No controller model access needed for connection with a non-admin user

[cderici]

Description

This is a follow up PR, includes changes from #1002. If you're reviewing this and #1002 hasn't landed yet, you might see some additional changes that'll land with #1002. We need those changes to be able to test this change.

ControllerAPIInfoForModels call in update_endpoints after a controller connection requires the uuid of the controller model, and if the user doesn't have at least read access, they won't be able to have that, so the update_endpoint call at the end of a
regular connection fails.

Fixes #998

QA Steps

We'll need a 2.9 controller, so:

 $ juju_29 bootstrap localhost issue998

Now we have the admin user on this by default, but we don't wanna use that. Let's create a new user (that doesn't have superuser so it can't read the controller model):

 $ juju add-user caner
 $ juju register

Now let's make a password for this user.

 $ juju change-user-password # to be able to access the admin user later
 $ juju logout
 $ juju login -u caner -c issue998
 $ juju change-user-password
<your-password>
 This should work just fine, we're just making sure the user is ready to go.

Now let's spawn a pylibjuju repl to test this change with this user (that can't access the controller model):

Wihtout this change, you'd see the error in #998. With this change the connection should work just fine:

# cd pylibjuju directory
$ python -m asyncio
>>> from juju import controller; c=controller.Controller()
>>> await c.connect(username='caner', password=<your-password>)
>>>
exiting asyncio REPL...
# Connection works without any issues.

Notes & Discussion

JUJU-5268

[anvial]

Thx, @cderici

I have the following problem on the last QA step:

>>> await c.connect(username='caner', password='q')
Traceback (most recent call last):
  File "/home/anvial/Projects/python-libjuju/juju/controller.py", line 143, in update_endpoints
    info = await self.info()
           ^^^^^^^^^^^^^^^^^
  File "/home/anvial/Projects/python-libjuju/juju/controller.py", line 289, in info
    raise errors.JujuPermissionError('Requires access to controller model.')
          ^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: module 'juju.errors' has no attribute 'JujuPermissionError'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.11/asyncio/__main__.py", line 58, in runcode
    return future.result()
           ^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/concurrent/futures/_base.py", line 456, in result
    return self.__get_result()
           ^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/concurrent/futures/_base.py", line 401, in __get_result
    raise self._exception
  File "<console>", line 1, in <module>
  File "/home/anvial/Projects/python-libjuju/juju/controller.py", line 139, in connect
    await self.update_endpoints()
  File "/home/anvial/Projects/python-libjuju/juju/controller.py", line 148, in update_endpoints
    except errors.JujuPermissionError:
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: module 'juju.errors' has no attribute 'JujuPermissionError'

PS: question - why do we need the juju register step in the QA?

[anvial]

updated comment

[cderici]

AttributeError: module 'juju.errors' has no attribute 'JujuPermissionError'

I have no idea how that attribute is lost in between my branches, thanks for actually running it so it's caught. Updating now 👍

PS: question - why do we need the juju register step in the QA?

Yeah we don't need it, I tried a bunch of different things in my local and copy/pasted these steps into the QA from my terminal, so that must've lingered in there by mistake.

[anvial]

@cderici,

Still have the problems on the last QA step:

>>> await c.connect(username='caner', password='w')
Traceback (most recent call last):
  File "/home/anvial/Projects/python-libjuju/juju/controller.py", line 143, in update_endpoints
    info = await self.info()
           ^^^^^^^^^^^^^^^^^
  File "/home/anvial/Projects/python-libjuju/juju/controller.py", line 289, in info
    raise errors.JujuPermissionError('Requires access to controller model.')
          ^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: module 'juju.errors' has no attribute 'JujuPermissionError'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.11/asyncio/__main__.py", line 58, in runcode
    return future.result()
           ^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/concurrent/futures/_base.py", line 456, in result
    return self.__get_result()
           ^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/concurrent/futures/_base.py", line 401, in __get_result
    raise self._exception
  File "<console>", line 1, in <module>
  File "/home/anvial/Projects/python-libjuju/juju/controller.py", line 139, in connect
    await self.update_endpoints()
  File "/home/anvial/Projects/python-libjuju/juju/controller.py", line 148, in update_endpoints
    except errors.JujuPermissionError:
           ^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: module 'juju.errors' has no attribute 'JujuPermissionError'

[anvial]

ups, I forgot to checkout...

Looks like everything now works fine:

>>> await c.connect(username='caner', password='w')
This user doesn't have at least read access to the controller model, so endpoints are not updated after connection.

[cderici]

/merge