## Overview
A JSON web token(JWT) is JSON Object which is used to securely transfer information over the web(between two parties).
We use Auth0 as the authentication system that will generate JWT for clients / frontend apps for the logged in user.
Frontend can then use this JWT to call any microservice via grass using this JWT. This JWT will act as a token of trust which only a
valid user can have.

![JWT flow diag](JWT_flow_diag.jpg)

See details below on what does JWT comprise of and how to use it with ows-grass.



## JWT Changelog

* Version 0.1 ***Current Version***

    This is the intital version of JWT. It is called Super JWT as this contains information from legacy user_metadata
    as well as from user profiles.

    See an example JWT [here](./example_jwt_0.1.json).



## JWT Usage


#### Grass Access methods to use.

Use `allow_jwt_token()` with your services that supports new profile headers.
Details about it can be found https://github.com/theorchard/ows-grass#access-methods-active-ones.


#### Service Registration Example

```
register(
    name='graphql-product',
    rule='/graphql-product',
    metric='graphql-product',
    service=OrchardWebService(
        domain=environment.select(
            prod='graphql-product.theorchard.io',
            default='qa-graphql-product.theorchard.io'),
        url_protocol='https',
        port=443,
        protocol=rest),
    access=[
        access.allow_jwt_token()
    ])

```


#### Raw JWT Example

```
eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IlJrSTROamRCTWpVNE1ETTBRVGd3UkRjd09EWkZSa0U1UmpFeVFUUXpNVE5FUlRFNFJUZ3lSZyJ9.eyJodHRwczovL2dyYXNzLnRoZW9yY2hhcmQuY29tL3Byb2ZpbGVzIjpbeyJwcm9maWxlX3R5cGUiOiJBcnRpc3RQcm9maWxlIiwicHJvZmlsZV9uYW1lIjoiQlRTIiwicHJvZmlsZV9pZCI6NTA0MTUzLCJyb2xlcyI6WyJhbmFseXRpY3MiXX1dLCJpc3MiOiJodHRwczovL3FhLW9yY2hhcmQuYXV0aDAuY29tLyIsInN1YiI6ImF1dGgwfDVjODIyOWQzY2I4MmU2MmViZWQ3OTY1OSIsImF1ZCI6WyJodHRwczovL3dvcmtzdGF0aW9uLnFhb3JjaC5jb20vYXBpIiwiaHR0cHM6Ly9xYS1vcmNoYXJkLmF1dGgwLmNvbS91c2VyaW5mbyJdLCJpYXQiOjE1NzM1NTMxMjMsImV4cCI6MTU3MzU1NDkyMywiYXpwIjoicDZ4M014a3hSOEtWVEZ0bFk4dm1nS09NSW83NWlxRUQiLCJzY29wZSI6Im9wZW5pZCBlbWFpbCIsImd0eSI6InBhc3N3b3JkIn0.XN_32tgMU-jwnsWkybB7QSS3s-ZCys0FTY2qLi1OWBb4CTuFLcLqprU1IiuxbGR1wy3bGpdHWks65fCT7GKZIu375_Cp1XiiLdv8SXyM8NEF2eeIQl9bHoiUkEdaaRXpsfn1UP_yJ0l93aK1cTmCda6iQMduWkfq0K7WMZKyAcyQ9fOj0gvKtu9ONaWhc9G4eZ5DyOsjCSL1fkSFdApFEsqKr72Z46bVDzuSgYF1gtXu3C5PKSIwDvKYF-j9PohAUspKifXwGG36XpkE8JgHfgBodYHEf_TJyjz1FYEicvgoahbrYEA5wlJR_Kqnh9dNYzAEnEuqFIVuB3gXppuyCA

```


#### Decoded JWT Example

```
{
  "https://grass.theorchard.com/version": "0.1",
  "https://grass.theorchard.com/profiles": [
    {
      "profile_type": "ArtistProfile",
      "profile_name": "BTS",
      "profile_id": 504153,
      "roles": [
        "analytics"
      ]
    }
  ],
  "iss": "https://qa-orchard.auth0.com/",
  "sub": "auth0|5c8229d3cb82e62ebed79659",
  "aud": [
    "https://workstation.qaorch.com/api",
    "https://qa-orchard.auth0.com/userinfo"
  ],
  "iat": 1573553123,
  "exp": 1573554923,
  "azp": "p6x3MxkxR8KVTFtlY8vmgKOMIo75iqED",
  "scope": "openid email",
  "gty": "password"
}
```


#### API Request via Grass using JWT

```
curl -X GET \
  http://api-dev.theorchard.io/users/hello/ \
  -H 'Accept: */*' \
  -H 'Accept-Encoding: gzip, deflate' \
  -H 'Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IlJrSTROamRCTWpVNE1ETTBRVGd3UkRjd09EWkZSa0U1UmpFeVFUUXpNVE5FUlRFNFJUZ3lSZyJ9' \
  -H 'Cache-Control: no-cache' \
  -H 'Connection: keep-alive' \
  -H 'Host: api-dev.theorchard.io' \
  -H 'Postman-Token: bc470ada-e5df-402e-8745-f5118ecdcada,35f43ecf-a27e-4c17-be58-692b4c1d0702' \
  -H 'User-Agent: PostmanRuntime/7.19.0' \
  -H 'cache-control: no-cache'

```