Fix permission check on the ui config endpoint

[jedcunningham]

This is just config for the UI, not the whole Airflow instances config, which is what the config permission for users controls. If the user doesn't have the config permission, without this change, the user cannot use the UI at all.

So, instead we just check that the user is authenticated at all.

You can reproduce the issue by using this auth manager:

class NoConfigSimpleAuthManager(SimpleAuthManager):
    def is_authorized_configuration(
        self,
        *,
        method: ResourceMethod,
        user: SimpleAuthManagerUser,
        details: ConfigurationDetails | None = None,
    ) -> bool:
        return False

[jason810496]

Middleware is applying to all endpoints, right? In this case, we may want to limit if the endpoint is /config.

IMHO, the current requires_authenticated authorization dependency is still more appropriate than using middleware. Middleware is better suited when all routes require the same condition, but in our case, we only want to limit access to the /config endpoint.

Alternatively, using _: GetUserDep directly in the route might be simpler.
I just checked that all UI endpoints use requires_access_<entity> dependencies, except for get_auth_menus, which uses user: GetUserDep.

[pierrejeambrun]

Looks good to me.

With the current usage I think the dependency is more convenient than a whole Middleware just for 1 route.

Beside the small nits mentioned above. (GetUserDep)

[jedcunningham]

Merging, failure is unrelated and already fixed.

[github-actions]

Backport successfully created: v3-0-test

Status	Branch	Result
✅	v3-0-test