editoast: authn: forbid the use of skip-authz and authn headers together

Signed-off-by: Younes Khoudli <younes.khoudli@epita.fr>

Author: Khoyo

editoast/src/authentication.rs

@@ -23,10 +23,7 @@ pub enum Mode {
         impersonator_name: String,
         impersonated_identity: String,
     },
-    Skip {
-        identity: Option<String>,
-        name: Option<String>,
-    },
+    Skip,
 }
 
 #[derive(Debug, Default)]
@@ -45,8 +42,9 @@ impl Mode {
                 skip: true,
                 identity,
                 name,
-                ..
-            } => Self::Skip { identity, name },
+                impersonate,
+            } if identity.is_none() && name.is_none() && impersonate.is_none() => Self::Skip,
+            AuthenticationParameters { skip: true, .. } => return Err(params),
             AuthenticationParameters {
                 impersonate: Some(impersonated_identity),
                 identity: Some(impersonator_identity),

editoast/src/views/server/middlewares.rs

@@ -158,11 +158,7 @@ pub(in crate::views) async fn authentication_validation_middleware(
     }
 
     let (user, roles_prot) = match &authn {
-        crate::authentication::Mode::Authenticated { identity, name }
-        | crate::authentication::Mode::Skip {
-            identity: Some(identity),
-            name: Some(name),
-        } => {
+        crate::authentication::Mode::Authenticated { identity, name } => {
             let conn = db_pool.get().await?;
             conn.transaction(async |conn| {
                 let user =
@@ -215,7 +211,7 @@ pub(in crate::views) async fn authentication_validation_middleware(
             })
             .await?
         }
-        crate::authentication::Mode::Skip { .. } => (None, ::authz::v2::Protected::default()),
+        crate::authentication::Mode::Skip => (None, ::authz::v2::Protected::default()),
         crate::authentication::Mode::Unauthenticated => {
             return Err(AuthorizationError::Unauthenticated.into());
         }