Retrieve OrgRules from FES before trying backend

[tomholub]

part of #1298

[tomholub]

Currently, we request OrgRules from backend. There is one FlowCrypt backend for all customers.

However some customers want to have more control. They want to run their own FES server: https://flowcrypt.com/docs/technical/enterprise-server/latest/enterprise-server.html which will serve OrgRules for them.

Therefore, in the app, we will test if FES is running on customer domain, which is https://fes.<domain>/api/ (for user@example.com it's https://fes.example.com/api/. Our own runs at https://fes.flowcrypt.com/api/ ). We only do this on non-public email domains (not on gmail.com, outlook.com etc).

If FES is running and available there, then we use FES to retrieve OrgRules, not backend. The endpoint is (example for flowcrypt.com domain):

https://fes.flowcrypt.com/api/v1/client-configuration?domain=flowcrypt.com (no authentication)

example other domain:

https://fes.example.com/api/v1/client-configuration?domain=example.com

The goal is that eventually, all functionality that may be available on flowcrypt.com backend will become available on FES, and whenever customer has FES, that should be used exclusively.

But for this issue, we only target downloading of OrgRules.

The way I've solved this on browser extension is to have AccountServer which is the one I'm calling from code around the app. Then AccountServer decides to call either FlowCryptComApi or EnterpriseServer (FES) based on whether FES was ever observed to be running on that domain.

You could of course structure it differently, like an AccountServer abstract class or interface with two implementations, but I do recommend to use this terminology (AccountServer, FlowCryptComApi, EnterpriseServer) so that the names are consistent across client apps, for ease of review and comparing of functionality).

(example implementations - not to copy, because the code does something slightly else then what I describe the issue - better follow the issue. Just to get general idea).

https://github.com/FlowCrypt/flowcrypt-browser/blob/3b506be8de07ae59ca7737ffb54eb741ba3057e0/extension/js/common/api/account-server.ts

https://github.com/FlowCrypt/flowcrypt-browser/blob/6ac78e7952ff79b18cc2fdb35aeda1211d9256ca/extension/js/common/api/account-servers/enterprise-server.ts

https://github.com/FlowCrypt/flowcrypt-browser/blob/3b506be8de07ae59ca7737ffb54eb741ba3057e0/extension/js/common/api/account-servers/flowcrypt-com-api.ts

After authentication, for example on browser extension, I do this:

 const potentialFes = new EnterpriseServer(authRes.acctEmail);
 if (await potentialFes.isFesInstalledAndAvailable()) {
 // set to storage a flag that FES is available
 } else {
 // as before
 }
 
 const accountServer = new AccountServer(authRes.acctEmail);
 // below may be calling either FES or flowcrypt.com/api based on the above
 const orgRules = accountServer.getOrgRules();

isFesInstalledAndAvailable should:

1. return false if it's a public email domain
2. try to call https://fes.example.com/api/. If there is successful response http 200 and service == "enterprise.server" then return true, else continue below
3. if there was error 404 returned, return false
4. if there was request timeout (3 seconds), or server not available:
   • If internet is not functioning (you cannot reach flowcrypt.com/api for example), then show error to user
   • if internet is functioning:
     • if this is consumer release, return false
     • if this is enterprise release, show error to user
5. if there was error 500 or other 4xx:
   • on consumer release, return false
   • on enterprise release, show the error to the user

This probably calls for another flow chart :-)

[DenBond7]

This probably calls for another flow chart :-)

Yup :-). I'm going to create a new one.

Please let me ask you a question. For now, after login, we call https://flowcrypt.com/api/account/get to get OrgRules. Does it mean instead of calling it I should firstly call https://fes.<domain>/api/?

[tomholub]

Please let me ask you a question. For now, after login, we call https://flowcrypt.com/api/account/get to get OrgRules. Does it mean instead of calling it I should firstly call https://fes./api/?

Correct. Only once you find out that FES is not running on that domain (with isFesInstalledAndAvailable returning false) would you proceed to do the original thing - get OrgRules from flowcrypt.com/api/.

[DenBond7]

[tomholub]

Thank you for making this chart.

We should completely avoid calling flowcrypt.com API if there is FES running. If a customer runs FES, they want nothing to do with our own flowcrypt.com/api server.

continue with gmail -> get FES /api/ -> service == enterprise.server -> GET FES client-configuration.

Only if the steps above showed that there is no FES running, then you fallback to loging into flowcrypt.com/api and getting OrgRules from there, both at the end of this chart.

[tomholub]

Here a bit more clarity, maybe :-)