Feature/auth

[bdmendes]

Closes #12

Review checklist

• Properly documents API changes in docs/openapi.yml
• Contains enough appropriate tests
• Behavior is as expected
• Clean, well structured code

[bdmendes]

The stateless implementation is working. We still need to save state, either to invalidate tokens or to link tokens to users for a manual check of permissions. How would you approach this @limwa?

[bdmendes]

After some research, I found that JWT with total stateless behavior is the best way to go (see https://stackoverflow.com/questions/6068113/do-sessions-really-violate-restfulness).
This implementation uses access and refresh tokens. An access token contains the user roles and is to be used as a bearer token in the Authorization header. It has a short (configurable) expiration time of 60 minutes, so that invalid roles aren't allowed for much time after they get removed. For improving the user's UX on the frontend (and not force the frontend to save the password), it will save a refresh token that will be valid for 7 days and will be used to generate a new access token (with updated rules and more 60 minutes) every time it needs to. This refresh stuff should really be implemented in some Vue/React/wtv lib, although I did not do much research on this. In the worst case scenario, we can simply create our own thin wrapper around requests logic.

[bdmendes]

I'll soon add a custom message for invalid tokens. Meanwhile, everything that is important is done, so this is ready for review

[bdmendes]

This is fully ready

[BrunoRosendo]

This is a really great job! Amazing PR, this will be extremely useful going forward 🚀

That said, I wrote quite a few comments, mostly asking questions since this is a complex PR. I also left some suggestions regarding smaller details.

[BrunoRosendo]

We should use the same method here and in the test above. I personally like the first one more because it doesn't depend on the Dto implementation but it can also be more verbose

[bdmendes]

I'll convert the first to this one since I prefer the less verbose approach

[BrunoRosendo]

I didn't test this on my own so I'm going to ask. I like the change but is this exception being handled or does it just return an unexpected error?

[bdmendes]

Yes, it is an AuthenticationException. This is being tested, too

[BrunoRosendo]

Great job! :)