EPIC: Unified Auth and RBA across all AKD resources

Gemini-based EPIC creation

What

This epic tracks the unification of Authentication (Auth) and Role-Based Access Control (RBAC) across the Accelerated Knowledge Discovery (AKD) ecosystem by migrating AKD Labs (alpha) to the existing authentication mechanism used by AKD Flow (beta).

Currently, AKD Labs uses a barebones, independent JWT implementation with a separate database, while AKD Flow utilizes a more robust identity provider (e.g., Keycloak/OIDC). To eliminate these silos, AKD Labs will deprecate its standalone auth and integrate directly with Flow's authentication provider and database, establishing a single source of truth for all AKD resources.

Why

• Reduce Tech Debt: Maintaining a separate, custom JWT implementation and independent database for Labs duplicates effort and slows down development.
• Seamless User Experience: Users should not need separate credentials or sessions when moving between AKD Flow pipelines and AKD Labs experimental features.
• Security & Scalability: Adopting Flow's existing auth provider provides a more secure, standardized, and scalable foundation compared to maintaining a barebones custom solution.
• Unified Authorization: We need to ensure that specific access roles in Labs (such as admin, dev, chat user) map directly to and are managed by the unified RBAC schema in the main auth provider.

How

1. RBAC Mapping: Audit the specific roles currently used in AKD Labs (admin, dev, chat user, etc.) and map them into the existing role schema in Flow's auth provider.
2. Database Migration: Create a migration path for existing AKD Labs users, moving their accounts and permissions from the independent Labs database into the unified auth database.
3. Labs Refactoring: Strip out the custom JWT generation and validation logic in the AKD Labs backend and frontend.
4. Integration: Implement the standard auth client (used by Flow) into AKD Labs to handle login, session management, and role verification.

Tentative Checklist

Discovery & Planning

• Document the exact auth architecture currently used in AKD Flow (provider, token structure, etc.).
• Map existing AKD Labs roles (admin, dev, chat user) to Flow's RBAC system.
• Define the data migration strategy for moving Labs users to the unified database.

Implementation

• Provision/configure the existing auth provider to accept AKD Labs as a valid client.
• Execute user data and role migration from the standalone Labs database.
• Refactor AKD Labs API to remove legacy JWT auth and validate tokens from the unified provider.
• Update AKD Labs frontend to redirect to the unified login and handle standard token storage.

Testing & Rollout

• Verify End-to-End (E2E) SSO across both AKD Flow and AKD Labs.
• Test RBAC enforcement in Labs to ensure admin, dev, and chat user restrictions function correctly under the new system.
• Create necessary sub-issues for frontend/backend implementation.
• Deprecate and drop the legacy AKD Labs user database.