test shared-tenant-fes some more

[tomholub]

 we'll still test it more after I finalize setup of shared-tenant-fes, before we release

Originally posted by @tomholub in #4907 (comment)

[tomholub]

Fixed shared-tenant-fes. Would be good to test:

• client configuration retrieval
  • (consumer) flowcrypt.com - doesn't use shared tenant - gets from fes.flowcrypt.com without checking shared-tenant
  • (consumer) gmail.com - gets client configuration without ever checking fes.gmail.com
  • (consumer) test.flowcrypt.com - tries fes.test.flowcrypt.com but ends up getting empty config from shared-tenant-fes. Check through browser network tab.
  • (enterprise) flowcrypt.com - doesn't use shared tenant - gets from fes.flowcrypt.com without checking shared-tenant
  • (consumer) gmail.com - I suppose this should show an error during setup?
  • (consumer) test.flowcrypt.com - tries fes.test.flowcrypt.com, no FES running there, shows error
• send message through web portal
  • (either build) flowcrypt.com uses fes.flowcrypt.com and works. Can also reply from the web portal
  • (either build) gmail.com uses flowcrypt.com/shared-tenant-fes and works. Can also reply from the web portal

[tomholub]

@martgil please test these

[tomholub]

@martgil please also test FlowCrypt/flowcrypt-android#2171 in the exact same scenarios, and produce a table below to track the differences of behavior between the two implementations, if any.

[tomholub]

@martgil please look at this in the next few days

[martgil]

@tomholub - I'll check this real quick and let you know the results.

[martgil]

client config retrieval (browser extension):

what to test	working as described	comments
(consumer) flowcrypt.com - doesn't use shared tenant - gets from fes.flowcrypt.com without checking shared-tenant	yes	-
(consumer) gmail.com - gets client configuration without ever checking fes.gmail.com	yes	(retested) gets client configuration from shared-tenant-fes and returns an empty config.
(consumer) test.flowcrypt.com - tries fes.test.flowcrypt.com but ends up getting empty config from shared-tenant-fes. Check through browser network tab.	yes	(retested) it is true. indeed tries fes.test.flowcrypt.com and get the client config from shared-tenant-fes with empty config
(enterprise) flowcrypt.com - doesn't use shared tenant - gets from fes.flowcrypt.com without checking shared-tenant	yes	-
(enterprise) allow to proceed with setup by never checking fes.gmail.com, and getting an empty client configuration from shared-tenant-fes	yes	(retested) indeed, fes lookup never performed for fes.gmail.com and retrieved client-config from /shared-tenant-fes/api/v1/client-configuration and returns an empty client config.
(enterprise) test.flowcrypt.com - tries fes.test.flowcrypt.com, no FES running there, shows error	yes	I assume this is supposed to be enterprise build.

[martgil]

@martgil please also test FlowCrypt/flowcrypt-android#2171 in the exact same scenarios, and produce a table below to track the differences of behavior between the two implementations, if any.

thanks - will do.

[martgil]

send messages through web portal (browser extension):

what to test	working as described	comments
(either build) flowcrypt.com uses fes.flowcrypt.com and works. Can also reply from the web portal	yes	can send and received encrypted emails from fes web portal.
(either build) gmail.com uses flowcrypt.com/shared-tenant-fes and works. Can also reply from the web portal	yes	works fine after the update on PR https://github.com/FlowCrypt/enterprise-server/pull/4269

[martgil]

Ok so there's an issue when sending opening password protected messages for user in gmail.com that uses shared-tenant-fes.:

1. The static files are hosted in fes.flowcrypt.com eg.

<script src="/lib/sha1.min.js?version=69"></script>
<script src="/lib/openpgp.min.js?version=69"></script>
<script src="/lib/jquery.min.js?version=69"></script>
<script src="/lib/purify.min.js?version=69"></script>
<script src="/lib/blob.js?version=69"></script>
<script src="/lib/FileSaver.min.js?version=69"></script>
<script src="/lib/uppy.min.js?version=69"></script>
<script src="/lib/sweetalert2.all.min.js?version=69"></script>
<script src="/lib/emailjs/punycode.js?version=69"></script>
<script src="/lib/emailjs/emailjs-stringencoding.js?version=69"></script>
<script src="/lib/emailjs/emailjs-mime-codec.js?version=69"></script>
<script src="/lib/emailjs/emailjs-mime-types.js?version=69"></script>
<script src="/lib/emailjs/emailjs-addressparser.js?version=69"></script>
<script src="/lib/emailjs/emailjs-mime-builder.js?version=69"></script>
<script src="/lib/emailjs/emailjs-mime-parser.js?version=69"></script>
<script src="/lib/web-stream-tools-bundle.js?version=69"></script>
<script src="/js/pages/web-portal-message.js?version=69"></script>

</body>
</html>

meanwhile CSS are in flowcrypt.com domain - https://fes.flowcrypt.com/stylesheets/foundation.css?version=69 and https://flowcrypt.com/assets/stylesheets/foundation.css?version=69. I observed that we'd like to perform pw message decryption using fes web portal (i'd say based on the HTML structure) however the path and csp policy could be different when the host is fes (a subdomain) vs flowcrypt.com.

[tomholub]

The static files are hosted in fes.flowcrypt.com eg.

can you link where can i see this code, where does this come from?

[martgil]

The domain fes.flowcrypt.com is not explicitly specified within the code but you can observe it by visiting these two links. Noticed the web page looks for static files in the relative path, from which the host differs.

https://flowcrypt.com/shared-tenant-fes/message/267920f8-9956-4cdb-b760-388fa03880ee
https://fes.flowcrypt.com/message/334ef5b7-abc6-4235-a9ff-e6c0ac220b62

And finally, the code came from here: https://github.com/FlowCrypt/enterprise-server/blob/2cc7fb253e4fdeebfc83d2062d23650c11b30f05/fes-lib/src/main/jte/web-portal-message.kte#L88

For ease, you can use this command and observe the domain names.

curl https://flowcrypt.com/shared-tenant-fes/message/267920f8-9956-4cdb-b760-388fa03880ee -s | tail -n 10
curl https://fes.flowcrypt.com/message/334ef5b7-abc6-4235-a9ff-e6c0ac220b62 -s | tail -n 10