1368739 - BMO OrangeFactor integration doesn't work with SSO

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: Extensions, enhancement, P5)

Description

[Ryan VanderMeulen [:RyanVM]]

Broken by the SSO move. Can't load the data anymore.

Comment 1

[Ed Morley [:emorley]]

The graph part of the integration being affected by SSO was expected (bug 1356410 comment 29) - though it was hoped that for users already signed in the API call would still work. It looks like the integration should be setting withCredentials=True so the SSO cookie gets sent, which should make it work:
https://github.com/mozilla-bteam/bmo/blob/20c1dbebae25818af68e68b77b8e33b76720c3c4/extensions/OrangeFactor/web/js/orange_factor.js#L75-L79

ie:
```
      xhrFields: {
           withCredentials: true
      },
```

Though IMO the graph part of the integration was pretty awful and not very helpful, so I wonder if it's even useful to leave it in any more?

Comment 2

[Ryan VanderMeulen [:RyanVM]]

"X failures in the last week" was useful

Comment 3

[Ed Morley [:emorley]]

Attachment: PR #86: Make OrangeFactor extension work with SSO

Comment 4

[Ed Morley [:emorley]]

OrangeFactor API CORS headers updated earlier in:
remote:   https://hg.mozilla.org/automation/orangefactor/rev/d01ad249565ef16d8516ccf671f0c915e470fc3

Comment 5

[Dylan Hardison [:dylan] (he/him)]

To [e-mail]:mozilla-bteam/bmo.git
   9b98e5f44..0087764fc  master -> master

Comment 6

[Ed Morley [:emorley]]

Many thanks!

Comment 7

[Ed Morley [:emorley]]

I've also disabled the Cookie attribute `SameSite=Lax` that lua-resty-session adds by default, since otherwise it would prevent usage of the API by BMO in browsers that support it (currently only Chrome and Opera)

https://hg.mozilla.org/automation/orangefactor/rev/5f58d96de33a6f64c02f4c61bb7f8d076589b7db