Experiment unverified auth #219
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit introduces comprehensive JWT debugging capabilities and experimental plaintext authentication support to help developers troubleshoot authentication issues. **New Features:** - getUserIdentityDebug() method returns detailed error information when JWT validation fails - getUserIdentityInsecure() method for accessing raw plaintext tokens (development/debugging only) - setAuthInsecure() client method for plaintext authentication mode **Backend Implementation:** - New 1.0/getUserIdentityDebug and 1.0/getUserIdentityInsecure syscalls in Rust - PlaintextUser identity type added to authentication system - Enhanced error metadata for JWT validation failures **Frontend Integration:** - TypeScript Auth interface extended with new debug methods - React client support for plaintext authentication mode - WebSocket protocol updates for plaintext token handling **Backward Compatibility:** - Existing getUserIdentity() method unchanged - All current authentication flows continue to work - New features are opt-in and don't affect existing implementations This implementation enables developers to get detailed JWT error messages instead of generic authentication failures, significantly improving the debugging experience for authentication issues.
graham
force-pushed
the
experiment-unverified-auth
branch
from
11fd75b to
c68480a
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is really two experiments that should be split if either is appealing to the team. The first experiment was adding a
getUserIdentityDebugthat would return the JWT error that had occurred if it had occurred (rather than the null value that the non-debug version would return).I found in my own convex work that often I would have forgotten the
audor incorrectly set theissuer. This helped me quickly understand what was wrong.Next, I experimented with a plain text, non-jwt token, this doesn't go through any of the verification on the client and doesn't need to be refreshed like a JWT, and the assumption is that the developer rotates this key themselves in some way.
This works "similar to a cookie" in that the developer must lookup the value in a session table, and do all the user lookup work themselves. The nice thing about this is that it doesn't require the lift of JWTs which can be big for users that have never interacted with them.
Additionally, it can be nice for server to server communication.
Finally, the real reason I built this is that, i found myself often writing
useAuthedQuerywhen initially developing a sandbox application. I didn't want to go through the fullintegrate a work os projectand just wanted to get to work, so a single pre-shared key was fine for auth.However, this isn't possible with the current setup, so writing my own
useAuthedQueryfelt like i wasdoing it wrongorworking around the original auth system.These experiments ended up being both more complicated than I had realized but easier to implement than I realized.
I do not intend to merge these, but they ended up being a good example of features that seemed to streamline my learning and my ability to get sandbox applications off the ground.
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.