Add user roles and permissions

[mjherzog]

ScanCode.io needs to add user roles and permissions for both UI and API access.
This issue is a placeholder for documenting requirements and a design. We should leverage existing Django features as much as possible.

[tdruez]

Django has built-in features to handle authentication, permission, and authorization.

• https://docs.djangoproject.com/en/5.0/topics/auth/default/#using-the-django-authentication-system
• https://docs.djangoproject.com/en/5.0/topics/auth/default/#permissions-and-authorization

We need to define the roles and the permissions we want in the context of ScanCode.io first.

[mjherzog]

An initial implementation could be to just create the basic user infrastructure with:

• Superuser permissions for all users
• Adding History to SCIO Projects so that you can see who did what for a Scan

[tdruez]

@mjherzog What about the user creation? Something along a self-registration system, with email confirmation?
Or simply a manual system admin command line interface?

[mjherzog]

The user creation system would need to be different by use case:

• For an SCIO public/demo system self-registration similar to DejaCode would work, but for that use case we would need to make sure that a self-registered user can only create, run or view scans. We would also need the Admin UI to manage users as with DejaCode.
• For a SCIO production instance (which may be linked to DejaCode or not), CLI could work to create users, but we probably need the UI to manage users when there are several
  I think that requiring basic authentication for user access is an essential security feature.

[tdruez]

@mjherzog Note that we already have a "requires authentication" mode available through the SCANCODEIO_REQUIRE_AUTHENTICATION application settings, see
https://scancodeio.readthedocs.io/en/latest/application-settings.html#scancodeio-require-authentication

By default, the ScanCode.io Web UI and REST API are available without any authentication.
Once enabled, all the Web UI views and REST API endpoints will force the user to login to gain access.
A management command $ scanpipe create-user is available to create users and generate their API key for authentication.

This is usually enforced on a SCIO instance that is used by DejaCode, where DejaCode use an API key to interact with the SCIO API.

The missing pieces are the roles and permissions but it requires design before implementation. The implementation will rely on the built-in Django's permissions system.

[mjherzog]

That makes sense. I infer that this means that we need to complete the user implementation for the UI if we want to enable UI access to a SCIO instance used by DejaCode (?).
@DennisClark Can we adapt a design from DejaCode roles and permissions?