Staff sign-in

Back in Middleware, the back office got a shared STAFF_TOKEN. Everyone knows it, it never changes, and the audit log can't tell staff members apart. The box office has real accounts and its own OpenID Connect provider now, so the back office can sign staff in exactly like the fan club signs fans in: by being a client of the box office.

Staff members

A staff member is a customer with a name the staff know them by. Its primary key is the customer's key:

use margaret::framework::active_record::key::Key;
use margaret::framework::macros::model;
use margaret::framework::model::on_delete::OnDelete;

use crate::customers::customer::Customer;

#[model(table = "staff_members")]
pub struct StaffMember {
    #[column(primary_key)]
    #[foreign_key(on_delete = OnDelete::Cascade)]
    pub customer: Key<Customer>,
    #[column]
    pub name: String,
}

A command adds them:

$ box_office add-staff-member ana@example.com --display-name Ana
Ana can sign in to the back office as ana@example.com

A client of its own provider

The back office lives in the same application as the provider. Admit it as a client, and let it sign in with keys the application already has, ClientKeys::Own. Staff shouldn't have to approve their own back office, so consent is Implicit. The back office only needs to know who signed in, so it asks for openid and needs no resources:

use margaret::framework::accepted_clients::client_keys::ClientKeys;
use margaret::framework::accepted_clients::consent_policy::ConsentPolicy;
use margaret::framework::jwks_secret_store::id_token_signing::IdTokenSigning;
use margaret::framework::macros::admits_oauth_client;
use margaret::framework::oauth_vocabulary::client_authentication_method::ClientAuthenticationMethod;
use margaret::framework::oauth_vocabulary::openid_scope::OpenidScope;

use crate::routes::admin::finish_staff_sign_in::FinishStaffSignIn;

#[admits_oauth_client(
    back_office_app,
    authentication = ClientAuthenticationMethod::PrivateKeyJwt(keys = ClientKeys::Own),
    authorization_code(
        consent = ConsentPolicy::Implicit,
        id_token_signing = IdTokenSigning::EllipticCurve,
        redirect_routes = [FinishStaffSignIn],
        scopes = [OpenidScope],
    ),
    client_id = "back-office",
    resources = [],
)]
pub struct BackOfficeApp;

redirect_routes names the callback route by its type, so the redirect address can never drift from the route. Then declare the client side, pointing at the admitted client:

use margaret::framework::macros::oauth_client;

#[oauth_client(back_office, admitted_as = back_office_app)]
pub struct BackOffice;

Sign-in routes

The back office signs staff in with the same two routes as Sign in with Google, on the admin server:

#[responds_to_http(
    method = RouteMethod::Get,
    name = "start_staff_sign_in",
    path = "/sign-in",
    server = "admin"
)]
#[serves_sign_in(SignInEndpoint::Start, client = back_office)]
pub struct StartStaffSignIn;

#[responds_to_http(method = RouteMethod::Get, path = "/sign-in/callback", server = "admin")]
#[serves_sign_in(SignInEndpoint::Callback(landing_route = ShowDashboard), client = back_office)]
pub struct FinishStaffSignIn;

Only staff members get in. The ID token's subject is the customer's id, because the box office issued it:

#[async_trait]
impl AdmitsSignIn for BackOfficeStaff {
    type IdClaims = IgnoredAny;

    async fn admit(
        &self,
        SignedIn { subject, .. }: SignedIn<IgnoredAny>,
        _flow: &SignInFlow,
    ) -> anyhow::Result<SignInAdmission> {
        let customer = Uuid::try_parse(&subject)?;

        Ok(match self.staff.find(customer).await? {
            Lookup::Found(_) => SignInAdmission::Admitted(customer),
            Lookup::Missing => SignInAdmission::Refused,
        })
    }
}

IgnoredAny from serde says the back office needs no claims beyond the subject. A staff member who's already signed in at the box office goes straight through. Anyone else signs in at the box office first, with a link or with Google.

Who is signed in

The back office asks for a StaffMember, from its own provider. It uses all three outcomes: no session sends the browser to the staff sign-in, a session of someone who isn't staff gets a 403, and a staff member is let in:

    #[infer_from_request]
    pub async fn infer(
        &self,
        routes: &Routes,
        #[session(issuer = box_office)] session: Option<Session>,
    ) -> anyhow::Result<AuthenticatedUserOutcome<StaffMember>> {
        let Some(session) = session else {
            return Ok(AuthenticatedUserOutcome::Interrupted(
                routes.admin.start_staff_sign_in.see_other().into(),
            ));
        };

        Ok(match self.staff.find(session.subject).await? {
            Lookup::Found(staff_member) => AuthenticatedUserOutcome::Authenticated(staff_member),
            Lookup::Missing => AuthenticatedUserOutcome::Interrupted(Response::forbidden().into()),
        })
    }

Customer and StaffMember both come from the same sessions, through two different providers. A route asks for one of them, never both.

Replacing the shared token

Every admin route drops #[middleware(staff_only)] and asks for the staff member instead. The dashboard greets them by name:

#[singleton]
#[middleware(audit_log)]
#[responds_to_http(
    method = RouteMethod::Get,
    name = "show_dashboard",
    path = "/",
    server = "admin"
)]
pub struct ShowDashboard {
    concerts: Arc<ConcertRepository>,
}

impl ShowDashboard {
    #[constructor]
    pub fn create(concerts: Arc<ConcertRepository>) -> anyhow::Result<Self> {
        Ok(Self { concerts })
    }

    #[process]
    pub async fn respond(
        &self,
        routes: &Routes,
        #[authenticated_user] staff: StaffMember,
    ) -> anyhow::Result<Response> {

The staff_only middleware, the StaffToken, its cookie, its sign-in form, and the STAFF_TOKEN variable all go away. audit_log stays. The staff sign out with a route of their own, which lands back on the staff sign-in:

#[responds_to_http(
    method = RouteMethod::Post,
    name = "sign_out_staff",
    path = "/sign-out",
    server = "admin"
)]
#[serves_session_endpoint(SessionEndpoint::SignOut(landing_route = StartStaffSignIn))]
pub struct SignOutStaff;

$ curl -i https://admin.tickets.internal/
HTTP/1.1 303 See Other
location: https://admin.tickets.internal/sign-in

$ curl -i https://admin.tickets.internal/sign-in
HTTP/1.1 303 See Other
location: https://tickets.example.com/authorize?response_type=code&client_id=back-office&state=...&redirect_uri=https%3A%2F%2Fadmin.tickets.internal%2Fsign-in%2Fcallback&scope=openid&code_challenge=...&code_challenge_method=S256&nonce=...