FS-4805 - Adding authentication to FAB

[wjrm500]

Ticket

Add authentication for FAB

Description

• Instead of just an index route for the home page, we now have index, login and dashboard routes, following the pattern in Post-Award Submit: https://github.com/communitiesuk/funding-service-design-post-award-data-store/blob/main/submit/main/routes.py
• Users landing at index (/) get redirected to dashboard (previously index) if authenticated, or login if not
• At login, users are presented with a button "Sign in using Microsoft" that sends them to the Authenticator app, which in turn redirects them to Entra ID (see OAuth)
• Users will be able to authenticate successfully with Microsoft if they are either members or guests of the MHCLG organisation in Microsoft
• All routes are now decorated with the login_required decorator from our fsd-utils library, which simply checks whether users have authenticated successfully
• All routes are also now decorated with the additional check_internal_user decorator, now also part of the fsd-utils library having recently been ported there from Post-Award Data Store. This decorator checks users have an email domain of either communities.gov.uk or test.communities.gov.uk, which prevents guest users on our Entra ID tenant (i.e., local authority users) from accessing
• Functionality has also been added to support local development, including a DEBUG_USER backdoor

---

Testing instructions

General pre-requisites

• Ensure the branch FS-4805_FAB-authentication is deployed to dev environment for this app
• Ensure the branch FS-4805_FAB-authentication is deployed to dev environment for Authenticator

Test 1 - Unauthenticated user

1.0

• Action: open an incognito / private mode browser window to ensure authentication begins afresh

1.1

• Action: go to https://fund-application-builder.dev.access-funding.test.levellingup.gov.uk/dashboard
• Expected behaviour: you will be redirected to https://authenticator.dev.access-funding.test.levellingup.gov.uk/service/sso/signed-out/no_token?return_app=fund-application-builder&return_path=%2Fdashboard and see a page saying "You are not logged in" with a "Sign in" button

Test 2- Authenticate as an internal user

2.0

• Action: open an incognito / private mode browser window to ensure authentication begins afresh

2.1

• Action: go to https://fund-application-builder.dev.access-funding.test.levellingup.gov.uk
• Expected behaviour: you will be redirected to https://fund-application-builder.dev.access-funding.test.levellingup.gov.uk/login and see a page with a button "Sign in using Microsoft"

2.2

• Action: click the button "Sign in using Microsoft"
• Expected behaviour: you will be redirected to an Entra ID login page where you will be requested to enter your Microsoft credentials. Once you have done this, you will be redirected to https://fund-application-builder.dev.access-funding.test.levellingup.gov.uk/dashboard. You will see the normal FAB home page

2.3

• Action: from the dashboard, click into "Manage Templates" and click one of the template name links (e.g., "Applicant Information COF")
• Expected behaviour: you will be sent to a route in the domain https://forms.dev.access-funding.test.levellingup.gov.uk (e.g., https://forms.dev.access-funding.test.levellingup.gov.uk/apply-for-funding-to-save-an-asset-in-your-community/applicant-information), where you will be able to preview the form (e.g., you will see a page titled "Applicant information" with a "Continue" button)

Test 3 - Authenticate as an external user

Test-specific pre-requisites

• You will need your personal email address included as a guest account in the Entra ID test tenant. I believe adding guests is something only admins can do (i.e., not me), so simplest solution for this test is to hop on a call with me and I can share my screen and run through the steps

3.0

• Action: open an incognito / private mode browser window to ensure authentication begins afresh

3.1

• Action: go to https://fund-application-builder.dev.access-funding.test.levellingup.gov.uk
• Expected behaviour: you will be redirected to https://fund-application-builder.dev.access-funding.test.levellingup.gov.uk/login and see a page with a button "Sign in using Microsoft"

3.2

• Action: click the button "Sign in using Microsoft"
• Expected behaviour: you will be redirected to an Entra ID login page where you will be requested to enter your Microsoft credentials. You will have to enter a code sent to your email address. Once you have done this, you will be redirected to https://fund-application-builder.dev.access-funding.test.levellingup.gov.uk/dashboard. Instead of seeing the normal home page, you will see a page titled "You do not have permission to access this page"

[nuwan-samarasinghe]

LGTM

nice work

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud