support require-adobe-auth on sequences

[moritzraho]

Describe the bug
Currently setting the annotation on a sequence doesn't add the /adobeio/shared-validators-v1/app-registry action to the sequence and hence doesn't protect the sequence. Individual web actions "components" of the sequence should also be protected with the require-whisk-annotation

Workaround

A workaround is to configure the protection manually:
EDIT: See comments below, you may want to remove the require-whisk-auth annotation and remove the web option instead.

runtimeManifest:
  packages:
    dx-excshell-1:
      license: Apache-2.0
      actions:
        action1:
          function: actions/action1/index.js
          web: 'yes'
          runtime: nodejs:18
          annotations:
            require-whisk-auth: true
        action2:
          function: actions/action2/index.js
          web: 'yes'
          runtime: nodejs:18
          annotations:
            require-whisk-auth: true
      sequences:
        mysequence:
          web: 'yes'
          actions: /adobeio/shared-validators-v1/app-registry, action1, action2

[shazron]

why does an action need require-whisk-auth here? Especially since they might want it to be public, as well as in a sequence?

If they wanted the action to require-whisk-auth, they can make it a non-web-action (web: false)

[aiojbot]

JIRA issue created: https://jira.corp.adobe.com/browse/ACNA-3424

[moritzraho]

@shazron the idea is to protect the actions in the sequence, otherwise the sequence is not secured. It's one way of doing it, the other way would be to delete the web annotation (just like we do when parsing require-adobe-auth for non-sequences)

Here is an updated workaround

runtimeManifest:
  packages:
    dx-excshell-1:
      license: Apache-2.0
      actions:
        action1:
          function: actions/action1/index.js
          runtime: nodejs:18
        action2:
          function: actions/action2/index.js
          runtime: nodejs:18
      sequences:
        mysequence:
          web: 'yes'
          actions: /adobeio/shared-validators-v1/app-registry, action1, action2