ONYX-20 | Added Permissions API path for check permissions

[anujachaitanya]

Torkeep write authorization was failing against the Permissions API because write requests were sent using the concrete request path instead of the templated route expected by policy.

Problem

GET requests succeed because they use the templated route:
/observations/{collection}

But PUT/POST/DELETE used:
/observations/<collection>/<observationID>

The Permissions API policy expects:
/observations/{collection}/{observationID}

Because the route key did not match the configured policy, write authorization failed.

Fix

Update RepoAction.checkWritePermission to:

• use the templated route /observations/{collection}/{observationID}
• send collection and observationID in the request body passed to authoriseRoute

Result

Write authorization now matches the configured Permissions API policy for:

• PUT
• POST
• DELETE

[brianmajor]

Looks good to me.

[pdowler]

This is nominally correct and was missed in the previous, so good find.

However, the observation URI includes additional text and the {observationID} subpath is only part of it... there is some logic to separating these that complicates this and doesn't add anything.

Instead: I have updated the torkeep route permissions in PAPI to only check the {collection} so the jsonBody only needs to include collection. That's actually more in line with how this is expected to work in general and should have been done that way from the beginning.

see https://gitlab.com/ska-telescope/src/src-service-apis/ska-src-permissions-api/-/merge_requests/165

[pdowler]

Since it is late there, I think I will pull your commit and tweak it myself so I can get the new image published today... will let you know how it goes.

[pdowler]

There was also a mistake in the PAPI rules (the prod exchange and route had different serviceName values) so the MR noted above includes that fix as well; once that is released I will be able to fully test.

You commits are part of PR #266 now.

[pdowler]

small rework in PR #266