fix: forbid non pub writing only for PUT requests

[xwid138]

When reading a path not starting with /pub/ Homeserver responds with Writing to directories other than '/pub/' is forbidden error message which is confusing for GET requests.

WARN request{method=GET uri="/test/hello.txt" version=HTTP/1.1}: pubky_homeserver::client_server::layers::authz: Writing to directories other than '/pub/' is forbidden: 8kcqwm7fw43j73jo4s4thzawzhjodc6zrn9cjyko4pzwxpkmwwey//test/hello.txt. Access forbidden

cargo run user get /test/hello.txt ./recovery.key
.
.
.
Error: Failed to get data

Caused by:
    0: Request failed: Server responded with an error: 403 Forbidden - Writing to directories other than '/pub/' is forbidden
    1: Server responded with an error: 403 Forbidden - Writing to directories other than '/pub/' is forbidden

After change:

Error: Failed to get data

Caused by:
    0: Request failed: Server responded with an error: 400 Bad Request - Invalid URL: Path must start with /pub/
    1: Server responded with an error: 400 Bad Request - Invalid URL: Path must start with /pub/

[SHAcollision]

Hey xwid138:fix-authz thank you for bringing this up and coming up with a fix. 🙌

I left a comment for a different take of this fix that could equally solve the problem you exposed without opening up some possible unsafe behaviour.

[SHAcollision]

Could potentially allow other writing methods like DELETE into non /pub/ paths.

Feels like this whole conditional is hacky, but it's kindda correct "as is". So we might simply want to change L123 and L128 messages to "Access to non-/pub/ paths is forbidden” so it is accurate for reads too. What do you think?

[xwid138]

That's true - my bad.

I suggest adding some unit tests to authz, just to be safe. Wdyt ?

edit: should we allow for OPTIONS method as well in case of /pub/ path ? Only GET and HEADER are allowed.

[xwid138]

Message update.