Groups management

[pudo]

This ticket exists to sketch out the current status of groups support in Aleph, and some possible next steps. First, the status quo:

• Groups in Aleph exist to manage access to datasets/collections for multiple users.
• Users are shown a list of groups they are a member of on their home dashboard.
• There is no distinction between being a member and an administrator for a group.
• There is no support for creating groups via the user interface or the command line.
• There is no support for adding or removing users from a group in the UI or CLI.

The context for this implementation is the development of Aleph inside of OCCRP. At OCCRP, we use a single sign-on system (Keycloak) that manages not just users but also what groups they are members of. When logging into Aleph, a user authenticates via Keycloak, which provides an access token listing the groups that a user should be linked to. Allowing users to change these group assignments inside of Aleph would be counter-productive for our use case.

Aleph is an open source project and we would love to see proper groups management implemented in the software. So in a way, this ticket is a challenge to the community to step in. Here's some ideas for PRs that would be incredibly useful:

Command-line groups support

Requires working knowledge of Python development, and the click command-line library.

• A command-line aleph creategroup <name> utility that would let the administrator create a user group.
• A pair of commands, aleph useradd <group> <user> and aleph userdel <group> <user>, to let the administrator manage what users are in which group.
• Optionally, aleph groups should probably list all groups and their members.

User interface support

Requires knowledge of Python, Flask and React.js

• A modal dialog to change the name of a group in the user interface
• An API to add users to a group and remove users from a group.
• A user editor in the group home page (/groups/<group_id>).
• A modal dialog to create a new group.
• Converting the role_membership join table into a proper database model, and adding the option to distinguish group members and group administrators (who get to use the user editor).

(Consolidates #576, #755 and references #1083).