feat/arborist-sync

[rudyardrichter]

Improvements

• Update user sync for compatibility with changes to arborist.
  • Policies now owned by arborist
  • Arborist needs (read-only) copy of users.

Breaking Changes

• Intended to work only with arborist >= 2.0 (using new database). Won't work with older arborist API.

[PlanXCyborg]

This PR contains code that is not formatted correctly according to black. Run black on your code before merging.

Expand the full diff to see formatting changes

--- fence/__init__.py
+++ blackened
@@ -15,11 +15,11 @@
 from fence.oidc.server import server
 from fence.rbac.client import ArboristClient
 from fence.resources.aws.boto_manager import BotoManager
 from fence.resources.openid.google_oauth2 import GoogleOauth2Client as GoogleClient
 from fence.resources.openid.microsoft_oauth2 import (
-    MicrosoftOauth2Client as MicrosoftClient
+    MicrosoftOauth2Client as MicrosoftClient,
 )
 from fence.resources.openid.orcid_oauth2 import OrcidOauth2Client as ORCIDClient
 from fence.resources.storage import StorageManager
 from fence.resources.user.user_session import UserSessionInterface
 from fence.error_handler import get_error_response

--- tests/data/test_data.py
+++ blackened
@@ -605,12 +605,13 @@
     )
     response = client.get(path, headers=headers, query_string=query_string)
     assert response.status_code == 403
 
 
-def test_initialize_multipart_upload(app, client, auth_client, encoded_creds_jwt, user_client):
-
+def test_initialize_multipart_upload(
+    app, client, auth_client, encoded_creds_jwt, user_client
+):
     class MockResponse(object):
         def __init__(self, data, status_code=200):
             self.data = data
             self.status_code = status_code
 

This formatting comment was generated automatically by a script in uc-cdis/wool.

[Avantol13]

Should say this is a breaking change if you're using arborist <{{new version with db}}, there's a heading for that in the PR description template. it's not really a breaking change to fence, but we should make it obvious this will not work with old arborist somehow in the release notes. Also, do you know why jenkins didn't run integration tests?

P.S. will look through actual code code in a bit :P

[Avantol13]

I think we want to keep these in the id token, right? just remove from access token?

[rudyardrichter]

I think we want to remove all the policies from everything; they can be retrieved from the user info endpoint now

[Avantol13]

was looking through code, seems like _parse_yaml from UserSyncer isn't called from anywhere, can we remove?

made fixes