Merged in feature/permit-integration-1 (pull request #172)

Permit integration - part 1

* WIP permit integration

* slim down build

* Merge branch 'main' of bitbucket.org:aarete/query-orchestration into feature/permit-integration-1

* omit swagger from auth

* clean build

* comment

* part 1 completed

this is the initial permitio parts and tests without integration. Also testing.md since we have a new test target `task test:permitio`

* feature flag for no jwt validation

* permit integration

* fix ci unit tests

* ci fix

* build fix

* fix home handler

* fix redirect

* test fix

* update docs for auth

api/queryAPI/homehandler.go

@@ -59,29 +59,41 @@ func HomeHandler(c echo.Context) error {
 	isAuthenticated := (err == nil && tokenCookie.Value != "")
 
 	// Variables for user info
-	username := ""
-	email := ""
-	var userGroups []string
+	var subject string
 
 	// If authenticated, try to decode the JWT token to get user info
 	if isAuthenticated {
-		// Parse the JWT token without verification (just to extract info for display)
-		// In a production application, you would want to verify the token here as well
-		token, _ := jwt.Parse([]byte(tokenCookie.Value), jwt.WithVerify(false))
-		if token != nil {
-			claims, _ := token.AsMap(context.Background())
-			username, _ = claims["cognito:username"].(string)
-			email, _ = claims["email"].(string)
+		// Use the same JWT parsing logic as the middleware to handle formatted tokens
+		tokenString := tokenCookie.Value
 
-			// Try to extract groups
-			if rawGroups, ok := claims["cognito:groups"]; ok {
-				if groups, ok := rawGroups.([]interface{}); ok {
-					userGroups = make([]string, len(groups))
-					for i, g := range groups {
-						userGroups[i] = fmt.Sprint(g)
-					}
+		// Handle RFC-compliant unsecured JWTs that may have only 2 parts (header.payload.)
+		parts := strings.Split(tokenString, ".")
+		if len(parts) == 2 {
+			// Add empty signature part to make it parseable by the JWT library
+			tokenString = tokenString + "."
+		}
+
+		// Parse token without verification (just for display purposes)
+		token, err := jwt.Parse(
+			[]byte(tokenString),
+			jwt.WithVerify(false),   // Skip signature verification
+			jwt.WithValidate(false), // Skip expiration and other validations
+		)
+		if err != nil {
+			subject = "JWT parsing failed: " + err.Error()
+		} else if token != nil {
+			claims, err := token.AsMap(context.Background())
+			if err != nil {
+				subject = "Claims extraction failed: " + err.Error()
+			} else {
+				if sub, ok := claims["sub"].(string); ok {
+					subject = sub
+				} else {
+					subject = "Subject claim not found or invalid type"
 				}
 			}
+		} else {
+			subject = "Token is nil"
 		}
 	}
 
@@ -91,12 +103,10 @@ func HomeHandler(c echo.Context) error {
 		authStatusHTML = fmt.Sprintf(`
 		<div class="auth-status authenticated">
 			<h2>Authentication Status: Authenticated</h2>
-			<p><strong>Username:</strong> %s</p>
-			<p><strong>Email:</strong> %s</p>
-			<p><strong>Groups:</strong> %s</p>
+			<p><strong>Subject:</strong> %s</p>
 			<p><a href="/logout" class="logout-btn">Logout</a></p>
 		</div>
-		`, username, email, strings.Join(userGroups, ", "))
+		`, subject)
 	} else {
 		authStatusHTML = `
 		<div class="auth-status unauthenticated">