JWT authentication & Clean up the board

[hweihwang]

• See actual Nextcloud user on the board (ongoing)
• Expose read only permission through token

[juliusknorr]

Could we make this configurable in the app config right away? And for the websocket_server configurable as environment variable?

[juliusknorr]

We should have the file id and probably permissions in the token payload right away so its use can be limited to that.

[hweihwang]

User can interact with multiple files at the same time, so we will have different short-lived tokens for each file. What are your thoughts on this approach? Here are two considerations:

• We can have one short/medium-lived token representing the user (not tied to any specific file) and perform the check/kick whenever retrieving or saving content to a specific file.

• We can use short-lived tokens for each file with the necessary permissions. These permissions can become outdated when user's permissions changed, but if they are short-lived, it shouldn't be a huge problem. But still need to check whenever retrieving or saving
  @juliushaertl

[juliusknorr]

I'd still prefer file based short-lived tokens. This will make it easier to further extend for cases where there is no user in scope as for public share links of files. Generally I'd also prefer to give the least possible scope to any tokens.

[juliusknorr]

Very nice, could you check the Ci failures? Then we can merge 👍

[juliusknorr]

PHPUnit tests seem caused because we have not tests and no test config yet.

[juliusknorr]

Suggested change

	private readonly IUserSession $userSession,
	private readonly IRootFolder $rootFolder,
	private readonly IConfig $config
	private IUserSession $userSession,
	private IRootFolder $rootFolder,
	private IConfig $config

We still need to support PHP 8.0 for now

[juliusknorr]

Suggested change

	IRequest $request,
	private readonly IUserSession $userSession,
	private readonly IConfig $config,
	/** @psalm-suppress MissingDependency */
	private readonly IRootFolder $rootFolder
	IRequest $request,
	private IUserSession $userSession,
	private IConfig $config,
	/** @psalm-suppress MissingDependency */
	private IRootFolder $rootFolder

[juliusknorr]

Thanks @hweihwang

I left two more comments as we need to keep supporting PHP 8.0 for now. Can you also squash the commits either logically or into one final one so we have a clean history?

I noticed when attempting to rebase the PR (I didn't have much time) that there were quite some merge commits that make future rebasing harder. In the future it might be better to only use rebasing to catch up with changes from the base branch.