Add user profile factory for authentication modules

[jannyHou]

Suggestion

This is a follow-up story for PoC #3771

Use Cases

Allow the strategy adapter to add a user profile factory that converts the returned user from a passport strategy to the user profile.

Examples

See the background and example in PoC PR

Acceptance criteria

• Add interface UserProfileFactory and key USER_PROFILE_FACTORY in
  @loopback/authentication to help developers inject the factory wherever it's
  needed.
• Add userProfileFactory in StrategyAdapter's constructor.
• Tests
• Document

[dhmlau]

@emonddr, assigning this to you per our discussion with @jannyHou.

[yiev]

Hello :-)

I came here from #2246 and I am a bit confused right now - maybe someone of you can help me out of my confusion.

My goal is to have a user profile with completely different properties than UserProfile. In the mentioned issue it seemed that this may be developed in future.
But this issue seems like you are building more of a workaround instead of really enabling UserProfile to take anything the user wants it to. E.g. by turning it into an empty interface.

Did I misunderstood the goal of this user profile factory or is it just not that easy to change UserProfile to an empty interface with no properties? I didn't check the code in @loopback/security and @loopback/authentication yet, so I can't really tell.

[emonddr]

@yiev , UserProfile is now in @loopback/security as it is used by both @loopback/authentication and @loopback/authorization .

https://github.com/strongloop/loopback-next/blob/master/packages/security/src/types.ts#L37

It extends a type called Principle which introduces
[securityId] : string
and
[attribute: string]: any;

securityId is required for authorization purposes.

[attribute: string]: any; lets you specify anything

In UserProfile itself,
we kept email and name as optional for backward compatibility.

So essentially, you can specify any fields you want.

[jannyHou]

@yiev Thank you for following up the implementation in the auth modules! Right now the UserProfile interface is defined in @loopback/security, it extends interface Principal.

Let me copy the relevant definitions:

/**
 * Represent a user, an application, or a device
 */
export interface Principal {
  /**
   * Name/id
   */
  [securityId]: string;

  // eslint-disable-next-line @typescript-eslint/no-explicit-any
  [attribute: string]: any;
}

/**
 * The minimum set of attributes that describe a user.
 */
export interface UserProfile extends Principal {
  // `email` and `name` are added to be identical with the
  // `UserProfile` that previously was exported by `@loopback/authentication`
  email?: string;
  name?: string;
}

It is not an empty interface but in terms of the flexibility to define custom fields, they doesn't differ a lot. The current UserProfile only has one symbol field [securityId] which is shared among all auth modules(authentication, security, authorization, and other modules in the future), and two optional fields email and name as string.