Feat/arborist2

[paulineribeyre]

• Use Arborist + gen3authz for auth requests
• Deprecate sheepdog's "admin" role which was used on the delete endoint: having the "delete" permission in arborist is enough
• Make all "file_operations" endpoints require admin access
• Unit tests:
  • Mock calls to gen3authz in unit tests
  • Remove project_access from the test user tokens
  • Remove the member fixture (only keep submitter and admin) since authorization doesn't depend on project access in the token anymore

TODO:

• use gen3authz package when it's on pypi
• automatically create program/project resources in arborist

TODO later:

• Deprecate the "admin" field of the token and replace it by arborist logic (PXP-4102)
• If/when gen3authz supports the authz provider parameter, use it in sheepdog so that resources persist

Closes #297

New Features

• Program and project creation automatically creates resources in arborist

Breaking Changes

• Use Arborist + gen3authz for auth requests

Dependency updates

• Add gen3authz dependency for auth requests

Deployment changes

• Optional configuration variable ARBORIST (arborist base URL)
• Requires Arborist to be deployed

[paulineribeyre]

Note: sheepdog used to check if the user had either "admin" or "delete" to allow deletion. With this update, users who have "admin" but not "delete" can't delete

[vpsx]

This code is not actually mocking GET in general, but rather the auth_request method in specific, so the names mocked_get and patch_get seem a little misleading. Since this fixture is explicitly intended for mocking auth_request only (per the docstring), and since the HTTP method being used doesn't actually affect the mocked response coming out of make_mock_response, these could be renamed to be auth_request specific?

[vpsx]

I think this can be unrolled? (response and make_mock_response)
Can just use response instead of make_mock_response() below since the mock only depends on authorized

[vpsx]

🎉

[vpsx]

Just curious but why? 😅

[paulineribeyre]

"JWTSizeError" is only defined in fence, i think that's a leftover from when you removed the fence dependency from the tests

[vpsx]

oooo, derp thanks!

[vpsx]

Wait, how come this doesn't need to mock_arborist_requests()?

Also: I think, if you want, you can avoid this code duplication by keeping the parametrization but adding another parametrized argument, bool mock_arborist or something, and then mocking arborist in the test based on that value. But probably I'm just missing something here...

[paulineribeyre]

the arborist_authorized fixture is in autouse so by default, mocked arborist requests return True

[vpsx]

Yay thanks!! 😍