Add user + auth

[KirillDogadin-std]

close #10

0. Run the service
   • cp developer.env .env
   • npx prisma db push
   • npm run dev
1. Go to localhost:3000
2. Use the following mutation to create user

mutation {
  signUp(user: { username: "asdf", password: "asdf" }) {
    user {
      username
    }
    token
  }
}

3. Use the following mutation to login

mutation {
  signIn(user: { username: "asdf", password: "asdf" }) {
    token
    user {
      username
    }
  }
}

4. see the user at the prisma playground.
   • run npx prisma studio
   • browser pops up
   • go to user table via ui and find your user there.
5. now you can query the me endpoint and make sure that being logged in allows you to access it:

add the following to the "Headers" menu (at the bottom left side of the tool):

{
  "Authorization": "Bearer <your token here you got from signIn endpoint>"
}

run this

query {
  me {
    username 
    id
  }
}

[KirillDogadin-std]

@valiafetisov the boilerplate linked in the original issue is added. Since there was some rescoping done, please call the shot on wether i should implement the tests here as well.

[valiafetisov]

• How long does this signature last?
• Does ecosystem-api jwt tokens expirable?
• How to invalidate this token, ie logout?
• How to update this token when it's expired?

[KirillDogadin-std]

• added 7d expiration as in ecosystem api
• update: sign in again.
• logging out with tokens is not straightforward:
  • original code seems to not have this functionality
  • we would have to either decrease the expiry period from 7d to something like 10 min - 1h
  • we could keep the list of expired tokens in the memory or db:
    • on each log out add the token to the global set
    • on each log out clean up the tokens that are past expiry
    • adjust the validation of the token with the check of it not being present in the expiry set.

any preference?

[valiafetisov]

I think the appropriate way to do logout functionality is by keeping the list of valid sessions instead of invalid ones. But I also see the advantage of storing only the logged out sessions since it's less comprisable. In any case, I would in principle not implement this logic ourselves, but instead look into authentication packages like auth.js to provide us with invalidation and renewal functionalities

To summarise,

• Let's not do it in this PR
• Before implementing it, let's investigate if there is appropriate package

[valiafetisov]

Based on the latest mock, I think we would need to create session table, where we would store session.id, expiration date, etc and than put this session.id into jwt, to later be able to mark some of those ids as revoked (on logout or manual revocation)

[valiafetisov]

i did not figure out how to handle the errors

Do you describe the current state of the PR after you've integrated genql? Do you suggest to revert back this integration? I see the potential problem in the fact that you use generated files in the same code where you've generated them. But I'm also not a big fan of the amount of boilerplate code and strange packages (undici) that were added to integrate this, so I'm not against of reverting it back

[valiafetisov]

Let's address as any in the next PR

[valiafetisov]

Nit: can you please generalise it in the next PR? Otherwise it's unclear that as soon as you create a new model, you also need to add line here. Eg prisma/docs#451 (comment)

[valiafetisov]

Nit: Do you actually need to do that before AND after. Let's remove unnecessary operations to speed up tests in the future

[LukSteib]

• was able to sign up users ✔️

- querying `me` endpoint without auth header correctly set results in auth error ✔️

{
  "errors": [
    {
      "message": "Not authenticated",
      "locations": [
        {
          "line": 2,
          "column": 3
        }
      ],
      "path": [
        "me"
      ],
      "extensions": {
        "code": "INTERNAL_SERVER_ERROR"

• querying me endpoint with auth header correctly set works ✔️

{
  "data": {
    "me": {
      "username": "lukas",
      "id": "e250741c-49a3-4c1d-87d9-94ce8a120db0"
    }
  }
}

Is there anything else that I'm supposed to check here @KirillDogadin-std?

• signIn with wrong credentials not possible ✔️

{
  "errors": [
    {
      "message": "User not found",
      "locations": [
        {
          "line": 2,
          "column": 3
        }
      ],
      "path": [
        "signIn"
      ],
      "extensions": {
        "code": "USER_NOT_FOUND",

[KirillDogadin-std]

You can check also incorrect password submission, sign in without signing up.

[valiafetisov]

A short summary of the outstanding points for the next issues:

• Figure out type safe query builder, see Add user + auth #16 (comment)
• Implement sessions, see Add user + auth #16 (comment)