Is a "magic link" a kind of authentication?
Yes, it is.
It authenticates the user; similarly to reciting a password, calculating a TOTP/HOTP, dipping a possessed smartcard, or presenting a fingerprint, "reading an e-mail inbox" (and thus "clicking a link in an e-mail sent to it") is an ability strongly associated to a particular user.
The emphasized text above may seem like a bold assumption, and it is: for this reason, many services (especially ones that handle money from their users) will put verbiage in their ToS that the user explicitly represents this association, to help give the site legal leverage/slack in cases where the user claims "I didn't do that; my roommate / romantic partner / etc. did".
E-mail can also serve as an authorization channel, if already regarded secure enough for use as an authentication channel. For example, an e-mail that includes an attestation like "click here if you're really trying to add a new device / share this folder / change these settings / grant this 3rd-party app access to your account / etc" would be an instance of "magic link"-based authorization.
However, "magic links" (both for authentication and authorization) are increasingly regarded as an unsafe practice because their use normalizes "clicking on links in e-mails" to the end users. If they can do something by clicking on a link in an e-mail, they could just as well do it through the site or program's interface—such as by entering an alphanumeric one-time code—without increasing their long-term exposure to phishing and CSRF attacks. (There are a few arguable exceptions, such as when more complex attestations—such as solving a CAPTCHA or presenting cookies from an existing log-in—are thought to be appropriate to require from the device on the network which is accessing the e-mail, but, broadly speaking, you should reconsider "magic links" per se in favor of pure authentication codes that don't require "clicking" anything.)
How safe it is to validate only the possession factor of authentication. Anyone who knows my email can request sign-in link on my behalf. / Can this be [safely] used with public emails like gmail, yahoo?
If you already treat e-mail as confidential enough to be a single-point-of-failure for drastic account changes like a password reset, it's obviously no less secure to also allow it for less impactful actions like dispensing single authentication tokens.
If you can't assume your users have a secure e-mail account, you're somewhat SOL without meatspace- or legal-process-based identity verification, though properly implemented 2FA options can greatly mitigate this.
If this is considered a form of authentication, can it be compared to the authorization_code authorization grant in OAuth? With the unique code in the magic link compared to the authorization_code?
The comparison is very strong, but (details aside) there is one big structural difference:
- An OAuth
authorization_code is generated by the identity provider (e.g. Google/Microsoft/Apple/Facebook), who gives it to the resource owner (end user), who gives it to the relying party (independent site) as authentication.
- An SMTP "magic link" is generated by the relying party (independent site), who gives it to the identity provider (mail server), who gives it to the resource owner (end user), who returns it to the relying party as authentication.
