Authentication, authorization and user management

[marpaia]

Work in progress implementation of authentication, authorization and user management APIs.

TODO

• Implement ViewerContext as a nice API around accessing the authorizations of the active user
• Add sessionization via middleware
• Use JWT to store the current user's user_id in the current session
• Add helpers around creating in-memory test databases to be used during testing
• Allow sessions to be perpetually reloaded and potentially never expire
• Login endpoint which validates credentials and augments the session to include JWT token
• Error management API to make delivering errors to the user easier
• Create user endpoint (PUT /api/v1/kolide/user)
• Modify user endpoint (PATCH /api/v1/kolide/user)
• Delete user endpoint (DELETE /api/v1/kolide/user)
• Get user info endpoint (POST/api/v1/kolide/user)
• [ ] Password reset endpoint (POST /api/v1/kolide/user/password/reset)
• Password update endpoint which hashes (PATCH /api/v1/kolide/user/password)
• Endpoint to allow the modification of admin settings on an account (admin, enabled)
• Add needs_reset field to user struct
  • [ ] Integrate needs_reset into user management endpoint
• Integrate user.Enabled into authorization checks
• [ ] Implement MySQL backing store with new sessions table
• [ ] Add admin APIs for managing the sessions in the database
  • [ ] Delete all sessions for a user (DELETE /api/v1/kolide/user/session)
  • [ ] Delete a single session for a user (DELETE /api/v1/kolide/user/session/{id})
• [ ] Go through cookie settings and set modern security flags
• [ ] Write integration tests for the full login and user management flow
• Write methods for managing DB handlers
  • Ensure test databases can be injected during the execution of tests and benchmarks
• [ ] Write a benchmark for JWTRenewalMiddleware
• [ ] Write tests for JWTRenewalMiddleware
• [ ] Write deeper tests for SessionMiddleware that stress the failure to set a session and calling GetSession after that
• [ ] See if there's a better way to cast claims['user_id'] into a uint other than type asserting it as a float64 first

[zwass]

Maybe we should check the error and then return nil for *User if there was an error?

[zwass]

Do we need a mechanism for expiring sessions (besides timeout which is implemented here)?

[zwass]

As discussed, let's look into this random generation.

"Let's unfuck this"

[marpaia]

This will be addressed in #19