Separate userinfo from the config endpoint (#1728)

* Separate userinfo from the config endpoint

previously information about if the user was logged in and their username
was part of the config endpoint.
However, the config endpoint was previously static, and has a cache control.
Rather than not caching the config, a new endpoint called "userinfo"
is created to handle that information.

The config endpoint still has the non-changing part of the authentication:

  config:
    authentication:
        requires_client_login:  True/False
        login: <uri to login endoint if requires_client_login is True>
        logout: <uri to logout endoint if requires_client_login is True>

The userinfo endpoint returns this information:

  userinfo:
    is_authenticated:  True/False
    username: <string if is_authenticated>

if authentication is not enabled then the config does not have an authentication key,
and userinfo returns None.

Also in the PR are a few minor code improvements and bug fixes

Co-authored-by: Colin Megill <colinmegill@gmail.com>

server/auth/auth_oauth.py

@@ -1,4 +1,4 @@
-from flask import session, request, redirect, current_app, after_this_request, has_request_context, g
+from flask import session, request, redirect, current_app, has_request_context, g
 from server.auth.auth import AuthTypeClientBase, AuthTypeFactory
 from server.common.errors import AuthenticationError, ConfigurationError
 from urllib.parse import urlencode
@@ -15,6 +15,7 @@ except ModuleNotFoundError:
 
 try:
     from jose import jwt
+    from jose.exceptions import ExpiredSignatureError, JWTError, JWTClaimsError
 except ModuleNotFoundError:
     missingimport.append("jose")
 
@@ -137,18 +138,15 @@ class AuthTypeOAuth(AuthTypeClientBase):
         return response
 
     def logout(self):
+        params = {'returnTo' : self.callback_base_url, 'client_id' : self.client_id}
+        response = redirect(self.client.api_base_url + '/v2/logout?' + urlencode(params))
+
         if self.session_cookie:
             if self.CXG_ID_TOKEN in session:
                 del session[self.CXG_ID_TOKEN]
         else:
-            @after_this_request
-            def remove_cookie(response):
-                response.set_cookie(self.cookie_params["key"], "", expires=0)
-                self.update_response(response)
-                return response
+            response.set_cookie(self.cookie_params["key"], "", expires=0)
 
-        params = {'returnTo' : self.callback_base_url, 'client_id' : self.client_id}
-        response = redirect(self.client.api_base_url + '/v2/logout?' + urlencode(params))
         self.update_response(response)
         return response
 
@@ -178,7 +176,7 @@ class AuthTypeOAuth(AuthTypeClientBase):
     def get_login_url(self, data_adaptor):
         """Return the url for the login route"""
         if current_app.app_config.is_multi_dataset():
-            return f"/login?dataset={data_adaptor.uri_path}"
+            return f"/login?dataset={data_adaptor.uri_path}/"
         else:
             return "/login"
 
@@ -205,7 +203,11 @@ class AuthTypeOAuth(AuthTypeClientBase):
         if token is None:
             return None
 
-        unverified_header = jwt.get_unverified_header(token)
+        try:
+            unverified_header = jwt.get_unverified_header(token)
+        except JWTError:
+            return None
+
         rsa_key = {}
         for key in self.jwks['keys']:
             if key['kid'] == unverified_header['kid']:
@@ -227,11 +229,12 @@ class AuthTypeOAuth(AuthTypeClientBase):
                 )
                 return payload
 
-            except jwt.JWTError as e:
+            except JWTError as e:
                 raise AuthenticationError(f"invalid signature: {str(e)}")
-            except jwt.ExpiredSignatureError as e:
-                raise AuthenticationError(f"token expired: {str(e)}")
-            except jwt.JWTClaimsError as e:
+            except ExpiredSignatureError:
+                # TODO, handle expired sessions by refreshing the token
+                return None
+            except JWTClaimsError as e:
                 raise AuthenticationError(f"invalid claims {str(e)}")
 
         raise AuthenticationError("Unable to find the appropriate key")