Fix rest user info to match API auth with Webapp Auth

[cghyzel]

Fixes the restUserInfo function to return Trino Gateway Roles (ADMIN, USER, API) to the Webapp, which is what the webapp expects.

Additional context and related issues

I opened this PR to map LDAP groups to Trino gateway roles and then came up with this simpler solution.

The following configs will break in the current (prior to this commit) version of Trino gateway because the admin user will not have admin privileges within the webapp like it should. This is because the webapp checks role membership by comparing the roles passed to those in an enum.

breaking auth example:

authorization:
    admin: .*FOO.*
    user: .*BAR.*
    api: .*BAZ.*

presetUsers:
    admin1:
        password: password
        privileges: FOO_BAR
    user1:
        password: password
        privileges: BAR_BAZ

This broken example works as expected after this fix.

This is how the webapp checks role membership:
https://github.com/trinodb/trino-gateway/blob/739ec5e67799dd5df0ab8aaec7934e21a63507fa/webapp/src/store/access.ts#L73C9-L76C9

And where those role membership checks are made:

trino-gateway/webapp/src/components/selector.tsx

Line 80 in ac407dc

{access.hasRole(Role.ADMIN) && (

trino-gateway/webapp/src/components/cluster.tsx

Line 89 in ac407dc

{access.hasRole(Role.ADMIN) && (

trino-gateway/webapp/src/components/history.tsx

Line 93 in ac407dc

<Form.Input field='user' label='User' initValue={form.user} disabled={!access.hasRole(Role.ADMIN)} style={{ width: 150 }} showClear />

trino-gateway/webapp/src/components/resource-group.tsx

Line 88 in ac407dc

{access.hasRole(Role.ADMIN) && (

Release notes

( ) This is not user-visible or is docs only, and no release notes are required.
( ) Release notes are required. Please propose a release note for me.
(X) Release notes are required, with the following suggested text:

* fixed userInfo resource to pass role information used by the api, so that webapp auth matches api auth

[oneonestar]

securityContext.isUserInRole() is actually calling this:

trino-gateway/gateway-ha/src/main/java/io/trino/gateway/ha/security/LbAuthorizer.java

Line 34 in ac407dc

public boolean authorize(LbPrincipal principal,

authorization:
    admin: .*FOO.*
    user: .*BAR.*
    api: .*BAZ.*

presetUsers:
    admin1:
        password: password
        privileges: FOO_BAR
    user1:
        password: password
        privileges: BAR_BAZ

authentication:
    defaultType: "form"
    form:
        selfSignKeyPair:
            privateKeyRsa: docs/private.pem
            publicKeyRsa: docs/public.pem

Before:

After:

[oneonestar]

LGTM.

nit: We should have a test for this.

[Chaho12]

Just tested and it seems to work well!
Please add same logic to GatewayWebAppResource

• https://github.com/trinodb/trino-gateway/blob/main/gateway-ha/src/main/java/io/trino/gateway/ha/resource/GatewayWebAppResource.java#L111

[andythsu]

securityContext.isUserInRole() is actually calling this:

trino-gateway/gateway-ha/src/main/java/io/trino/gateway/ha/security/LbAuthorizer.java

Line 34 in ac407dc

public boolean authorize(LbPrincipal principal,

authorization:
    admin: .*FOO.*
    user: .*BAR.*
    api: .*BAZ.*

presetUsers:
    admin1:
        password: password
        privileges: FOO_BAR
    user1:
        password: password
        privileges: BAR_BAZ

authentication:
    defaultType: "form"
    form:
        selfSignKeyPair:
            privateKeyRsa: docs/private.pem
            publicKeyRsa: docs/public.pem

Before:

After:

good call!

[ebyhr]

Please squash commits into one and follow the commit message guideline: https://github.com/trinodb/trino/blob/master/.github/DEVELOPMENT.md#format-git-commit-messages