TNL-782 each request should have valid ID Token

[tymofij]

Each incoming request is expected to have signed non-expired JSON Web Token, containing information about user (sub), matching edx-notes client id (to be set in provider's database) and signed with edx-notes client secret (the same).

https://openedx.atlassian.net/browse/TNL-782

[coveralls]

Coverage increased (+1.98%) when pulling b75f00f on tim/id-token-auth into 440e47f on oleg/create-app.

[tymofij]

@jimabramson @olmar @polesye please take a look
cc @jzoldak @benpatterson

[polesye]

Can we set it globally? http://www.django-rest-framework.org/api-guide/permissions/#setting-the-permission-policy

[tymofij]

thanks, that is nice. done aa3c503

[polesye]

I'd like to move this code in helper method:

def get_user(self, request):
  for request_field in ('GET', 'POST', 'DATA'):
    data = getattr(request, request_field)
    if 'user' in data:
      return data['user']
  return None

What do you think?

[tymofij]

that would requre returning from get_user not unly user but request_field where it was found, for better error log if it does not match. IMHO not worth it.

[jimabramson]

?

[tymofij]

this allows make requirement to work, otherwise it will just stop seeing requirements directory exists.

[jimabramson]

@tymofij don't forget to add yourself to AUTHORS

[olmar]

👍 once previously mentioned commnents will be addressed