fix #1426: handle HTTPError during getProfileData

lib/fxa.js

@@ -73,10 +73,15 @@ const FXA = {
   },
 
   async getProfileData(accessToken) {
-    const data = await got(FxAOAuthUtils.profileUri,
-      { headers: { Authorization: `Bearer ${accessToken}` } }
-    );
-    return data.body;
+    try {
+      const data = await got(FxAOAuthUtils.profileUri,
+        { headers: { Authorization: `Bearer ${accessToken}` } }
+      );
+      return data.body;
+    } catch (e) {
+      log.warn("getProfileData", {stack: e.stack});
+      return e;
+    }
   },
 
   async sendMetricsFlowPing(path) {

middleware.js

@@ -139,6 +139,10 @@ async function requireSessionUser(req, res, next) {
     return res.redirect(`/oauth/init?${queryParams}`);
   }
   const fxaProfileData = await FXA.getProfileData(user.fxa_access_token);
+  if (fxaProfileData.hasOwnProperty("name") && fxaProfileData.name === "HTTPError") {
+    delete req.session.user;
+    return res.redirect("/");
+  }
   await DB.updateFxAProfileData(user, fxaProfileData);
   req.session.user = user;
   req.user = user;

tests/middleware.test.js

@@ -17,6 +17,7 @@ test("requireSessionUser calls getProfileData, updateFxAProfileData, and sets re
   jest.mock("../db/DB");
   jest.mock("../lib/fxa");
   FXA.getProfileData = jest.fn();
+  FXA.getProfileData.mockReturnValueOnce({});
   DB.updateFxAProfileData = jest.fn();
 
   await requireSessionUser(req, res, next);
@@ -34,6 +35,22 @@ test("requireSessionUser calls getProfileData, updateFxAProfileData, and sets re
 });
 
 
+test("requireSessionUser clears session user and redirects to / if FXA error", async () => {
+  const req = { session: { user: TEST_SUBSCRIBERS.firefox_account } };
+  const res = { redirect: jest.fn() };
+  const next = jest.fn();
+  jest.mock("../lib/fxa");
+  FXA.getProfileData = jest.fn();
+  FXA.getProfileData.mockReturnValueOnce({ name: "HTTPError" });
+
+  await requireSessionUser(req, res, next);
+
+  expect(req.session.hasOwnProperty("user")).toBeFalsy();
+  const mockRedirectCallArgs = res.redirect.mock.calls[0];
+  expect(mockRedirectCallArgs[0]).toBe("/");
+});
+
+
 test("requireSessionUser redirects to /oauth/init if no user", async () => {
   const req = { session: { } };
   const res = { redirect: jest.fn() };