hicommonwealth / commonwealth

A platform for decentralized communities

https://commonwealth.im

GNU General Public License v3.0

67 stars 41 forks source link

Create Utility to Generate JWT for Secure Endpoints #8874

Open Rotorsoft opened 3 weeks ago

Rotorsoft commented 3 weeks ago

Description

Develop a utility function inside /libs/api-client to generate JSON Web Tokens (JWT) for secure access to API endpoints. This utility should reproduce the authentication flows we are currently using (magic, wallet, canvas, privy?)

Project Owner

No response

Bucket ID

8694

User Stories / Acceptance Criteria

A utility function is created that generates JWTs.
Initially supports wallet auth and maybe canvas. Privy/Magic SSO options will be considered in future phases.
JWT utility allows setting expiration times, etc - consider token refresh flow
Unit tests cover JWT generation and validation.

Design Devlink

No response

Design Screenshot

No response

Additional Context

No response

Rotorsoft commented 3 weeks ago

@jnaviask who can take this one? @raykyri?

jnaviask commented 3 weeks ago

This may actually be something for @ianrowan or @egetekiner to look at ... but it depends on the context about how these JWTs will be used/consumed.

timolegros commented 3 weeks ago

For clarity, this ticket involves creating an 'authentication' function for the SDK

Use a PRIVATE_KEY environment variable to sign a message attesting ownership
- This should replicate the message signing with wallet behaviour from the client
POST the signature to /verifyAddress (or new route)

The scope may include modifying /verifyAddress or creating a new authentication route which directly returns the JWT since in the current implementation, /verifyAddress returns a session cookie (/status returns the JWT based on session cookie).