RSPEED-2435: fix rh-identity health probe path matching with root_path

When root_path is set (e.g. /api/lightspeed), the request path
becomes /api/lightspeed/liveness instead of /liveness. The exact
match fails and health probes get rejected with 401. Match only the
final path segment to handle any prefix.

Signed-off-by: Major Hayden <major@redhat.com>

Author: major

src/authentication/rh_identity.py

@@ -217,7 +217,7 @@ async def __call__(self, request: Request) -> AuthTuple:
         identity_header = request.headers.get("x-rh-identity")
         if not identity_header:
             # Skip auth for health probes when configured
-            if request.url.path in ("/readiness", "/liveness"):
+            if request.url.path.endswith(("/readiness", "/liveness")):
                 if configuration.authentication_configuration.skip_for_health_probes:
                     return NO_AUTH_TUPLE
             logger.warning("Missing x-rh-identity header")

tests/unit/authentication/test_rh_identity.py

@@ -111,6 +111,7 @@ def create_request_with_header(header_value: Optional[str]) -> Mock:
     """
     request = Mock(spec=Request)
     request.headers = {"x-rh-identity": header_value} if header_value else {}
+    request.url = Mock(path="/test")
     request.state = Mock()
     return request
 
@@ -467,7 +468,15 @@ def _mock_configuration(
         mocker.patch("authentication.rh_identity.configuration", mock_config)
 
     @pytest.mark.asyncio
-    @pytest.mark.parametrize("path", ["/readiness", "/liveness"])
+    @pytest.mark.parametrize(
+        "path",
+        [
+            "/readiness",
+            "/liveness",
+            "/api/lightspeed/readiness",
+            "/api/lightspeed/liveness",
+        ],
+    )
     async def test_probe_paths_skip_auth_when_enabled(
         self, mocker: MockerFixture, path: str
     ) -> None:
@@ -481,7 +490,15 @@ async def test_probe_paths_skip_auth_when_enabled(
         assert result == NO_AUTH_TUPLE
 
     @pytest.mark.asyncio
-    @pytest.mark.parametrize("path", ["/readiness", "/liveness"])
+    @pytest.mark.parametrize(
+        "path",
+        [
+            "/readiness",
+            "/liveness",
+            "/api/lightspeed/readiness",
+            "/api/lightspeed/liveness",
+        ],
+    )
     async def test_probe_paths_require_auth_when_disabled(
         self, mocker: MockerFixture, path: str
     ) -> None: