(api) Implement scopes

[Leobouloc]

STALE BRANCH, PR KEPT OPEN FOR REFERENCE

Purpose

Currently, the API has no restriction to the data / endpoints available. All authenticated users have unlimited read and write access, through all endpoints. The purpose, of this PR, (initiated by #288) is to add security mechanism including scopes and permissions. The xAPI specification suggests these scopes.

NB: The term "scope" is used losely, as the authentification mode (for now) is Basic Auth ("scope" is usually used in the context of OAuth). We use the term in a similar sense but applied to a user. (eg. "a user has the right to access scope /statements/read/mine").

Proposal

Adding scopes is relatively straightforward except for the scope /statements/read/mine, which requires to add a notion of belonging to the statements being stored. This notion is covered by the xAPI specification under the name "Authority", which is a field that SHOULD be created by the LRS upon receiving statements and populated with the requesting user account information. This authority field may then be used to filter incoming queries and/or results.

The proposed solution (a first pass) includes pre-processing the data to add "Authority", implementing scopes, and adding a permissions mechanism which forces user to query using an authority field, when the broadest scope available is /statements/read/mine.

The proposed pre-processing also handles annex LRS conformity issues, by adding to the statements the fields timestamp, stored and id (when not present).

Description...

• Add statement pre-processing on POST and PUT for timestamp, stored, id
• Test pre-processing for timestamp, stored, id for PUT
• Test pre-processing for timestamp, stored, id for POST
• Refactor endpoint tests to work with pre-processing (GET, POST, PUT)
• Test new helper functions in utils
• Add authority to databases and query statements
• Decide whether or not to authorize same authority for different users
• Test querying by authority
• Add statement pre-processing on POST and PUT for authority (separate as it is a more complex issue)
• Test pre-processing for authority for POST
• Test pre-processing for authority for PUT
• Add "scope" (see above) mechanism to auth, to restrict access to endpoints
• Test "scope" mechanism (especially test permissions vulnerabilities)
• Add permissions mechanism to get
• Test permission mechanism
• Update CHANGELOG

[Leobouloc]

Stale branch. See:
#441