allow ui login w/o auth in dev#3098
Open
danoswaltCL wants to merge 3 commits intodevfrom
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a DEV-only “no-auth” login flow so local development can bypass the Google sign-in UI when the backend is configured with Google auth disabled, while still tagging requests with a distinct fake credential for clearer auditing/log attribution.
Changes:
- Frontend: in
DEV, calls a new backend/login/check-authendpoint to decide whether to auto-login as a dev user (dispatching a fake credential) vs. rendering the Google sign-in button. - Backend: adds
/api/login/check-auth, introduces fake-credential handling in authorization to attribute requests to either a dev user or system user when auth is off, and seeds a dev user. - Updates test coverage for the new endpoint/flow and adjusts backend
.envexample defaults for local development.
Reviewed changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/frontend/projects/upgrade/src/environments/environment-types.ts | Adds checkAuthConfig endpoint to the API endpoints typing. |
| packages/frontend/projects/upgrade/src/app/features/auth/login/login.component.ts | DEV-only auto-login logic based on backend auth config; dispatches fake credential. |
| packages/frontend/projects/upgrade/src/app/features/auth/login/login.component.spec.ts | Adds Jest unit tests for DEV/non-DEV login branching behavior. |
| packages/frontend/projects/upgrade/src/app/core/auth/auth.data.service.ts | Adds checkAuthConfig() data call. |
| packages/frontend/projects/upgrade/src/app/core/api-endpoints.constants.ts | Adds /login/check-auth endpoint constant. |
| packages/frontend/jest.config.js | Stops ignoring all feature tests so the login feature spec can run. |
| packages/backend/test/unit/controllers/LoginController.test.ts | Adds unit tests for GET /api/login/check-auth. |
| packages/backend/src/init/seed/systemUser.ts | Expands system user fields and adds a seeded dev user. |
| packages/backend/src/auth/AuthService.ts | Adds helper to fetch dev/system user for no-auth attribution. |
| packages/backend/src/auth/authorizationChecker.ts | When auth is off, attributes requests to system user; adds bypass path for fake dev credential. |
| packages/backend/src/auth/auth.constants.ts | Introduces constants for fake credential and dev/system emails. |
| packages/backend/src/api/controllers/LoginController.ts | Adds unauthenticated GET /login/check-auth; keeps /login/user authorized. |
| packages/backend/.env.example | Sets local defaults to reduce auth friction; adjusts mooclets example value. |
| packages/backend/.env.docker.local.example | Sets local docker defaults to reduce auth friction. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#3094
when frontend envName="DEV" and backend has google auth off, the login screen is skipped and you are "Dev User".
Requests will be sent with a specific fake "token" when you are Dev User to make sure the logs show that. It may not really matter, but there can also be the "System User" in there in the logs, so seemed like you might want to differentiate.
Non-DEV: initializeGoogleSignInButton called directly, no HTTP
DEV + auth off: two dispatches (actionSetGoogleCredential + actionLoginStart) with the fake credential, no Google button
DEV + auth on: falls back to Google button
DEV + auth off but no devUser in response: also falls back to Google button