Parenting Assistant - Auth Tester

⚙️ Config

API Base URL (auto = same origin as this page)

Stored JWT (localStorage)

no token yet

Actions

How to run

cargo run -p auth-service
# Default PORT=8085 with TLS (certs/cert.pem)
# Open: https://devvm37280.rva0.facebook.com:8085/  (self-signed, accept)
# Or https://localhost:8085/ via SSH tunnel:
#   ssh -L 8085:localhost:8085 devvm37280.rva0.facebook.com
# Or open file directly and set API Base to https://devvm37280...:8085
# Backend has permissive CORS, file:// also works
# API Base is now auto = window.location.origin

🎫 Last Response & JWT

Expires in 24h, sub=user_id, iss=parenting-assistant-auth

JWT Token

-

Full JSON Response (user, identities, families, family auto-onboarding)

No requests yet. Try Google Sign-Up →

Google SSO

Provider (forced to google by /auth/google but editable for /sso)

external_id (Google sub)

email (UQ lowercased)

display_name

email_verified

Flow

1) Check user_identities UQ(provider, external_id) → sign-in, is_new_user=false, update last_login_at
2) Else lookup users by email → link new provider (multi-SSO google OR facebook → same users.id)
3) Else sign-up → create user + identity + auto family "{display_name}'s Family" + family_members primary_parent, JWT

Facebook SSO & Multi-SSO

Provider

external_id (FB id)

email (same as Google to test linking)

display_name

email_verified

Test Multi-SSO (per Excalidraw)

1. Google Sign-Up alice@example.com / google_123 → new user
2. Facebook login same email alice@example.com / fb_456 → is_new_user=false, same users.id, identities=2 proves users 1:N user_identities
Button above uses same email as Google form, so click Google Sign-Up first, then this button.

🔒 Authenticated (Bearer)

Link Provider (POST /auth/link)

Actions

Current User ID (for list identities)

Authenticated responses will appear here…

🧪 Generic SSO & Edge Cases / UQ Constraints

Generic: POST /api/v1/auth/sso

UQ Tests (Excalidraw constraints)

Results show in Last Response. Check console for details.
- UQ(provider,external_id) prevents duplicate provider accounts
- UQ(user_id,provider) prevents same user linking same provider twice
- UQ(email) is case-insensitive (alice == ALICE)

📚 About this MVP

5 tables from docs/diagrams/db-schemas.excalidraw:
users (UQ email) 1:N user_identities (UQ provider,external_id) (UQ user_id,provider) users 1:N families, families 1:N family_members (primary_parent/co_parent), families 1:N children (jsonb profile_data)

JWT HS256 24h, sub=user_id, in-memory MemoryDb enforcing same UQ/FK as SQL, soft-delete via deleted_at.

Production TODO: Replace MockVerifier with GoogleVerifier (verify vs https://www.googleapis.com/oauth2/v3/certs) and FacebookVerifier (graph.facebook.com/debug_token).

Current dir is aai_labs_parenting_assistant. This frontend is at frontend/index.html and also served at GET / when you run the Rust service (added frontend_handler). CORS permissive, so both file:// and http://localhost:8080 work.

Endpoints:
GET /health
POST /api/v1/auth/sso {provider, external_id, email, display_name, email_verified}
POST /api/v1/auth/google (same)
POST /api/v1/auth/facebook
GET /api/v1/me Bearer $TOKEN
POST /api/v1/auth/link Bearer {provider, external_id}
POST /api/v1/auth/logout Bearer
GET /api/v1/users/:user_id/identities Bearer