[$100] Prod - permission issue debugging

[jmgasper]

As discussed via email, debugging permission issues.

[jmgasper]

Challenge https://www.topcoder.com/challenges/38acefad-3b38-482e-95cc-f57ff100948f has been created for this ticket.

This is an automated message for ghostar via Topcoder X

[jmgasper]

Challenge https://www.topcoder.com/challenges/38acefad-3b38-482e-95cc-f57ff100948f has been assigned to obog.

This is an automated message for ghostar via Topcoder X

[jmgasper]

@atelomycterus - Another issue, potentially related. A few folks saw the refresh / authorise URL as incorrect, which may be the cause of the issue:

ok, now i’m seeing it in incognito
https://authorize/?client_id=...&scope=openid%20profile%20email&response_type=code&response_mode=web_message&state=...&nonce=...&redirect_uri=https%3A%2F%2Faccounts-auth0.topcoder.com&code_challenge=Briqu_INRZu2MNaY8Fn-s6IdWwbkXt2mYnQMHWBLqXY&code_challenge_method=S256&prompt=none&auth0Client=eyJuYW1lIjoiYXV0aDAtc3BhLWpzIiwidmVyc2lvbiI6IjEuMTAuMCJ9

Any idea why it would be going to https://authorize?

We double checked that the env variable is set correctly:

$Configuration['Plugins']['Topcoder']['M2M']['Auth0Url'] = getenv('AUTH0_URL');

AUTH0_URL https://topcoder.auth0.com/oauth/token

[atelomycterus]

@jmgasper

1. "https://authorize?" issue
   I’m seeing it in the default mode. The bug exists in auth0-spa-js , not Vanilla. The authorize url is extracted from jwt token. If the token is not found then the url is invalid, the domain (issuer host) is missing.
   How to reproduce it : sign in Vanilla, then open a new window and log out, go to the first window and you should see the invalid authorize url:

2. The most Rest API methods use the userID from the current session, there is no way to get calculated category permissions for a specified user. I added 2 endpoints in DebugPlugin to get calculated user permissions for UserID. Please apply PR-Add endpoints to get user permissions forums-plugins#68 and deploy it in PROD.
   After deploying, I'll verify User Permissions for all users mentioned in the email. At the very least, we will understand the possible source of the problems.

User permissions for Category/Group by UserID:

Default User permissions by UserID:

[jmgasper]

@rootelement ☝️ Has anything changed with Auth0 recently?

[atelomycterus]

@rootelement @jmgasper I noticed it a couple of months ago.

[rootelement]

@sachin-maheshwari @mtwomey has anything changed in auth0 that would cause this issue?