Draft: oauth

[RensDimmendaal]

This PR adds the oauth feature for plash apps.

[gitnotebooks]

Found 2 changed notebooks. Review the changes at https://app.gitnotebooks.com/AnswerDotAI/plash_cli/pull/54

[github-actions]

📖 Documentation Preview: https://plash-docs-pr-54.pla.sh

[algal]

This is a comment about the example code in the documentation.

In that code, an app checks if a user is logged in to an app by examining session.get('user_id'), and an app logs a user in by doing session['user_id'] = uid.

But then the app logs a user out by doing session.clear(), rather than clearing only the user_id property with a statement like session.pop('user_id', None).

I am not sure, but I think it might be better if the logout example showed clearing only the user_id property. Here's why:

1. It's more consistent and locally comprehensible. If someone is reading the logout code session.pop('user_id',None) (or del session['user_id']) then they know that the effect of it is to clear the user_id property, and that the user_id property alone is what determines the user's login state wrt that app.

2. It avoids unintended side-effects on the app. An app developer might store other data in the session besides the login state. Clearing all session state on logout might clear that other state unintentionally. If the developer wants to clear that other state at logout, they should do it explicitly and therefore intentionally.

3. It avoids unintended side-effects on Plash. Plash also stores a token in the session associated with that app's domain. So session.clear() will also clear that state. Will it have a different effect on future login attempts if that state is also cleared -- that is, if the app does session.clear() vs session.pop('user_id',None) ? If there is a difference and it matters, then perhaps this doc should be more clear and prescriptive that one of the ways is right and the other is wrong. If there is no difference or a minor difference which does not matter, that would be great, but we should be sure of that.

[RensDimmendaal]

@algal thanks for the comment. Ive adopted the changes you've suggested!