Release Debug 2024

Overview

This release introduces a debug mode bypass in the ms-nodejs-backend system’s authentication and authorization process to facilitate development and troubleshooting. It allows skipping OAuth token validation and disables platform ID permission checks when specific environment settings are enabled.

New Features

Added a bypass for token validation and user setup when the configuration flag ignoreExpiration in jwkConfig is enabled and an environment variable ORG_ID is set.
Automatically assigns a test user with global admin role and injects organization details from ORG_ID for debugging purposes.

Improvements / Changes

Disabled platform ID permission checks that previously enforced that a user must belong to the platform associated with the provider.
Commented out the permission verification that throws errors if a user's platformIds does not include the provider’s ID, allowing un-restricted access during debugging.
Logging a fatal message "USER logged in without oauth" whenever the bypass is triggered, to clearly indicate the non-standard auth flow.
These changes are gated behind the jwkConfig.ignoreExpiration() setting and the presence of ORG_ID environment variable, thus not affecting standard production behavior.

Bug Fixes

None in this release.

Technical / Developer Notes

The new debugging logic short-circuits the OAuth token validation by injecting a hard-coded test user with global admin privileges, organization data loaded from the environment, and an empty decoded token.
The original platform ID authorization checks are left in the code as commented-out lines, making it easy to re-enable them if needed.
This debug mode should ONLY be enabled in safe, non-production environments to avoid security risks.
Developers should set environment variable ORG_ID and enable ignoreExpiration in the JWT configuration to activate this mode.
Extensive logging is introduced to help diagnose when the bypass is engaged.

Breaking Changes

None. The debug bypass is opt-in and controlled by configuration flags to avoid impacting production systems.