fix #3654: jupyterhub moderation requests

[rorour]

No description provided.

[robnagler]

First set of comments. I would like to discuss parse_post.require_sim_type.

[e-carlin]

Reminding myself - we need to write a migration for existing users

[robnagler]

More comments. I didn't finish. LMK when you are ready for another review.

[robnagler]

It might be good to walk through these changes together. I have particular opinions here that may need more explanations.

[robnagler]

I backtracked on some decisions and added more feedback. I'm being pedantic, because there are a lot of interesting coding and testing cases.

[robnagler]

I think I should help with this. Set up a meeting when you want to work on this.

[rorour]

@robnagler where should we check for guest users to keep them from accessing the moderation apis?

[e-carlin]

@robnagler ready for another review

[robnagler]

I think this is good to go. Is there a migration for users? Do you want to push to alpha?

[e-carlin]

Yes a migration needs to be written, thanks for the reminder. I'll add that then we can merge.

[e-carlin]

Thinking about this more, no migration is needed. User's who are in the approved community pool already have the sim_type_jupyterhublogin role. So, things will continue to work like normal for them. User's who are in the denied list (not actually used anywhere currently but we kept it around) don't have any records in the db so we have no way of finding a uid for them and setting them as denied in user_role_invite_t. So, I think we're good to go. Please confirm and I'll merge.

[robnagler]

Did you run a check for the denied list? I think we should run this check: validate that only users in valid pools (uspas, etc.) have the role. Any users not in these pools should get role removed.

We need to migrate from the community pool to the everybody pool once moderation is released to production. We still need pools for uspas, etc.

[e-carlin]

@robnagler I've written a script (hand/check-jupyter-users/check-jupyter-users.sh) to do the validation. You can run it as is (only does reads currently). I left a TODO with a question at the top. If you could answer as well as do a full review of the script (I'd really like to improve my bash) I'd appreciate it.