Security hardening: replace unconditional NoopAuthorizationFilter with configurable/fail-closed auth

[themudhaxk]

Summary

OrionServer.configAuthFilter() unconditionally instantiates and registers NoopAuthorizationFilter — there is no config key or null check guarding it. That filter sets every request's security context to UserPrincipal("anonymous", authenticated=true) with ADMIN_ROLE before any handler runs, so every @RolesAllowed(ADMIN_ROLE) check on cluster management endpoints passes unconditionally on every deployment, regardless of how the server is configured.

This is a code-level issue, not a config issue — there is no operator-side workaround available without patching the source.

Affected code

// OrionServer.java
protected void configAuthFilter(OrionConf configuration, Environment environment) throws Exception {
    OrionAuthorizationFilter authorizer = new NoopAuthorizationFilter(); // no config guard
    authorizer.configure(configuration);
    environment.jersey().register(authorizer);
    environment.jersey().register(RolesAllowedDynamicFeature.class);
}

// NoopAuthorizationFilter.java
@Override
public void filter(ContainerRequestContext requestContext) throws IOException {
    OrionSecurityContext ctx = new OrionSecurityContext(
        new UserPrincipal("anonymous", true),
        ADMIN_ROLE_SET); // grants ADMIN_ROLE on every request
    requestContext.setSecurityContext(ctx);
}

Endpoints annotated @RolesAllowed(OrionConf.ADMIN_ROLE) — including cluster action dispatch, maintenance mode, and cost data — are effectively unauthenticated on every deployment cloned from this repo.

Suggested fix

Replace the unconditional new NoopAuthorizationFilter() with a configurable lookup: read authorization.filter.class from OrionConf, and throw IllegalStateException at startup when the key is absent (fail-closed). NoopAuthorizationFilter should only be usable in test/development contexts via explicit opt-in config, not as the production default.

A SampleAuthorizationFilter pattern (similar to what DoctorK shipped) in the repo would help operators understand the expected interface.

Happy to send a PR if the direction is agreed.