SSO, test additions, database work, ASGI middleware, and more

[aholmes]

This massive PR contains the work required to finish the CAP migration. That includes components for SSO, database migrations, ASGI, SSM, users/roles, sessions, integration between Flask and Connexion, various middlewares, and so on.

Dan and I will go over this PR in person and review the dark corners.

[dan-knight]

Based on our discussion/review in person this looks good to me. A few notes:

• I like the move to Config classes. We already see benefits when setting up the test environment(s).
• A lot of this functionality is consistent with CAP (if not directly lifted from CAP).
• We may revisit feature flags in the future. The tests look good to me, but we're not yet using the feature as extensively as we likely will in the future. So far, we're focusing on storing feature flags in the database. I wonder if we might need to extend this in future to allow other methods of handling feature configuration. Way outside the scope of this PR.

[aholmes]

• A lot of this functionality is consistent with CAP (if not directly lifted from CAP).

Much is lifted from CAP, but has either been modified to fit into BLP or to allow more generic uses.

• We may revisit feature flags in the future. The tests look good to me, but we're not yet using the feature as extensively as we likely will in the future. So far, we're focusing on storing feature flags in the database. I wonder if we might need to extend this in future to allow other methods of handling feature configuration. Way outside the scope of this PR.

Definitely. The base classes are extendable, so it should not be difficult to at least get started with this.

[aholmes]

Approving with Makefile updates for MacOS. make dev runs correctly for me, creating the virtual environment in the correct place with the correct Python 3.10.x version. make does not automatically find the target, but I think it's reasonable to just run make dev for now.

Cool. I still need to figure out some problem that doubled CI/CD runtimes, but I'm glad this works now.