feat: Refresh Token for improved Session Security (#927)

* feat(api): refresh token logic

* feat(client): refresh token logic

* feat(data-provider): refresh token logic

* fix: SSE uses esm

* chore: add default refresh token expiry to AuthService, add message about env var not set when generating a token

* chore: update scripts to more compatible bun methods, ran bun install again

* chore: update env.example and playwright workflow with JWT_REFRESH_SECRET

* chore: update breaking changes docs

* chore: add timeout to url visit

* chore: add default SESSION_EXPIRY in generateToken logic, add act script for testing github actions

* fix(e2e): refresh automatically in development environment to pass e2e tests

e2e/.env.test.example

@@ -1,9 +0,0 @@
-# Test database. You can use your actual MONGO_URI if you don't mind it potentially including test data.
-MONGO_URI=mongodb://127.0.0.1:27017/chatgpt-jest
-
-# Credential encryption/decryption for testing
-CREDS_KEY=c3301ad2f69681295e022fb135e92787afb6ecfeaa012a10f8bb4ddf6b669e6d
-CREDS_IV=cd02538f4be2fa37aba9420b5924389f
-
-# For testing the ChatAgent
-OPENAI_API_KEY=your-api-key

e2e/playwright.config.local.ts

@@ -13,8 +13,10 @@ const config: PlaywrightTestConfig = {
     ...mainConfig.webServer,
     command: `node ${absolutePath}`,
     env: {
-      NODE_ENV: 'production',
       ...process.env,
+      NODE_ENV: 'development',
+      SESSION_EXPIRY: '60000',
+      REFRESH_TOKEN_EXPIRY: '300000',
     },
   },
   fullyParallel: false, // if you are on Windows, keep this as `false`. On a Mac, `true` could make tests faster (maybe on some Windows too, just try)

e2e/playwright.config.ts

@@ -11,7 +11,7 @@ export default defineConfig({
   /* Run tests in files in parallel.
   NOTE: This sometimes causes issues on Windows.
   Set to false if you experience issues running on a Windows machine. */
-  fullyParallel: true,
+  fullyParallel: false,
   /* Fail the build on CI if you accidentally left test.only in the source code. */
   forbidOnly: !!process.env.CI,
   /* Retry on CI only */
@@ -62,7 +62,8 @@ export default defineConfig({
     env: {
       ...process.env,
       NODE_ENV: 'development',
-      SESSION_EXPIRY: '86400000',
+      SESSION_EXPIRY: '60000',
+      REFRESH_TOKEN_EXPIRY: '300000',
     },
   },
 });

e2e/setup/authenticate.ts

@@ -22,13 +22,8 @@ async function authenticate(config: FullConfig, user: User) {
   if (!baseURL) {
     throw new Error('🤖: baseURL is not defined');
   }
-  await page.goto(baseURL);
+  await page.goto(baseURL, { timeout: 5000 });
   await login(page, user);
-  // const loginPromise = page.getByTestId('landing-title').waitFor({ timeout: 25000 }); // due to GH Actions load time
-  // if (process.env.NODE_ENV === 'ci') {
-  //   await page.screenshot({ path: 'login-screenshot.png' });
-  // }
-  // await loginPromise;
   await page.waitForURL(`${baseURL}/chat/new`);
   console.log('🤖: ✔️  user successfully authenticated');
   // Set localStorage before navigating to the page

e2e/specs/keys.spec.ts

@@ -13,7 +13,7 @@ const enterTestKey = async (page: Page, endpoint: string) => {
 test.describe('Key suite', () => {
   // npx playwright test --config=e2e/playwright.config.local.ts --headed e2e/specs/keys.spec.ts
   test('Test Setting and Revoking Keys', async ({ page }) => {
-    await page.goto('http://localhost:3080/');
+    await page.goto('http://localhost:3080/', { timeout: 5000 });
     const endpoint = 'chatGPTBrowser';
 
     const newTopicButton = page.getByTestId('new-conversation-menu');
@@ -50,7 +50,7 @@ test.describe('Key suite', () => {
   });
 
   test('Test Setting and Revoking Keys from Settings', async ({ page }) => {
-    await page.goto('http://localhost:3080/');
+    await page.goto('http://localhost:3080/', { timeout: 5000 });
     const endpoint = 'bingAI';
 
     const newTopicButton = page.getByTestId('new-conversation-menu');

e2e/specs/landing.spec.ts

@@ -1,15 +1,14 @@
-/* eslint-disable no-undef */
 import { expect, test } from '@playwright/test';
 
 test.describe('Landing suite', () => {
   test('Landing title', async ({ page }) => {
-    await page.goto('http://localhost:3080/');
+    await page.goto('http://localhost:3080/', { timeout: 5000 });
     const pageTitle = await page.textContent('#landing-title');
     expect(pageTitle?.length).toBeGreaterThan(0);
   });
 
   test('Create Conversation', async ({ page }) => {
-    await page.goto('http://localhost:3080/');
+    await page.goto('http://localhost:3080/', { timeout: 5000 });
 
     async function getItems() {
       const navDiv = await page.waitForSelector('nav > div');

e2e/specs/messages.spec.ts

@@ -19,7 +19,7 @@ const waitForServerStream = async (response: Response) => {
 };
 
 async function clearConvos(page: Page) {
-  await page.goto(initialUrl);
+  await page.goto(initialUrl, { timeout: 5000 });
   await page.getByRole('button', { name: 'test' }).click();
   await page.getByText('Settings').click();
   await page.getByTestId('clear-convos-initial').click();
@@ -47,7 +47,7 @@ test.afterAll(async () => {
 });
 
 test.beforeEach(async ({ page }) => {
-  await page.goto(initialUrl);
+  await page.goto(initialUrl, { timeout: 5000 });
 });
 
 test.afterEach(async ({ page }) => {
@@ -60,7 +60,7 @@ test.describe('Messaging suite', () => {
   }) => {
     test.setTimeout(120000);
     const message = 'hi';
-    await page.goto(initialUrl);
+    await page.goto(initialUrl, { timeout: 5000 });
     await page.locator('#new-conversation-menu').click();
     await page.locator(`#${endpoint}`).click();
     await page.locator('form').getByRole('textbox').click();
@@ -125,7 +125,7 @@ test.describe('Messaging suite', () => {
 
   test('message should stop and continue', async ({ page }) => {
     const message = 'write me a 10 stanza poem about space';
-    await page.goto(initialUrl);
+    await page.goto(initialUrl, { timeout: 5000 });
 
     await page.locator('#new-conversation-menu').click();
     await page.locator(`#${endpoint}`).click();
@@ -161,7 +161,7 @@ test.describe('Messaging suite', () => {
 
   // in this spec as we are testing post-message navigation, we are not testing the message response
   test('Page navigations', async ({ page }) => {
-    await page.goto(initialUrl);
+    await page.goto(initialUrl, { timeout: 5000 });
     await page.getByTestId('convo-icon').first().click({ timeout: 5000 });
     const currentUrl = page.url();
     const conversationId = currentUrl.split(basePath).pop() ?? '';

e2e/specs/nav.spec.ts

@@ -2,7 +2,7 @@ import { expect, test } from '@playwright/test';
 
 test.describe('Navigation suite', () => {
   test('Navigation bar', async ({ page }) => {
-    await page.goto('http://localhost:3080/');
+    await page.goto('http://localhost:3080/', { timeout: 5000 });
 
     await page.locator('[id="headlessui-menu-button-\\:r0\\:"]').click();
     const navBar = await page.locator('[id="headlessui-menu-button-\\:r0\\:"]').isVisible();
@@ -10,7 +10,7 @@ test.describe('Navigation suite', () => {
   });
 
   test('Settings modal', async ({ page }) => {
-    await page.goto('http://localhost:3080/');
+    await page.goto('http://localhost:3080/', { timeout: 5000 });
     await page.locator('[id="headlessui-menu-button-\\:r0\\:"]').click();
     await page.getByText('Settings').click();
 

e2e/specs/popup.spec.ts

@@ -2,7 +2,7 @@ import { expect, test } from '@playwright/test';
 
 test.describe('Endpoints Presets suite', () => {
   test('Endpoints Suite', async ({ page }) => {
-    await page.goto('http://localhost:3080/');
+    await page.goto('http://localhost:3080/', { timeout: 5000 });
     await page.getByTestId('new-conversation-menu').click();
 
     // includes the icon + endpoint names in obj property

e2e/specs/settings.spec.ts

@@ -2,7 +2,7 @@ import { expect, test } from '@playwright/test';
 
 test.describe('Settings suite', () => {
   test('Last Bing settings', async ({ page }) => {
-    await page.goto('http://localhost:3080/');
+    await page.goto('http://localhost:3080/', { timeout: 5000 });
     await page.evaluate(() =>
       window.localStorage.setItem(
         'lastConversationSetup',
@@ -23,7 +23,7 @@ test.describe('Settings suite', () => {
         }),
       ),
     );
-    await page.goto('http://localhost:3080/');
+    await page.goto('http://localhost:3080/', { timeout: 5000 });
 
     const initialLocalStorage = await page.evaluate(() => window.localStorage);
     const lastConvoSetup = JSON.parse(initialLocalStorage.lastConversationSetup);