Add authN layer

[kislerdm]

Context

As a user, I want to have access to better model(s) and advanced features.

• Fine-tuned models are paid, hence an "authentication wall" filter shall be set to keep the costs under control
• Non-guest users data shall be used to improve the product quality

Problem

Authentication layer is required.

Proposed Solution

Implement pass-wordless authentication using Auth0:

• email with an auth code
• 3rd party IdPs:
  • GitHub
  • Google

Note that we maintain the option for a user to assume the "guest role", i.e. no authentication.

Flowchart

flowchart LR
    subgraph App
        trigger[Button 'Generate Diagram'] --> cache
        cache --> cacheGuest{Guest prefernece}
        cacheGuest -- No --> cacheAuth{JWT found}
        download[Button 'Download'] --> diagram[Diagram SVG]
    end
    subgraph Auth[Authentication Service]
        authFlow{Is IdP?}
        authFlow -- No --> email
        email[Email flow] --> SMTP
        email --> Logic
        Logic --> db[(Userbase)]
    end

    user((User)) --> trigger
    user --Download generated diagram--> download
    server --> diagram
    cacheGuest -- Yes --> server[Server: Core]
    cacheAuth --Yes--> server
    cacheAuth --No--> Logic
    user -- Authenticates --> authFlow
    user -- Enters email --> email
    user -- Enters access code --> Logic
    SMTP -- Sends access code --> userEmail(((User email server)))
    user -- Fetch access code --> userEmail
    Logic -- Returns JWT --> cache
    authFlow -- Yes --> IdP(((3rd party IdP)))
    user -- Confirms usage --> IdP
    IdP -- Configrms authentication --> Logic

Loading

### References

- Auth0
- API GW AuthN
- webclient logic with vanilla js:
~~ - auth0 docu~~
~~ - auth0 user's blog~~

Acceptance Criteria

• Users are prompted to login screen upon the first click of the button "Generate Diagram"
• Authenticated user's ID is propagated to the backend
  - Auth0 authN is plugged into the API GW
• API GW request cognito authorisation is set

[kislerdm]

The auth0 account was created.

[kislerdm]

It was identified that unfortunately the auth0 free plan does not include passwordless authentication. On that basis, aws cognito to be used instead.

References

• js client
• tutorial to develop cognito triggers for passwordless authentication