Add SSO support

[skovati]

closes NASA-AMMOS/aerie#1100

This PR significantly reworks the hooks.server.ts logic to support SSO in addition to the /login page. Using a new environment variable PUBLIC_AUTH_SSO_ENABLED, the top level hook auth flow is now as follows:

if (env.PUBLIC_AUTH_SSO_ENABLED === 'true') {
   return await handleSSOAuth({ event, resolve });
} else {
   return await handleJWTAuth({ event, resolve });
}

handleJWTAuth

handleJWTAuth is just a refactored version of the existing auth flow:

• validate + populate event.locals.user using existing JWT cookie (by hitting Gateway's /auth/session)
• if JWT was invalid / nonexistent, redirect to /login

handleSSOAuth

handleSSOAuth is a new flow that supports SSO auth by forwarding cookies to new Gateway endpoints, which will check SSO token validity (e.g. CAM token) and return JWTs or redirections accordingly:

• forward cookies to /auth/validateSSO, which will run an auth provider specific SSO validation
• if above validation was successful, Gateway returns an Aerie JWT, which we store in cookies and use in Auth: headers as usual.
• else, the SSO token was invalid or DNE, Gateway returns the URL of the auth providers login page (e.g. CAM-UI), which we redirect the user to.

Logout

The UI also switches on this PUBLIC_AUTH_SSO_ENABLED env var during logout, where it'll either call the Gateway's /auth/logoutSSO (which invalidates the SSO token using the auth provider), or just clear the JWT and redirect to /.

On the next page load, the UI will run through the auth flow in hooks.server.ts, which will correctly redirect us to either /login or the SSO login page, depending on PUBLIC_AUTH_SSO_ENABLED.

This design allows the UI to remain auth provider agnostic. The Gateway can then be extended to support other auth providers (e.g. https://aws.amazon.com/cognito).

The corresponding Gateway PR (NASA-AMMOS/aerie-gateway#51) defines these new auth endpoints, as well as lists the testing steps and possible env var configurations.

[duranb]

I set AUTH_TYPE to "none", but it still redirects me to the CAM login. Also, after logging in to CAM, I wasn't redirected back to aerie-ui. I think whatever is doing the redirect is not including the goto return url to CAM