authentication improvements

[tripodsan]

goals:

• admin, preview and live are protected using the same access token (user only needs to login once)
• ttl of user access token is long enough (1 work day) or can silently be refreshed
• customer can use API keys, to either access a protected admin or page/live from a service
• API keys can be revoked

implementation:

• issue JWT, singed with helix private key (also see use custom JWT instead the one of the IDP. #287)
• JWT can include owner/repo in sub claim (also see verify sub claim in jwt to match project #285 )
• JWT can include key id in jid claim (also see verify jid claim #286)
• if jid is included, it must match any of the configured access.apiKeyId values
• if sub is included, it must match owner/repo of the project. sub should support wildcard for the repo
• pipeline response no longer includes the public key, iss, and aud, but this is now stored in edge dict of .live
• jti of the project should also be stored in the edge dict and updated automatically
• API_KEYs must use a sub and jti claim
• API_KEYs can also include a roles claim, that can be used to auth against admin
• API_KEYs have admin@adobe.com as email. defining their role in the config overrides the ones defined in the roles claim
• (edge dict of .live should have a list of projects with auth enforced on .live and pre-emptively check all requests)

future:

• create customer UI to easily create API keys

/cc @stefan-guggisberg @davidnuescheler

[github-actions]

🎉 This issue has been resolved in version 4.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀