Create proposal for new shared_list synchronization

[lentschi]

• Current algorithms using direct db sync should be discarded.
• Replacement:
  • One way sync (sharedlists -> foodsoft) through JSON-Get endpoint in foodsoft itself instead of an external application (providing a continuation point logic on later requests)
  • Synchronize view where users can modify data to be imported should remain the same (except for extending the fields to match the new article fields of course):

[lentschi]

@paroga Since we now decided to use a JSON API interface instead of direct database access to handle supplier sharing:
How should we handle authentication/permissions for this interface?
My suggestion for a first version: Let's add a "Share" button (maybe somewhere on the Supplier show view). When pressed it generates a unique link that can be shared with any other foodcoop e.g. https://app.foodcoops.at/someFoodCoop/423789472eeea12.json which can be manually forwared to the admins of another foodcoop. With this link no additional extra auth headers would be required. Whenever the link is regenerated, the previous access is implicitly revoked.

Of course, what would be missing, is a way to provide a kind of central instance of foodsoft (replacing the shared_lists app), from which a foodcoop could retrieve a list of suppliers ready for import. We could have another API endpoint for the list (maybe in this case via API key) and configure this central instance via optional env variables.

What do you think?

[lentschi]

Also, I just noted, there's the ancient open issue foodcoops/foodsoft#396