Setup Auth0 Authentication for Web and Twilio Users

[SAUMILDHANKAR]

Title: Implement Auth0 Authentication for LMS Users

Description:
Use Auth0 for secure authentication and session management. This ensures that only verified users can interact with the chatbot, both through the web interface and Twilio.

Tasks:

• Create Auth0 application and configure callback URLs.
• Implement login/logout on the LMS web interface using Auth0.
• Link Auth0 identity to phone number for Twilio users.
• Store user metadata (e.g., role, grant history) securely.

Acceptance Criteria:

• Web users can authenticate via Auth0.
• Twilio users are matched to their Auth0 identity using phone number verification or OTP.
• JWT tokens are used to authorize access to chatbot API.

[SAUMILDHANKAR]

Hi @hzhao1003 based on last mentor meeting, I am assigning this to you, so you can help fellows related to working on this issue or sub issues. Hope it is fine. Thank you.

[hzhao1003]

For my reference lol:

Auth0

A third-party authentication and authorization platform that handles secure login, identity management, and token generation.

LMS — Learning Management System

A platform for delivering educational content, managing courses, tracking student progress, and supporting instructors and learners.

OTP — One-Time Password

A single-use code typically sent via SMS or email to verify a user's identity during authentication.

JWT — JSON Web Token

A compact, URL-safe token format used to securely transmit information (like user identity and roles) between parties. Often used for authorizing API requests.

API — Application Programming Interface

A set of rules and protocols that allows different software applications to communicate with each other — in this case, between the LMS frontend/Twilio and the chatbot backend.

[hzhao1003]

More comments to help understand the project:

1. What is RuralLearn? Is it the 3rd party LMS or the name for our project
2. Is this chatbot going to be a separated app or we are going to configure this with current amplify website
3. What feature Auth0 has that can help achieve this functionality
4. Will this chatbot used in other scenarios or just single instance? Do we want to build it reusable?

[hzhao1003]

1. Create Auth0 Application and Configure Callback URLs

🧩 Issue 1.1: Create Auth0 application for LMS integration

• Create a new Auth0 application (Single Page App).
• In Auth0 website, create your own account and and application (see Auth0 DOC)
• Configure allowed callback URLs, logout URLs, and allowed web origins.
• This needs to be done in Auth0 website too.
• Document the application details for devs.
• Write comments and documentation on each class and method you created

🧩 Issue 1.2: Configure environment variables for Auth0 credentials

• Store AUTH0_CLIENT_ID, AUTH0_DOMAIN, and AUTH0_SECRET securely in environment files.
• Update .env.example and deployment configs
• Document everything!

2. Implement Login/Logout on LMS Web Interface Using Auth0
   🧩 Issue 2.1: Set up Auth0 SDK in LMS frontend (vue/typescript)

• Install Auth0 SDK
• Initialize Auth0 following the auth0 doc
• Configure login and logout methods

🧩 Issue 2.2: Implement login and logout UI components (we will need a homepage for it)

• Add login/logout buttons in the navigation bar
• Show user info when logged in
• Redirect user on successful login/logout

Below issues need to be investigated for finding the best approach

🧩 Issue 2.3: Protect LMS routes using Auth0 authentication guard
Use route guards to block unauthenticated access

Redirect unauthorized users to login

📞 3. Link Auth0 Identity to Phone Number for Twilio Users
🧩 Issue 3.1: Store user phone number in Auth0 metadata
Add rule or Action in Auth0 to capture phone number

Ensure it gets added to user_metadata or app_metadata

🧩 Issue 3.2: Implement phone number matching logic for Twilio users
Use Twilio phone number to look up Auth0 user

Return identity or user info if match is found

🧩 Issue 3.3: Implement fallback OTP verification if no match found
Trigger OTP flow via Twilio

On verification success, link number to Auth0 identity

🗂️ 4. Store User Metadata (e.g., Role, Grant History) Securely
🧩 Issue 4.1: Define user metadata schema (role, grants)
Decide on structure for storing roles, history, etc.

Use app_metadata for privileged information

🧩 Issue 4.2: Add/update metadata via Auth0 Rules or Actions
Write a Rule/Action to update metadata at login or registration

Include logic to avoid overwriting critical data

🧩 Issue 4.3: Expose metadata in JWT for downstream services
Modify Rule/Action to add app_metadata to token as custom claim

Use namespaced claims (e.g., https://yourapp.com/role)

[SAUMILDHANKAR]

@a-adeyori
Update: @hzhao1003 is on a break for a week. Please reach out to other mentors for any queries related to this issue. Thanks.

[a-adeyori]

Thank you I will do so

[SAUMILDHANKAR]

Progress Update

1. What did you work on last week?
2. What do you plan do work on next week?
3. Blockers
4. ETA (Expected Time of Completion)

[SAUMILDHANKAR]

@hzhao1003 @a-adeyori

1. Progress update
2. Blockers
3. Availability (numbers of hours this week)
4. ETA (expected time of completion)
5. Picture of blockers

[SAUMILDHANKAR]

@a-adeyori

1. Progress update
2. Blockers
3. Availability (numbers of hours this week)
4. ETA (expected time of completion)
5. Picture of blockers

[a-adeyori]

1. Connected API For login and it is fully working
2. Had errors using Docker and Postgres but has been resolved
3. 5 hours
4. July 18
5. N/A