ENH: locking down read access on API key

[tech3371]

Change Summary

closes #1163

Overview

Need to lock down API read access given the amount of API requests coming our way.

File changes

Minor refactoring and added checks for read access for upload API. Others are ok.

Testing

[Copilot]

Pull request overview

This PR introduces a new read API key scope intended to allow read access while preventing uploads and other write-like operations, addressing increased API traffic by tightening permissions around sensitive endpoints.

Changes:

• Refactors the API key authorizer to centralize scope/path/method authorization logic and adds explicit restrictions for read scope.
• Adds read scope validation/printing to the key management script and documents scope options in the README.
• Enforces upload denial for read scope in the upload lambda and updates DynamoDB-based authorization tests accordingly.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
tests/infrastructure/test_api_key_dynamodb.py	Updates scope restriction tests to validate the new read behavior (including write/upload denial).
sds_data_manager/lambda_code/authorization/manage_api_keys.py	Adds scope documentation + validation for add_key / update_permission and prints scope after changes.
sds_data_manager/lambda_code/authorization/lambda_api_key_authorizer.py	Refactors authorization into _is_authorized and adds method/path-based restrictions for read scope.
sds_data_manager/lambda_code/SDSCode/api_lambdas/upload_api.py	Denies upload signed-URL generation when authorizer scope is read.
sds_data_manager/lambda_code/IAlirtCode/ialirt_data_query_api.py	Treats read as “full read” for HIT field filtering via READ_ONLY_SCOPES.
README.md	Documents scope options and updates CLI usage examples to include scope.

Comments suppressed due to low confidence (1)

sds_data_manager/lambda_code/authorization/manage_api_keys.py:203

• In update_permission, the variable name key is reused to hold the metadata dict (keys[matches[0]]), which is easy to confuse with the API key string itself. Consider renaming it to something like key_meta/metadata to make the code clearer.

    if matches:
        key = keys[matches[0]]
        table.put_item(
            Item={
                "api_key": matches[0],
                "owner": key["owner"],
                "email": key["email"],

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The new read-only restrictions only apply when scope == "read". This PR also renames the test scope from read_only to read, which suggests existing DynamoDB records may still have scope="read_only"; those keys would not be restricted from write methods or /api-key/upload by the new logic. Consider treating legacy read_only as equivalent to read (or migrating existing records) so the lock-down actually applies to previously-issued read-only keys.

[tech3371]

we don't have any with read_only. Just read.

[tech3371]

I tested it again in dev and read access lock down works and updates and removal of access still works as well.