feat: implement passwordless flows (otp)

[hozier]

Issues worked on:

• Passwordless authentication using One-Time Passwords (OTP) allows users to securely log in without remembering or transmitting passwords.

[Copilot]

Pull Request Overview

This PR implements passwordless authentication via OTP, enhancing security by enabling users to log in without traditional passwords. Key changes include:

• Implementation of an OTP provider and its integration into the authentication flow.
• Enhancements in secret management (addition of secret deletion) and adjustments to JWT configurations.
• Updates to API definitions and documentation to support the new OTP endpoints.

Reviewed Changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/src/test/scala/com/theproductcollectiveco/play4s/auth/DefaultOtpProviderSpec.scala	Added tests to validate OTP round-trip functionality.
app/src/main/scala/com/theproductcollectiveco/play4s/auth/DefaultOtpProvider.scala	Implements OTP initialization and validation logic.
app/src/main/scala/com/theproductcollectiveco/play4s/auth/DefaultKeyStoreBackend.scala	Introduces deletion functionality for stored secrets in the keystore.
app/src/main/scala/com/theproductcollectiveco/play4s/auth/DefaultJwtProvider.scala	Adjusts JWT leeway and refines error handling using AuthProcessingError.
app/src/main/scala/com/theproductcollectiveco/play4s/auth/DefaultAuthProvider.scala	Modifies secret initialization to accept an optional provided secret and adds secret removal.
app/src/main/scala/com/theproductcollectiveco/play4s/api/AuthService.scala	Integrates OTP provider into the auth service with endpoints for OTP initiation and redemption.
app/src/main/scala/com/theproductcollectiveco/play4s/MainApp.scala	Registers the new OTP provider within the main application.
api/src/main/smithy/com/theproductcollectiveco/play4s/internal/auth/service-auth-api.smithy	Adds OTP-related operations and updates error definitions.
api/src/main/smithy/com/theproductcollectiveco/play4s/internal/auth/model.smithy	Introduces the OTP and contact models required for OTP flows.
api/src/main/smithy/com/theproductcollectiveco/play4s/game/sudoku/errors.smithy	Adds definitions for AuthValidationError and AuthProcessingError.
README.md	Documents new endpoints for OTP initiation and authorization.

Comments suppressed due to low confidence (1)

app/src/main/scala/com/theproductcollectiveco/play4s/api/AuthService.scala:43

• The ifM branches appear inverted: when OTP validation returns true (indicating a valid OTP), the current code raises an error. Consider swapping the branches so that a valid OTP results in calling requestToken(requester) and an invalid OTP raises an error.

otpProvider.validateOtp(requester, otp).ifM(InvalidInputError("Invalid OTP supplied").raiseError, requestToken(requester))

[Copilot]

[nitpick] The pattern matching 'case Some(_) | None' covers all cases, which makes the match redundant. Consider removing the match and directly calling loaded.store, if overwriting the secret is the intended behavior.

Suggested change

	loaded.retrieve(alias).flatMap { case Some(_) | None => loaded.store(alias, providedSecret.getOrElse(uuid)) }
	loaded.store(alias, providedSecret.getOrElse(uuid))