fix(auth): allow anonymous callers to GetJWKS and GetOpenIDConfiguration

[sdachepally]

Related issues

nvbug 6504386

Description

Two public Core gRPC calls, GetJWKS and GetOpenIDConfiguration, were wrongly returning 403 to callers with no client certificate, even though they're supposed to allow anonymous access.

Root cause: in InternalRBACRules::allowed, the "no client certificate" branch allowed a request only when the rule's principal set was exactly [Anonymous]. The affected rules are [Anonymous, Agent, ForgeAdminCLI, SiteAgent], so the exact-match check failed and certless callers were denied. The fix changes that check from exact equality to membership, so any rule that lists Anonymous allows certless callers, while rules without Anonymous still reject them.

Type of Change

• Add - New feature or capability
• Change - Changes in existing functionality
• Fix - Bug fixes
• Remove - Removed features or deprecated functionality
• Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

• This PR contains breaking changes

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No testing required (docs, internal refactor, etc.)

Ran Core locally with permission checks turned on and called the two RPCs with no client certificate:

• Before the fix: both returned 403.
• After the fix: both worked (no 403).

Additional Notes

One-line change in InternalRBACRules::allowed: check whether the rule contains Anonymous instead of checking that the rule equals exactly [Anonymous].

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: b345fb1e-e70f-4c2d-bc14-69a73a6adc42

📥 Commits

Reviewing files that changed from the base of the PR and between b5fac75 and 07405bd.

📒 Files selected for processing (1)

• crates/api-core/src/auth/internal_rbac_rules.rs

🚧 Files skipped from review as they are similar to previous changes (1)

• crates/api-core/src/auth/internal_rbac_rules.rs

Included review availability: Your plan includes up to 12 reviews per rolling hour; 10 remain after this review.

---

Summary by CodeRabbit

• Bug Fixes
  • Anonymous access now works when Anonymous is included alongside other principals in an access rule.
  • Certificate-free access to JWKS and OpenID configuration endpoints is now handled correctly.

Walkthrough

Anonymous access now succeeds when a rule includes Principal::Anonymous, even when other principals are present. Regression tests cover certless access to GetJWKS and GetOpenIDConfiguration.

Changes

Anonymous access authorization

Layer / File(s)	Summary
Anonymous principal matching and regression coverage crates/api-core/src/auth/internal_rbac_rules.rs	The empty-user-principal branch accepts rules that contain Principal::Anonymous. Regression tests verify certless access to GetJWKS and GetOpenIDConfiguration.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 07405

The change allows certificate-less callers to access the two intended public discovery APIs while continuing to reject rules that do not include anonymous access; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the fix for anonymous access to the two affected public Core gRPC calls.
Description check	✅ Passed	The description accurately explains the authorization bug, the membership-check fix, and the manual validation.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[sunilkumar-nvidia]

Could we add a regression test for this case? The existing anonymous test covers a rule containing only Anonymous (DiscoverMachine), while this fix is specifically for rules where Anonymous appears alongside other principals. An assertion that certless requests can access GetJWKS and GetOpenIDConfiguration would prevent this from regressing.