Feat/id token projects

[Avantol13]

New Features

Breaking Changes

• projects field (user access) removed from id_token for implicit client flow

Bug Fixes

Improvements

Dependency updates

Deployment changes

[github-actions]

This PR contains code that is not formatted correctly according to black. Run black on your code before merging.

Expand the full diff to see formatting changes

--- fence/jwt/token.py
+++ blackened
@@ -374,33 +374,33 @@
         },
         "azp": client_id or "",
     }
 
     if include_project_access:
-      # NOTE: "THIS IS A TERRIBLE STOP-GAP SOLUTION SO THAT USERS WITH
-      #       MINIMAL ACCESS CAN STILL USE LATEST VERSION OF FENCE
-      #       WITH VERSIONS OF PEREGRINE/SHEEPDOG THAT DO NOT CURENTLY
-      #       SUPPORT AUTHORIZATION CHECKS AGAINST ARBORIST (AND INSTEAD
-      #       RELY ON THE PROJECTS IN THE TOKEN). If the token is too large
-      #       everything breaks. I'm sorry" --See PXP-3717
-      if len(dict(user.project_access)) < config["TOKEN_PROJECTS_CUTOFF"]:
-          claims["context"]["user"]["projects"] = dict(user.project_access)
-      else:
-          # truncate to configured number of projects in token
-          projects = dict(user.project_access)
-          for key in list(projects)[config["TOKEN_PROJECTS_CUTOFF"]:]:
-              del projects[key]
-          claims["context"]["user"]["projects"] = projects
-          logger.warning(
-              "NOT including project_access = {} in claims for user {} because there are too many projects for the token\n".format(
-                  {
-                      k: dict(user.project_access)[k]
-                      for k in set(dict(user.project_access)) - set(projects)
-                  },
-                  user.username,
-              )
-          )
+        # NOTE: "THIS IS A TERRIBLE STOP-GAP SOLUTION SO THAT USERS WITH
+        #       MINIMAL ACCESS CAN STILL USE LATEST VERSION OF FENCE
+        #       WITH VERSIONS OF PEREGRINE/SHEEPDOG THAT DO NOT CURENTLY
+        #       SUPPORT AUTHORIZATION CHECKS AGAINST ARBORIST (AND INSTEAD
+        #       RELY ON THE PROJECTS IN THE TOKEN). If the token is too large
+        #       everything breaks. I'm sorry" --See PXP-3717
+        if len(dict(user.project_access)) < config["TOKEN_PROJECTS_CUTOFF"]:
+            claims["context"]["user"]["projects"] = dict(user.project_access)
+        else:
+            # truncate to configured number of projects in token
+            projects = dict(user.project_access)
+            for key in list(projects)[config["TOKEN_PROJECTS_CUTOFF"] :]:
+                del projects[key]
+            claims["context"]["user"]["projects"] = projects
+            logger.warning(
+                "NOT including project_access = {} in claims for user {} because there are too many projects for the token\n".format(
+                    {
+                        k: dict(user.project_access)[k]
+                        for k in set(dict(user.project_access)) - set(projects)
+                    },
+                    user.username,
+                )
+            )
 
     # only add google linkage information if provided
     if linked_google_email:
         claims["context"]["user"]["google"][
             "linked_google_account"

This formatting comment was generated automatically by a script in uc-cdis/wool.

[coveralls]

Pull Request Test Coverage Report for Build 7616

• 5 of 11 (45.45%) changed or added relevant lines in 2 files are covered.
• 1 unchanged line in 1 file lost coverage.
• Overall coverage remained the same at ?%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
fence/oidc/grants/implicit_grant.py	0	1	0.0%
fence/jwt/token.py	5	10	50.0%

Files with Coverage Reduction	New Missed Lines	%
fence/oidc/jwt_generator.py	1	49.06%

Totals
Change from base Build 7612:	0.0%
Covered Lines:
Relevant Lines:	0

---

💛 - Coveralls