refactor(extensions)!: refactor the extensions URLs and errors (#1636)

BREAKING CHANGE: The functionality provided by the mgmt endpoint has beed redesigned - see details below
BREAKING CHANGE: The API keys endpoint has been moved -  see details below
BREAKING CHANGE: The mgmt extension config has been removed - endpoint is now enabled by having both the search and the ui extensions enabled
BREAKING CHANGE: The API keys configuration has been moved from extensions to http>auth>apikey

mgmt and imagetrust extensions:
- separate the _zot/ext/mgmt into 3 separate endpoints: _zot/ext/auth, _zot/ext/notation, _zot/ext/cosign
- signature verification logic is in a separate `imagetrust` extension
- better hanling or errors in case of signature uploads: logging and error codes (more 400 and less 500 errors)
- add authz on signature uploads (and add a new middleware in common for this purpose)
- remove the mgmt extension configuration - it is now enabled if the UI and the search extensions are enabled

userprefs estension:
- userprefs are enabled if both search and ui extensions are enabled (as opposed to just search)

apikey extension is removed and logic moved into the api folder
- Move apikeys code out of pkg/extensions and into pkg/api
- Remove apikey configuration options from the extensions configuration and move it inside the http auth section
- remove the build label apikeys

other changes:
- move most of the logic adding handlers to the extensions endpoints out of routes.go and into the extensions files.
- add warnings in case the users are still using configurations with the obsolete settings for mgmt and api keys
- add a new function in the extension package which could be a single point of starting backgroud tasks for all extensions
- more clear methods for verifying specific extensions are enabled
- fix http methods paired with the UI handlers
- rebuild swagger docs

Signed-off-by: Andrei Aaron <aaaron@luxoft.com>

pkg/api/constants/consts.go

@@ -15,6 +15,7 @@ const (
 	CallbackBasePath             = "/auth/callback"
 	LoginPath                    = "/auth/login"
 	LogoutPath                   = "/auth/logout"
+	APIKeyPath                   = "/auth/apikey" //nolint: gosec
 	SessionClientHeaderName      = "X-ZOT-API-CLIENT"
 	SessionClientHeaderValue     = "zot-ui"
 	APIKeysPrefix                = "zak_"

pkg/api/constants/extensions.go

@@ -4,21 +4,31 @@ package constants
 const (
 	ExtCatalogPrefix     = "/_catalog"
 	ExtOciDiscoverPrefix = "/_oci/ext/discover"
-	// zot specific extensions.
-	ExtPrefix = "/_zot/ext"
 
+	// zot specific extensions.
+	BasePrefix = "/_zot"
+	ExtPrefix  = BasePrefix + "/ext"
+
+	// search extension.
 	ExtSearch        = "/search"
 	ExtSearchPrefix  = ExtPrefix + ExtSearch
 	FullSearchPrefix = RoutePrefix + ExtSearchPrefix
 
-	ExtMgmt        = "/mgmt"
-	ExtMgmtPrefix  = ExtPrefix + ExtMgmt
-	FullMgmtPrefix = RoutePrefix + ExtMgmtPrefix
+	// mgmt extension.
+	Mgmt     = "/mgmt"
+	ExtMgmt  = ExtPrefix + Mgmt
+	FullMgmt = RoutePrefix + ExtMgmt
 
-	ExtUserPreferences        = "/userprefs"
-	ExtUserPreferencesPrefix  = ExtPrefix + ExtUserPreferences
-	FullUserPreferencesPrefix = RoutePrefix + ExtUserPreferencesPrefix
-	ExtAPIKey                 = "/apikey"
-	ExtAPIKeyPrefix           = ExtPrefix + ExtAPIKey //nolint: gosec
-	FullAPIKeyPrefix          = RoutePrefix + ExtAPIKeyPrefix
+	// signatures extension.
+	Notation     = "/notation"
+	ExtNotation  = ExtPrefix + Notation
+	FullNotation = RoutePrefix + ExtNotation
+	Cosign       = "/cosign"
+	ExtCosign    = ExtPrefix + Cosign
+	FullCosign   = RoutePrefix + ExtCosign
+
+	// user preferences extension.
+	UserPrefs     = "/userprefs"
+	ExtUserPrefs  = ExtPrefix + UserPrefs
+	FullUserPrefs = RoutePrefix + ExtUserPrefs
 )