remove duplicate dependencies in API

[JC-wk]

Resolves #4797

What is being addressed

Dependencies are duplicated which would cause auth checks to run twice

If you attach the same auth dependency both at the router level (via APIRouter(dependencies=[Depends(auth)])) and again on the endpoint (either in dependencies=[Depends(auth)] or as a parameter user = Depends(auth)), FastAPI will execute it twice because each Depends(...) occurrence is evaluated independently; router-level dependencies are simply added to the route’s dependency list. [fastapi.tiangolo.com]

How is this addressed

• Remove dependencies where they are the same as the router dependencies
• Updated CHANGELOG.md if needed
• Increment API version

[github-actions]

Unit Test Results

711 tests   711 ✅  8s ⏱️
  1 suites    0 💤
  1 files      0 ❌

Results for commit 07e77ce.

♻️ This comment has been updated with latest results.

[Copilot]

Pull request overview

This PR resolves duplicate authentication dependency declarations in FastAPI endpoints by removing redundant dependency specifications at the endpoint level when they're already declared at the router level. According to FastAPI behavior, dependencies declared both at router and endpoint levels are executed twice, causing unnecessary duplicate authentication checks.

Key Changes:

• Removed duplicate auth dependencies from endpoint decorators across multiple route files
• Incremented API version from 0.25.7 to 0.25.8 (PATCH version)
• Updated CHANGELOG.md with bug fix entry

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
api_app/api/routes/workspaces.py	Removed duplicate get_current_workspace_owner_or_researcher_user_or_airlock_manager from two GET endpoints that already inherit this dependency from the router
api_app/api/routes/workspace_service_templates.py	Removed duplicate get_current_tre_user_or_tre_admin from two GET endpoints that already inherit this dependency from the router
api_app/api/routes/user_resource_templates.py	Removed duplicate get_current_tre_user_or_tre_admin from two GET endpoints that already inherit this dependency from the router
api_app/api/routes/shared_services.py	Removed duplicate get_current_tre_user_or_tre_admin from two GET endpoints while preserving it in function signatures where needed for business logic
api_app/api/routes/shared_service_templates.py	Removed duplicate get_current_tre_user_or_tre_admin from one GET endpoint that already inherits this dependency from the router
api_app/_version.py	Incremented API version from 0.25.7 to 0.25.8 following semantic versioning for bug fixes
CHANGELOG.md	Added bug fix entry documenting the removal of duplicate auth dependencies

[Copilot]

The reference should point to issue #4797 instead of PR #4796. The PR description states "Resolves #4797", so the changelog entry should reference the issue number to maintain consistency with the format used in other entries.

Suggested change

	* Remove duplicate auth dependencies in API ([#4796](https://github.com/microsoft/AzureTRE/pull/4796))
	* Remove duplicate auth dependencies in API ([#4797](https://github.com/microsoft/AzureTRE/issues/4797))

[marrobi]

@JC-wk thanks. Didn't realise this was an issue. In the past I've been in two minds if security dependencies are best on each route or the router. I thin they would actually be better on each route as it enables us to to custom logic for each route to enable something like:

#3826

Thoughts?

[JC-wk]

@marrobi this one is just a small interim fix to prevent auth checks happening twice and that's how all of the other endpoints work currently so keeps it consistent.
I am planning to look at #3826 soon.

[marrobi]

Analysis: Does Removing the Duplicate dependency from the Route Add/Remove Permissions?

Short answer: No, removing these dependencies does NOT change the effective permissions. The auth checks are still applied — they were just duplicated, causing them to run twice. Here's the file-by-file breakdown:

---

1. shared_service_templates.py

Endpoint	Dependency Removed from Route	Router-Level Dependency	Still Protected?
GET /shared-service-templates/{name}	Depends(get_current_tre_user_or_tre_admin)	shared_service_templates_core_router has dependencies=[Depends(get_current_tre_user_or_tre_admin)]	✅ Yes — same dependency on router

No permission change. The router already enforces get_current_tre_user_or_tre_admin.

---

2. shared_services.py

Endpoint	Dependency Removed from Route	Router-Level Dependency	Still Protected?
GET /shared-services	Depends(get_current_tre_user_or_tre_admin)	shared_services_router has this at router level + user=Depends(get_current_tre_user_or_tre_admin) as a function param	✅ Yes — router-level + function param
GET /shared-services/{id}	Depends(get_current_tre_user_or_tre_admin)	Same router-level dep + user=Depends(get_current_tre_user_or_tre_admin) as function param	✅ Yes — router-level + function param

No permission change. Both endpoints still have the auth dependency via the router and as a function parameter (since user=Depends(get_current_tre_user_or_tre_admin) remains in the function signature).

---

3. user_resource_templates.py

Endpoint	Dependency Removed from Route	Router-Level Dependency	Still Protected?
GET .../user-resource-templates	Depends(get_current_tre_user_or_tre_admin)	user_resource_templates_core_router = APIRouter(dependencies=[Depends(get_current_tre_user_or_tre_admin)])	✅ Yes
GET .../user-resource-templates/{name}	Depends(get_current_tre_user_or_tre_admin)	Same router-level dep	✅ Yes

No permission change.

---

4. workspace_service_templates.py

Endpoint	Dependency Removed from Route	Router-Level Dependency	Still Protected?
GET /workspace-service-templates	Depends(get_current_tre_user_or_tre_admin)	workspace_service_templates_core_router = APIRouter(dependencies=[Depends(get_current_tre_user_or_tre_admin)])	✅ Yes
GET /workspace-service-templates/{name}	Depends(get_current_tre_user_or_tre_admin)	Same router-level dep	✅ Yes

No permission change.

---

5. workspaces.py

Endpoint	Dependency Removed from Route	Router-Level Dependency	Still Protected?
GET /workspaces/{id}/workspace-services	Depends(get_current_workspace_owner_or_researcher_user_or_airlock_manager)	workspace_services_workspace_router = APIRouter(dependencies=[Depends(get_current_workspace_owner_or_researcher_user_or_airlock_manager)])	✅ Yes
GET /workspaces/{id}/workspace-services/{service_id}	Depends(get_current_workspace_owner_or_researcher_user_or_airlock_manager)	Same router-level dep	✅ Yes

No permission change. Note that Depends(get_workspace_by_id_from_path) is kept in the route-level dependencies for the second endpoint because it's a different dependency (not an auth duplicate — it fetches the workspace resource).

---

Summary

Every dependency that was removed from an individual route was already present on the parent APIRouter. In FastAPI, router-level dependencies are automatically applied to all routes under that router. The PR correctly identifies that having the same Depends(...) at both the router and route level causes the auth check to execute twice per request, which is redundant.

No permissions are added or removed by this PR — the effective authorization behavior remains identical. The only change is that auth checks now run once instead of twice per request.

[marrobi]

@copilot please fix the merge conflicts in this pull request.

[Copilot]

Pull request overview

Copilot reviewed 44 out of 46 changed files in this pull request and generated 7 comments.

Comments suppressed due to low confidence (3)

api_app/api/routes/workspaces.py:245

• This endpoint declares require_workspace_owner twice (once via dependencies=[Depends(require_workspace_owner)] on the decorator and again as user=Depends(require_workspace_owner)). This can lead to duplicated auth evaluation; drop the decorator-level dependency and keep the injected user parameter (same pattern applies to patch/delete/invoke workspace-service endpoints below).

@workspace_services_workspace_router.post("/workspaces/{workspace_id}/workspace-services", status_code=status.HTTP_202_ACCEPTED, response_model=OperationInResponse, name=strings.API_CREATE_WORKSPACE_SERVICE, dependencies=[Depends(require_workspace_owner)])
async def create_workspace_service(response: Response, workspace_service_input: WorkspaceServiceInCreate, user=Depends(require_workspace_owner), workspace_service_repo=Depends(get_repository(WorkspaceServiceRepository)), workspace_repo=Depends(get_repository(WorkspaceRepository)), resource_template_repo=Depends(get_repository(ResourceTemplateRepository)), operations_repo=Depends(get_repository(OperationRepository)), resource_history_repo=Depends(get_repository(ResourceHistoryRepository)), workspace=Depends(get_deployed_workspace_by_id_from_path)) -> OperationInResponse:

api_app/api/routes/shared_services.py:85

• This route lists both require_tre_admin and get_shared_service_by_id_from_path in the decorator dependencies, but it also injects both as parameters (user=Depends(require_tre_admin), shared_service=Depends(get_shared_service_by_id_from_path)). That duplication can execute dependencies twice. Remove the decorator-level dependencies and rely on the parameters.

@shared_services_router.patch("/shared-services/{shared_service_id}",
                              status_code=status.HTTP_202_ACCEPTED,
                              response_model=OperationInResponse,
                              name=strings.API_UPDATE_SHARED_SERVICE,
                              dependencies=[Depends(require_tre_admin), Depends(get_shared_service_by_id_from_path)])

CHANGELOG.md:12

• The PR metadata says this change resolves #4797 (duplicate auth dependencies causing checks to run twice), but the new changelog entry references PR #4989 and describes a broader auth refactor. If this PR is specifically fixing #4797, the changelog item should reference #4797 (and ideally describe the duplication fix) so release notes align with the actual change/issue being resolved.

* Strengthen TRE API authentication: introduce layered `auth/` package with typed exceptions, `PyJWKClient`-backed token validation with issuer checking, immutable `AuthenticatedUser` model, and composable RBAC factories; remove the `AccessService` abstraction that is no longer needed now that Entra ID is the only auth provider. ([#4989](https://github.com/microsoft/AzureTRE/pull/4989))

[Copilot]

Pull request overview

Copilot reviewed 44 out of 46 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (8)

api_app/api/routes/airlock.py:38

• This route declares require_workspace_owner_or_researcher twice (once in dependencies=[...] and again as user=Depends(...)), which can cause the auth check to run multiple times.

@airlock_workspace_router.post("/workspaces/{workspace_id}/requests", status_code=status_code.HTTP_201_CREATED,
                               response_model=AirlockRequestWithAllowedUserActions, name=strings.API_CREATE_AIRLOCK_REQUEST,
                               dependencies=[Depends(require_workspace_owner_or_researcher), Depends(get_workspace_by_id_from_path)])
async def create_draft_request(airlock_request_input: AirlockRequestInCreate, user=Depends(require_workspace_owner_or_researcher),

api_app/api/routes/airlock.py:81

• This endpoint repeats require_workspace_owner_or_researcher_or_airlock_manager in both the decorator dependencies=[...] and the user=Depends(...) parameter (and also via the router), which can lead to multiple auth evaluations per request.

@airlock_workspace_router.get("/workspaces/{workspace_id}/requests/{airlock_request_id}", status_code=status_code.HTTP_200_OK,
                              response_model=AirlockRequestWithAllowedUserActions, name=strings.API_GET_AIRLOCK_REQUEST,
                              dependencies=[Depends(require_workspace_owner_or_researcher_or_airlock_manager), Depends(get_workspace_by_id_from_path)])
async def retrieve_airlock_request_by_id(airlock_request=Depends(get_airlock_request_by_id_from_path),
                                         airlock_request_repo=Depends(get_repository(AirlockRequestRepository)),
                                         user=Depends(require_workspace_owner_or_researcher_or_airlock_manager)) -> AirlockRequestWithAllowedUserActions:
    allowed_actions = get_allowed_actions(airlock_request, user, airlock_request_repo)

api_app/api/routes/airlock.py:90

• This route declares require_workspace_owner_or_researcher twice (decorator dependencies=[...] and user=Depends(...)), which can cause duplicate auth checks.

@airlock_workspace_router.post("/workspaces/{workspace_id}/requests/{airlock_request_id}/submit", status_code=status_code.HTTP_200_OK,
                               response_model=AirlockRequestWithAllowedUserActions, name=strings.API_SUBMIT_AIRLOCK_REQUEST,
                               dependencies=[Depends(require_workspace_owner_or_researcher), Depends(get_workspace_by_id_from_path)])
async def create_submit_request(airlock_request=Depends(get_airlock_request_by_id_from_path),
                                user=Depends(require_workspace_owner_or_researcher),
                                airlock_request_repo=Depends(get_repository(AirlockRequestRepository)),

api_app/api/routes/airlock.py:103

• This route declares require_workspace_owner_or_researcher twice (decorator dependencies=[...] and user=Depends(...)), which can cause duplicate auth checks.

@airlock_workspace_router.post("/workspaces/{workspace_id}/requests/{airlock_request_id}/cancel", status_code=status_code.HTTP_200_OK,
                               response_model=AirlockRequestWithAllowedUserActions, name=strings.API_CANCEL_AIRLOCK_REQUEST,
                               dependencies=[Depends(require_workspace_owner_or_researcher), Depends(get_workspace_by_id_from_path)])
async def create_cancel_request(airlock_request=Depends(get_airlock_request_by_id_from_path),
                                user=Depends(require_workspace_owner_or_researcher),
                                workspace=Depends(get_workspace_by_id_from_path),

api_app/api/routes/airlock.py:121

• This route declares require_airlock_manager twice (decorator dependencies=[...] and user=Depends(...)), which can cause duplicate auth checks.

@airlock_workspace_router.post("/workspaces/{workspace_id}/requests/{airlock_request_id}/revoke", status_code=status_code.HTTP_200_OK,
                               response_model=AirlockRequestWithAllowedUserActions, name=strings.API_REVOKE_AIRLOCK_REQUEST,
                               dependencies=[Depends(require_airlock_manager), Depends(get_workspace_by_id_from_path)])
async def create_revoke_request(revoke_input: AirlockRevokeInCreate,
                                airlock_request=Depends(get_airlock_request_by_id_from_path),
                                user=Depends(require_airlock_manager),
                                workspace=Depends(get_workspace_by_id_from_path),

api_app/api/routes/airlock.py:136

• This route declares require_airlock_manager twice (decorator dependencies=[...] and user=Depends(...)), which can cause duplicate auth checks.

@airlock_workspace_router.post("/workspaces/{workspace_id}/requests/{airlock_request_id}/review-user-resource",
                               status_code=status_code.HTTP_202_ACCEPTED, response_model=AirlockRequestAndOperationInResponse,
                               name=strings.API_CREATE_AIRLOCK_REVIEW_USER_RESOURCE,
                               dependencies=[Depends(require_airlock_manager), Depends(get_workspace_by_id_from_path)])
async def create_review_user_resource(
        response: Response,
        airlock_request=Depends(get_airlock_request_by_id_from_path),
        user=Depends(require_airlock_manager),
        workspace=Depends(get_deployed_workspace_by_id_from_path),

api_app/api/routes/airlock.py:174

• This route declares require_airlock_manager twice (decorator dependencies=[...] and user=Depends(...)), which can cause duplicate auth checks.

@airlock_workspace_router.post("/workspaces/{workspace_id}/requests/{airlock_request_id}/review",
                               status_code=status_code.HTTP_200_OK, response_model=AirlockRequestWithAllowedUserActions,
                               name=strings.API_REVIEW_AIRLOCK_REQUEST, dependencies=[Depends(require_airlock_manager),
                                                                                      Depends(get_workspace_by_id_from_path)])
async def create_airlock_review(
        airlock_review_input: AirlockReviewInCreate,
        airlock_request=Depends(get_airlock_request_by_id_from_path),
        user=Depends(require_airlock_manager),
        workspace=Depends(get_deployed_workspace_by_id_from_path),

api_app/api/routes/airlock.py:196

• This route declares require_workspace_owner_or_researcher_or_airlock_manager twice (decorator dependencies=[...] and user=Depends(...)), which can cause duplicate auth checks.

@airlock_workspace_router.get("/workspaces/{workspace_id}/requests/{airlock_request_id}/link",
                              status_code=status_code.HTTP_200_OK, response_model=AirlockRequestTokenInResponse,
                              name=strings.API_AIRLOCK_REQUEST_LINK,
                              dependencies=[Depends(require_workspace_owner_or_researcher_or_airlock_manager)])
async def get_airlock_container_link_method(workspace=Depends(get_deployed_workspace_by_id_from_path),
                                            airlock_request=Depends(get_airlock_request_by_id_from_path),
                                            user=Depends(require_workspace_owner_or_researcher_or_airlock_manager)) -> AirlockRequestTokenInResponse: