const { oauthRefreshTokenExpiration } = authData
     const expiresIn = (oauthRefreshTokenExpiration - moment().utc()) / 1000
 
@@ -140,4 +156,5 @@ module.exports = {
   createOAuthIdentity,
   getUserIdentities,
   getDefaultIdentity,
+  hasValidRefreshToken,
 }

src/models/identity/identity.resolvers.js

 const logger = require('@pubsweet/logger')
 const { pubsubManager } = require('pubsweet-server')
-const moment = require('moment')
 
-const { createOAuthIdentity } = require('./identity.controller')
+const {
+  createOAuthIdentity,
+  hasValidRefreshToken,
+} = require('./identity.controller')
+
 const { getUser } = require('../user/user.controller')
 
 const {
@@ -43,21 +46,11 @@ const createOAuthIdentityResolver = async (
   }
 }
 
-const hasValidRefreshTokenResolver = async identity => {
-  const { oauthRefreshTokenExpiration } = identity
-  const UTCNowTimestamp = moment().utc().toDate().getTime()
-
-  return (
-    oauthRefreshTokenExpiration &&
-    oauthRefreshTokenExpiration.getTime() > UTCNowTimestamp
-  )
-}
-
 module.exports = {
   Mutation: {
     createOAuthIdentity: createOAuthIdentityResolver,
   },
   Identity: {
-    hasValidRefreshToken: hasValidRefreshTokenResolver,
+    hasValidRefreshToken,
   },
 }