allow status requests for anonymous users in mapi/internal api

Author: Camelia-Orcid

orcid-api-web/src/main/resources/orcid-api-security-context.xml

@@ -20,9 +20,24 @@
 	<sec:http pattern="/v2**/o2c.html" security="none"/>
 	<sec:http pattern="/v3**/o2c.html" security="none"/>
 
-	<!--  Status check -->
-	<sec:http pattern="/v*/status" security="none"/>
-	<sec:http pattern="/v*/apiStatus" security="none"/>
+    <!-- Status checks allow anonymous access, but still process bearer tokens when present -->
+    <sec:http pattern="/v*/status" create-session="stateless">
+        <sec:csrf disabled="true"/>
+        <sec:anonymous enabled="true" />
+        <sec:http-basic entry-point-ref="apiAuthenticationEntryPoint" />
+        <sec:custom-filter ref="orcidBearerTokenFilter" before="PRE_AUTH_FILTER" />
+        <sec:intercept-url pattern="/**" access="permitAll"/>
+        <sec:access-denied-handler ref="orcidAPIAccessDeniedHandler" />
+    </sec:http>
+
+    <sec:http pattern="/v*/apiStatus" create-session="stateless">
+        <sec:csrf disabled="true"/>
+        <sec:anonymous enabled="true" />
+        <sec:http-basic entry-point-ref="apiAuthenticationEntryPoint" />
+        <sec:custom-filter ref="orcidBearerTokenFilter" before="PRE_AUTH_FILTER" />
+        <sec:intercept-url pattern="/**" access="permitAll"/>
+        <sec:access-denied-handler ref="orcidAPIAccessDeniedHandler" />
+    </sec:http>
 
     <!-- Token endpoint -->
     <sec:http pattern="/oauth/token" security="none" />

orcid-internal-api/src/main/resources/orcid-internal-api-security-context.xml

@@ -12,6 +12,16 @@
     <!-- Token endpoint -->
     <sec:http pattern="/oauth/token" security="none"/>
 
+    <!-- Status check allows anonymous access, but still processes bearer tokens when present -->
+    <sec:http pattern="/status" create-session="stateless" >
+        <sec:csrf disabled="true"/>
+        <sec:anonymous enabled="true" />
+        <sec:http-basic entry-point-ref="apiAuthenticationEntryPoint" />
+        <sec:custom-filter ref="orcidBearerTokenFilter" before="PRE_AUTH_FILTER" />
+        <sec:intercept-url pattern="/**" access="permitAll"/>
+        <sec:access-denied-handler ref="orcidAPIAccessDeniedHandler" />
+    </sec:http>
+
     <sec:http create-session="stateless" >
         <sec:csrf disabled="true"/>
         <sec:anonymous enabled="true" />