Swagger API "could not validate credentials" though it says I'm logged in

[bmeluch]

Describe the bug
In the production Swagger UI page, I get a "could not validate credentials" response on the first use of a padlocked endpoint even though it says I'm logged in when I click on "Authorizations" at the top of the page.

To Reproduce
Steps to reproduce the behavior:

1. Open a new tab api.microbiomedata.org
2. It says I'm already logged in. Cool!
3. Try and use a locked endpoint eg. queries:run
4. Server response { "Could not validate credentials" }

Expected behavior
I should be able to use locked endpoints when the page says I am logged in.

Acceptance Criteria
Can use a locked endpoint upon opening a new tab where the API says I am logged in without having to reenter my credentials.

Additional context
I'm speculating that this is related to the new addition of persistent login because 1) logging out and back in fixes the problem and 2) this didn't happen to me before the last release.

[eecavanna]

Thanks for reporting this! I just noticed that this ticket was created. I'll try to reproduce the symptom later this week.

[eecavanna]

Hi @bmeluch, I haven't tried to reproduce did yet. I am thinking about it right now, while away from my computer. I have two questions (I'll still be able to investigate even without knowing the answers to these, but I think the answers will help me rule some possibilities out). The questions are:

1. Do you log in using ORCID Login, or a "native" Runtime account (i.e. a username and password that a team member sent you some time in the past)?
2. I'm wondering whether the "access token" that your web browser stores when you log in, happened to expire; and the Swagger UI didn't "realize" it, but the Runtime API did. With that in mind, had you already been logged in for a few weeks when the endpoint access failure happened?

I don't remember how long the access tokens last until they expire. I'm going to look it up in the codebase once I post this comment (I'm on my iPhone).

---

Update: After having perused the codebase for a few minutes here on my iPhone, I think the access tokens expire after 24 hours. So, if you last logged in over 24 hours before, it might be the case that your access token had expired (but Swagger UI didn't "realize" it). With that possibility in mind, I'd like to update the API's code so that the error message indicates that. Also, we can increase the expiration duration; and maybe make it easier to refresh the token without having to log out and back in again (I don't know how far the codebase is from providing that functionality—it's among the things I'll look into when I work on this ticket).

[bmeluch]

1. Do you log in using ORCID Login, or a "native" Runtime account (i.e. a username and password that a team member sent you some time in the past)?

I log in with a username and password, have never used ORCID for the API, but I do use ORCID for the data portal and submission portals.

2. I'm wondering whether the "access token" that your web browser stores when you log in, happened to expire; and the Swagger UI didn't "realize" it, but the Runtime API did. With that in mind, had you already been logged in for a few weeks when the endpoint access failure happened?

Update: After having perused the codebase for a few minutes here on my iPhone, I think the access tokens expire after 24 hours. So, if you last logged in over 24 hours before, it might be the case that your access token had expired (but Swagger UI didn't "realize" it).

As far as I remember this was happening once a day, so that makes sense!

[ssarrafan]

Newish issue. Moving to new sprint.

[eecavanna]

I opened a PR that replaces the one, blanket error message with a set of more granular ones. For example:

- Could not validate credentials
+ Access token has expired. Please log in again.