fix: add authentification through JSON body for API v3 WRITE requests

[stephanegigandet]

This PR adds authentification for API v3 WRITE requests, by providing user_id and password fields in the JSON body of the request (it was documented in OpenAPI, but not implemented).

Also added tests for authentification for API READ + WRITE for v2 + v3

[hangy]

I kinda missed the discussion: Why do we want the password in the JSON body instead of HTTP Basic Auth or a token (ORY Hydra+Kratos)? HTTP bodies might be logged somewhere, and using HTTP Headers for auth is a more standard behaviour.

OpenAPI has built-in support for basic auth, which is often also supported by design tools (ie. Swagger): https://swagger.io/docs/specification/authentication/basic-authentication/

[stephanegigandet]

I kinda missed the discussion: Why do we want the password in the JSON body instead of HTTP Basic Auth or a token (ORY Hydra+Kratos)? HTTP bodies might be logged somewhere, and using HTTP Headers for auth is a more standard behaviour.

OpenAPI has built-in support for basic auth, which is often also supported by design tools (ie. Swagger): https://swagger.io/docs/specification/authentication/basic-authentication/

Hi @hangy. Thanks for the feedback. We will use HTTP basic auth soon, this is a temporary solution because we need something working as soon as possible as we need the mobile app to support packagings before an event that happens on January 12th.

There is a discussion about it here: #7564 (comment)

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[alexgarel]

All good !

[alexgarel]

In python if you use a dict as a default parameter, it will be shared between every call.
(so you prefer to initialize with "undefined" and then if request_ref is undefined, you create a new dict).

But this seems to work in perl (I've done a test !)