* Updates due dependency version changes.
h5py recently changes and now values once returned as str are now returned as bytes.
This would have caused a much larger change, so instead the version is restricted to <3.0.0.
This caused the bulk of the testing failues.
A few other changes were needed to make a few other tests pass.
#1959
* Fix bug in oauth.
The error checking was too specific, and missed a case.
Make the error checking catch all exceptions.
#1947
* Add logging when the cookie cannot be processed
* add tests
* run black
* run black and add disclaimer that tweaked errors on server
* lint
* change to get so it will return None
* tweak existing token instead of new one
* Trigger
* token is dict
* jsonify dict before encoding
* json dump instead of jsonify
* encode into bytes object
* use correct id token
* decode byte to string
* split out config
* add tests for base and app config, refactor client config out of app config
* refactor default config retrieval
* create config test class and helper functions
* move default_config into server to fix import issue
* separate backend base url from frontend
This is needed for auth, and to support a different location for the backend api server,
than the frontend.
part of chanzuckerberg/cellxgene#1778
new server config parameters: app__api_base_url, app__web_base_url
Also changed api_base_url in the oauth config section to "oauth_api_base_url" to
be less confusing with the app's api_base_url
Other minor changes:
changed how the jwt decode options are handled.
Previously they needed to be set in a test case, and there was some extra logic to handle that.
Now they are handled through comfig parameters, which makes it more general.
Also, add a feature to set the CORS support credentials, which seems
to be necessary for the backend/frontend separation, at least when run
locally. This part is sort of experimental, and may be removed or changed later.
* Handle the refresh token in oauth authentication
If the token has expired, then it can be refreshed to get a new token.
This is automatically handled by the server without the client being aware.
Also in the PR:
- refactor the auth_oauth.py file to more simply handle the save/restore of the token,
and the refresh token
- added an end2end test for oauth, which also tests refresh.
* adding python-jose and Authlib to requirements-dev.txt
They are needed in the auth_oauth test
