Replace Verida Connect by Verida Auth

[aurelticot]

What's changed?

How to test these changes?

Anything to be aware of?

[tahpot]

Comments from @aurelticot

I haven't tested everything yet. Except the Browse Data page that has an issue, likely already present earlier (related to a react controlled input). I'll have a look tomorrow (tuesday).

So far, I put arbitrary scopes for the Auth token, I'm still unsure what's needed.
For the DCS API /app/... that are consumed by the Developer Console, the routes are not configured with a scope (see on GitHub) but /app/account fails with a 403 Forbidden Invalid token (insufficient scope). This issue is purely related to the options passed to the auth middleware, not the token received in the request (see GitHub). Did it worked previously?

[tahpot]

For the DCS API /app/... that are consumed by the Developer Console, the routes are not configured with a scope

This is because this app was using the wallet to sign in, which doesn't use scopes. The dev console was providing the raw session token object.

/app/account fails with a 403 Forbidden Invalid token (insufficient scope)

Yep, that's because there's no scope defined and scopes are required when using an API key instead of a session token for authentication.

I think adding a app-developer scope to all these app endpoints would make sense:

const appAuth = auth({
    scopes: ['app-developer'],
    options: {
        // App DID's don't need to be whitelisted
        ignoreAccessCheck: true,
    }
})

The developer console can then request that scope as part of signing in.

[aurelticot]

Yep, that's because there's no scope defined and scopes are required when using an API key instead of a session token for authentication.

I think adding a app-developer scope to all these app endpoints would make sense:

const appAuth = auth({
    scopes: ['app-developer'],
    options: {
        // App DID's don't need to be whitelisted
        ignoreAccessCheck: true,
    }
})

The developer console can then request that scope as part of signing in.

Okay, makes sense

[tahpot]

The connect button doesn't appear correctly.

Other than that, this is great. I tested end to end using two different mainnet accounts. This can be released.