Feature/issue 530 google grant

[sosnovsky]

This PR separates asking for mail and contacts permissions.

close #530

---

Tests (delete all except exactly one):

• Difficult to test (explain why) - it's difficult to revoke given permissions through iOS simulator to be able to test sign up process.

---

To be filled by reviewers

I have reviewed that this PR... (tick whichever items you personally focused on during this review):

• addresses the issue it closes (if any)
• code is readable and understandable
• is accompanied with tests, or tests are not needed
• is free of vulnerabilities
• is documented clearly and usefully, or doesn't need documentation

[tomholub]

Looks good - sharing general code feedback. Didn't run it yet

[tomholub]

Tried to log in, saw the "Gmail" permissing unchecked. Left it unchecked and proceeded. No visual feedback in the app, this was in the logs:

"ℹ️[App Start][GlobalRouter] Sign in with gmailLogin(<FlowCrypt.SignInViewController: 0x13a852400>)"
"ℹ️[App Start][GlobalRouter] gmail login failed with error The operation couldn’t be completed. (FlowCrypt.GoogleUserServiceError error 1.)"
"ℹ️[App Start][GlobalRouter] Sign in with gmailLogin(<FlowCrypt.SignInViewController: 0x13a852400>)"
"ℹ️[App Start][GlobalRouter] gmail login failed with error The operation couldn’t be completed. (org.openid.appauth.general error -3.)"

[tomholub]

However, on the first prompt it was still showing 3 other permissions + checkbox for Gmail.

Could we split it into two steps? In first step, grant 3 other permissions. In second step, grant Gmail (which will then be without checkbox).

[sosnovsky]

In the case when user doesn't check mail checkbox on the first auth screen app should show next screen with message about "Inbox access", and then show Google auth screen only with mail screen. Here how it works for me:

Simulator.Screen.Recording.-.iPhone.12.-.2021-11-19.at.22.28.06.mp4

We can remove mail permission from the first step, I left it as described here #530 (comment) - so if user grants mail permission on the first step then no need for the second step, and user goes straight to Inbox.

[tomholub]

Got it. I'll re-test

[tomholub]

code good - need to retry manual testing

[tomholub]

Same (unchecked gmail)

"ℹ️[App Start][GlobalRouter] Sign in with gmailLogin(<FlowCrypt.SignInViewController: 0x10a85b600>)"
"ℹ️[App Start][GlobalRouter] gmail login failed with error The operation couldn’t be completed. (FlowCrypt.GoogleUserServiceError error 1.)"

[tomholub]

From your testing - "other contacts" don't include regular contacts? We need both?

[tomholub]

Currently, if I only choose one of the two, it will not tell me that I did something wrong and yet it will not search contacts (it seems). First though, need to confirm we really need both. And before that will need to debug the issue I'm having when logging in. Maybe add some more logs?

[sosnovsky]

Other contacts are contacts which automatically created by Google and not stored in user's contacts (#844). So we need both scopes for full contacts search.

Currently, if I only choose one of the two, it will not tell me that I did something wrong and yet it will not search contacts (it seems). First though, need to confirm we really need both.

I'm working on adding popup with error message as you've described here #1043 (comment), then users will see message about missing scope.

And before that will need to debug the issue I'm having when logging in. Maybe add some more logs?

Yes, it's strange as I didn't notice any issue with unchecked mail permission during testing - it always redirected me to Inbox permission screen.

Did you remove Flowcrypt iOS App from Third-party apps with account access list at https://myaccount.google.com/u/2/permissions before testing? Maybe it redirects you to the next screen because you already gave access to your Inbox?

[tomholub]

Did you remove Flowcrypt iOS App from Third-party apps with account access list at https://myaccount.google.com/u/2/permissions before testing? Maybe it redirects you to the next screen because you already gave access to your Inbox?

I did remove it - else I wouldn't see the grant screen at all.

Once I've seen the error once and try again, it only asks for Gmail auth (that means from google's perspective it was successfully granted) and proceeds successfully.

[tomholub]

Marking as draft until resolved

[sosnovsky]

@tomholub I added handling for contacts permission errors and also updated logging to print more detailed messages.
Can you please check permissions flow now? It'll be useful if you'll be able to record video of it, if something goes wrong

[tomholub]

updated logs:

"ℹ️[App Start][GlobalRouter] Sign in with gmailLogin(<FlowCrypt.SignInViewController: 0x10e8c9000>)"
"ℹ️[App Start][GlobalRouter] gmail login failed with error Missing scopes error: Gmail"

I'm testing by going to a menu and then adding a secondary account - sorry for not mentioning it earlier. It does work properly when I just tried it when adding a first account, issue can be reproduced when adding additional accounts (and leaving out one scope) - please see if you also observe the same.

[sosnovsky]

@tomholub I reproduced this issue with secondary account adding, it's fixed now ✅

[tomholub]

@sosnovsky all good but tests seem unhappy

[sosnovsky]

It seems UI tests for other PRs and master are failing too, maybe your tests timeout increase will fix it.