Myinfo v5 support - new Singpass userinfo endpoint and flows

[cflee]

Is your feature request related to a problem? Please describe.

("new Myinfo" and "Myinfo v5" seem to refer to the same thing)

In the new Singpass API, there appears to be a few changes to how Myinfo works:

1. more scopes on auth authorise endpoint
2. consent screen during Singpass logins when requesting sensitive data
3. new userinfo endpoint that allows retrieving Myinfo data using the access token (from the token endpoint)

(^ This might be slightly inaccurate, I only did one quick pass through the docs and the briefing slide deck, but I believe there's definitely a new endpoint and new scopes)

This new setup seems to be the way forward from Myinfo v3 (Gov) and Myinfo v4 (non-Gov).

• Myinfo v3 (Gov) decommission date isn't known yet, but likely will be "at least 1 year" from late 2024?
• Myinfo v3 (non-Gov) will be decommissioned "by 30 Jun 2025".
• Myinfo v4 (non-Gov) will be decommissioned "by 31 Dec 2025".
• New Myinfo (non-Gov) integrations already cannot use v3/v4 and must use the new setup

So there might be more demand for this soon. There were previous queries about Myinfo v4 (non-Gov), see #644

References:

• Briefing slide deck, Q&A, recording: https://partnersupport.singpass.gov.sg/hc/en-sg/articles/39996163746585--18-Nov-2024-Singpass-Onboarding-Resumption-Briefing-Materials-Available
• Developer docs: https://docs.developer.singpass.gov.sg/docs

Describe the solution you'd like

MockPass to support the new flows/endpoints for the new Singpass API

Describe alternatives you've considered

There is now a set of Myinfo Test Personas published, presumably using the username/password login to the new Myinfo (not Myinfo v3) Test environment: https://docs.developer.singpass.gov.sg/docs/testing/myinfo-test-personas
However, that would not allow customising the data to facilitate test scenarios.
There is a note in the briefing slide deck – "Future State: Self management of Myinfo test accounts."
If it's easy and instant to onboard to Myinfo Test environment in future, and use username/password to login, clients potentially could use that directly if outbound internet access is OK.
However, if that still requires a Corppass login, that might still present a barrier to developers, and MockPass might still be of use.