Move airlock notifications

Description

As a Azure TRE Developer
I want the airlock notifications to be sent by the notifications logic app
So that all notification logic is managed in one place.

Options considered:

1. Move to airlock processor (AP). That will require airlock processor to be able to:

   • Query the API - to get workspace client id. It will require implementation of authentication mechanism for the AP: have a client which has a permission for the api client. A token retrieval mechanism. Maybe we should also consider have an application role for it.
   • Query the graph - in the api we use the api client to query the graph, airlock processor has only managed identity. We considered in this case to have a client which will be used across the whole system to query the MS graph, and have it used in the api and the airlock processor.

2. Move to notifications logic app. In this case:

   • A new endpoint will be created in the API which will return by workspace id - users email and their role assignments in the workspace
   • notifications logic app will need to be able to retrieve a token and a permission to access the api. In this case we will need to consider what identity it will use, implement a token retrieval mechanism. Maybe we should also consider have an application role for it.

No files, tests, or entry points are named. Start by locating the existing airlock notification flow, the API, and the notifications logic app, then clarify which identity and access changes are in scope. Done means airlock notifications are sent by the notifications logic app and notification logic is managed there.