OAuth2 support via planet_auth python libraries

[carl-adams-planet]

Change planet.Auth over to using the planet-auth-python library to move towards OAuth2 as the preferred authentication mechanism..

[carl-adams-planet]

Addressed the mutating of the SKEL. I now copy before I modify.

Change pushed to MR

[carl-adams-planet]

The Auth ABC preserves the v2 structure. I didn't really like the old structure, either, but I was aiming for minimizing impact between v2 and v3 auth for developers.

v2 had Auth(ABC) with static from_file() -> AuthType and other methods that returned a concrete APIAuthKey(httpx.AuthBasic, Auth) . These leaned on a AuthClient class that knew how to speak the legacy protocol.

AuthClient is gone, as it's entirely replaced by the planet_auth and planet_auth_utils that speak legacy, a bunch of flavors of OAuth, or plain old static key.

APIKeyAuth(httpx.AuthBasic, Auth) is replaced by _PLAuthLibAuth(Auth), which connects the concepts implemented in planet_auth to the structures already present in the SDK.

One thing that was and still is different from the SDK's planet.Auth class and planet_auth's planet_auth.Auth class is the SDK's Auth takes the approach that the Auth object is a httpx.Auth authenticator object (which is the thing that can mutate a request() to be auth'ed). planet_auth.Auth on the other hand is an auth context that has a request authenticator, since I treat the business of obtaining, refreshing, revoking, auth tokens as distinct from using the auth tokens to make requests. The planet_auth.Auth also has planet_auth's equlivilent of the AuthClient, carrying it round in a way the old SDK did not. This is necessary for OAuth in a way it was not when we just used the legacy auth protocol to unwrap a JWT and get the API key, because unlike API keys the OAuth JWTs expire, and we need to keep the AuthClient equivalent around to make transparent token refresh work.

One change I did make to the SDK's planet.Auth interface was to push the extension of httpx.Auth up from the old child class of APIKeyAuth(planet.Auth) into the abstract base class. This let me take out the old AuthType = httpx.Auth declaration which I felt let my statics have a clear factory signatures like def some_static_factory_methd() -> Auth. The old signature with def some_static_factory() -> AuthType I felt tried to pretent it was hiding httpx, but wasn't while also preventing me from having more than just httpx.Auth methods on the AuthType (which I wanted so the rest of the code could do the right thing for managing multi-step device code flow login or saving state to application defined storage for smooth use of refresh tokens across sessions.

Layers, man. This problem can have twisty layers. Open to better ideas.

[carl-adams-planet]

Deprecation - Maybe I missed a spot. I tried to do this:

• Deprecated Now. It doesn't work. I raise DeprecationWarning and using that path will fail. The value I see in in the raise vs just removing the code outright is devx hand holding. We can just as well release note it, and I actually love it more when the merge has more delete lines.
• Pending Deprecation Warning. I use warnings.warn("some message", PendingDeprecationWarning) . Taking this path should still work, but it's not advised and we would like to discourage this path and maybe someday remove it.
• Annotation - I guess I am not using that. I could I suppose. I think I set down this path because in an earlier version of my changes the warnings were raised in particular branches of if statements. That might not be true of any of the (pending) deprecated paths

[carl-adams-planet]

Auth profile of none (and EmptyBuiltinProfileConstants):

The none profile lets you try a request unauthenticated easily. Maybe not super useful, but possible and somewhat falls out of plauth being more general than planet. I'm sure I copy-pasta that from elsewhere. Say the word and I can remove it from planet. I almost did myself, but might have left it for unit tests. If you want to, it's possible to do something like planet --auth-profile none data search-list. If a client had unprotected endpoints, this does provide a path to using those when your session is foobar without the client needing to think about paths for authenticated and unauthenticated sessions. (somewhat contrived, I admit)

Similar story with EmptyBuiltinProfileConstants. The built-in provider is a later/newer concept in this history of these libs. I found it far less disruptive to be able to fall back to an empty shell than NPE and sprinkle a bunch of "If not None" all over the code.

[carl-adams-planet]

As a side comment, using plauth outside planet APIs and the SDK isn't academic. I do this today in my dev envs. I use it to talk to vendor APIs. I use it to talk to other internal services not under Planet's OAuth servers that may not have mature client libs. I have my Bruno API client wired up to understand my ~/.planet/ directory to share access tokens with any number of auth servers and identities.

[carl-adams-planet]

Bug:
Can you share with me what you have in various PL_ env vars, and the structure of your ~/.planet.json file (if it exists)?

[carl-adams-planet]

Removed "none" built-in profile per feedback.

Change pushed to MR.

[carl-adams-planet]

Closing this PR in favor of the PR into the 3.0 branch: #1121