Add authorization to AuthenticatedFileHandler

[jiajunjie]

jupyter_server/docs/source/operators/security.rst

Lines 251 to 255 in 31cdf4d

	* - contents
	- read files
	- modify files (create, modify, delete)
	-
	- ``/api/contents``, ``/view``, ``/files``

/files requests are handled by AuthenticatedFileHandler by default.

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 75.00000% with 2 lines in your changes missing coverage. Please review.

Project coverage is 75.44%. Comparing base (e66306d) to head (e9b0831).
Report is 292 commits behind head on main.

Files with missing lines	Patch %	Lines
jupyter_server/auth/authorizer.py	50.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1021      +/-   ##
==========================================
- Coverage   76.28%   75.44%   -0.85%     
==========================================
  Files          63       63              
  Lines        8228     8235       +7     
  Branches     1637     1642       +5     
==========================================
- Hits         6277     6213      -64     
- Misses       1546     1618      +72     
+ Partials      405      404       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[jiajunjie]

@blink1073 Please take a look. /files requests handled by AuthenticatedFileHandler are not authorized. I suggest adding the authorization.

[kevin-bates]

These changes look right to me, but having not implemented authorization-related code, I'd prefer others take look.

One thing I do notice is that this needs to coordinate the resource name "contents" with the same in ContentsManager. I wonder if it would be beneficial to add an enumerated type (or equivalent) in auth/resources.py(?) that provides canonical resource names that authorizing methods can set and authorizers can validate/reference against?

I'm not suggesting this be done in this PR, but, if others agree, is probably something that should be done fairly soon. The enum would also serve as the single location for identifying what resources are being authorized.

[Zsailer]

Thanks, @jiajunjie. This LGTM!

[welcome]

Congrats on your first merged pull request in this project! 🎉

Thank you for contributing, we are very proud of you! ❤️