Upgrade panda to v4

[Fweddi]

This PR upgrades our pan-domain-authentication (panda) libraries to v4, which is a vital step towards our plan to improve key rotation.

How to review and test

Check if this branch is deployed to CODE. If not, deploy to CODE¹.

We want to test that the Panda library can:
(1) verify valid Panda cookies
(2) issue Panda cookies through OAuth
(3) issue cookies that work 'pan domain', i.e. across tools on the same domain (in this case, dev-gutools.co.uk)

Choose another tool on the same domain to test with. For example, Composer CODE.

1. Verification

Open the other tool. If the tool asks you to login through Google Auth, log in. This will issue you a Panda cookie. If you are not directed to Google Auth, you already have a Panda cookie to test with.

Open Story Packages. You should see Story Packages as normal. Check your network tab - you should see no requests to OAuth.

This should give confidence that Panda has verified your cookie.

2. Issuing

Open Story Packages.

In the DevTools, under the Application panel, you can find the Panda cookie. It has the name gutoolsAuth-assym:

Delete the cookie, and refresh the page. You should see Story Packages as normal². Check the network tab. You should see a request to OAuth.

Check the Application tab again. You should have a new gutoolsAuth-assym cookie - though it looks very similar to the old one!

This should give confidence that Panda has issued you a cookie.

3. Pan-Domain

Open the other tool.

You should see the tool as normal. Check your network tab - you should see no requests to OAuth.

This should give confidence that your new cookie (issued by Story Packages) works across the domain³.

Footnotes

1. You can also test this locally, but you will need to test with another local tool. CODE and local are scoped to different domains (.code.dev-gutools.co.uk and .local.dev-gutools.co.uk). ↩

2. If you are redirected to Google Auth, then your Auth session with Google may have expired. This is fine. Log in through Google Auth and repeat the test. If it keeps directing you to Google Auth, then there may be an issue! ↩

3. If you check the Application tab in the other tool, you might find the cookie has changed! This is still the same cookie, but it has been slightly edited. Each tool you access with the cookie will be added to the cookie's authedIn list. The edits are hard to see as the cookie is encrypted. If you check the first tool again, you will see the cookie has stabilised. ↩

[rhystmills]

Deployed to code and tested story-packages with a cookie from Composer, and vice versa. All seems to be working as expected.

[prout-bot]

Seen on PROD (merged by @Fweddi 6 minutes and 21 seconds ago) Please check your changes!