Release Explorer

Release Notes – Debug Mode Enhancement for ms-nodejs-backend

Overview

This release introduces a debug mode in the backend authentication flow that allows bypassing token validation and permission checks, enabling developers to simulate a user with global admin privileges conveniently. It facilitates debugging and local development when token expiration is ignored and an organizational context is set via environment variables.

New Features

  • Added a conditional bypass that disables token validation when jwkConfig.ignoreExpiration() returns true and the environment variable ORG_ID is set, allowing direct login without OAuth.
  • The bypass sets up a test user object with a GLOBAL_ADMIN role and fetches the associated organisation by ORG_ID. This simulates authenticated context for debugging.

Improvements / Changes

  • Disabled the platform ID permission check that verifies whether the authenticated user has access to the specified provider by commenting out the related error throwing logic. This prevents permission errors during debugging sessions.
  • Enhanced logging with a fatal-level log entry—"USER logged in without oauth"—to indicate when debug bypass is active.

Bug Fixes

  • N/A for this release.

Technical / Developer Notes

  • When debugging and jwkConfig.ignoreExpiration() is enabled along with ORG_ID in the environment, the server sets iamObject.user to a test user with:
    • _id: "test"
    • name: "test"
    • orgId from environment variable
    • role: "GLOBAL_ADMIN"
  • Permission checks related to user-platform ID matching have been commented out to ease testing without access restrictions.
  • The decoded token is replaced with an empty object in debug mode to bypass actual token parsing.

Breaking Changes

  • None; however, note that debug bypass only activates when explicitly configured by environment variables and does not affect normal production flows.

Acknowledgements / Contributors

  • N/A

This update is intended for development and debugging phases and should be carefully controlled in deployment environments to prevent unintentional security bypass.