Backend Sign Up Methods do not rollback changes during authentication failure

[Joshua-Douglas]

Overview

We currently authenticate users using AWS Cognito, within the signUpHost and signUpCoordinator methods contained within /api/openapi_server/controllers/auth_controller.py.

https://github.com/hackforla/HomeUniteUs/blob/47d7dc6e968b7881d6953c723991e8f12f1ad002/api/openapi_server/controllers/auth_controller.py#L130-L170

The signup method has two basic steps, that both have the possibility of failing:

1. Update the database with the new user email
2. Make an API request to AWS Congito to sign up the user

The problem is that if step 1 succeeds but step 2 fails, then the user database will contain a user email that was not added to the AWS Cognito database. If the signup fails then we should rollback change to our user database, in order to keep the AWS Cognito user entries and postgres database user entries synchronized.

Besides introducing a design flaw, this can also prevent users from signing up. If user re-tries the signup endpoint then the attempt will always fail because the user email is already present in the postgres user database.

Action Items

Update the auth_controller signup methods to provide atomic updates to the AWS cognito and local database. If either update fails, then both updates should be rolled back.

[Joshua-Douglas]

This bug was first identified while reviewing #562 and we decided to break it out into a separate issue.

[JpadillaCoding]

Hey @Joshua-Douglas, I noticed that the signup logic is different now since this issue was made. Do you happen to know if this bug still exist with the changes?