Auth revamp

[MasterKenth]

New auth (Authentication + Authorization) system. Major points:

• De-coupling and interfacing of authentication (login) and authorization (still uses part of old system for now)
• Enable API-keys (loginless endpoint security)
• Cleaner endpoint code for enabling auth
• Using the new provided auth decorator, automatically handle auth-related results (400/401/403), with documentation for OpenAPI docs

Decorator

New decorator is opt-in. Create an object that wraps an existing APIRouter instance:

router = APIRouter(
    prefix="/api/auth",
    tags=["Auth Test"]
)
auth = AuthRouterDecorator(router)

Then substitute @router.X with @auth.X:

@auth.get(
    '/test',
    ['can_ask_questions'],
    summary='Test authentication/authorization endpoint',
    description='''This endpoint does nothing except showcase how auth endpoints work. 
    
It also serves as a code example of how to implement an endpoint with auth (see source code).''',
    response_model=AuthTestReturnModel,
    response_description='Success. Returns the authentication details.'
)
async def auth_test(auth_identity: AuthenticatedIdentity):
   ...

The second positional argument is the list of "scopes" (permissions) required for the endpoint.

Not all parameters of the @router decorator is exposed, but they can easily be added as needed in the future.

Optional auth_identity argument to endpoint function can be used to extract the identity for further use (similar to use cases of get_project_user from old code).

Authentication

Bearer tokens (users)

For now, user authentication uses the same system and login procedure as before (jwt bearer token through either a cookie or the WWW-Authenticate header).

API keys

API-keys can be provided to endpoints with the X-Api-Key header, e.g. X-Api-Key: fai-abcdef....

API keys can be created/list/revoked through the new API key CRUD api at /api/auth/apikey. Managing API keys requires the can_manage_api_keys scope.

After the results of the initial create call (POST /api/auth/apikey) the actual API key is never exposed again. Instead a key can only be revoked by using its revoke_id which is also provided in the result of the create call.

TODO/future

• Limit scopes an API key can be created with to a subset of the scopes available of the calling identity DONE
• Store hashed API keys in database instead to further limit possible exposure
• Adopt for endpoints
• Improve de-coupling of the implementation of IAuthorizationProvider