fix: honor read_only=false so e2e mutating requests are not rejected

The e2e leg was soft-failing (continue-on-error) with 23 failures.
Root cause (type b — wiring bug in RBAC, not the read-only middleware):

1. PRIMARY (19 failures): get_current_user() always granted role="viewer"
   when no user_id was stamped on request.state.  With auth disabled the
   AuthMiddleware is not in the stack, so user_id is never set — every
   unauthenticated caller got viewer, which blocked all routes declared with
   require_role("admin") or require_role("operator") with HTTP 403.

   Fix: create_fastapi_app() stamps app.state.auth_enabled=<flag>.
   get_current_user() reads that flag: auth disabled → role="admin"
   (unrestricted, operator intent); auth enabled but excluded path →
   role="viewer" (least privilege, unchanged).

2. SECONDARY (4 failures, previously masked by #1): list_templates and
   list_machines routes overlay result.total_count / result.next_cursor
   on the response payload.  Test mocks used plain Mock() objects, so
   auto-created attributes (total_count, next_cursor) were non-None Mock
   instances that survived the None-check and ended up in the JSONResponse,
   causing TypeError: Object of type Mock is not JSON serializable.

   Fix: explicitly set mock_result.total_count = None and
   mock_result.next_cursor = None in the four affected test cases so the
   route falls back to len(result.templates/machines).

Verification:
- read_only=True still blocks POST/PUT/DELETE with 403 READ_ONLY_MODE
- read_only=False (default) no longer blocks mutations
- auth_enabled=True + unauthenticated path still gets viewer (unchanged)
- 35/35 e2e tests pass; 386/386 unit/api tests pass; 0 regressions

Author: fgogolli

src/orb/api/dependencies.py

@@ -340,17 +340,30 @@ def get_current_user(request: Request) -> CurrentUser:
       - ``request.state.user_roles`` → raw roles list used to derive RBAC role
       - ``request.state.auth_result`` → full AuthResult (claims stored in metadata)
 
-    When auth is disabled (no ``user_id`` on state), falls back to an
-    anonymous viewer — least privilege, never admin.
+    When auth is disabled (``app.state.auth_enabled=False``), returns an
+    anonymous admin — unrestricted access because the operator has explicitly
+    opted out of authentication.  When auth is enabled but the request arrived
+    on an excluded path (no ``user_id`` on state), falls back to an anonymous
+    viewer — least privilege.
 
     Returns:
         CurrentUser with username, role, and raw claims.
     """
     user_id: str | None = getattr(request.state, "user_id", None)
 
     if not user_id:
-        # Auth disabled / excluded path — grant least privilege (viewer).
-        # Never elevate an unauthenticated caller to admin.
+        # When auth is explicitly disabled, no identity will ever be stamped
+        # on request.state (the AuthMiddleware is not in the stack).  In that
+        # case the operator has intentionally opened the API without
+        # authentication, so every caller should receive unrestricted access.
+        # We check app.state.auth_enabled (stamped by create_fastapi_app) to
+        # distinguish this from an auth-enabled deployment where a request
+        # arrived on an excluded path — that case keeps least privilege (viewer).
+        _app_state = getattr(getattr(request, "app", None), "state", None)
+        auth_enabled: bool = getattr(_app_state, "auth_enabled", True)
+        if not auth_enabled:
+            return CurrentUser(username="anonymous", role="admin", claims={})
+        # Auth enabled but no identity on state (excluded path) — least privilege.
         return CurrentUser(username="anonymous", role="viewer", claims={})
 
     raw_roles: list[str] = getattr(request.state, "user_roles", []) or []

src/orb/api/server.py

@@ -536,6 +536,11 @@ async def favicon() -> Any:
 
             return FileResponse(_favicon_path, media_type="image/png")
 
+    # Stamp auth-enabled status on app state so request-time dependencies
+    # (get_current_user) can distinguish "auth disabled → grant admin" from
+    # "auth enabled but excluded path → grant viewer".
+    app.state.auth_enabled = server_config.auth.enabled
+
     # Register API routers
     _register_routers(app)
 

tests/e2e/test_critical_path_e2e.py

@@ -373,6 +373,8 @@ def test_list_templates_returns_empty_list(self, app, client: TestClient):
         """GET /api/v1/templates/ returns empty list when no templates exist."""
         mock_result = Mock()
         mock_result.templates = []
+        mock_result.total_count = None
+        mock_result.next_cursor = None
         mock_orch = AsyncMock()
         mock_orch.execute = AsyncMock(return_value=mock_result)
 
@@ -401,6 +403,8 @@ def test_list_templates_returns_templates(self, app, client: TestClient):
         )
         mock_result = Mock()
         mock_result.templates = [mock_template]
+        mock_result.total_count = None
+        mock_result.next_cursor = None
         mock_orch = AsyncMock()
         mock_orch.execute = AsyncMock(return_value=mock_result)
 
@@ -647,6 +651,8 @@ def test_list_templates_with_provider_api_filter(self, app, client: TestClient):
         )
         mock_result = Mock()
         mock_result.templates = [mock_template]
+        mock_result.total_count = None
+        mock_result.next_cursor = None
         mock_orch = AsyncMock()
         mock_orch.execute = AsyncMock(return_value=mock_result)
 
@@ -757,6 +763,8 @@ def test_list_machines_endpoint_exists(self, app, client: TestClient):
         """GET /api/v1/machines/ endpoint is reachable and returns results."""
         mock_result = Mock()
         mock_result.machines = []
+        mock_result.total_count = None
+        mock_result.next_cursor = None
         mock_orch = AsyncMock()
         mock_orch.execute = AsyncMock(return_value=mock_result)