There may be an interaction between softDelete and authentication

[eddyystop]

Someone reported authentication working with softDelete in feathers-hooks-common v3.2.0 but not v3.3.0. The softDelete was on the users service.

@ekryski is tracking the issue down, and is not positive the problem is with softDelete.

softDelete used to do 2 gets for service.get, one with provider: undefined, the other with provider: hook.para,s.provider. Now it does just one with provider: hook.params.provider.

[eddyystop]

More info #163 (comment)

I don't know if this is related, but I was trying out softDelete and it works as expected, the only problem I'm getting from it is it's still giving me

{
  "name": "NotFound",
  "message": "Item not found.",
  "code": 404,
  "className": "not-found",
  "errors": {}
}

Even though it was able to successfully patch the item with deleted: true. The before hooks from this service looks like this:

  before: {
    all:  [ softDelete() ],
    find: [],
    get: [],
    create: [ 
      authenticate('jwt'),
      associateCurrentUser({ as: 'ownerId' }),
    ],
    update: [...restrict],
    patch: [...restrict],
    remove: [...restrict],
  },

[eddyystop]

Am I correct in understanding you got the NotFound message during the patch call, even though that call changed the record as expected?

softDelete does not contain any after hooks, so it ran nothing after the successful patch call.

That would be the message you'd get if you tried a get after patching the record to be deleted.

What DB are you using? Perhaps you can clarify the situation, or provide some code that shows the situation?

@eddyystop Hi eddy. Yeah sure, it's actually a new toy project, I'm familiarizing myself with Auk so I can update some of our legacy projects that were using older versions/styles. The code is mostly boilerplate code yet from the latest feathers-cli. And no, I'm not trying to do a get after the remove. I just send a delete request from Postman and that's what I get.

https://github.com/johncrisostomo/voting-backend/tree/master/src/services/polls

[eddyystop]

I couldn't find a softDelete in either polls or users in the link above. Could you provide a breaking example and instructions to cause it?

Could you also run with feathers-hooks-common v3.2.0 rather than the current one and if the issue still occurs? Thanks.

Sorry for the late response and sorry because yeah I removed it from that code. I brought it back and tried to roll back feathers-hooks-common to v3.2.0 and it is still the same. You can look at the same repo for reference. I'm just adding a poll and then trying to remove it with a DELETE request from Postman.

[eddyystop]

Could you try this with v3.4.0 which will be published soon?

#197 might affect this issue. In any case I want to eliminate it as a cause.

Thanks.

[jordanbtucker]

Just ran into this problem today, however I am using softDelete as an application hook rather than a service hook. I also have authentication on my service.

app.hooks.js

const {softDelete} = require('feathers-hooks-common')
module.exports = {
	before: {
		all: [softDelete()],
		find: [],
		get: [],
		create: [],
		update: [],
		patch: [],
		remove: [],
	},
...
}

agents.hooks.js

const {authenticate} = require('feathers-authentication').hooks
module.exports = {
	before: {
		all: [authenticate('jwt')],
		find: [],
		get: [],
		create: [],
		update: [],
		patch: [],
		remove: [],
	},
...
}

When I perform a REST DELETE on an agent, I get:

{
    "name": "NotFound",
    "message": "Item not found.",
    "code": 404,
    "className": "not-found",
    "errors": {}
}

and {deleted: true} does not get set on the agent.

When I move softDelete to agents.hooks.js, everything works. Or when I remove authenticate from agents.hooks.js everything works.

Here are my feathers versions:

"feathers": "^2.1.7",
"feathers-authentication": "^1.2.7",
"feathers-authentication-hooks": "^0.1.4",
"feathers-authentication-jwt": "^0.3.2",
"feathers-authentication-local": "^0.4.3",
"feathers-configuration": "^0.4.1",
"feathers-errors": "^2.9.1",
"feathers-hooks": "^2.0.2",
"feathers-hooks-common": "^3.5.5",
"feathers-nedb": "^2.6.2",
"feathers-rest": "^1.8.0",
"feathers-socketio": "^2.0.0",

[eddyystop]

I assume authenticate makes internal service calls itself and softDelete is not compatible with them. I wouldn't know more than that. Perhaps @ekryski can comment.

[eddyystop]

Perhaps you can add the debug() hook before softDelete and perhaps identify what, if any, the unexpected called service is. Then you can instead use when(context => context.path !== '...', softDelete());

Please let me know what happens.

[jordanbtucker]

Added debug hooks to app.hooks.all and agents.hooks.all. Here's the result.

* app.hooks.before.all
type:before, method: remove
query: {}
* app.hooks.before.all
type:before, method: get
query: { '$disableSoftDelete': true }
* agents.hooks.before.all
type:before, method: get
data: {}
query: {}
info: error: agents - Method: get: No auth token
error:  NotAuthenticated: No auth token
    at Error.NotAuthenticated (node_modules\feathers-errors\lib\index.js:100:17)
    at node_modules\feathers-authentication\lib\hooks\authenticate.js:102:31
    at process._tickCallback (internal/process/next_tick.js:109:7)
info: error: agents - Method: remove: Item not found.
error:  NotFound: Item not found.
    at Error.NotFound (node_modules\feathers-errors\lib\index.js:121:17)
    at node_modules\feathers-hooks-common\lib\services\soft-delete.js:74:15
    at process._tickCallback (internal/process/next_tick.js:109:7)

After reviewing the code for softDelete, it appears that when remove is called, it checks to see if the item has already been deleted, and it does this with a get. Since app hooks are called before service hooks, the user hasn't been authenticated when get is called, and that's where the error occurs.

The soft delete works after moving authenticate to app.hooks.before.all and before softDelete.

So, as long as authenticate comes before softDelete, everything works.