Cannot login in production or staging environments

Help me!
1

Hi there,

My backend stack is Serverless + Express + Typescript + Mongoose hosted on AWS Lambda
I’m using forest-express-mongoose 7.6.2
I followed all the steps required to migrate to v7, I generated a client_id, pushed my updated schema and everything look good on local.
But in production it’s another story:
First, the /auth request returns a cors error:
{"errors":[{"status":400,"detail":"The redirect uri must be one of https://s4cb2w6ep5.execute-api.us-east-1.amazonaws.com/staging/forest/authentication/callback. Received \" https://s4cb2w6ep5.execute-api.us-east-1.amazonaws.com/staging/forest/authentication/callback\"","meta":{},"name":"InvalidRedirectUriError"}]}
So initially I thought my cors setup was wrong but everything seems ok.
Then I checked out my Cloudwatch logs and here it is:

[forest] 🌳🌳🌳  An error occured while computing the Forest schema. Your application schema cannot be synchronized with Forest. Your admin panel might not reflect your application models definition. EROFS: read-only file system, open '/var/task/.forestadmin-schema.json'

"stack": "Error: EROFS: read-only file system, open '/var/task/.forestadmin-schema.json'\n    at Object.openSync (fs.js:462:3)\n    at Object.writeFileSync (fs.js:1384:35)\n    at SchemaFileUpdater.update (/var/task/node_modules/forest-express/dist/services/schema-file-updater.js:118:15)\n    at generateAndSendSchema (/var/task/node_modules/forest-express/dist/index.js:196:37)\n    at _callee$ (/var/task/node_modules/forest-express/dist/index.js:355:13)\n    at tryCatch (/var/task/node_modules/regenerator-runtime/runtime.js:63:40)\n    at Generator.invoke [as _invoke] (/var/task/node_modules/regenerator-runtime/runtime.js:293:22)\n    at Generator.next (/var/task/node_modules/regenerator-runtime/runtime.js:118:21)\n    at asyncGeneratorStep (/var/task/node_modules/@babel/runtime/helpers/asyncToGenerator.js:3:24)\n    at _next (/var/task/node_modules/@babel/runtime/helpers/asyncToGenerator.js:25:9)"

Any idea how to fix that ?

2

Hello @benjaming,

When your Forest Admin agent starts, it generates the .forestadmin-schema.json file. We use it internally to represent your collections, and by default it is stored at the root of your project.

AWS Lambda seems to prevent writing it the application directory (“read-only file system”).

You can change the directory used by adding a schemaDir option in the middlewares/forestadmin.js file of your code.

It could be:

module.exports = async function forestadmin(app) {
  app.use(await Liana.init({
    schemaDir: '/tmp/',
    ...

Another solution could be to include the .forestadmin-schema.json file within your lambda code.

Hope this helps.

3

Hum… thanks for your answer Guillaume.
Actually yes, I’m publishing the .forestadmin-schema.json along with the rest of the lambda but the Forest plugin is probably looking at the wrong folder.

By the way is this “schemaDir” a new option ?
image

Looks like the compiler is not recognizing this option yet…

4

It’s better: I don’t have the schema error anymore, but the cors issue is still present:

{"errors":[{"status":400,"detail":"The redirect uri must be one of https://s4cb2w6ep5.execute-api.us-east-1.amazonaws.com/staging/forest/authentication/callback. Received \" https://s4cb2w6ep5.execute-api.us-east-1.amazonaws.com/staging/forest/authentication/callback\"","meta":{},"name":"InvalidRedirectUriError"}]}
5

I don’t get why there’s an empty space char “%20” before my callback url:
https://api.forestadmin.com/oidc/auth?client_id=CLIENT_ID_STRING&scope=openid%20email%20profile&response_type=code&redirect_uri=%20https%3A%2F%2Fs4cb2w6ep5.execute-api.us-east-1.amazonaws.com%2Fstaging%2Fforest%2Fauthentication%2Fcallback&state=%7B%22renderingId%22%3A90920%7D ?

6

Hello @benjaming !
Yeah this space could be the problem here, can you check that your APPLICATION_URL doesn’t have a space ?

7

I’m sure there’s not as I requested the client ID directly from my command line like this:

     -H "Authorization: Bearer FOREST_STAGING_SECRET_KEY" \
     -X POST \
     -d '{"token_endpoint_auth_method": "none", "redirect_uris": ["https://s4cb2w6ep5.execute-api.us-east-1.amazonaws.com/staging/forest/authentication/callback"]}' \
     https://api.forestadmin.com/oidc/reg```
8

Yeah but here you write the redirect_uri yourself, whereas inside your liana it’s built from the env variable

9

Indeed, there was an invisible space char on my Serverless dashboard :man_facepalming:

Thanks a lot for your help though !

1 Like