v3.0.0: Site roles, program authz, user authz

[daisieh]

v3.0.0: Site roles, program authz, user authz

• Site roles, including site admin, now defined in Opa
• Program authorizations are defined in Opa's vault secret store
• User-specific program authorizations are defined in Opa's vault secret store
• Refactored rego policies and created unit tests

• Tagged as a release in this repo
• Passes integration tests on a development instance
• Images pushed to Dockerhub

[kcranston]

Thanks for this! Couple of questions:

• for data ingest workflow, how does the Program data get created in opa? Would the user uploading a new Program have a site curator role which allows for adding new Program data, or does ingest do this on the user's behalf using a service token? Or does a system admin need to create the program before a curator can upload data?
• is there a sister PR with new integration tests for these changes? or a ticket with the integration tests that should be written?

[daisieh]

Documentation for the ingest workflow was added in CanDIG/candigv2-ingest#93. When ingesting a Program Authorization for the first time, Opa needs the user to be someone with permission to ingest any program for the site. At the moment, the only site role for that is Admin, but in future, we could add a site-curator role that would be allowed to do this as well.

If the Program Authorization has not been ingested before data is ingested, the only user that would be allowed to ingest data for that program is the site admin. If the site admin adds the Program Authorization first, any listed program curator in the Program Authorization would then have the authz to ingest data.

Integration tests were added in CanDIG/CanDIGv2#550, which was the sister PR to #52 and CanDIG/candigv2-ingest#80.