De-authentication between discord/frontend

[walmat]

Describe the bug
Once a user has "deactivated" from the discord bot by sending !deactivate <key>, they are still authenticated on a close -> relaunch of the application. Also, the user may not deactivate from the frontend after they have sent the discord bot the deactivate command. While this is the "expected" behavior, we may want to handle this case and just clear the session even if the key is not found or something.

To Reproduce
Steps to reproduce the behavior:

1. Successfully authenticate the frontend with your key
2. Go to the discord bot and send !deactivate <key>
   3a. Attempt to deactivate from the frontend
   3b. Attempt to close & reopen the frontend (should be deactivated)

Expected behavior
3a should allow you to deactivate still, and 3b should require reauthentication

Desktop (please complete the following information):

• OS: All
• Service: Frontend, Discord Bot, API
• Version: 1.0.0

[pr1sm]

I believe at this point, we have no communication between the discord bot and the frontend of a users machine.

The change will eventually propagate as the access jwt we store expires every 2 days IIRC. So the user would still be allowed to use the frontend until the jwt expires. Once the jwt expires, the frontend would then make an api request, find that the key was deactivated, then kick the user to the auth screen.

[pr1sm]

We should look in-depth into some options for speeding this up. Here are a few off the top of my head. We should discuss them deeper to nail down the pros and cons:

1. Shorten the expiration time for the jwt to force the reauth check to happen faster
2. Enable a small service in the frontend that would allow external communication requests (the discord bot could send a request to deactivate)
3. Leave the same [re]auth check on startup, but force any actions that make outside requests (i.e. task related actions) to perform an auth check before starting. If the auth check fails, the user would be kicked out to the auth screen
4. Remove the jwt token auth altogether and require the user to make a standard auth request everytime the frontend starts

[walmat]

Maybe do a combination of these? I like the first 3 options honestly.

[pr1sm]

👍 We can do a combo! Will tackle this after we release the beta

[walmat]

Maybe for the sake of open beta, we just try and tackle #4?

[pr1sm]

punting this to a 1.0.2 or 1.1.0 release