add auth to all calls except login/logout

[adamkorynta]

add integration test that reads all endpoints from the OpenAPI and tests that they all throw 401 unauthorized error codes when the client is not authorized

Problem Description

Almost (if not all) GET endpoints are public, which can potentially leak sensitive information via properties.

Fixes #189.

Solution

Add required authorization to all endpoints except /credentials (this is the login) and /logout

how you tested the change

Created an integration test that scrapes the OpenAPI (which is auto generated by finding all registered endpoints) and makes a request against them for all available methods (GET/POST/DELETE/etc) and asserts that an unsessioned client will get an error code 401 response.

Where the following done:

• Tests. Check all that apply:
  • Unit tests created or modified that run during ant test.
  • Integration tests created or modified that run during integration testing
    (Formerly called regression tests.)
  • Test procedure descriptions for manual testing
• Was relevant documentation updated?
• Were relevant config element (e.g. XML data) updated as appropriate

[zack-rma]

Looks like there's one failing test due to the test call not being properly authenticated:

AlgorithmResourcesIT > getAlgorithmRefs() > OpenDCS-Postgres FAILED java.lang.AssertionError: 1 expectation failed. Expected status code is <200> but was <401>.

Otherwise these changes look good.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud