Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: update facebook sdk and implement limited login #10143

Merged
merged 20 commits into from Apr 29, 2024

Conversation

brainbicycle
Copy link
Contributor

@brainbicycle brainbicycle commented Apr 24, 2024

This PR resolves PHIRE-736

Description

  • Updates facebooks sdk to version 17 containing a privacy manifest
  • This update also came with a big change to the Facebook sdk behavior: Privacy manifests only included in release 17.0.0 with breaking changes聽facebook/facebook-ios-sdk#2384 - if users are not opted into tracking (all of our users) - Facebook defaults to limited login by default on iOS, this means we no longer can get user data back from graph api but instead need to get it from the jwt that is returned and then validate that jwt on our backend to create a user session.

Depends on backend changes to auth code, draft until then.

Experience

For the user the experience is almost exactly the same except the Facebook domain is limited.facebook.com in the new oauth flow.

Limited Sign in iOS
limited-sign-in.mov
Limited Sign up iOS
limited-sign-up.mov
Classic Sign in Android
android-fb-login.mov
Classic Sign up Android
android-fb-signup.mov

Testing Done

iOS:

  • email sign in
  • email sign up
  • facebook sign in (limited)
  • facebook sign up (limited)
  • apple sign in
  • apple sign up
  • google sign in
  • google sign up

Android:

  • email sign in
  • email sign up
  • facebook sign in (classic)
  • facebook sign up (classic)
  • google sign in
  • google sign up

Follow-ups

  • I am seeing some weird behavior in 3rd party sign up on Android in the case when the user needs to performs some update to their account or sign some agreement before continuing with oauth, for example in emulator I got a flow to update my contact settings in google, this seemed to open a separate chrome window, after completing the artsy app restarted, the account was created successfully. I am 90% sure this is not related to these changes but should be investigated.
  • some light refactoring of the auth code to make a bit more readable would be good

PR Checklist

  • I have tested my changes on iOS and Android.
  • I hid my changes behind a feature flag, or they don't need one.
  • I have included screenshots or videos, or I have not changed the UI.
  • I have added tests, or my changes don't require any.
  • I added an app state migration, or my changes do not require one.
  • I have documented any follow-up work that this PR will require, or it does not require any.
  • I have added a changelog entry below, or my changes do not require one.

To the reviewers 馃憖

  • I would like at least one of the reviewers to run this PR on the simulator or device.
Changelog updates

Changelog updates

Cross-platform user-facing changes

iOS user-facing changes

  • update Facebook sdk and implement limited login - Brian

Android user-facing changes

Dev changes

Need help with something? Have a look at our docs, or get in touch with us.

@brainbicycle brainbicycle self-assigned this Apr 24, 2024
@brainbicycle brainbicycle marked this pull request as draft April 24, 2024 18:13
@brainbicycle brainbicycle changed the title chore: update Facebook sdk and implement limited login chore: update facebook sdk and implement limited login Apr 24, 2024
@ArtsyOpenSource
Copy link
Contributor

ArtsyOpenSource commented Apr 24, 2024

This PR contains the following changes:

  • iOS user-facing changes (update Facebook sdk and implement limited login - Brian)

Generated by 馃毇 dangerJS against f03b8e5

@@ -9529,6 +9529,11 @@ jws@^3.2.2:
jwa "^1.4.1"
safe-buffer "^5.0.1"

jwt-decode@4.0.0:
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

need new dep for decoding jwts from Facebook to get user info

import { jwtDecode } from "jwt-decode"
import { capitalize } from "lodash"
import { Alert } from "react-native"
import {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this file just moved some existing helpers from AuthModel the make that file a little easier to read, most already existed a few new ones for limited login.

}
}

export async function handleLimitedFacebookAuth(
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this method is the major new behavior, on iOS we use the new jwt auth for both sign in and sign up


interface FacebookLimitedOAuthParams {
oauthProvider: "facebook"
oauthMode: "jwt"
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

since Facebook now has 2 different oauth modes this param is necessary to decouple oauth modes from providers on backend

id_token: oauthProvider === "apple" ? args.idToken : undefined,
grant_type: grantTypeMap[oauthProvider],
id_token: oauthMode === "idToken" ? args.idToken : undefined,
grant_type: grantTypeMap[oauthMode],
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

similarly, use oauthMode rather than provider name when choosing params

@@ -126,9 +126,9 @@ target 'Artsy' do
pod 'Pulley', git: 'https://github.com/artsy/Pulley.git', branch: 'master'

# Facebook
pod 'FBSDKCoreKit', '~> 16.3.1'
pod 'FBSDKLoginKit', '~> 16.3.1'
pod 'FBSDKShareKit', '~> 16.3.1'
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tangent: we have a bunch of deps explicitly listed in the podfile that we get automatically through the associated node_module deps, this makes it harder to upgrade, we should probably remove from the Podfile.

@brainbicycle brainbicycle marked this pull request as ready for review April 29, 2024 12:32
@brainbicycle brainbicycle added the Squash On Green A label to indicate that Peril should squash-merge this PR when all statuses are green label Apr 29, 2024
@artsy-peril artsy-peril bot merged commit b7caf88 into main Apr 29, 2024
7 checks passed
@artsy-peril artsy-peril bot deleted the brian/update-fbsk branch April 29, 2024 12:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Jira Synced Squash On Green A label to indicate that Peril should squash-merge this PR when all statuses are green
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants