Add basic ownership as temporary prototype for demo

[PGijsbers]

This is a draft PR and not meant to merge. We have to work with a different system later to account for groups etc., this is a quick hack for the prototype.

---

What this does

With this PR, every asset uploaded to the metadata catalogue will have an associated user identifier that is considered the owner. This user identifier is the 'sub' token provided by keycloak. With this PR, users can only edit or delete assets they uploaded themselves. Attempting to edit or delete an asset created by a different user will result in an error. All assets are still public: user B can still see assets uploaded by user A.

How to test

Instructions assume default variables as defined in .env for credentials, etc.

Updating the Database

This update requires a change to the database schema. No migration has been developed yet, so the easiest thing to do is to run the startup once with --rebuild-db always (if you do not care about the data in your local instance).

Caution

Using --rebuild-db always will delete all data from the database. If you use it, make sure you do not care about the data.
It is advised to turn off --rebuild-db always as soon as you do not need it anymore, to avoid unintended loss of data.

If you care about the keeping the data in your database, you could just add the column yourself in mysql (UNTESTED):

docker exec -it sqlserver mysql -uroot -pok -e 'alter table aiod_entry add column creator_identifier varchar(36) NOT NULL' aiod

However, I strongly recommend you do not test this feature on a database with data you care about.. Note that previous entries will no longer be editable by anyone through the REST API.

Create an Extra User

As the default config only ships with one predefined user, you'll need to create a second one:

1. Navigate to localhost/aiod-auth and enter admin credentials (admin/password)
2. In the top-left dropdown, switch the realm from Keycloak to aiod.
3. Go to Users>add user, give it some name.
4. Edit the user by clicking on it, go to Credentials and set a password, go to Role mapping and add edit_aiod_resources.

Try it in the REST API

You can now create an asset with your new user, and try to edit or delete it with the default user (or vice versa).
You should get an error when you try to edit a resource the user did not create.

[PGijsbers]

When continuing this work, the connectors should also be updated.