Token Validation for API calls, fix #354

[kamicut]

This implements:

1. token extraction from authorized API calls that have Bearer <access_token>
2. checks if the access token is valid by sending it to the /introspect route in the auth proxy (check 5470dc5)
3. extracts the sub trait from the resulting token and adds it to the session

This will allow API calls from third party applications to use access tokens to authenticate with the API.

I also added isAuthenticated for routes that need simply to have the session and session user ids in the can middleware.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Updated
osm-teams	✅ Ready (Inspect)	Visit Preview	Jan 12, 2023 at 5:36PM (UTC)

[LanesGood]

@kamicut does this close issue 354?

[kamicut]

Yes! I forgot the issue number, it fixes #354

[vgeorge]

@kamicut this look good overall, lets try to add test coverage for a HTTP agent, as discussed.

[vgeorge]

@kamicut I suggest adding a check here to avoid exposing this route outside testing:

if (process.env.TESTING !== 'true' || req.method !== 'POST') {
  throw Boom.notFound()
}

[vgeorge]

@kamicut I think we are almost there, should we add a test for a route in 'manage' folder?