Updated auth interface (#1384)

* Updated  auth interface

* Add Rule

* Remove Rule

* Return token from Renew

* Renew => Refresh

* Implement Tokens & Default Auth Implementation

* Change default auth to noop

* Change default auth to noop

* Move token.Token to auth.Token

* Remove Token from Account

* Auth service implementation

* Decode JWT locally

* Cookie for secret

* Move string to bottom of interface definition

* Depricate auth_exclude

* Update auth wrappers

* Update go.sum

Co-authored-by: Ben Toogood <ben@micro.mu>

auth/auth.go

@@ -4,24 +4,44 @@ package auth
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"time"
 
 	"github.com/micro/go-micro/v2/metadata"
 )
 
+var (
+	// ErrNotFound is returned when a resouce cannot be found
+	ErrNotFound = errors.New("not found")
+	// ErrEncodingToken is returned when the service encounters an error during encoding
+	ErrEncodingToken = errors.New("error encoding the token")
+	// ErrInvalidToken is returned when the token provided is not valid
+	ErrInvalidToken = errors.New("invalid token provided")
+	// ErrInvalidRole is returned when the role provided was invalid
+	ErrInvalidRole = errors.New("invalid role")
+	// ErrForbidden is returned when a user does not have the necessary roles to access a resource
+	ErrForbidden = errors.New("resource forbidden")
+)
+
 // Auth providers authentication and authorization
 type Auth interface {
-	// Init the auth package
-	Init(opts ...Option) error
-	// Options returns the options set
+	// Init the auth
+	Init(opts ...Option)
+	// Options set for auth
 	Options() Options
-	// Generate a new auth Account
+	// Generate a new account
 	Generate(id string, opts ...GenerateOption) (*Account, error)
-	// Revoke an authorization Account
-	Revoke(token string) error
-	// Verify an account token
-	Verify(token string) (*Account, error)
-	// String returns the implementation
+	// Grant access to a resource
+	Grant(role string, res *Resource) error
+	// Revoke access to a resource
+	Revoke(role string, res *Resource) error
+	// Verify an account has access to a resource
+	Verify(acc *Account, res *Resource) error
+	// Inspect a token
+	Inspect(token string) (*Account, error)
+	// Refresh an account using a secret
+	Refresh(secret string, opts ...RefreshOption) (*Token, error)
+	// String returns the name of the implementation
 	String() string
 }
 
@@ -31,40 +51,47 @@ type Resource struct {
 	Name string
 	// Type of resource, e.g.
 	Type string
-}
-
-// Role an account has
-type Role struct {
-	// Name of the role
-	Name string
-	// The resource it has access
-	// TODO: potentially remove
-	Resource *Resource
+	// Endpoint resource e.g NotesService.Create
+	Endpoint string
 }
 
 // Account provided by an auth provider
 type Account struct {
 	// ID of the account (UUIDV4, email or username)
-	Id string `json:"id"`
-	// Token used to authenticate
-	Token string `json:"token"`
-	// Time of Account creation
-	Created time.Time `json:"created"`
-	// Time of Account expiry
-	Expiry time.Time `json:"expiry"`
+	ID string `json:"id"`
+	// Secret used to renew the account
+	Secret *Token `json:"secret"`
 	// Roles associated with the Account
-	Roles []*Role `json:"roles"`
+	Roles []string `json:"roles"`
 	// Any other associated metadata
 	Metadata map[string]string `json:"metadata"`
 }
 
+// Token can be short or long lived
+type Token struct {
+	// The token itself
+	Token string `json:"token"`
+	// Type of token, e.g. JWT
+	Type string `json:"type"`
+	// Time of token creation
+	Created time.Time `json:"created"`
+	// Time of token expiry
+	Expiry time.Time `json:"expiry"`
+	// Subject of the token, e.g. the account ID
+	Subject string `json:"subject"`
+	// Roles granted to the token
+	Roles []string `json:"roles"`
+	// Metadata embedded in the token
+	Metadata map[string]string `json:"metadata"`
+}
+
 const (
-	// MetadataKey is the key used when storing the account
-	// in metadata
+	// MetadataKey is the key used when storing the account in metadata
 	MetadataKey = "auth-account"
-	// CookieName is the name of the cookie which stores the
-	// auth token
-	CookieName = "micro-token"
+	// TokenCookieName is the name of the cookie which stores the auth token
+	TokenCookieName = "micro-token"
+	// SecretCookieName is the name of the cookie which stores the auth secret
+	SecretCookieName = "micro-secret"
 )
 
 // AccountFromContext gets the account from the context, which