align JWT with ENABLE_AUTH

[MattShirley]

The existing setup has no connection between JWT and ENABLE_AUTH.

This PR introduces a jwt_required_if_auth_enabled decorator that requires a JWT only if ENABLE_AUTH=True. Otherwise, the endpoint will allow traffic without checking for a JWT.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.00%. Comparing base (5c13d51) to head (50cbd14).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #1213      +/-   ##
===========================================
+ Coverage    85.93%   86.00%   +0.06%     
===========================================
  Files           94       94              
  Lines         3236     3251      +15     
  Branches       371      372       +1     
===========================================
+ Hits          2781     2796      +15     
  Misses         380      380              
  Partials        75       75              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ponyisi]

Hi @MattShirley - I don't think this is quite what I was after, although I guess it addresses another failure mode.

The place where we are currently failing wrt Nebraska is the jwt_required decorator itself. Even if the optional argument is specified, if a token is present in the request, it will attempt to validate it. If ENABLE_AUTH is false, this validation will fail and the request will be rejected. The optional argument only means that the requests with no token will be accepted. So we need a new decorator that wraps jwt_required which skips all the logic if ENABLE_AUTH is false (or otherwise perhaps a super-decorator that returns jwt_required or a dummy depending on the configuration).

[MattShirley]

@ponyisi I added a no-op/dummy pass through decorator

[ponyisi]

I think the "optional"-ness of the JWT came from the idea that it would handle the case we're now protecting. If ENABLE_AUTH is set now, I don't think there is a case where we should not expect a JWT? (In which case we should get rid of the optional=True in all cases and this additional protection.)

[MattShirley]

I have removed both calls with optional=True