Where an issue?

Whether we have a base router with require_auth or not, we won't be able to override it in its children (cf #417 ).
So for pilots we must have require_auth=False at the base router because of secret-exchange. But now every pilot endpoint is opened.

Possibilities

Splitting

Let's start with the routers themselves. We can separate pilots and users endpoints : /api/pilots (only for pilots) and ~/api/pilot_management (only for users).

That brings us:

1. Cleaner: each their own territory, no overlapping, easier to read (you know that on /pilots its only pilot resources)
2. More secure: we can add a dependency to the pilot router (same as verify_dirac_pilot_token but for pilots)
3. We can have require_auth for /pilot_management, and enforce tokens

Using another approach

We could have a bare base router without dependency injection, with sub routers with verify_dirac_access_token:

# Authenticated parent router
protected_router = APIRouter(dependencies=[Depends(verify_dirac_access_token)])

@protected_router.get("/secure")
def secure_route():
    return {"msg": "secure"}

# Public sub-router (no auth)
public_router = APIRouter()

@public_router.get("/public")
def public_route():
    return {"msg": "public"}

Its goal would be to replacer DiracxRouter by fixing the issue, and keeping an explicit depedency injection.
Or have @router.authentificated.get(...) instead of @router.get, to explicitely say if we want auth or not

Great, but now there are conflicts, and one test is not passing. Can you fix?

Yes it's fixed now

pytest-integration not passing, should be fixed with #924 🤞

ddev:
part of a bigger plan with 3 axis: pilot management (user), pilot security (pilot tokens), pilot transition in DIRAC
only missing piece is the getPilotOutput: could be handled with a DIRAC Agent to fetch the pilot output and put it in the DB for now
also the current DIRAC Webapp does not communicate to diracx

There was a plan (may be not written anywhere?):

• pilot can talk to DIRAC and DiracX
• DiracX can interact with pilot
  Either we revisit that plan or we write it down in an ADR

@fstagni will double check and see if getPilotOutput is the only issue. If it's the case, we just isolate it in DIRAC (outside of the PilotManagerHandler) and we move on with the legacy adaptor. Will closely be followed by issues if any problem occurs afterwards.