Feature/app api access

[michaeljcollinsuk]

📝 Summary

This PR contains implementation of ministryofjustice/analytical-platform#5777

These changes will allow app admins to create a machine to machine Auth0 client that use the client credential grant flow to retrieve an access token for the Control Panel API. More details about m2m authorization via Auth0 can be found here https://auth0.com/blog/using-m2m-authorization/.

When a machine-to-machine client is created, it is granted specific permissions that only allow it access specific app-related endpoints. Apps will have access to endpoints that will allow them to:

• Retrieve details about their app
• List app customers
• Add app customers
• Delete app customers

The permissions that are granted to the M2M apps have been created manually in the auth0 dev tenant, for the Control Panel localhost and dev API applications. These will need to be added to the alpha auth0 tenant before deploying to production.

Merging this PR will have the following side-effects:

• Opens up the Control Panel API to programatic use for the first time
• Number of Auth0 clients could increase by up to 2x the number of apps (if all app owners decided they wanted control panel API access)

🔍 What should the reviewer concentrate on?

• Creation of the machine-to-machine client via the manage app page
• Obtaining and rotating client secrets
• Using the provided client credentials to retrieve an access token and make successful requests to the Control Panel API
• The details provided from each endpoint

🧑‍💻 How should the reviewer test these changes?

• In your local .env file, change or add OIDC_CPANEL_API_AUDIENCE to "control-panel-localhost". This ensures that when the M2M client is created, it is granted permissions for the localhost API application in auth0, rather than the dev application.
• Run control panel locally
• You will need to have an app registered within control panel - register one if you don't already have one
• Visit the manage app page, and scroll down to the Machine-to-machine API Access section
• Use the button to create the M2M client. Store the provided credentials somewhere secure.
• You then need to use these credentials to obtain an access token via Auth0. See the docs with code examples - I like to use Postman for testing API's so you may want to try this.
• When making the request to obtain an access token, along with your client credentials, ensure you set you will need to:
  • Use the dev tenant url
  • Use "client_credentials" grant type
  • For the audience, pass "control-panel-localhost". This is the identifier of the Control Panel local API application you can find in Auth0
• When you have successfully retrieved an access token, you are ready to test the API endpoints. Only views/viewsets that use the AppJwtPermissions should be accessible.
• When testing, make sure that you have the app running locally use the localhost domain. For example: http://localhost:8000/api/cpanel/v1/apps/app_name/<app-name-here>/
• To test retrieving/adding/deleting customers, you will need to make sure the app has a relevant auth client setup - if not, you can create one from the manage app page.

📚 Documentation status

• No changes to the documentation are required
• This PR includes all relevant documentation
• Documentation will be added in the future because ... (see subtask)

[jamesstottmoj]

Tested locally. Followed instructions and could access API and customer endpoints.

Encountered no issues