Implemented jwt token authentication for login #1574

Sujanadh · 2024-06-13T12:47:01Z

What type of PR is this? (check all applicable)

Related Issue

issue Used JWT-based authentication regardless of OAuth method #1539

Describe this PR

This PR adds new configuration to generate jwt authentication token for temporary login as well as to encapsulate the osm login for consistency. For token generation, the "RS256" algorithm is used, whereas rsa keys are generated for encoding and decoding the token.

Screenshots

N/A

Alternative Approaches Considered

Did you attempt any other approaches that are not documented in code?

Review Guide

Notes for the reviewer. How to test this change?

Checklist before requesting a review

📖 Read the FMTM Contributing Guide: https://github.com/hotosm/fmtm/blob/main/CONTRIBUTING.md
📖 Read the HOT Code of Conduct: https://docs.hotosm.org/code-of-conduct
👷‍♀️ Create small PRs. In most cases, this will be possible.
✅ Provide tests for your changes.
📝 Use descriptive commit messages.
📗 Update any related documentation and include any relevant screenshots.

[optional] What gif best describes this PR or how it makes you feel?

spwoodcock

Very nice code!

I think the only thing missing is modifying the introspect endpoint to deserialise the access token and check that it has not expired.

Also the tests are failing and may need to be looked at 😁

src/backend/app/auth/auth_routes.py

src/backend/app/config.py

Sujanadh · 2024-06-14T05:51:48Z

Very nice code!

I think the only thing missing is modifying the introspect endpoint to deserialise the access token and check that it has not expired.

Also the tests are failing and may need to be looked at 😁

introspect depends on login_required and expiry check is done in login_required.

Sujanadh · 2024-06-14T05:56:54Z

Since a temporary user is not a real user and is not present in a database, we need to create it in the database, so for that, we need to explicitly specify the fields like id and other fields like profile_img as None.

Sujanadh · 2024-06-14T07:21:06Z

I think test was failing because env file is not updated with variables like AUTH_PRIVATE_KEY .

spwoodcock · 2024-06-14T08:42:45Z

Thanks for the feedback - was reviewing on my phone again and missed the login_required link 😁

We already have user svcfmtm in the db - could we use that for the temp user possibly?

I'll update the env vars for the tests 👍

Sujanadh · 2024-06-14T09:27:13Z

Thanks for the feedback - was reviewing on my phone again and missed the login_required link 😁

We already have user svcfmtm in the db - could we use that for the temp user possibly?

I'll update the env vars for the tests 👍

should we use username "svcfmtm" also or just the id ?

spwoodcock · 2024-06-14T14:57:53Z

Thanks for the feedback - was reviewing on my phone again and missed the login_required link 😁
We already have user svcfmtm in the db - could we use that for the temp user possibly?
I'll update the env vars for the tests 👍

should we use username "svcfmtm" also or just the id ?

Probably good to just hardcode svcfmtm as the user 👍
It is a valid OSM username too.
We can then pick up that username/id during data conflation and instead insert the username of the project manager for OSM submissions.

spwoodcock · 2024-06-14T17:41:01Z

This is pretty much good to go, but I will wait to merge until we finalise the 2024.3.1 release.

spwoodcock · 2024-06-24T20:29:24Z

In addition to the above @Sujanadh and I just discussed the possibility of using JWT refresh tokens to keep the token alive.

If the user is inactive for many days it will expire, but if accessed regularly the token will refresh.

Seems like a good idea to me 👍

…oles OrgManagers

spwoodcock · 2024-07-02T19:47:41Z

Did a bit of additional refactoring and finished off the roles!

Still need to:

Set additional env vars in Github environments
Fix test_create_project that is showing 400 project with name already exists??

* feat: implemented jwt token authentication for login * fix: added audience while decoding * feat: added pyjwt , updated user id to existing svcfmtm osmid * feat: change username to svcfmtm * feat: implemented refresh token and updated dependency lock file * fix: return user data from refresh endpoint * changed img_url -> picture, retrieve id from sub field * feat: exception handling if osm deserialization fails * build: relock deps after pyjwt added * refactor: remove auth key path variables, require passing string values * docs: update install docs with info for gen priv/pub keys * docs: update all docs for AUTH_PUBLIC_KEY vars * build: add AUTH_PUBLIC_KEY vars to gen-env.sh script * refactor: exclude rsa keys from debug printed settings * fix(backend): improve logic for /me endpoint upsert & return ProjectRoles OrgManagers * fix(backend): return int type for AuthUser.id * refactor: create auth_schemas and replace all imports * refactor: pass user_id only to task_crud functions * test: update auth user creation for fixtures * test: guarantee randomness with uuid4 over randint * fix(backend): create_project existing project check must be scalar * fix(backend): conform to nominatim usage policy referer header * test: rename var for clarity --------- Co-authored-by: spwoodcock <sam.woodcock@protonmail.com>

feat: implemented jwt token authentication for login

1f2c834

Sujanadh requested a review from spwoodcock June 13, 2024 12:47

Sujanadh self-assigned this Jun 13, 2024

Sujanadh temporarily deployed to test June 13, 2024 12:47 — with GitHub Actions Inactive

github-actions bot added the backend Related to backend code label Jun 13, 2024

Sujanadh had a problem deploying to test June 13, 2024 12:47 — with GitHub Actions Failure

Sujanadh marked this pull request as draft June 13, 2024 12:48

spwoodcock reviewed Jun 13, 2024

View reviewed changes

src/backend/app/auth/auth_routes.py Outdated Show resolved Hide resolved

src/backend/app/auth/auth_routes.py Outdated Show resolved Hide resolved

src/backend/app/config.py Outdated Show resolved Hide resolved

fix: added audience while decoding

70e1eef

Sujanadh temporarily deployed to test June 14, 2024 06:05 — with GitHub Actions Inactive

Sujanadh had a problem deploying to test June 14, 2024 06:05 — with GitHub Actions Failure

feat: added pyjwt , updated user id to existing svcfmtm osmid

3febc7c

Sujanadh temporarily deployed to test June 14, 2024 09:41 — with GitHub Actions Inactive

Sujanadh had a problem deploying to test June 14, 2024 09:41 — with GitHub Actions Failure

feat: change username to svcfmtm

ff5859c

Sujanadh marked this pull request as ready for review June 14, 2024 11:44

Sujanadh temporarily deployed to test June 14, 2024 11:44 — with GitHub Actions Inactive

Sujanadh had a problem deploying to test June 14, 2024 11:44 — with GitHub Actions Failure

spwoodcock self-assigned this Jun 14, 2024

Sujanadh added 2 commits June 25, 2024 22:21

Merge branch 'development' of github.com:hotosm/fmtm into feat/jwt-auth

50a65ab

feat: implemented refresh token and updated dependency lock file

1d090e5

Sujanadh temporarily deployed to test June 25, 2024 16:43 — with GitHub Actions Inactive

spwoodcock added 4 commits July 1, 2024 19:52

refactor: remove auth key path variables, require passing string values

e4e46c9

docs: update install docs with info for gen priv/pub keys

0eaaf6f

docs: update all docs for AUTH_PUBLIC_KEY vars

3493c27

build: add AUTH_PUBLIC_KEY vars to gen-env.sh script

47759ee

spwoodcock temporarily deployed to test July 1, 2024 18:59 — with GitHub Actions Inactive

github-actions bot added docs Improvements or additions to documentation devops Related to deployment or configuration labels Jul 1, 2024

spwoodcock had a problem deploying to test July 1, 2024 18:59 — with GitHub Actions Failure

spwoodcock added 7 commits July 1, 2024 20:10

refactor: exclude rsa keys from debug printed settings

fbb2f73

fix(backend): improve logic for /me endpoint upsert & return ProjectR…

5a4d9f8

…oles OrgManagers

fix(backend): return int type for AuthUser.id

070ced2

refactor: create auth_schemas and replace all imports

9bbfb65

refactor: pass user_id only to task_crud functions

0a1e4c5

test: update auth user creation for fixtures

553614b

test: guarantee randomness with uuid4 over randint

a667e4d

spwoodcock temporarily deployed to test July 2, 2024 19:46 — with GitHub Actions Inactive

spwoodcock had a problem deploying to test July 2, 2024 19:46 — with GitHub Actions Failure

spwoodcock added 3 commits July 3, 2024 13:45

fix(backend): create_project existing project check must be scalar

8f83eb5

fix(backend): conform to nominatim usage policy referer header

6478217

test: rename var for clarity

15da73b

spwoodcock temporarily deployed to test July 3, 2024 12:45 — with GitHub Actions Inactive

spwoodcock had a problem deploying to test July 3, 2024 12:46 — with GitHub Actions Failure

spwoodcock temporarily deployed to test July 3, 2024 13:03 — with GitHub Actions Inactive

spwoodcock temporarily deployed to 1574/merge July 3, 2024 13:03 — with GitHub Actions Inactive

spwoodcock had a problem deploying to test July 3, 2024 13:06 — with GitHub Actions Failure

spwoodcock merged commit 4eb01c7 into development Jul 3, 2024
7 of 9 checks passed

spwoodcock deleted the feat/jwt-auth branch July 3, 2024 13:07

spwoodcock mentioned this pull request Jul 3, 2024

Replace usage of RS256 JWT signing with simpler HS384 #1622

Merged

7 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implemented jwt token authentication for login #1574

Implemented jwt token authentication for login #1574

Sujanadh commented Jun 13, 2024

spwoodcock left a comment •

edited

Loading

Sujanadh commented Jun 14, 2024

Sujanadh commented Jun 14, 2024

Sujanadh commented Jun 14, 2024

spwoodcock commented Jun 14, 2024

Sujanadh commented Jun 14, 2024 •

edited

Loading

spwoodcock commented Jun 14, 2024 •

edited

Loading

spwoodcock commented Jun 14, 2024 •

edited

Loading

spwoodcock commented Jun 24, 2024

spwoodcock commented Jul 2, 2024 •

edited

Loading

Implemented jwt token authentication for login #1574

Implemented jwt token authentication for login #1574

Conversation

Sujanadh commented Jun 13, 2024

What type of PR is this? (check all applicable)

Related Issue

Describe this PR

Screenshots

Alternative Approaches Considered

Review Guide

Checklist before requesting a review

[optional] What gif best describes this PR or how it makes you feel?

spwoodcock left a comment • edited Loading

Choose a reason for hiding this comment

Sujanadh commented Jun 14, 2024

Sujanadh commented Jun 14, 2024

Sujanadh commented Jun 14, 2024

spwoodcock commented Jun 14, 2024

Sujanadh commented Jun 14, 2024 • edited Loading

spwoodcock commented Jun 14, 2024 • edited Loading

spwoodcock commented Jun 14, 2024 • edited Loading

spwoodcock commented Jun 24, 2024

spwoodcock commented Jul 2, 2024 • edited Loading

spwoodcock left a comment •

edited

Loading

Sujanadh commented Jun 14, 2024 •

edited

Loading

spwoodcock commented Jun 14, 2024 •

edited

Loading

spwoodcock commented Jun 14, 2024 •

edited

Loading

spwoodcock commented Jul 2, 2024 •

edited

Loading