Re-add UserTokenContext, with instance checks

[woodruffw]

Reverts #15588, reviving #15581.

WIP while I add both coverage and determine a backstop test approach here.

[di]

There was another failure case in #15586 which I couldn't root-cause: "caveat must be an array", which change covers that here?

[woodruffw]

There was another failure case in #15586 which I couldn't root-cause: "caveat must be an array", which change covers that here?

Hmm, that happens in caveats._core.deserialize_obj. Looking now...

[woodruffw]

Oh, I think that error happens as a variant of #15588 (comment) when the API token is in the "legacy" format: we call _adapt_v1, which then contains a request.user check which would fail because request.user == None before this fix.

Relevant bit:

    # Our V1 token didn't have a way to specify that a token should be
    # restricted to a specific user, just that it was scoped to "the user",
    # which the user was whoever the token was linked to in the database.
    # Our new tokens strengthens that to validate that the linked user
    # matches who it is expected to be, but since we don't have that
    # data for V1 tokens, we'll just use the current user.
    if permissions == "user":
        request = get_current_request()

        # If we don't have a current request, then we can't validate this
        # token.
        if request is None:
            return None

        # If we don't have a user associated with this request, then we
        # can't validate this token.
        if request.user is None:
            return None

        return [3, str(request.user.id)]

So we'd return None, from _adapt_v1, which would then cause the "must be an array" error.

[woodruffw]

I've added some tests for the behavior here, but I'm not immediately sure how to "backstop" this -- maybe some additional test_legacy tests that ensure uploads succeed when the "user" identity is of both sorts?

[woodruffw]

This should be good to go now: I've added a layer of configurations on test_successful_upload that ensures identity=UserTokenContext works as expected.

[di]

@woodruffw Can you rebase & get tests passing?

[woodruffw]

@woodruffw Can you rebase & get tests passing?

Should be good now!