[FEATURE] Auth system refactor - Use AWS Cognito

[shanthisa]

Is your feature request related to a problem? Please describe.
Currently there is no easy way to onboard users in the app. The admin has to create username and password and send it to the client.

Describe the solution you'd like
We are implementing AWS Cognito as the IAM solution replacing the existing auth system we have. This would involve refactoring the code to use AWS Cognito authorization system for both Mealplanner app as well as admin UI app.

Describe alternatives you've considered
Google social login and Facebook social login. Ran into issues with facebook social login as API is not exposed.
AWS Cognito also allows social login. So at any point we want to implement it, this infrastructure will help do it.

Dev Notes
These requires the following tasks to be done:

1. Configure AWS Cognito
2. Setup openid-client on the backend server
3. When the user wants to login, redirect to the backend api login that should use the OIDC auth code flow
4. The redirect url on the backend (/api/callback) should verify the JWT token with the pool's JWKS url
5. The redirect url on the backend (/api/callback) then should set session with the JWT token
6. After the session is set, it should then redirect back again to the app

[shanthisa]

For Configuring AWS Cognito, setting up openid-client on NodeJS

Install "openid-client"

Below code is for reference purpose only. Use TypeScript and ES module imports.

const express = require('express');
const session = require('express-session');
const { Issuer, generators } = require('openid-client');
const app = express();

let client;
// Initialize OpenID Client
async function initializeClient() {
    const issuer = await Issuer.discover('https://cognito-idp.ca-central-1.amazonaws.com/ca-central-1_Vk4uN1fR6');
    client = new issuer.Client({
        client_id: '1q5ui49aumjiv31b4tkckfc92q',
        client_secret: '<client secret>',
        redirect_uris: ['https://d84l1y8p4kdic.cloudfront.net'],
        response_types: ['code']
    });
};
initializeClient().catch(console.error);

To. generate redirect url, reference only

app.get('/login', (req, res) => {
    const nonce = generators.nonce();
    const state = generators.state();

    req.session.nonce = nonce;
    req.session.state = state;

    const authUrl = client.authorizationUrl({
        scope: 'email openid phone',
        state: state,
        nonce: nonce,
    });

    res.redirect(authUrl);
});

This is reference for callback code

// Helper function to get the path from the URL. Example: "http://localhost/hello" returns "/hello"
function getPathFromURL(urlString) {
    try {
        const url = new URL(urlString);
        return url.pathname;
    } catch (error) {
        console.error('Invalid URL:', error);
        return null;
    }
}

app.get(getPathFromURL('https://d84l1y8p4kdic.cloudfront.net'), async (req, res) => {
    try {
        const params = client.callbackParams(req);
        const tokenSet = await client.callback(
            'https://d84l1y8p4kdic.cloudfront.net',
            params,
            {
                nonce: req.session.nonce,
                state: req.session.state
            }
        );

        const userInfo = await client.userinfo(tokenSet.access_token);
        req.session.userInfo = userInfo;

        res.redirect('/');
    } catch (err) {
        console.error('Callback error:', err);
        res.redirect('/');
    }
});

For Logout, reference code:

// Logout route
app.get('/logout', (req, res) => {
    req.session.destroy();
    const logoutUrl = `https://ca-central-1vk4un1fr6.auth.ca-central-1.amazoncognito.com/logout?client_id=1q5ui49aumjiv31b4tkckfc92q&logout_uri=<logout uri>`;
    res.redirect(logoutUrl);
});

Please note all code snippets are for reference only. They need to be adapted for our existing codebase flow.

[SHERIN216]

Hi, Plsease asiign me @SHERIN216 , Thankyou

[mitch-kyle]

Out of curiosity, is it possible use a configurable OIDC endpoint rather than hardcoding cognito? I see two major benefits:

• Avoid vendor lock-in. If amazon decides to raise prices we aren't stuck.
• Allow downstream deployers use their existing IdPs.

Apologizes for the late comment on this; I just got here.

[nabil053]

Could it also be possible to implement AWS Amplify alongside Cognito for user authentication?