fix: enforce app_provider_id ownership on EAM and TI app references

George Papathanailrequested to merge
fix/eam-ownership-checks into develop

What

Adds app_provider_id ownership checks to the Edge App Management endpoints that act on an app, instance or deployment by ID, and to the appId check in Traffic Influence create. Before this, any authenticated caller could read, delete, deploy or reference resources owned by another app provider.

Changes

Endpoint Owner source On mismatch
GET /apps/{appId} service_specification.app_provider_id from the SRM catalog 404
DELETE /apps/{appId} same, checked before the SRM delete 404, nothing deleted
POST /appinstances, POST /deployments (appId) same 400 "App … is not registered"
POST /traffic-influences (appId) same (replaces the previous tenant_id comparison) 400
DELETE /appinstances/{id}, DELETE /deployments/{id} app_provider_id of the deploy operation 404, no terminate published
  • Reads and deletes return 404 rather than 403, so callers can't probe which IDs exist (same pattern as QoD sessions and TI).
  • Ownership is based on app_provider_id only; tenant_id is not used.
  • New helper _get_owned_app in EdgeApplicationManagementService; the router now passes the caller to get_app.

Behaviour notes

  • An instance or deployment whose deploy operation row is missing now returns 404 on delete. This matches how GET /deployments already filters.
  • The app checks make one SRM catalog read. GET /apps/{appId} already did this; for the other paths it's one extra call.

Tests

  • New tests per endpoint: another provider is rejected, and nothing is deleted, persisted or published.
  • Test fixtures now seed an owner: the SRM catalog entry, and the deploy operation for delete tests.
  • The TI test for the old tenant_id rule is replaced by test_other_providers_app_id_is_rejected.
  • pytest tests/unit: 1146 passed. ruff, ruff format and mypy are clean.

Merge request reports