Temporary Authentication login

[Sujanadh]

What type of PR is this? (check all applicable)

• 🍕 Feature
• 🐛 Bug Fix
• 📝 Documentation
• 🧑‍💻 Refactor
• ✅ Test
• 🤖 Build or CI
• ❓ Other (please specify)

Related Issue

• Issue start mapping button is not functional on mobile website and PWA #1393

Describe this PR

This PR implements JWT authentication with a validity of 7 days. It includes a new endpoint, /temp/login/ which creates a token and sets a cookie, and a wrapper function to verify the token and return static user info, which is svcfmtm.

Alternative Approaches Considered

Did you attempt any other approaches that are not documented in code?

Review Guide

Notes for the reviewer. How to test this change?

Checklist before requesting a review

• 📖 Read the FMTM Contributing Guide: https://github.com/hotosm/fmtm/blob/main/CONTRIBUTING.md
• 📖 Read the HOT Code of Conduct: https://docs.hotosm.org/code-of-conduct
• 👷‍♀️ Create small PRs. In most cases, this will be possible.
• ✅ Provide tests for your changes.
• 📝 Use descriptive commit messages.
• 📗 Update any related documentation and include any relevant screenshots.

[optional] What gif best describes this PR or how it makes you feel?

[Sujanadh]

• I have used PyJWT package
• AUTH_SECRET_KEY with 64 bytes is randomly generated and is used in .env file
• Still need to update the dependency to update-task-status endpoint and related project summary endpoints
• PyJWT package and pdm lock file are not pushed yet
• open to suggestions and improvements

[spwoodcock]

This is pretty neat 😁

But there is no need for us to generate our own tokens, as this can be handled by OpenStreetMap.

I will send you the OSM auth token for svcfmtm and we can simply verify that using login_required.

The token can be set inside a cookie in the same way we do currently too

[Sujanadh]

ohh ok i thought we are not using osm auth. I totally forgot svcfmtm is already an osm user ,not just made up user.

[Sujanadh]

i have updated the temp login to use osm auth tokens.
what are the other endpoints that we are giving temporary access?

[spwoodcock]

For sure we need to update the task status (lock/unlock) - that's the main one 👍

[Sujanadh]

I have added login_required in update_task_status , is there anything to add?

[spwoodcock]

This shouldn't be hardcoded, but configurable.

In the Pydantic, specifying Optional[str] makes the field nullable. Specifying Optional[str] = None makes the field optional (what we want).

The value is then injected via the .env file.
Don't worry about updating the example dotenv etc, I can do that after.

[spwoodcock]

Very nice - we just need the frontend implementation now 👍

[spwoodcock]

We probably don't need a new router for the single endpoint - should it go under the auth router?

[spwoodcock]

One last thing: I think we should take an extra param email here.

Thus implementation will work for now.

When we have an email service included, maybe we ads the extra step to require verification by clicking a button in the users email inbox.

[Sujanadh]

just an extra param for now?

[spwoodcock]

I have added login_required in update_task_status , is there anything to add?

There is also the GET project endpoint that we should probably put behind login again.

[Sujanadh]

I have added login_required in update_task_status , is there anything to add?

There is also the GET project endpoint that we should probably put behind login again.

There is no dependency check in GET endpoints of project view; even non-logged-in users are allowed to view projects, right?
Are we now adding login_required to them?

[spwoodcock]

I have added login_required in update_task_status , is there anything to add?

There is also the GET project endpoint that we should probably put behind login again.

There is no dependency check in GET endpoints of project view; even non-logged-in users are allowed to view projects, right? Are we now adding login_required to them?

In the past we had projects behind a ProtectedRoute in the frontend, requiring login.
I removed it temporarily for field testing, but we probably need it back in, to cover the case of private projects (we can't have users able to access everything by default).

We can add the ProtectedRoute back into the frontend, meaning we probably also want login_required on

fmtm/src/backend/app/projects/project_routes.py

Line 218 in a50540a

@router.get("/{project_id}", response_model=project_schemas.ReadProject)

The project_dashboard endpoint is also called on the project detail page.

fmtm/src/backend/app/projects/project_routes.py

Line 1183 in a50540a

"/project_dashboard/{project_id}", response_model=project_schemas.ProjectDashboard

This should have login_required too, but also should not be called when the user goes to the project details, only when they go to the dashboard (requires frontend change)

[Sujanadh]

makes sense 👍

[Sujanadh]

One question. Since private and public access are checked in mapper role but not in login_required, and for the temporary login also we use svcfmtm which is mapper by default. Again, in the future new login from any source will be assigned role mapper so better to use mapper dependency instead of login_required what do you think?

[spwoodcock]

You are completely right!

We need to give this more thought!

We need temp users to be able to access projects, so they have to be assigned MAPPER role.
As they all use the svcfmtm user, this works fine for public projects.
We just need to make sure the user svcfmtm exists and has MAPPER role.

I actually think that by default svcfmtm is ADMIN... we need to separate those roles and use two different usernames. That's another issue 😅

For private projects, we probably need a mechanism for project admins to generate an invite link. This could create a specific user tied to a project with MAPPER permission, so a user must have an invite like to access it.

Open to ideas!

[Sujanadh]

Can't we change the role of svcfmtm to mapper?
Yes, I agree with the idea of sending invites to users via email for the private project since we don't have ui to assign users to the project.

[spwoodcock]

After discussion, we decided to:

• Remove ADMIN permission from default svcfmtm user account.
• Create a second user localadmin that is manager for the FMTM Public Beta org.
  • This user is not an OSM user and is only local in the database.
  • It cannot be logged into.
• Use svcfmtm for the temp auth in this PR.

Doing this also remove a potential future security flaw: if another organisation deploys FMTM and we kept the svcfmtm user as an admin user, we could potentially log in as admin on their FMTM instance!

[Sujanadh]

{
  "detail": "Auth failed. No user id present"
}

I got this error while using localadmin, which has an id '0'. Since the id in the user's table is the primary key, does it accept a '0' value?

[spwoodcock]

How are you using localadmin?

Login shouldn't work, except for during local development where login is skipped and localadmin is returned.

Can you check your db if the user exists? The user should have been created at server startup with id 0 (the field should accept 0 no problem)

[Sujanadh]

yes i checked db, it has record of localadmin. but while getting uid during check access in roles.py it doesn't extract id from the user_data though the data have id : 0. instead it returned above error.

[spwoodcock]

Nice, if changing to id 1 fixed the error, then all good!