r-scheele / rego_builder

Write your rego authorization rules from the frontend - Open policy agent
1 stars 1 forks source link

Dockerize application and set up authentication #22

Closed r-scheele closed 2 years ago

r-scheele commented 2 years ago

Login:

  1. A GET request to /login requests authorization to github.
  2. Once permission is granted, the API redirects to /token, with a authorization code to get token.
  3. Auth token from github is pasted into the JWT Bearer token field, which is then used to grant permission to the API
francbartoli commented 2 years ago

@r-scheele I'm wondering why we are reinventing the wheel to authenticate with the OIDC protocol. Are we sure we need all that boilerplate of code? Isn't there any reusable package out there in the fastapi ecosystem? @Youngestdev thoughts about this?

Also, we are using requests that is blocking the event loop and still using json.dumps while I guess we can coherently only rely on pydantic.

Youngestdev commented 2 years ago

@r-scheele I'm wondering why we are reinventing the wheel to authenticate with the OIDC protocol. Are we sure we need all that boilerplate of code? Isn't there any reusable package out there in the fastapi ecosystem? @Youngestdev thoughts about this?

Also, we are using requests that is blocking the event loop and still using json.dumps while I guess we can coherently only rely on pydantic.

Unfortunately, there's no reusable package for GitHub authentication yet. This might be a good time to build a mini one so we can just integrate. We're only using GitHub for authentication atm.

I'll work on a small package to help with our situation so we can reduce the amount of code we're using. What do you think, @francbartoli ?

Re: the requests, I'll take a look at it 🤔.