commit b545f0cae553bf0381b5df85079c7e0e11113ad3
author David Ostrovsky <david@ostrovsky.org> Sat Aug 11 10:40:26 2018 +0200
committer David Ostrovsky <david@ostrovsky.org> Fri Aug 31 08:41:06 2018 +0200
tree 1c2247ecb4ae5a08826f1e8dab3fdef5e9f8c1a3
parent 9932a888654ddb34d62d354ed3d0290fc973f4de

Ensure user authentication in AllRequestFilter filters

The current order of filters declaration make request authentication
only work when HTTP request is issued from the Gerrit UI, but not
work when REST API is used.

In Daemon#createWebInjector() we have this:

  [...]
  modules.add(RequestContextFilter.module());
  modules.add(AllRequestFilter.module());
  modules.add(RequestMetricsFilter.module());
  modules.add(H2CacheBasedWebSession.module());
  modules.add(sysInjector.getInstance(GitOverHttpModule.class));
  [...]

The are two major use cases to consider:

1. Gerrit UI request: when authenticated user session is found and set
in RequestContextFilter, before AllRequestFilter, that's why in
AllRequestFilter we have a user:

  Account: 1000000 username: admin

2. REST API request, e.g.:

  curl --user user http://localhost:8080/a/config/server/version
  "2.14.7-9-g9ebfce95b7-dirty"

Here the AllRequestFilter is bound before GitOverHttpModule, that
provides ProjectBasicAuthFilter filter, and thus, there is no identified
user:

  anonymous

Adapt the AllRequestFilter registration order to fix authentication also
for REST API requests.

This is needed for Javamelody's monitoring filter to work properly for
Prometheus scraping request:

  curl -u user http://localhost:8080/a/monitoring?format=prometheus

There is more context and discussions in these CLs:

https://gerrit-review.googlesource.com/c/plugins/javamelody/+/192411
https://gerrit-review.googlesource.com/c/plugins/javamelody/+/192170
https://gerrit-review.googlesource.com/c/gerrit/+/164991

Change-Id: I925e952474440cb612080dafd917a01dba8f3330