Release Notes – ms-nodejs-backend Debug Update

Overview

This update introduces a debug-mode enhancement that conditionally bypasses OAuth token validation under specific environment configurations. The change is designed to facilitate testing or local development by allowing a default global admin user login without full OAuth authentication. Additionally, the internal IAM object construction has been refactored to improve clarity and consistency in handling user organization associations.

New Features

Added a debug bypass mechanism that, when enabled via the jwkConfig.ignoreExpiration() flag and presence of an ORG_ID environment variable, logs a fatal warning and returns a test user with global admin privileges without performing standard OAuth token validation.

Improvements / Changes

Refactored IAM (Identity and Access Management) object construction: instead of returning a newly constructed object, the system now assigns properties directly onto an existing IAM object.
User object within IAM now explicitly includes an orgId field populated from the environment variable ORG_ID. This replaces embedding the full organisation data object in the IAM structure.
Removed redundant embedding of organization details (organisation) and empty decodedToken objects from the IAM return payload when using the debug bypass.
Enhanced logging by recording a fatal-level log entry whenever a user login occurs without OAuth due to the debug bypass being active.
Maintained standard token validation flow when debug bypass conditions are not met, ensuring normal security behavior.

Bug Fixes

Not applicable in this update.

Technical / Developer Notes

The debug bypass logic is triggered only if both jwkConfig.ignoreExpiration() returns true and the environment variable ORG_ID is set.
This update introduces a logging side-effect intended to flag and monitor scenarios where users login without OAuth authentication, potentially serving as a security or audit checkpoint during development.
Consumers of the IAM object should now expect orgId to be part of the user object, and no longer rely on a nested organisation property.
Refactoring aimed at standardizing IAM object handling improves maintainability and aligns with permission setup expectations based on orgId.

Breaking Changes

The IAM object structure returned under debug bypass no longer includes the full organisation object or decodedToken field. Code depending on these fields must be updated to accommodate this change.
Direct assignment to an existing IAM object replaces previous return of a new object for the test user scenario; calling code should verify compatibility.