Merge pull request juju#17952 from Aflynn50/offer-permissions

juju#17952

Methods in state used by the offer facade are the last remaining usages
of the state user access methods. By moving these offer access checks
to the facade we can remove all usages of these in state and move
towards deleting the mongo collections for users and permissions.

As part of this work the everyone@external user is now added at bootstrap.
The everyone@external user is used to grant permissions to all external
users in the database. In mongo this user didn't need to exist as the
user that permissions were granted to didn't need to exist.

Now that we have referential integrity this user needs to exist to grant
it permissions.

When an offer is added the everyone@external user needs
to be granted read permissions on it. This means it needs to already
exist in the database. It is now added by the bootstrap worker.

_Resulting behaviour changes:_

In 3.x the "everyone@external" user showed up on all offers as having read permissions. This is no longer the case because they are filtered from being displayed by the database. On the other hand, every external user known to juju will now be shown to have read permissions. This means that if you grant an external user access on something unrelated, and they are therefore added to the database, they will now show up as a reader of the offer.


<!-- 
The PR title should match: <type>(optional <scope>): <description>.

Please also ensure all commits in this PR comply with our conventional commits specification:
https://docs.google.com/document/d/1SYUo9G7qZ_jdoVXpUVamS5VCgHmtZ0QA-wZxKoMS-C0 
-->

<!-- Why this change is needed and what it does. -->

## Checklist

<!-- If an item is not applicable, use `~strikethrough~`. -->

- [x] Code style: imports ordered, good names, simple structure, etc
- [x] Comments saying why design decisions were made
- [x] Go unit tests, with comments saying what you're testing
- [ ] [Integration tests](https://github.com/juju/juju/tree/main/tests), with comments saying what you're testing
- [ ] [doc.go](https://discourse.charmhub.io/t/readme-in-packages/451) added or updated in changed packages

## QA steps
**Note:** during QA, when logging out and logging in again you may run into [this bug](https://bugs.launchpad.net/juju/+bug/2072473). This can prevent login. To fix it, delete all cookies for the controller in `~/.local/share/juju/cookies/`. @gfouillet is working on this.
### Test basic offer functionality
```
$ juju bootstrap lxd test-offers
$ juju add-model offerer
$ juju deploy juju-qa-dummy-source
$ juju offer dummy-source:sink
Application "dummy-source" endpoints [sink] available at "admin/offerer.dummy-source"
$ juju show-offer dummy-source
Store URL Access Description Endpoint Interface Role
test-offers3 admin/offerer.dummy-source admin This dummy charm is used to verify that a sink dummy-token requirer
 relationship is created correctly 
$ juju add-model consumer
$ juju deploy juju-qa-dummy-sink
$ juju consume offerer.dummy-source
Added admin/offerer.dummy-source as dummy-source
$ juju relate dummy-source dummy-sink
$ juju switch offerer
$ juju config dummy-source token=123
$ juju switch consumer
$ juju status
...
App Version Status Scale Charm Channel Rev Exposed Message
dummy-sink active 1 juju-qa-dummy-sink latest/stable 7 no Token is 123
...
```

### Test offer permissions
#### Test grant and revoke
```
$ juju grant bob admin offerer.dummy-source
$ juju show-offer offerer.dummy-source --format=yaml
test-offers4:admin/offerer.dummy-source:
...
 users:
...
 bob:
 access: admin
...
$ juju revoke bob admin offerer.dummy-source
$ juju show-offer offerer.dummy-source --format=yaml
test-offers3:admin/offerer.dummy-source:
 ...
 users:
...
 bob:
 access: consume
$ juju revoke bob consume offerer.dummy-source
$ juju show-offer offerer.dummy-source --format=yaml
test-offers3:admin/offerer.dummy-source:
 ...
 users:
...
 bob:
 access: read
$ juju revoke bob read offerer.dummy-source
$ juju show-offer offerer.dummy-source --format=yaml
test-offers4:admin/offerer.dummy-source:
 description: |
 This dummy charm is used to verify that a relationship is created correctly
 access: admin
 endpoints:
 sink:
 interface: dummy-token
 role: requirer
 users:
 admin:
 display-name: admin
 access: admin
```
#### Test local user read
```
$ juju add-user bob
$ juju grant bob read offerer
$ juju show-offer dummy-source

$ juju change-user-password bob
$ juju change-user-password admin
$ juju logout
$ juju login -u bob
$ juju status
$ juju show-offer dummy-source
ERROR application offer "admin/offerer.dummy-source" not found
$ juju logout
$ juju login -u admin
$ juju grant bob read offerer.dummy-source
$ juju show-offer dummy-source --format=yaml
test-offers3:admin/offerer.dummy-source:
$ juju logout
$ juju login -u bob
$ juju show-offer dummy-source
...
 users:
 admin:
 display-name: admin
 access: admin
 bob:
 access: read

```
#### Test local user consume
```
$ juju logout
$ juju login -u admin
$ juju grant bob consume offerer.dummy-source
$ juju add-model bobs-consumer
$ juju grant bob write bobs-consumer
$ juju logout
$ juju login -u bob
$ juju consume admin/offerer.dummy-source
Added admin/offerer.dummy-source as dummy-source
```
#### Test local user admin
```
$ juju logout
$ juju login -u admin
$ juju grant bob admin offerer.dummy-source
$ juju logout
$ juju login -u bob
$ juju remove-offer admin/offerer.dummy-source
$ juju status
# offer is gone
```
#### Test external users
```
$ juju bootstrap lxd test-offers5 --config identity-url=https://api.jujucharms.com/identity --config allow-model-access=true 
$ juju add-model offerer
$ juju deploy juju-qa-dummy-source
$ juju grant aflynn50@external login
$ juju grant aflynn50@external admin offerer
$ juju change-user-password-admin
$ juju logout && juju login -u aflynn50@external
$ juju status
$ juju offer dummy-source:sink
$ juju show-offer admin/offerer.dummy-source --format=yaml
$ juju status
$ juju logout
$ juju login -u admin
$ juju revoke aflynn50@external admin offerer
$ juju show-model offerer
$ juju grant aflynn50@external read offerer
$ juju show-offer admin/offerer.dummy-source --format=yaml
$ juju revoke aflynn50@external admin offerer.dummy-source
$ juju show-offer admin/offerer.dummy-source --format=yaml
$ juju logout
$ juju login -u aflynn50@external
$ juju status
$ juju show-offer admin/offerer.dummy-source --format=yaml
$ juju logout && juju login -u admin
$ juju grant aflynn50@external superuser
$ juju logout && juju login -u aflynn50@external
$ juju add-model offerer2
$ vim ~/.local/share/juju
$ juju add-credential lxd 
$ lxc config trust add
$ juju add-model offerer2
$ juju deploy juju-qa-dummy-source
$ juju show-model offerer2
$ juju offer dummy-source:sink
$ juju add-model consumer2
$ juju deploy juju-qa-dummy-sink
$ juju consume aflynn50@external/offerer2.dummy-source
$ juju relate dummy-source dummy-sink
$ juju status --relations
$ juju remove-saas dummy-source
$ juju status --relations
$ juju consume admin/offerer.dummy-source
$ juju relate dummy-source dummy-sink
$ juju status --relations
```

<!-- Describe steps to verify that the change works. -->


## Links

<!-- Link to all relevant specification, documentation, bug, issue or JIRA card. -->

**Jira card:**[ JUJU-5410](https://warthogs.atlassian.net/browse/JUJU-5410)

apiserver/common/crossmodel/interface.go

@@ -39,9 +39,6 @@ type Backend interface {
 	// Application returns a local application by name.
 	Application(string) (Application, error)
 
-	// GetOfferAccess gets the access permission for the specified user on an offer.
-	GetOfferAccess(offerUUID string, user names.UserTag) (permission.Access, error)
-
 	// RemoteApplication returns a remote application by name.
 	RemoteApplication(string) (RemoteApplication, error)