Proposal: Token based authentication

[subroseio]

The current authentication method is limited, unsuitable for purpose and requires sending passwords to the vault for registration.

1. No built in revocation
2. Can't control how many times a JWT can be used
3. Renewal is not possible

Proposal: Move over to Opaque tokens which would just be random cryptographically generated strings that don't contain any information. These should be hashed and stored in the database as keys with the values of that token being attributes that configure the token's access and authorisation granularly.

For example a principal should be able to:

1. Generate a single use token
2. Generate a token with a subset of their policies
3. Generate a token that is valid from t1 and expires at t2

Standalone example:

package main

import (
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"math/rand"
	"time"
)

type Token struct {
	PrincipalId string   // ID of the principal associated with the token
	CreatedAt   time.Time  // Creation time of the token
	Name        string   // Human-readable name for the token
	Policies    []string // Policies associated with the token
}

type TokenStore struct {
	store map[string]*Token
}

func NewTokenStore() *TokenStore {
	return &TokenStore{
		store: make(map[string]*Token),
	}
}

func (ts *TokenStore) CreateToken(principalId string, name string, policies []string) string {
	token := generateToken()
	hashedToken := hashToken(token)
	ts.store[hashedToken] = &Token{PrincipalId: principalId, CreatedAt: time.Now(), Name: name, Policies: policies}
	return token
}

func (ts *TokenStore) VerifyToken(token string) bool {
	_, ok := ts.store[hashToken(token)]
	return ok
}

func generateToken() string {
	rand.Seed(time.Now().UnixNano())
	token := fmt.Sprintf("%d", rand.Int63())
	return token
}

func hashToken(token string) string {
	hash := sha256.Sum256([]byte(token))
	return hex.EncodeToString(hash[:])
}

func main() {
	ts := NewTokenStore()
         
        // 1) On successful login, generate a token:
	principalId := "user1"
	policies := []string{"read", "write"}
	token := ts.CreateToken(principalId, "Token for user1", policies)
	fmt.Printf("Generated Token: %s\n", token)
	

        // 2) On requests to the vault, verify and look up the token
        fmt.Println("Verify Token:", ts.VerifyToken(token))
	tokenInfo := ts.store[hashToken(token)]
	fmt.Printf("Token Name: %s\n", tokenInfo.Name)
	fmt.Printf("PrincipalId: %s\n", tokenInfo.PrincipalId)
	fmt.Printf("Policies: %v\n", tokenInfo.Policies)
	
	// 3) Proceed to policy enforcement
}