API Token Management

[dabeeeenster]

At the moment, to use the rest API, user's must use an API token associated with a user. We should add the ability to create API tokens scoped to allow access to the relevant resources.

[matthewelwell]

The first step here is to create a 'Role' entity which can then be attached to a User, Group or an API token.

[matthewelwell]

@kyle-ssg one thing that we've discussed as part of this is having a single view of the permissions across all entities for a Role (which we can extend to use for Users / Groups too). So we would need a panel for Org, Projects (with a drop down to select the project perhaps?), Environments (with a drop down to select the env perhaps?).

Does that sound feasible?

[gagantrivedi]

Since we don't want the tokens to be associated with the user, we have ruled out using rest_framework.authtoken.models.Token
Now, the next in line is rest_framework_api_key.models.AbstractAPIKey (also used as terraform/master API key)

There are a couple of things we can do here:

1. Keep the terraform key model as it is and create another model for the new token that we are discussing

2. Add support for adding roles to the master API keys,
   Now, to not break the public API:

   i. create a role with terraform permissions and add that to all the existing master API keys that we have and start calling them something other than terraform API keys

   ii. Let the old key behave as they currently do, but as and when we add a new resource to our terraform provider (and if that needs new permissions) the user will need to attach the role with those permissions to access them

I am leaning more towards 2(i)

[dabeeeenster]

Agree with 2

[matthewelwell]

Yep, also agree with 2(i)

[gagantrivedi]

The backed part of roles was added here: #2232

[novakzaballa]

As per our conversation in this regard, I will first create a couple of UI/UX designs for Role management at the Organisation Management level either in a new Roles tab or under the existing Manage Users and Permissions tab

[novakzaballa]

@matthewelwell @kyle-ssg here are the UI designs for roles management:
These screens will be displayed under Organization Management:

Roles list:

Edit role:

Role permissions:

[matthewelwell]

Needs FE work still.