Extract client_id from HTTP referer

[nelsonic]

auth_plug sends the client_id to the auth_url when no valid JWT is found: lib/auth_plug.ex#L167
We need to verify the client_id (decode_decrypt/1 followed by lookup in apikeys)
and if the client_id is valid, use the client_secret to sign the JWT on successful authentication.

Todo

• Extract the client_id from the HTTP referer
  • Check if the client_id is valid before displaying the "login buttons" page
    • If client_id not valid, return a friendly Error: 401: AUTH_API_KEY not valid
• Include the client_id in the state prop that gets sent to GitHub/Google
  I checked and it's RFC3986 compliant to have multiple question marks in a URL Query:
  https://stackoverflow.com/questions/2924160/is-it-valid-more-than-one-question-mark-in-a-url
• Extract the the client_id from the state (returned by Auth Provider)
• Confirm that it's still valid (not altered by the Auth Provider > decode_decrypt/1)
• Lookup the client_id in apikeys
• Use corresponding client_secret to sign JWT
• Redirect back to original HTTP referer with JWT

With the completion of this issue Auth dwyl/app#268 will be fully functional!
Let's get it done!

[nelsonic]

[nelsonic]

Extracting the client_id from the URL query params works:

[nelsonic]

This is working. ✅
See: #43