Massively Refactor Authentication internals

[CarsonF]

This was one of the end goals I had a week ago, but if first I needed fix all the tight coupling to Session.

• Moved ~/components/authentication -> ~/core/authentication

• Moved Session to core as well. There are no remaining auth exports in ~/common

• Decoupled some authorization functionality from authentication.

  • powers & betaFeatures resolve in the authorization module now.
  • Impersonation checks are decoupled with an event

• AuthenticationService was split

  • Functionality needed for GQL resolvers stayed put: register, log in/out, password management.
  • JwtService for encoding/decoding session & email tokens
  • SessionManager holds the remaining functionality...for managing sessions.

• SessionInterceptor was split

  • SessionInitiator is now the service that parses the request info & relays to SessionManager to create sessions
  • Now SessionInterceptor only:
    • Creates the ALS layer for the request's session
    • Consumes AuthLevel & applies their logic/constraints
    • Forwards requests to SessionInterceptor to resume the session.
  • Now the SessionInterceptor can be a private "hook". Since SessionInitiator is injectable now. Though the Identity facade still fronts this.

• AdminModule now pulls authentication services loosely via ModuleRef.

  • This allows many internal layers/services to be un-exported from the AuthenticationModule.
  • The admin use is an edge case to handle the unique RootUser case. I'd like to rethink this RootUser all together, and I'm hoping our SystemAgents are a step in that direction. Until then though, it was a bit silly to expose many internal layers/services to the codebase just for this.

• Now only Identity is the only exported service that the codebase can use to do auth things.
  Its surface area is a fraction of the former AuthenticationService - all of the internals have been made private.

[github-actions]

🗞 GraphQL Summary

View schema changes

@@ -6918,9 +6918,9 @@
   """
   The impersonator if the user is logged in and impersonating someone else
   """
   impersonator: User
-  powers: [Power!]
+  powers: [Power!]!
 
   """
   Use this token in future requests in the Authorization header.
   Authorization: Bearer {token}.

[bryanjnelson]

💪🏼