Implement API Key for programmatic access to WebAPI without authentication

Expected behavior

It would be nice to be able to access WebAPI (security enabled) by passing an user-owned API key that would bypass authentication and impersonate the person that issued the API key when calling functions. This would avoid problems where if you authenticate twice, your previous session is closed and you are logged out of the previous session. This makes it hard to work in something like the Atlas UI and an R session.

Actual behavior

Only authentication is supported, where you pass the authentication header that you got from a login request, and then use that to access WebAPI. If you log in again, the session is closed leading to confusing errors about 'access denied' when you accidently log into a new session.

Implementation Notes

The functional requirements are as follows (open to discussion):

• Any user can create an API Key.
• A user may create one or more API Keys.
• When you create a key, you can specify an expriation days such that the key will automatically expire after a fixed number of days from creation.
• A user may opt to 'refresh' an API key which will reset the expiration date to a new date.
• A user may delete an API key at any time which will prevent anyone who has a copy of it from using it to access WebAPI as the user.
• WebAPI should accept an alternative key WEBAPI_KEY in the request header that when present, it will attempt to resolve the key to the issuing user, and if successful, will continue the request under the context of the user that issued the key.
• This feature can be disabled by WebAPI configuration setting.
• The key should be encrypted in the database (ie: not stored in plain-text)

Database Details

Probably only 1 new table is required: API_key

Service Details

Simple CRUD and list operations to manage the 1 (user)-to-many (API keys) relationships.

User interface details

Fairly simple: a simple form primpting the user to create or delete a collection of issued API keys for the user. Some helper functions would be nice (ie: copy to clipboard, refresh, etc)

The issue names no files, tests, or entry points. Start by mapping WebAPI authentication, user/API-key management, database, configuration, and user-interface areas. Done means users can create, refresh, list, and delete encrypted keys, use WEBAPI_KEY with expiration and configuration controls, and access the corresponding UI.