fix(auth): don't run any authentication logic if auth is disabled

adfinis · Jul 28, 2023 · 564b504 · 564b504
1 parent a1db060
commit 564b504
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/document_merge_service/api/authentication.py b/document_merge_service/api/authentication.py
@@ -85,6 +85,9 @@ def get_userinfo(self, token):
         return response.json()
 
     def authenticate(self, request):
+        if not settings.REQUIRE_AUTHENTICATION:
+            return None
+
         token = self.get_bearer_token(request)
         if token is None:
             return None

diff --git a/document_merge_service/api/tests/test_authentication.py b/document_merge_service/api/tests/test_authentication.py
@@ -22,6 +22,8 @@
 def test_bearer_token_authentication_authenticate(
     rf, authentication_header, error, requests_mock, settings, status_code
 ):
+    settings.REQUIRE_AUTHENTICATION = True
+
     userinfo = {"sub": "1"}
     requests_mock.get(
         settings.OIDC_USERINFO_ENDPOINT,
@@ -51,6 +53,7 @@ def test_bearer_token_authentication_authenticate(
 def test_bearer_token_authentication_authenticate_groups_claim(
     settings, requests_mock, rf
 ):
+    settings.REQUIRE_AUTHENTICATION = True
     settings.OIDC_GROUPS_CLAIM = "document-merge-service"
 
     userinfo = {"sub": "1", settings.OIDC_GROUPS_CLAIM: ["test"]}