Return 404 when unauthorised to access resources

[Callum027]

When a user is not authorised to access a specific resource (e.g. did not create the resource, or not part of the project that owns the resource, or the project that created the resource), they should not be able to enumerate the resource in any way.

To prevent such users from inferring the existence of resources they should not have access to, change the policy enforcement for get resource such that it returns 404 Not Found instead of 403 Forbidden in these cases.

[tobias-urdin]

LGTM, let me know if it's good to merge

Pull request has been modified.

[Callum027]

Project the resource is located in:

# openstack project show 03837612201c42dfa746b56ef65af145
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description | None                             |
| domain_id   | default                          |
| enabled     | True                             |
| id          | 03837612201c42dfa746b56ef65af145 |
| is_domain   | False                            |
| name        | projectowner1.example.com        |
| parent_id   | default                          |
| tags        | []                               |
+-------------+----------------------------------+

Resource accessed by an admin:

# openstack metric resource show --type network 9c8406c3-8287-4e52-9bf9-da2c4068314d
+-----------------------+-------------------------------------------------------------------+
| Field                 | Value                                                             |
+-----------------------+-------------------------------------------------------------------+
| created_by_project_id | 7f9c10a210954feea4a6c8fdde433c96                                  |
| created_by_user_id    | 1333c5829ffc4d80aea02a7fdbaee5cd                                  |
| creator               | 1333c5829ffc4d80aea02a7fdbaee5cd:7f9c10a210954feea4a6c8fdde433c96 |
| ended_at              | None                                                              |
| id                    | 9c8406c3-8287-4e52-9bf9-da2c4068314d                              |
| metrics               | network: 3b2c0e67-c122-45ec-bddd-07d22afd89c5                     |
| name                  | test-network                                                      |
| original_resource_id  | 9c8406c3-8287-4e52-9bf9-da2c4068314d                              |
| project_id            | 03837612201c42dfa746b56ef65af145                                  |
| revision_end          | None                                                              |
| revision_start        | 2026-05-07T21:50:55.983238+00:00                                  |
| started_at            | 2026-05-07T21:50:55.983229+00:00                                  |
| type                  | network                                                           |
| user_id               | None                                                              |
+-----------------------+-------------------------------------------------------------------+

Accessed by a normal user inside the project:

# OS_PROJECT_NAME=projectowner1.example.com OS_USERNAME=projectowner1@example.com openstack metric resource show --type network 9c8406c3-8287-4e52-9bf9-da2c4068314d
+-----------------------+-------------------------------------------------------------------+
| Field                 | Value                                                             |
+-----------------------+-------------------------------------------------------------------+
| created_by_project_id | 7f9c10a210954feea4a6c8fdde433c96                                  |
| created_by_user_id    | 1333c5829ffc4d80aea02a7fdbaee5cd                                  |
| creator               | 1333c5829ffc4d80aea02a7fdbaee5cd:7f9c10a210954feea4a6c8fdde433c96 |
| ended_at              | None                                                              |
| id                    | 9c8406c3-8287-4e52-9bf9-da2c4068314d                              |
| metrics               | network: 3b2c0e67-c122-45ec-bddd-07d22afd89c5                     |
| name                  | test-network                                                      |
| original_resource_id  | 9c8406c3-8287-4e52-9bf9-da2c4068314d                              |
| project_id            | 03837612201c42dfa746b56ef65af145                                  |
| revision_end          | None                                                              |
| revision_start        | 2026-05-07T21:50:55.983238+00:00                                  |
| started_at            | 2026-05-07T21:50:55.983229+00:00                                  |
| type                  | network                                                           |
| user_id               | None                                                              |
+-----------------------+-------------------------------------------------------------------+

Access denied for a normal user outside the project (before):

# OS_PROJECT_NAME=projectowner2.example.com OS_USERNAME=projectowner2@example.com openstack metric resource show --type network 9c8406c3-8287-4e52-9bf9-da2c4068314d
Forbidden (HTTP 403)

Access denied for a normal user outside the project (after):

# OS_PROJECT_NAME=projectowner2.example.com OS_USERNAME=projectowner2@example.com openstack metric resource show --type network 9c8406c3-8287-4e52-9bf9-da2c4068314d
Resource 9c8406c3-8287-4e52-9bf9-da2c4068314d does not exist (HTTP 404)

Debug logs:

2026-05-07 21:57:29,470 [9] DEBUG    gnocchi.rest.auth_helper: Checking if user 5ba7975468a84cb69d613cd085b4765a:dfa7fa5103324c96906b21d6de310779 is allowed to access any resource in any project under policy rule [get resource].
2026-05-07 21:57:29,472 [9] DEBUG    gnocchi.rest.api: Aborting request. Code [403]. Details []
2026-05-07 21:57:29,473 [9] DEBUG    gnocchi.rest.auth_helper: User 5ba7975468a84cb69d613cd085b4765a:dfa7fa5103324c96906b21d6de310779 is NOT allowed to access any resource in any project under policy rule [get resource].
2026-05-07 21:57:29,474 [9] DEBUG    gnocchi.rest.auth_helper: Checking if user 5ba7975468a84cb69d613cd085b4765a:dfa7fa5103324c96906b21d6de310779 is allowed to access resources within their project under policy rule [get resource].
2026-05-07 21:57:29,476 [9] DEBUG    gnocchi.rest.auth_helper: User 5ba7975468a84cb69d613cd085b4765a:dfa7fa5103324c96906b21d6de310779 is allowed to access resources within their project under policy rule [get resource].
2026-05-07 21:57:29,477 [9] DEBUG    gnocchi.rest.auth_helper: User 5ba7975468a84cb69d613cd085b4765a:dfa7fa5103324c96906b21d6de310779 is NOT authenticated under the project the resource belongs to.
2026-05-07 21:57:29,478 [9] DEBUG    gnocchi.rest.auth_helper: Checking if user 5ba7975468a84cb69d613cd085b4765a:dfa7fa5103324c96906b21d6de310779 is allowed to access resources if they are part of the project that created the resource under policy rule [get resource].
2026-05-07 21:57:29,480 [9] DEBUG    gnocchi.rest.api: Aborting request. Code [403]. Details []
2026-05-07 21:57:29,480 [9] DEBUG    gnocchi.rest.auth_helper: User 5ba7975468a84cb69d613cd085b4765a:dfa7fa5103324c96906b21d6de310779 is NOT allowed to access resources if they are part of the project that created the resource under policy rule [get resource].
2026-05-07 21:57:29,481 [9] DEBUG    gnocchi.rest.auth_helper: Checking if user 5ba7975468a84cb69d613cd085b4765a:dfa7fa5103324c96906b21d6de310779 is allowed to access resources they created under policy rule [get resource].
2026-05-07 21:57:29,483 [9] DEBUG    gnocchi.rest.api: Aborting request. Code [403]. Details []
2026-05-07 21:57:29,484 [9] DEBUG    gnocchi.rest.auth_helper: User 5ba7975468a84cb69d613cd085b4765a:dfa7fa5103324c96906b21d6de310779 is NOT allowed to access resources they created under policy rule [get resource].
2026-05-07 21:57:29,484 [9] DEBUG    gnocchi.rest.auth_helper: User 5ba7975468a84cb69d613cd085b4765a:dfa7fa5103324c96906b21d6de310779 allowed access to the endpoint, but denied access to the resource under policy rule [get resource]. Forbidding access to resource 9c8406c3-8287-4e52-9bf9-da2c4068314d.
2026-05-07 21:57:29,485 [9] DEBUG    gnocchi.rest.api: Aborting request. Code [404]. Details [Resource 9c8406c3-8287-4e52-9bf9-da2c4068314d does not exist]

Note that the policy in our deployment does not allow anyone except admins and users part of the project to access resources. Creators are not allowed.

[Callum027]

@tobias-urdin Sorry for the delay, I'm satisfied this is ready to go.