fix(api-gateway): make securityContext available to extendContext

[morford-brex]

Check List

• Tests have been run in packages where changes have been made if available
• Linter has been run for changed code
• Tests for the changes have been added if not covered yet
• Docs have been added / updated if required

Issue Reference this PR resolves
#10049 (comment)

[morford-brex]

@igorlukanin - would you be able to assign this to the appropriate reviewers? 🙏

[morford-brex]

@igorlukanin - would you be able to assign this to the appropriate reviewers? 🙏

@KSDaemon perhaps? 🙏

[KSDaemon]

I'd say @ovr is better here :)

[morford-brex]

I'd say @ovr is better here :)

@ovr - gentle bump here. also, not sure that the integration test failures are related to these changes but i may be missing some context

[morford-brex]

@KSDaemon - sorry for another ping but any chance you could help bump this? hoping to get unblocked on some SQL API usage here

[KSDaemon]

Hi @morford-brex, we'll try to have a look asap. Sorry for the delays, too busy...

[ovr]

First, I am sorry for the late reply.

@morford-brex Good catch! However, I believe it's correct to assign securityContext for req.securityContext instead of merging.

I assume that securityContext is correct for checkAuth in HTTP (see pic 1), while it's incorrect for WebSocket server and checkSqlAuth (SQL API).

I am OK with changing it once as the last mile instead of fixing it in (sql-server.ts#contextByNativeReq and SubscriptionServer.ts#processMessage), but I suggest using req.securityContext = securityContext instead of merging.

There is no need to merge it, because:

1. HTTP checkAuth will receive the same object. this.contextByReq(req, req.securityContext, getRequestIdFromRequest(req)), see pic 1
2. WS request doesn't have securityContext, it stores it separately
3. SQL API request doesn't have securityContext, it stores it separately

Thanks

[morford-brex]

no worries at all - thanks for the follow up!

i think that makes sense and just updated here to skip the merging and directly set it