Bug 2075358 - Native Mojo REST endpoints serve anonymous requests when requirelogin is enabled

[Xzzz]

Summary

The native Mojo login helper (bugzilla.login in Bugzilla/App/Plugin/Login.pm) upgrades the login type to LOGIN_REQUIRED when the requirelogin parameter is on, but only acts on it for browser usage modes. For REST it falls through and returns the anonymous user, so native REST endpoints that allow anonymous access keep serving anonymous requests on a site that requires login. The legacy dispatcher's Bugzilla->login() refuses them with login_required.

Filed as its own bug rather than fixed inside a migration PR, since it changes behaviour for every native REST endpoint at once. This PR stands on its own and does not depend on any other open PR.

Changes

• Bugzilla/App/Plugin/Login.pm: when the login type is LOGIN_REQUIRED, the request is REST (USAGE_MODE_REST or USAGE_MODE_MOJO_REST) and no credentials authenticated, throw login_required instead of returning the anonymous user. The usage mode is normalized to USAGE_MODE_MOJO_REST first, for the same reason as the existing normalization above it: routes that authenticate before switching modes (e.g. /rest/configuration, /rest/bug/<id>/graph) would otherwise hit the legacy REST error path and return a 500
• t/app-login-requirelogin.t: with requirelogin on, anonymous GET /rest/configuration, GET /rest/classification/1 and GET /rest/product_accessible return 401 / code 410 and the same requests with an API key are not refused; with requirelogin off, anonymous requests are let through again
• Bugzilla/API/V1/Product.pm: remove the local _login stopgap that Bug 2071907 - Migrate Product REST resource to native Mojo API #2762 shipped with; get and get_products_by_type call the shared login helper again

Behaviour changes

With requirelogin on, anonymous requests to these native endpoints now get login_required (HTTP 401, code 410) instead of data:

• GET /rest/bug/<id>/graph (BugGraph)
• GET /rest/classification/<id_or_name>
• GET /rest/component/<product>/<component>
• GET /rest/configuration
• GET /rest/config/component_teams[/<team>]
• BMO's Triage endpoint

Product's endpoints already behaved this way through their own stopgap; they now get it from the helper, with no visible change.

With requirelogin off nothing changes, and authenticated requests are unaffected either way. Browser routes keep their existing redirect-to-login behaviour. Endpoints that authenticate by other means and never call the login helper (e.g. the GitHub webhooks) are unaffected. extensions/GitHubPullRequests/lib/API/V1/PullRequests.pm already passes LOGIN_REQUIRED and checks $user->id itself, so it returns the same 401 as before, now from the helper.

Test plan

• t/app-login-requirelogin.t
• t/app-login-disabled-account.t passes unchanged
• With requirelogin on: anonymous GET /rest/configuration, GET /rest/classification/1 and GET /rest/product_accessible return 401 / code 410; the same with an X-Bugzilla-API-Key header succeed
• With requirelogin off: the same anonymous requests succeed as before

Note

#2762 landed first with a local _login stopgap for this gap. Master is merged in, and this PR now removes it (see Changes).

References

• Bugzilla link: 2075358
• Blocks 2057358

[dklawren]

LGTM r=dkl