editoast: add authorization to the rolling stock endpoints

[younesschrifi]

Add authorization to the rolling stock and light rolling stock endpoints.

Related ticket: https://github.com/osrd-project/osrd-confidential/issues/1064

Warning

This PR is a feature branch and is not ready for review yet.

TODO

Backend - Add authorization on the following endpoints:

• POST /authz/grants/: editoast: allow rolling stock grants revoking in POST:/authz/grants #17242 editoast: POST:/authz/grants make it possible to give rolling stock grants #17245
• GET /rolling_stock/{rolling_stock_id}: CanRead editoast: add GET /rolling_stock/{id} and GET /rolling_stock/name privileges check #17218
• GET /rolling_stock/name/{rolling_stock_name}: CanRead editoast: add GET /rolling_stock/{id} and GET /rolling_stock/name privileges check #17218
• GET /light_rolling_stock/: filter to readable IDs editoast: list rolling_stocks privileges #17243
• GET /light_rolling_stock/{rolling_stock_id}: CanRead editoast: add GET /rolling_stock/{id} and GET /rolling_stock/name privileges check #17218
• GET /light_rolling_stock/name/{rolling_stock_name}: CanRead editoast: add GET /rolling_stock/{id} and GET /rolling_stock/name privileges check #17218
• POST /rolling_stock/: grant Owner via SystemAuthorizer POST:/rolling_stock: give the request issuer ownership of the created rolling stock in the authorization store #17875
• PUT /rolling_stock/{rolling_stock_id}: CanWrite editoast: add check privileges for delete and put rolling stock endpoint #17359
• DELETE /rolling_stock/{rolling_stock_id}: CanDelete editoast: add check privileges for delete and put rolling stock endpoint #17359
• PATCH /rolling_stock/{rolling_stock_id}/locked: CanWrite editoast: add privileges check for patch /rolling_stock/{id}/locked endpoint #17402
• POST /rolling_stock/{rolling_stock_id}/livery: CanWrite editoast: add authorization to POST:/rolling_stock/{id}/livery #17392
• GET /rolling_stock/{rolling_stock_id}/usage: CanRead editoast: add authorization to GET:rolling_stock/{id}/usage #17383
• POST /timetable/{id}/stdcm: CanRead for every rolling stock editoast: views: POST:/timetable/{id}/stdcm endpoint: add authorization for the rolling stocks used in the query #17433
• All the endpoints which are calling pathfinding_from_train_batch, core_task or something which depends on them (example: batch simulations).
  • POST:/level_crossing_occupancy: CanRead, filter out the trains that are unauthorized for the user (editoast : add authorization to level crossing occupancy endpoint #17993) (editoast: refactor level_crossing_occupancy endpoint #18031)
  • POST:/train_schedules/project_path_op: CanRead, same thing as train_schedule/track_occupancy. (editoast: add authorisation check on project_path_op #18007) (editoast: fix project_path and project_path_op 403 error #18116)
  • POST:/train_schedules/project_path: CanRead, 403 Forbidden is some train schedules are unauthorized (editoast: add privilege check for project path endpoint #18025) (editoast: fix project_path and project_path_op 403 error #18116)
  • GET:/timetable/{id}/requirements: only available for admins or when authz is skipped (endpoint called by core). editoast: only authorize admins to use GET:/timetable/{id}/requirements #18021
  • GET:/timetable/{id}/conflicts: CanRead, also filter out the unauthorized trains editoast: filter out unauthorized trains in GET:/timetable/id/conflicts #18024
  • POST:/train_schedule/occupancy_blocks: CanRead, filter out unauhtorized rolling stocks editoast: filter forbidden trains and exceptions in POST:/train_schedule/occupancy_blocks #18104
  • GET:/train_schedule/{id}/etcs_braking_curves: CanRead, 403 Forbidden if unauthorized editoast: require Reader grant on the rolling stock in GET: /train_schedule/{id}/etcs_braking_curves #18019
  • POST:/train_schedule/track_occupancy: CanRead, if the endpoint is called with use_simulation, then unauthorized trains should trigger a 403 response from the endpoint. If there is no simulation, the train schedules authorization is skipped. editoast: add check for track occupancy #18012
• GET:train_schedule/{id}/path: CanRead, 403 Forbidden if unauthorized editoast: authorize the rolling stock in GET:/train_schedule/{id}/path #18013
• GET /rolling_stock/power_restrictions? no authorization

[Sh099078]

rebased on dev

[Sh099078]

rebase on dev + update obsolete commit name in the feature branch

[younesschrifi]

rebase on dev

[Sh099078]

rebased on dev

[Sh099078]

rebased on dev

[github-actions]

⚠️ API changes

This Pull Request introduces some changes in the API:

• please own it: notify or even prepare dedicated PR(s) to consumer projects

[Sh099078]

rebase on dev

[Sh099078]

rebased on dev

[Sh099078]

rebased on dev

[Sh099078]

rebased on dev