Refactor authentication API into pipeline format

[jaswilli]

Refs #5508

• Adds tests for authentication API methods that didn't have them.
• Adds some missing catch handlers for inverted tests.
• Adds a new error type TokenRevocationError that returns an HTTP status code 503 in the event there's a failure during token revocation so that the client is aware the token may still be valid.
• No longer consider token_type_hint during the revocation process. When presented with a token /revoke will do its best to invalidate even without a valid hint.
• Do not attempt to recover from missing owner user during setup. Missing fixtures should be fatal.

[sebgie]

Hey, thank you for taking on this issue!

Although it looks like an oversight, not returning an error for invalid tokens was done according to the specification (https://tools.ietf.org/html/rfc7009):

The authorization server responds with HTTP status code 200 if the token has been revoked successfully or if the client submitted an invalid token.

Note: invalid tokens do not cause an error response since the client cannot handle such an error in a reasonable way. Moreover, the purpose of the revocation request, invalidating the particular token, is already achieved.

Not ignoring token_type_hint was a bug 👍.

An invalid token type hint value is ignored by the authorization server and does not influence the revocation response.

[jaswilli]

Although it looks like an oversight, not returning an error for invalid tokens was done according to the specification (https://tools.ietf.org/html/rfc7009):

That's how this is intended to work. An invalid/non-existent/previously revoked token will return a 200 status. However, if there's another type of error encountered (e.g., the server is somehow in a bad state) then a 503 status is returned so that the client knows that the token may not have been revoked and is free to retry at a later time. (https://tools.ietf.org/html/rfc7009#section-2.2.1)

[sebgie]

oh, thanks for clarifying 👍

[jaswilli]

Thanks for taking the time to review!