feat: Make db-anon-role optional

Without db-anon-role, PostgREST will block any anonymous access without hitting the database.

Resolves #1689, Ref #1823

test/spec/Feature/NoAnonSpec.hs

@@ -0,0 +1,30 @@
+module Feature.NoAnonSpec where
+
+import Network.Wai (Application)
+
+import Network.HTTP.Types
+import Test.Hspec
+import Test.Hspec.Wai
+import Test.Hspec.Wai.JSON
+
+import Protolude  hiding (get)
+import SpecHelper
+
+spec :: SpecWith ((), Application)
+spec = describe "server started without anonymous role" $ do
+  it "behaves normally on attempted auth" $ do
+    -- token body: { "role": "postgrest_test_author" }
+    let auth = authHeaderJWT "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoicG9zdGdyZXN0X3Rlc3RfYXV0aG9yIn0.Xod-F15qsGL0WhdOCr2j3DdKuTw9QJERVgoFD3vGaWA"
+    request methodGet "/authors_only"
+        [auth]
+        ""
+      `shouldRespondWith`
+        200
+
+  it "responds with error when user does not attempt auth" $
+    get "/items"
+      `shouldRespondWith`
+        [json|{"message":"Anonymous access is disabled"}|]
+        { matchStatus  = 401
+        , matchHeaders = ["WWW-Authenticate" <:> "Bearer"]
+        }

test/spec/Main.hs

@@ -37,6 +37,7 @@ import qualified Feature.InsertSpec
 import qualified Feature.JsonOperatorSpec
 import qualified Feature.LegacyGucsSpec
 import qualified Feature.MultipleSchemaSpec
+import qualified Feature.NoAnonSpec
 import qualified Feature.NoJwtSpec
 import qualified Feature.NonexistentSchemaSpec
 import qualified Feature.OpenApiSpec
@@ -96,6 +97,7 @@ main = do
       maxRowsApp           = app testMaxRowsCfg
       disabledOpenApi      = app testDisabledOpenApiCfg
       proxyApp             = app testProxyCfg
+      noAnonApp            = app testCfgNoAnon
       noJwtApp             = app testCfgNoJWT
       binaryJwtApp         = app testCfgBinaryJWT
       audJwtApp            = app testCfgAudienceJWT
@@ -170,6 +172,10 @@ main = do
     parallel $ before proxyApp $
       describe "Feature.ProxySpec" Feature.ProxySpec.spec
 
+    -- this test runs without an anonymous role
+    parallel $ before noAnonApp $
+      describe "Feature.NoAnonSpec" Feature.NoAnonSpec.spec
+
     -- this test runs without a JWT secret
     parallel $ before noJwtApp $
       describe "Feature.NoJwtSpec" Feature.NoJwtSpec.spec

test/spec/SpecHelper.hs

@@ -76,7 +76,7 @@ baseCfg :: AppConfig
 baseCfg = let secret = Just $ encodeUtf8 "reallyreallyreallyreallyverysafe" in
   AppConfig {
     configAppSettings           = [ ("app.settings.app_host", "localhost") , ("app.settings.external_api_secret", "0123456789abcdef") ]
-  , configDbAnonRole            = "postgrest_test_anonymous"
+  , configDbAnonRole            = Just "postgrest_test_anonymous"
   , configDbChannel             = mempty
   , configDbChannelEnabled      = True
   , configDbExtraSearchPath     = []
@@ -118,6 +118,9 @@ testCfgDisallowRollback = baseCfg { configDbTxAllowOverride = False, configDbTxR
 testCfgForceRollback :: AppConfig
 testCfgForceRollback = baseCfg { configDbTxAllowOverride = False, configDbTxRollbackAll = True }
 
+testCfgNoAnon :: AppConfig
+testCfgNoAnon = baseCfg { configDbAnonRole = Nothing }
+
 testCfgNoJWT :: AppConfig
 testCfgNoJWT = baseCfg { configJwtSecret = Nothing, configJWKS = Nothing }