API key server logic

[sgratzl]

Prerequisites:

• Unless it is a documentation hotfix it should be merged against the dev branch
• Branch is up-to-date with the branch to be merged with, i.e. dev
• Build is successful
• Code is cleaned up and formatted

Summary

implements the server logic to require API keys and roles for the endpoints.

tasks

• check for api key
• show a soft warning
• show a hard warning
• adapt tests
• create tests
• admin interface?
• [?] log / track api_key + query if allowed
• create basic google form
• connect google form with api server handling -> webhook
• create a basic request a key form: /admin/create_key
• use flask-limited for rate limiting
• setup a Redis DB for shared rate limit tracking
• define a good default rate limit
• consider using Redis DB also for account management instead of SQL server

[sgratzl]

basic admin interface:

/admin/

[sgratzl]

[ ] setup a Redix DB for shared rate limit tracking

@korlaxxalrok heads up we are going to need some kind of redis like database that is accessible from all web server nodes

[korlaxxalrok]

@sgratzl What URL will we expose the admin interface at?

[sgratzl]

@sgratzl What URL will we expose the admin interface at?

so far the plan is on delphi.cmu.edu/epidata/admin/ which is connected to the master database. Thus, when you edit users it should get replicated to the other databases.

[korlaxxalrok]

@sgratzl Re Redix DB. Can we use Redis?

[sgratzl]

@sgratzl Re Redix DB. Can we use Redis?

lol. I should watch out more for typos. Sure, it should be a Redis-compatible database. see also https://limits.readthedocs.io/en/latest/storage.html#storage-scheme

[krivard]

superceded by #1061