# Macrostrat authentication system

This module contains tools to manipulate Macrostrat's user authentication
system. It is divided into two submodules:

- `macrostrat.auth_system.legacy`: A JWT-based authentication system relying on
  local storage of hashed passwords. This system was created as part
  of [Sparrow](https://sparrow-data.org) and is being phased out in favor of a
  more modern system based on ORCID.
- `macrostrat.auth_system.oauth`: An ORCID-based user
  authentication system. This system will become the primary authentication
  system for
  Macrostrat.

We plan to gradually converge the functionality of both versions while phasing
out the legacy system.

## Key planned functionality

- Allow many Macrostrat-hosted services to easily integrate with Macrostrat's
  login and token flow
- Allow APIs to easily validate user credentials and tokens with minimum
  overhead
- Allow access to be checked in multiple ways:
  - Cookies and headers
  - Limited-time JWT tokens and long-duration, cancelable API tokens
  - Verify against Macrostrat "user group" or application-specific criteria (
    e.g., a list of authorized ORCID IDs)

