Authx - Add APIv4 support for creating and validating credentials

[totten]

Overview

Add APIv4 actions for creating login credentials (as JWT) and validating login credentials (without actually logging in).

(Builds on @seamuslee001's #25992. But it makes several changes -- I'm posting under diff PR# so we can pick/discuss if some are more interesting or controversial than others.)

Before

N/A

After

Defines API AuthxCredential.create, as in:

cv api4 AuthxCredential.create contactId=203

[
    {
        "cred": "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsImtpZCI6IndkcHZGZEZyNFZHWGdiNnNnMXVPLXlsck9NZyJ9.eyJleHAiOjE2ODExOTI0NzQsInN1YiI6ImNpZDoyMDMiLCJzY29wZSI6ImF1dGh4In0.6RHP5f54O3bfzN3dLYd9VpL8uTBPC_FSKJWhq7cSJdo"
    }
]

Defines API AuthxCredential.validate, as in:

cv api4 -U validate-user AuthxCredential.validate checkPermissions=1 cred="$(cv api4 -IU auth-user AuthxCredential.create contactId=203 checkPermissions=1)"

[
    {
        "flow": "script",
        "credType": "jwt",
        "jwt": {
            "exp": 1681192121,
            "sub": "cid:203",
            "scope": "authx"
        },
        "useSession": false,
        "userId": 1,
        "contactId": "203"
    }
]

Technical Details

For r-run, I used this setup script:

drush -y role-create auth-role
drush -y role-create validate-role
drush -y rap auth-role 'access CiviCRM,generate any authx credential'
drush -y rap validate-role 'access CiviCRM,validate any authx credential'

drush -y user-create --password="demo" --mail="[email protected]" "auth-user"
drush -y user-create --password="demo" --mail="[email protected]" "validate-user"
drush -y user-add-role auth-role auth-user
drush -y user-add-role validate-role validate-user

And then these example commands (note: they're long - scroll horizontally):

echo 'http://dmaster.bknix:8001/civicrm/dashboard?_authxSes=1&_authx='$(cv api4 -IU auth-user AuthxCredential.create contactId=203 checkPermissions=1)

echo 'http://dmaster.bknix:8001/civicrm/dashboard?_authxSes=1&_authx='$(cv api4 -IU validate-user AuthxCredential.create contactId=203 checkPermissions=1)

cv api4 -U validate-user AuthxCredential.validate checkPermissions=1 cred="$(cv api4 -IU auth-user AuthxCredential.create contactId=203 checkPermissions=1)"

[civibot]

(Standard links)

• If you are reviewing this pull-request, you may wish to consult the test sites and the Review Standards (long template, short template).

[seamuslee001]

@totten I think this works for me and I'll work to incorporate it into the extension I am writing but I think this can be merged now