ODCR: set up API keys and API Authn/Authz model

sergei-maertens commented 2 months ago

The publication component and citizen portal will consume the registration API. For this, they need to authenticate using an API key.

Tasks

~~Define two roles: publication_component, citizen_portal~~ SCRAPPED
- publication component implies read + write of all data
- citizen portal implies read of published (!) data only
[x] Define data model + set up admin for API Key, similar to objects API
- API key, (securily) randomly generated string
- Contact person name, phone + email address (optional fields)
- Roles to apply, which is one or more of the two roles above (simple ArrayField should suffice)
[x] Define DRF authentication class
- Authenticate based on the API key in the request header Authorization: Token <key>
- This is the only allowed authentication class (so don't expose/enable BasicAuth, TokenAuth, SessionAuth...)
- Must be properly documented in the generated API schema
[x] Define permission classes for read/write permissions, which are inferred/taken from the roles associated with the API key

MarcoKlerks commented 1 month ago

Geen acceptatie criteria gedefinieerd. Dit is te technisch voor mij om daar meer zinnigs over te zeggen dan de gebruikelijke open deuren.

sergei-maertens commented 1 month ago

For now put this behind a feature flag (envvar) ENABLE_API_AUTH, default enabled.

mstokericatt commented 1 month ago

Na implementatie kan "ODPC: calls naar het ODRC authentiseren" #66 gerealiseerd worden.

MarcoKlerks commented 4 weeks ago

De hashtag-link in de vorige mention verwees niet naar de juiste story, want andere repository. De juiste link is ODPC #66.

sergei-maertens commented 1 week ago

Needs to be tested on our deployed instance, and for that it needs to be deployed first :)

MarcoKlerks commented 1 week ago

Ik kan dit niet functioneel testen. @felixcicatt , kun jij hier even naar kijken?

GeneriekPublicatiePlatformWoo / registratie-component