Refactor API for consistency

[charithe]

We have /api/check for checking a single principal and a single resource against a single action. It returns a response like the following.

{
  "requestId": "460d1429-9798-4a6f-8505-170193909003",
  "statusCode": 200,
  "statusMessage": "Allow",
  "effect": "EFFECT_ALLOW",
  "meta": {
    "matchedPolicy": "leave_request:20210210",
    "effectiveDerivedRoles": [
      "any_employee",
      "direct_manager"
    ],
    "evaluationDuration": "0.000628452s"
  }
}

Then we have the /api/check_resource_batch endpoint which checks a single principal against multiple actions and multiple resources.

{
  "requestId":  "test",
  "resourceInstances":  {
    "XX125":  {
      "actions":  {
        "approve":  "EFFECT_DENY",
        "create":  "EFFECT_DENY",
        "view:public":  "EFFECT_ALLOW"
      }
    },
    "XX150":  {
      "actions":  {
        "approve":  "EFFECT_DENY",
        "create":  "EFFECT_DENY",
        "view:public":  "EFFECT_ALLOW"
      }
    },
    "XX250":  {
      "actions":  {
        "approve":  "EFFECT_DENY",
        "create":  "EFFECT_DENY",
        "view:public":  "EFFECT_ALLOW"
      }
    },
    "YY100":  {
      "actions":  {
        "approve":  "EFFECT_ALLOW",
        "create":  "EFFECT_ALLOW",
        "view:public":  "EFFECT_ALLOW"
      }
    },
    "YY200":  {
      "actions":  {
        "approve":  "EFFECT_ALLOW",
        "create":  "EFFECT_ALLOW",
        "view:public":  "EFFECT_ALLOW"
      }
    }
  }
}

This is not ideal because we have two wildly different responses for very similar requests. The /api/check endpoint is strictly not necessary because it can be subsumed by the /api/check_resource_batch endpoint.

Proposal

• Remove the current /api/check endpoint.
• Rename /api/check_resource_batch to /api/check and make it the default endpoint.
• introduce a debug parameter to the request so that we can add debug metadata (matched policy, active derived roles) to the response.

[emreb]

Would the format of a single check still be the same?

[charithe]

No, it would be replaced by the batch request where the batch size is 1.

[charithe]

Fixed by #60