Running locally

[mduffin95]

Do you have any documentation for getting the frontend running locally?

I've got as far as running yarn dev in the apps/nowcasting-app directory. I assume I also need to run some sort of backend to get it to work.

[mduffin95]

Never mind, missed a README within the nowcasting-app directory 🤦. Might be worth linking to it from the main README though?

[mduffin95]

I've been unable to get the frontend working as it seems I don't have access to certain secrets required for auth0 to work. What do you need to do to get a development environment up and running?

[mduffin95]

Or is this something that will only be possible for people outside OCF once #505 has been implemented?

[mduffin95]

@peterdudfield any ideas? Also is this the best place to post questions? Perhaps there is a slack channel?

[peterdudfield]

Hi @mduffin95

sorry we took a while to get back to you. Did you get it working?

I think in general its good to put the questions on the repo, in the repo, and try to tag the main developer. In this case it would be @braddf. Happy for me to be tagged in anything too.

1. a link in the main repo would be great. Could you do a PR for this? Oh i can now see this in update README #525
2. For en vars for auth0 to work, have you got it sorted yet? If not, @braddf can we share the development ones, to help people run this locally.

I think #505 has been attempted, a put in a PR #516.

[peterdudfield]

hi @mduffin95. Thanks for trying this out, and I'm glad you can make a bearer token that way.

I dont think we should give out the AUTH0_CLIENT_SECRET, feels like it shouldnt be made public. I am correct?
Is there a way to by pass there perhaps a way (in code) to bypass the log in and pass in your bearer token you have created?

Sorry this is very much a work in progress, and your inputs here are really valuable

[mduffin95]

feels like it shouldnt be made public

Yeah agreed.

Just wanted to check I wasn't missing anything obvious. I can take another look this weekend into getting a local setup working 👍

[braddf]

Hey @mduffin95, sorry for the belated response... Firstly, to reiterate, yes I agree, we will not be giving out, sharing or otherwise exposing vars like the client_secret as this is potentially a grave security issue. 😬

I looked into this a bit yesterday to make a plan, my current thinking is that as we are only using client-side API calls and otherwise no other server to server comms, I think it makes sense for us to switch to a PKCE flow in an SPA way with Auth0 instead of the current Regular Web App... this would mean we only need the client_id and not the client_secret which should be much easier for us to onboard collaborators!

To do this, I think best to switch to using the (newer) React Auth0 SDK instead of the current auth0-nextjs library, which hopefully shouldn't be too painful; if you fancy having a go at that if you do look at this repo over the weekend, and seeing if you can get it to work just using the client_id you have, then go for it – otherwise I can have a look on Monday hopefully and free up access to helpful folks like yourself! 😅

I should have reconfigured the Auth0 App to accept the PKCE flow requests, but without trying myself I obv can't be 100%, so any specific issues let me know on here and I'll keep an eye on this discussion!

[mduffin95]

I've had a look but not made any progress with this I'm afraid. I think you'll be able to tackle it a lot faster than me.

[mduffin95]

@braddf I'm not sure if this is helpful but I've hackily managed to get it working locally using the approach shown here:

https://github.com/mduffin95/quartz-frontend/pull/1/files

My frontend skills are rather lacking so it's pretty ugly...