Add authorization scriptlet

[bensmrs]

Closes: #188

[bensmrs]

Some context is needed for a few changes.
Scriptlet code refactoring was done to avoid dependency cycles, as the instance placement scriptlet interacts with the cluster, which checks authorization, which in turn now uses a scriptlet. So (un)marshalling and log functions are now in their own packages, and the authorization scriptlet also gets its own package.
Authorization code refactoring was done so that the authorization scriptlet can have access to required struct fields, and also to break a dependency cycle.
The rest should be straightforward.

[bensmrs]

I don’t really get why the code checks are failing, the errors are not something my knowledge of Go allows me to decipher :)

[stgraber]

Alright, got all the tests to behave. Now I can actually review this PR :)

[bensmrs]

Nice!
Btw, even if one of my comments/reviews is marked as outdated, it’s very much not :)

[stgraber]

Looks pretty good to me!
I'll do a more detailed pass later, going commit by commit as for this pass I just looked at the overall diff.

What we still need to add to this are two commits:

• api: authorization_scriptlet
• doc/authorization: Add authorization scriptlet

[stgraber]

With this change I'm getting pretty tempted to rename openfga.* to authorization.openfga.* but we'll possibly do that a bit later as I have nagging feeling we'll want to do the same with loki.* when we start adding some more options for logging too.

[bensmrs]

Hi! Does it help if I rebase the PR?

[stgraber]

Yeah, that'd be quite useful, thanks!

[bensmrs]

There you go. I started freaking out when I saw changes to the OpenFGA driver, but it wasn’t that dramatic in the end.

[stgraber]

Looking good.

On the details part, I don't think we want to expose a whole RequestDetails to the scriptlet as the forwarded pieces are confusing and shouldn't be handled by the scriptlet.

Instead we should expose a script which just includes:

• Protocol string
• Username string
• Project string
• AllProjects bool

And have the username and protocol be pre-expanded as is done in username and authenticationProtocol.

[stgraber]

Looks good, just a capitalization nit left ;)

It's nice that the test uses OIDC, makes it easier to try multiple users.

[bensmrs]

It's nice that the test uses OIDC, makes it easier to try multiple users.

It was actually a mix of “I don’t want to generate certificates and pass them cleanly to Incus” and ”Oh! The tests make it sooo easy to use OIDC”, combined to “I prefer to use explicit user names in the tests”.
Kudos for all the very useful helper functions!

[bensmrs]

Hey! all these rebases are starting to become quite boring :D

[stgraber]

Thanks for the great work!