Error: Cookie has domain set to the public suffix "localhost" which is a special use domain.

[kennsippell]

Describe the bug
Its a crash

To Reproduce

1. npx cht --local

Expected behavior
Should be able to deploy locally

Logs

INFO Starting action: backup-all-forms… 
INFO Error: Cookie has domain set to the public suffix "localhost" which is a special use domain. To allow this, configure your CookieJar with {allowSpecialUseDomain:true, rejectPublicSuffixes: false}.
    at Object.getPublicSuffix (/home/kenn/config-echis-2.0/node_modules/tough-cookie/lib/pubsuffix-psl.js:62:11)
    at permuteDomain (/home/kenn/config-echis-2.0/node_modules/tough-cookie/lib/permuteDomain.js:38:28)
    at MemoryCookieStore.findCookies (/home/kenn/config-echis-2.0/node_modules/tough-cookie/lib/memstore.js:99:21)
    at MemoryCookieStore.findCookies (/home/kenn/config-echis-2.0/node_modules/universalify/index.js:5:67)
    at CookieJar.getCookies (/home/kenn/config-echis-2.0/node_modules/tough-cookie/lib/cookie.js:1410:11)
    at CookieJar.getCookies (/home/kenn/config-echis-2.0/node_modules/universalify/index.js:5:67)
    at CookieJar.getCookieString (/home/kenn/config-echis-2.0/node_modules/tough-cookie/lib/cookie.js:1455:21)
    at CookieJar.getCookieString (/home/kenn/config-echis-2.0/node_modules/universalify/index.js:5:67)
    at node:internal/util:364:7
    at new Promise (<anonymous>)
    at bound getCookieString (node:internal/util:350:12)
    at fetchCookie (/home/kenn/config-echis-2.0/node_modules/fetch-cookie/index.js:15:26)
    at ourFetch (/home/kenn/config-echis-2.0/node_modules/pouchdb-adapter-http/lib/index.js:218:12)
    at fetchJSON (/home/kenn/config-echis-2.0/node_modules/pouchdb-adapter-http/lib/index.js:246:12)
    at setup (/home/kenn/config-echis-2.0/node_modules/pouchdb-adapter-http/lib/index.js:294:20)
    at PouchDB.HttpPouch.api.fetch (/home/kenn/config-echis-2.0/node_modules/pouchdb-adapter-http/lib/index.js:467:12) 
ERROR Cookie has domain set to the public suffix "localhost" which is a special use domain. To allow this, configure your CookieJar with {allowSpecialUseDomain:true, rejectPublicSuffixes: false}. 

Environment

• Instance: localhost
• Client platform: Ubuntu
• export COUCH_URL=http://medic:pwd@localhost:6984/medic
• cht-conf version: 3.18.3
• cht-core version: 4.4

Additional context
Kenya eCHIS local testing

[kennsippell]

Workaround is to use 127.0.0.1 instead of localhost

[kennsippell]

Also manifests as

INFO Error: Unable to fetch xml attachment of doc with id xxx, returned status code = undefined
    at Object.preUploadForm (/home/kenn/config-echis-2.0/node_modules/cht-conf/src/lib/warn-upload-overwrite.js:199:13)
    at processTicksAndRejections (node:internal/process/task_queues:96:5)
    at async execute (/home/kenn/config-echis-2.0/node_modules/cht-conf/src/lib/upload-forms.js:91:21)
    at async module.exports (/home/kenn/config-echis-2.0/node_modules/cht-conf/src/lib/main.js:193:5)
    at async /home/kenn/config-echis-2.0/node_modules/cht-conf/src/bin/index.js:16:5 

[andrablaj]

@ernestoteo are you still planning to work on this issue?

[ernestoteo]

@ernestoteo are you still planning to work on this issue?

Yes @andrablaj, I already have a PR

[jkuester]

@ernestoteo this is a weird one! After a bunch of tinkering, though, I am pretty sure this is not actually a problem in cht-conf. While I could reproduce the behavior by following @kennsippell's exact steps from the PR, I was suspicious because I was not able to reproduce similar behavior from a globally installed version of cht-conf. This led me to think that it had something to do with using npx cht ... to run the local version of cht-conf installed for the repo. However, that command works fine for me in other config repos (e.g. https://github.com/medic/config-moh-mali-chw).

I believe there is actually just an issue with package-lock.json file in the config-echis-2.0 repo. In further testing, I observed the following behavior:

# Start with a completely fresh version of the repo
git clone git@github.com:moh-kenya/config-echis-2.0.git
cd config-echis-2.0
npm ci
npx cht --local backup-all-forms

# SEE ERROR

rm -rf node_modules && rm package-lock.json && npm install
npx cht --local backup-all-forms

# SEE NO ERROR

When I regenerate the package-lock.json file (and force a refresh of my local dependency files by removing the node_modules folder) the error goes away (even though I did not change anything in the package.json).

---

I think what is going on behind the scenes here is some weirdness with npm dependency resolution. Somehow refreshing the package-lock.json "fixes" how the dependencies are getting resolved. The error is coming during the initialization of Pouch from the tough-cookie package which introduced some localhost problems with 4.1. (Seems like those issues were present in some of the patch versions for 4.1, but were resolved in later patch versions.) However, Pouch does not depend directly on tough-cookie. Instead it depends on version 2.2.0 of fetch-cookie. That version of fetch-cookie depends on version ^4.0.0 if tough-cookie. It seems like the existing version of the package-lock.json file must be pointing to one of the bugged versions of tough-cookie that is compatible with the ^4.0.0 range. Then, refreshing the package-lock.json file causes it to pick a new one.