API token requests cannot access records restricted via CERN e-group role grants

[zzacharo]

Description

API requests authenticated with a Personal Access Token (PAT) fail with 403 on records whose access.grants contain a role-based grant (e.g. {"type": "role", "id": "cern-accounts-primary"}), even when the requesting user is a member of that CERN e-group. The same user accessing the same record via browser session works correctly.

This affects all records migrated from legacy CDS that use CERN e-group role grants.

Root cause

There are two separate identity loading paths:

• SSO login (invenio-oauthclient handlers/authorized.py):

groups_handler(resp) → session["unmanaged_roles_ids"] = {group_ids}
login_user(user) → identity_loaded fires
  └── cern_openid.on_identity_loaded → reads session → adds RoleNeed("cern-accounts-primary")

• PAT request (invenio-oauth2server provider.py):

get_token(access_token) → DB lookup only
g._login_user = oauth.user → identity_loaded fires
  └── cern_openid.on_identity_loaded → session empty → no RoleNeed 

Potential solutions

Fetch groups on-demand from CERN AuthZ API during PAT requests: In identity_loaded, detect PAT requests and call the AuthZ API to retrieve the user's current groups, with a short-lived cache (e.g. Redis, keyed by user ID + TTL). We need to implement it in a way that this can be used by other partners, defining their own group handler.

Con: adds latency and an external API dependency on every PAT request.