User Management Improvements

[ahayes]

Nunaliit currently depends on CouchDB's _users database for storing details of atlas user accounts. These include display names, authentication credentials (password hashes), email addresses, and Nunaliit-specific role attributes. In current versions of CouchDB, access to this _users database has had additional restrictions placed on it that broke the old model for Nunaliit atlas administrators to access and modify user documents to reset passwords and alter atlas roles.

There is a need for atlas administrators to manage users without having the skills or trust required to be full CouchDB admin users.

A review of Nunaliit's current client-side and server-side user creation and management workflows needs to be undertaken and a plan devised to restore user complete user management capability for atlas administrators to the codebase.

[billingb]

Currently these calls go through a simple proxy that the Nunaliit servlet uses to pass traffic to the CouchDB instance. After discussion today with @ahayes we decided to create new endpoints for each identified request to check if the user has permissions and then use escalated permissions to connect and modify CouchDB data as needed. The new code to check permissions and connected with elevated permissions should be made as generic as possible for future use cases.

[billingb]

@ahayes I thought that we could just replace the API calls on the frontend with calls to a new endpoint. Unfortunately there are multiple large (over 1000 line files) classes that are tightly coupled to CouchDB that do the lookahead, text search and results for the tools page. After spending a couple days look thought all of these files to try to get a handle on modifying them I'm now evaluating if we should try to modify those files, or if we need replace all of that code with a separate new implementation that relies on an API instead of CouchDB.

[billingb]

I have figured out how to have the API endpoint work with auth checks and have a prototype in place for the first API endpoint (searching users). Will need to add additional endpoints and improve this one, but it is a start. Now need to revisit the UI and the question of using current code or writing new code to use the new endpoint.

[ahayes]

Super! Let's discuss this afternoon.

[billingb]

@ahayes Figured out searching and listing users in the frontend using the new backend API. Moving on to testing all other functions and seeing what works. I just realized today that I'm doing all this work against CouchDB 3.x because I work on newer Ubuntu now and don't have CouchDB 2.x. I don't know if we will see the same behavior on CouchDb 2.x.

[ahayes]

Excellent. We'll have to test on CouchDB 2.x but if it doesn't work there then I'd suggest that between this and the jQuery upgrade uncertainty, we might have to prepare for a Nunaliit 2.3 release with revisions and big pointers to our changes and upgrades documentation.

[ahayes]

Preliminary testing on CouchDB 2.x by @billingb and @ahayes appears to show no problems. I have reached out to the users who requested the feature to go through some additional training and testing with it.

[billingb]

Reviewed and updated docs. PR submitted.