restapi: Restrict access to domain user API for non-admin users

[Artemi10]

Non-admin users can access the domain user API endpoints (GET /api/domains/{domainId}/users and GET /api/domains/{domainId}/users/{userId}), which is a security issue. This commit adds permission checks to these endpoints. If a user without admin permissions attempts to access them, a 403 Forbidden response will be returned.

• Before fix
  
  

• After fix
  
  

Are you the owner of the code you are sending in, or do you have permission of the owner?

Yes

[dupondje]

Please see how it's implemented in backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/resource/aaa/BackendUsersResource.java
There you also have isFiltered(), so implement with the same logic.

[Artemi10]

Please see how it's implemented in backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/resource/aaa/BackendUsersResource.java There you also have isFiltered(), so implement with the same logic.

@dupondje
Thanks for pointing that out!

I looked into the isFiltered() implementation in BackendUsersResource, but I noticed a potential issue: it respects the filter query parameter even for non-admin users. This means a non-admin could explicitly set filter=false in the request header and potentially bypass data filtering, which might expose sensitive information.

To avoid this, implemented a separate method isAdmin(). This way, I only check user permissions and do not take any request headers into account, ensuring stricter access control.

protected boolean isAdmin() {
DbUser user = getCurrent().getUser();
return user.isAdmin();
}