JWT for local dev: use local DB permissions, allow expired JWT - #3347
Draft
mattjreynolds wants to merge 1 commit into
Draft
mattjreynolds wants to merge 1 commit into
mattjreynolds wants to merge 1 commit into
Conversation
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Makes local development / testing easier by allowing use of an expired token, not verifying the token against cognito, and forcing use of permissionSets from the local DB not those from the token.
This allows use of a JWT without setting up a cognito environment or adding any ENV variables. Any JWT that has an
entraObjectIdorappIdat the root of the payload should work.Permission sets will be looked up from the local DB each time, this allows a very quick feedback loop for testing of modifying the user / permission_sets in the local CMS and re-running the query.
This is completely insecure, and probably wants more thought before we even consider merging it in (or maybe even a wholly different approach to reducing friction for local testing / development of non-public data and functions), but for now it has value, so leaving it here.