User-level state shared accross browser (and potentially computers) about wave

[aranvir]

Thanks again for the feedback! That gives me some food for thought...

[mturoci]

Hey @aranvir. q.user assumes the presence of an OIDC authenticated user (maybe our docs need improvement). You can see how it's scoped here. The example you linked uses a custom JWT auth.

[aranvir]

I see, thank you for the clarification. Then I implemented this JWT approach with the wrong assumption. But I also guess it's then not even possible to use user state reasonably without OIDC, right? Or rather - I assume that user state is then also shared across all users like app state.

Does it then even make sense to keep the JWT example, if it can't work?

[mturoci]

But I also guess it's then not even possible to use user state reasonably without OIDC, right?

You would need to implement your own version of q.user: A global dict keyed by JWT token usernames/subjects whatever. The implementation would be very similar to the one I linked above. Another option would add it natively to Wave somehow.

I assume that user state is then also shared across all users like app state.

Correct. Non-authenticated users have auth.subject set to anon. Since all users have the same key so it basically equals to q.app in that case.

Does it then even make sense to keep the JWT example, if it can't work?

I would say it does. It only can't work with q.user. The point of the example is to show that JWT is possible (login screen) if you put in the effort. In real-world apps, user-state is stored in an external DB anyway, not in-memory.

[mturoci]

Also, since this is a very niche feature (most folks go with OIDC), it won't be prioritized, but I am fine with accepting a contribution as long as it doesn't make the code much more complex.

Feel free to ping me in case of any more questions! Covnerting this into a GH discussion.