[Discussion] OAuth 2.0 changes

[nkshah2]

Changes in web-js

We create a new recipe for oauth 2.0 that manages the following:

• Handle saving/loading the info required to redirect back to the client app (state, redirect_uri, scopes, etc.)
• Handle getting the url to redirect to the authorize endpoint of the BE SDK
• Handle getting the final redirect url from the backend SDK (POST endpoint)

Changes in the auth-react SDK

We create a new recipe for oauth 2.0 that manages the following:

• Create an auth page (/auth/oauth2/authorize)
  • It should check if the current user has an active session.
    • If yes, we can call the BE authorization endpoint to get tokens.
      • In the future, we may need internal redirections based on the requested scopes and the session payload. We don't need to implement anything right now, but it'd be nice to allow for it.
    • Use web-js to build the redirection url based on the current query params or the stored info.
    • Redirect back to the backend (which redirects back to the client)
  • If there is no active session, it should save the redirection info and redirect to the auth page.
    • We need to make sure that the success redirection will redirect back to the new page (which will check the session and redirect back to the client)
  • In case of header based auth it should not redirect to the BE but get the final redirect URL using the post method
  • We should show a spinner here if it takes long (or just show a spinner at the start we'll solve for flickering if its an issue)