editoast: ignore user headers when skip-authz is present

Update whoami endpoint response accordingly. The special handling was
required when editoast could start with --disable-authorization. It is
not possible for the frontend to skip authorization with the
`x-osrd-skip-authz` header as it will be stripped by the gateway.

Co-authored-by: Younes Khoudli <younes.khoudli@epita.fr>
Signed-off-by: Younes Khoudli <younes.khoudli@epita.fr>
Signed-off-by: Loup Federico <16464925+Sh099078@users.noreply.github.com>

Author: Sh099078

editoast/src/authentication.rs

@@ -138,15 +138,7 @@ impl State {
                 let user = user.expect("providing the request user is required when Mode::Authenticated or Mode::Impersonating");
                 Ok(State::Authenticated { user, roles })
             }
-            Mode::Skip { .. } => {
-                // TODO review: Arguably the skip header should prevent any authentication info from being used
-                // however this would change whoami behavior for Tartine RMI
-                if let Some(user) = user {
-                    Ok(State::Authenticated { user, roles })
-                } else {
-                    Ok(State::Skip)
-                }
-            }
+            Mode::Skip { .. } => Ok(State::Skip),
         }
     }
 }

editoast/src/views/authz.rs

@@ -130,31 +130,18 @@ pub(in crate::views) struct WhoamiResponse {
     ))
 )]
 pub(in crate::views) async fn whoami(
-    Extension(authn): Extension<crate::authentication::Mode>,
     Extension(authn_state): Extension<crate::authentication::State>,
 ) -> Result<Json<WhoamiResponse>> {
-    let skip = matches!(authn, crate::authentication::Mode::Skip { .. });
-    if let Some(editoast_models::User { id, name }) = authn_state.user() {
-        let mut roles = HashSet::from_iter(authn_state.roles().iter().copied());
-        // Authorization is skipped by header, but identity headers are provided so we could fetch
-        // the user's roles, though Admin may be lacking.
-        if skip {
-            roles.insert(Role::Admin);
+    match authn_state {
+        crate::authentication::State::Skip => Err(AuthorizationError::Unauthenticated)?,
+        crate::authentication::State::Authenticated { user, roles } => {
+            let roles = HashSet::from_iter(roles);
+            Ok(Json(WhoamiResponse {
+                id: user.id,
+                name: user.name,
+                roles,
+            }))
         }
-        Ok(Json(WhoamiResponse {
-            id: *id,
-            name: name.clone(),
-            roles,
-        }))
-    } else if skip {
-        // TODO: don't return -1 and a hardcoded name, return a different schema instead, requires frontend changes
-        Ok(Json(WhoamiResponse {
-            id: -1,
-            name: "OSRD user".to_string(),
-            roles: HashSet::from([Role::Admin]),
-        }))
-    } else {
-        Err(AuthorizationError::Forbidden.into())
     }
 }
 
@@ -1832,38 +1819,23 @@ mod tests {
             .create()
             .await;
 
-        let user_data = app
-            .get("/authz/me")
+        app.get("/authz/me")
             .by_user(user.as_ref())
             .skip_authz()
             .await
-            .assert_status_ok()
-            .json::<WhoamiResponse>();
-
-        assert_eq!(
-            user_data,
-            WhoamiResponse {
-                id: user.id,
-                name: "Bob".to_string(),
-                roles: HashSet::from([Role::Admin]),
-            }
-        );
+            .assert_status_unauthorized();
     }
 
     #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
     async fn whoami_skip_with_unprivileged_user_info() {
         let app = test_app!().build();
         let user = app.user("test", "test").create().await;
 
-        let WhoamiResponse { roles, .. } = app
-            .get("/authz/me")
+        app.get("/authz/me")
             .by_user(user.as_ref())
             .skip_authz()
             .await
-            .assert_status_ok()
-            .json::<WhoamiResponse>();
-
-        assert_eq!(roles, HashSet::from([Role::Admin]));
+            .assert_status_unauthorized();
     }
 
     #[tokio::test(flavor = "multi_thread", worker_threads = 1)]
@@ -1990,23 +1962,13 @@ mod tests {
     async fn user_groups_skip_authz() {
         let app = test_app!().build();
         let user = app.user("test", "test").create().await;
-        let group = app.group("group").with_members([&user]).create().await;
 
         // With a user in the request
-        let groups = app
-            .get("/authz/me/groups")
+        app.get("/authz/me/groups")
             .by_user(user.as_ref())
             .skip_authz()
             .await
-            .assert_status_ok()
-            .json::<Vec<Group>>();
-        assert_eq!(
-            groups,
-            vec![editoast_models::Group {
-                id: group.id,
-                name: "group".to_owned(),
-            }]
-        );
+            .assert_status_unauthorized();
 
         // Without a user in the request
         app.get("/authz/me/groups")

editoast/src/views/server/middlewares.rs

@@ -239,6 +239,7 @@ pub(in crate::views) async fn authentication_validation_middleware(
     let state = crate::authentication::State::try_new(authn, user, roles.clone())?;
     span.record("authz.state", tracing::field::debug(&state));
     req.extensions_mut().insert(state);
+    req.extensions_mut().remove::<crate::authentication::Mode>();
     Ok(next.run(req).await)
 }