Research User Architecture Design¶

// ResearchUser represents the research identity for a profile
type ResearchUser struct {
    // Core identity (per-profile, not global)
    ProfileID    string `json:"profile_id"`    // Links to Profile.AWSProfile
    Username     string `json:"username"`      // Research username (e.g., "alice_researcher")
    UID          int    `json:"uid"`           // Consistent UID across all instances
    GID          int    `json:"gid"`           // Consistent GID across all instances

    // Identity verification
    GlobusIdentity *GlobusIdentity `json:"globus_identity,omitempty"` // Optional Globus Auth
    EmailVerified  bool            `json:"email_verified"`            // Email verification status

    // SSH key management (per-profile)
    SSHPublicKey  string `json:"ssh_public_key,omitempty"`  // Research user SSH key
    SSHKeyPath    string `json:"ssh_key_path,omitempty"`    // Local private key path

    // Research environment preferences
    Shell         string            `json:"shell,omitempty"`         // Default: /bin/bash
    HomeDirMount  string           `json:"home_dir_mount,omitempty"` // EFS mount for home directory
    Groups        []string         `json:"groups,omitempty"`         // Additional groups (docker, etc.)

    // Metadata
    CreatedAt     time.Time `json:"created_at"`
    LastUsed      time.Time `json:"last_used"`
    DisplayName   string    `json:"display_name,omitempty"` // From invitation or Globus
}

// GlobusIdentity represents optional Globus Auth integration
type GlobusIdentity struct {
    GlobusID     string `json:"globus_id"`      // Globus user identifier
    ORCID        string `json:"orcid,omitempty"` // ORCID if linked
    Institution  string `json:"institution,omitempty"` // Institution from Globus
    Email        string `json:"email,omitempty"` // Verified email from Globus
    VerifiedAt   time.Time `json:"verified_at"` // When Globus verification completed
}

// Extension to existing Profile struct
type Profile struct {
    // ... existing fields ...

    // Research user identity (new fields)
    ResearchUser   *ResearchUser `json:"research_user,omitempty"`   // Research identity
    RequireGlobus  bool          `json:"require_globus,omitempty"`  // Globus Auth required

    // Home directory management
    EFSHomeDir     string        `json:"efs_home_dir,omitempty"`    // EFS filesystem for home
    HomeDirectory  string        `json:"home_directory,omitempty"`  // Home directory path
}

// Extension to existing InvitationToken
type InvitationToken struct {
    // ... existing fields ...

    // Research user requirements
    RequireGlobusAuth    bool     `json:"require_globus_auth,omitempty"`  // Globus Auth required
    AllowedInstitutions  []string `json:"allowed_institutions,omitempty"` // Institution whitelist
    RequiredORCID        bool     `json:"required_orcid,omitempty"`       // ORCID required

    // Research user provisioning
    DefaultUsername      string   `json:"default_username,omitempty"`     // Suggested username
    DefaultShell         string   `json:"default_shell,omitempty"`        // Default shell
    AdditionalGroups     []string `json:"additional_groups,omitempty"`    // Extra groups
}

// GlobusAuthClient handles OAuth integration
type GlobusAuthClient struct {
    ClientID     string
    ClientSecret string
    RedirectURI  string
    Scopes       []string // ["openid", "profile", "email", "urn:globus:auth:scope:auth.globus.org:view_identities"]
}

// InitiateAuth starts Globus OAuth flow
func (g *GlobusAuthClient) InitiateAuth() (*AuthSession, error) {
    // Generate state parameter for CSRF protection
    state := generateSecureState()

    authURL := fmt.Sprintf(
        "https://auth.globus.org/v2/oauth2/authorize?response_type=code&client_id=%s&redirect_uri=%s&scope=%s&state=%s",
        g.ClientID,
        url.QueryEscape(g.RedirectURI),
        url.QueryEscape(strings.Join(g.Scopes, " ")),
        state,
    )

    return &AuthSession{
        AuthURL: authURL,
        State:   state,
    }, nil
}

// ExchangeAuthCode exchanges authorization code for tokens
func (g *GlobusAuthClient) ExchangeAuthCode(code, state string, session *AuthSession) (*GlobusIdentity, error) {
    // Verify state parameter
    if state != session.State {
        return nil, fmt.Errorf("state mismatch - possible CSRF attack")
    }

    // Exchange authorization code for access token
    tokenResp, err := g.exchangeCode(code)
    if err != nil {
        return nil, err
    }

    // Get user info from Globus Auth
    userInfo, err := g.getUserInfo(tokenResp.AccessToken)
    if err != nil {
        return nil, err
    }

    return &GlobusIdentity{
        GlobusID:    userInfo.Sub,
        Email:       userInfo.Email,
        Institution: userInfo.Organization,
        ORCID:       userInfo.ORCID,
        VerifiedAt:  time.Now(),
    }, nil
}