Add RBAC with Azure AD authentication provider

[apedroferreira]

• Add RBAC based on provider roles.
• Add Azure Active Directory (AD) as authentication provider, the first one with roles enabled.
• Add role mapping from provider role names to Toolpad role names, set via UI in application.yml.
• Disallow users from accessing pages if they don't have the correct roles (client-side only, as our routing for these pages is client-side? Should we also try to block by HTTP somehow or is it not worth it?). In a separate PR I am disallowing queries from being called if user does not have the necessary roles, if possible, just need to finish it up if needed, it's outdated right now (Protect runtime RPC with authorization #3034)
• Hide inaccessible pages in sidebar + show message that page is inaccessible if user somehow still navigates to them.

Will add to documentation in the authentication/authorization documentation PR: #3067
Also to cover in authentication/authorization tests in: #3056

Video

Screen.Recording.2024-01-16.at.18.30.53.mov

It's possible to assign multiple provider roles to a Toolpad role by separating the roles with commas such as admin, reader,writer.

[apedroferreira]

Is this fine or should I use this specific version of pnpm? I had a more recent one installed.

[Janpot]

I was hoping we could pin the pnpm version, just like we used to do with yarn

[apedroferreira]

So I should use 8.7.0? Why are we not using a more recent version?
Anyway I can switch, no problem, I guess it's safer against weird issues if we all use the same version.

[Janpot]

Why are we not using a more recent version?

Because I haven't yet fully figured out yet how to enforce this in circleci, netlify, ánd codesandbox ci simultaneously.

[apedroferreira]

I saw something else wrong in the video - the admin-only page is showing when it shouldn't, feel free to wait before reviewing until I add some fix. Fixed, video updated.

[apedroferreira]

Also they don't return any data that allows us to determine if emails are verified, from what I searched.

[Janpot]

Intuitively this feels like a provider specific property. e.g. how would this work under Google/GitHub?
I'd sort of have expected something like:

providers:
  - provider: 'azure-ad'
    roles:
      - source: 
          - my-azure-role
          - my-other-azure-role
        target: my-toolpad-role

Also, UI doesn't really have proirity right now. I'm fine to release this with config only

[apedroferreira]

You're right, I'll make that change, seems better. The UI is already done so should be easy to keep now.

[apedroferreira]

I've changed the schema here: 2075577

The schema definition is much better like this too.

[Janpot]

👍 Looking good