fix(auth): scope info/collections expiry exemption to its exact route (#2435)

* fix(auth): scope info/collections expiry exemption to its exact route

The Hawk expiry exemption for the legacy read-only /1.5/{uid}/info/collections endpoint was applied to any path ending in "/info/collections", which also matches the storage route /1.5/{uid}/storage/info/collections (collection "info", item "collections"). Match the legacy route exactly (four path segments) so the exemption no longer applies to that writable storage item. Adds a unit test.

Closes STOR-620

* ci: install clippy/rustfmt components and python deps on cache miss

The clippy, clippy-release, and rust-checks jobs only restored the Rust toolchain cache and ran `rustup default`, which yields a toolchain without the clippy/rustfmt components when the `*-rust-toolchain-${RUST_VERSION}` cache is absent (e.g. after a RUST_VERSION bump) or holds a component-less toolchain, causing "cargo-clippy is not installed" failures. These jobs now install the components idempotently. Likewise, python-checks now runs `poetry install` so ruff/mypy/etc. are present when the virtualenv cache misses.

Author: taddes

.github/workflows/main-workflow.yml

@@ -118,6 +118,9 @@ jobs:
       - name: Install Poetry
         run: pip3 install poetry
 
+      - name: Install Python dependencies
+        run: poetry install --with tokenserver-unit-tests,dev --no-interaction --no-ansi
+
       - name: Python Format Check
         run: poetry run ruff format --diff tools
 
@@ -152,7 +155,7 @@ jobs:
           key: ${{ runner.os }}-rust-toolchain-${{ env.RUST_VERSION }}
 
       - name: Set Rust toolchain
-        run: rustup default ${RUST_VERSION}
+        run: rustup toolchain install ${RUST_VERSION} --component rustfmt --component clippy --no-self-update && rustup default ${RUST_VERSION}
 
       - name: Cache cargo-audit
         id: cache-cargo-audit
@@ -209,7 +212,7 @@ jobs:
           key: ${{ runner.os }}-rust-toolchain-${{ env.RUST_VERSION }}
 
       - name: Set Rust toolchain
-        run: rustup default ${RUST_VERSION}
+        run: rustup toolchain install ${RUST_VERSION} --component rustfmt --component clippy --no-self-update && rustup default ${RUST_VERSION}
 
       - name: Rust Clippy ${{ matrix.target }}
         run: make clippy_${{ matrix.target }}
@@ -248,7 +251,7 @@ jobs:
             ${{ runner.os }}-cargo-release-${{ matrix.target }}-
 
       - name: Set Rust toolchain
-        run: rustup default ${RUST_VERSION}
+        run: rustup toolchain install ${RUST_VERSION} --component rustfmt --component clippy --no-self-update && rustup default ${RUST_VERSION}
 
       - name: Rust Clippy release ${{ matrix.target }}
         run: make clippy_release_${{ matrix.target }}

syncserver/src/web/auth.rs

@@ -187,7 +187,7 @@ impl HawkPayload {
             80
         };
         let path = uri.path_and_query().ok_or(HawkErrorKind::MissingPath)?;
-        let expiry = if path.path().ends_with("/info/collections") {
+        let expiry = if is_info_collections_path(path.path()) {
             0
         } else {
             Utc::now().timestamp() as u64
@@ -197,6 +197,25 @@ impl HawkPayload {
     }
 }
 
+/// Matches only the legacy read-only `/1.5/{uid}/info/collections` endpoint,
+/// requiring exactly four path segments. An exact match is needed because a
+/// plain `/info/collections` suffix also matches the storage route
+/// `/1.5/{uid}/storage/info/collections` (collection `info`, item
+/// `collections`), which must not receive the same handling.
+fn is_info_collections_path(path: &str) -> bool {
+    let mut segments = path.trim_start_matches('/').split('/');
+    matches!(
+        (
+            segments.next(),
+            segments.next(),
+            segments.next(),
+            segments.next(),
+            segments.next(),
+        ),
+        (Some("1.5"), Some(uid), Some("info"), Some("collections"), None) if !uid.is_empty()
+    )
+}
+
 /// Helper function for [HMAC](https://tools.ietf.org/html/rfc2104) verification.
 fn verify_hmac(info: &[u8], key: &[u8], expected: &[u8]) -> ApiResult<()> {
     let mut hmac = Hmac::<Sha256>::new_from_slice(key)?;
@@ -208,7 +227,21 @@ fn verify_hmac(info: &[u8], key: &[u8], expected: &[u8]) -> ApiResult<()> {
 mod tests {
     use std::fmt::{self, Display, Formatter};
 
-    use super::{HawkPayload, Secrets};
+    use super::{HawkPayload, Secrets, is_info_collections_path};
+
+    #[test]
+    fn info_collections_exemption_matches_only_exact_route() {
+        // The legacy read-only endpoint is exempt.
+        assert!(is_info_collections_path("/1.5/123/info/collections"));
+        // The writable storage route shares the same suffix but must not match.
+        assert!(!is_info_collections_path(
+            "/1.5/123/storage/info/collections"
+        ));
+        // Other storage items must not match.
+        assert!(!is_info_collections_path("/1.5/123/storage/bookmarks/abc"));
+        // A trailing slash or extra segment must not match.
+        assert!(!is_info_collections_path("/1.5/123/info/collections/"));
+    }
 
     #[test]
     fn valid_header() {