Public Webforms: Deep-link handling and security

[nospame]

Product Description

Public Web Apps Sessions let someone open a one-time link and fill a single, pre-designated form
without an HQ account. This PR is where that behavior is confined: a public session can reach only
the form-entry routes it needs, and is locked to the exact app, endpoint, and identity HQ bound the
link to — it cannot navigate to any other app or form.

Technical Summary

SAAS-19928, SAAS-19929, SAAS-19930

• Second of three public webforms PRs in this repo; builds on Public Webforms: Authentication #1791. Adds the confinement layer:
  • WebSecurityConfig: restrictPublicSession(...) default-deny allowlist on /validate_form and
    anyRequest. A public session may reach only get_endpoint + the in-form actions; new-form
    and validate_form are denied.
  • get_endpoint/new-repeat: sessionid cookie binding relaxed to required=false (public
    sessions carry no Django cookie).
  • HqUserDetailsBean: HQ-authoritative app_build_id + endpoint_id.
  • PublicSessionLockAspect (ordered ahead of all other aspects): overrides client-supplied app,
    endpoint, endpoint args, and identity with HQ's values; fails closed if they're missing.
  • UserRestoreAspect#configureRestoreFactory: a public session restores strictly as its
    HQ-authenticated user (no client username / restore-as / case id).
  • MenuSessionRunnerService: public sessions use endpoint navigation without the
    SESSION_ENDPOINTS toggle - rather than building out a new method of navigation or
    requiring the toggle to be enabled in HQ.

Code and PR description written or co-written by AI and edited by human. Review by commit.

Safety Assurance

Safety story

The core safety property is default-deny: restrictPublicSession only ever removes access, and
only when the principal is a public session — regular sessions get exactly their prior decision. The
lock aspect and restore pinning both fail closed on missing authoritative values, and a public
session restores under its own synthetic user, so no real user's sandbox or identity is touched.
Aspect ordering (a subtle correctness requirement) is guarded by a dedicated weaving test after a
real ordering bug was caught there. Still inert in production until HQ issues links.

Automated test coverage

• SessionAuthTests — allowlist: allowed routes not 403, new-form/validate_form denied, regular
  sessions unaffected.
• PublicSessionLockAspectTest — app/endpoint/identity override + fail-closed cases.
• PublicSessionLockAspectWeavingTest — proves the aspect actually weaves and is correctly ordered.
• EndpointLaunchTest — public launch without the SESSION_ENDPOINTS toggle.
• HqUserDetailsTests + test harness (@WithHqUser public flag).

QA Plan

Public Webforms will get end-to-end QA before its release.

Special deploy instructions

• Cross-repo dependency: relies on HQ's session_details returning app_build_id + endpoint_id
  for public sessions. Safe to deploy formplayer first (feature stays dark until HQ issues links), but
  the feature must not be enabled on HQ until this is deployed.

Rollback instructions

• This PR can be reverted after deploy with no further considerations.

Review

• The set of people pinged as reviewers is appropriate for the level of risk of the change.

[codecov]

Codecov Report

❌ Patch coverage is 86.95652% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 70.45%. Comparing base (0388456) to head (ca819c9).

Files with missing lines	Patch %	Lines
...re/formplayer/aspects/PublicSessionLockAspect.java	83.33%	1 Missing and 4 partials ⚠️
...re/formplayer/configuration/WebSecurityConfig.java	88.88%	0 Missing and 2 partials ⚠️
...commcare/formplayer/aspects/UserRestoreAspect.java	80.00%	0 Missing and 1 partial ⚠️
...ava/org/commcare/formplayer/util/RequestUtils.java	66.66%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@                      Coverage Diff                       @@
##             ejp/public-webforms-auth    #1792      +/-   ##
==============================================================
+ Coverage                       70.28%   70.45%   +0.17%     
- Complexity                       2046     2079      +33     
==============================================================
  Files                             259      260       +1     
  Lines                            8039     8103      +64     
  Branches                          767      790      +23     
==============================================================
+ Hits                             5650     5709      +59     
+ Misses                           2104     2099       -5     
- Partials                          285      295      +10     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.