appauth: Add token and user (with roles) to context

When successfully authenticating a user via apptoken, resolve the user's
roles and add the user and the token returned by the auth service to the
request context. Rely on the account_resolve middleware to add the reva
token to the outgoing request as the other auth middlewares do.

services/proxy/pkg/middleware/app_auth.go

@@ -6,6 +6,7 @@ import (
 	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
 	cs3rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
 	"github.com/opencloud-eu/opencloud/pkg/log"
+	"github.com/opencloud-eu/opencloud/services/proxy/pkg/userroles"
 	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
 )
@@ -14,6 +15,7 @@ import (
 type AppAuthAuthenticator struct {
 	Logger              log.Logger
 	RevaGatewaySelector pool.Selectable[gateway.GatewayAPIClient]
+	UserRoleAssigner    userroles.UserRoleAssigner
 }
 
 // Authenticate implements the authenticator interface to authenticate requests via app auth.
@@ -43,11 +45,20 @@ func (m AppAuthAuthenticator) Authenticate(r *http.Request) (*http.Request, bool
 		return nil, false
 	}
 	if authenticateResponse.GetStatus().GetCode() != cs3rpc.Code_CODE_OK {
-		// TODO: log???
+		m.Logger.Debug().Str("msg", authenticateResponse.GetStatus().GetMessage()).Str("clientid", username).Msg("app auth failed")
 		return nil, false
 	}
 
-	r.Header.Set(revactx.TokenHeader, authenticateResponse.GetToken())
+	user := authenticateResponse.GetUser()
+	if user, err = m.UserRoleAssigner.ApplyUserRole(r.Context(), user); err != nil {
+		m.Logger.Error().Err(err).Str("clientid", username).Msg("app auth: failed to load user roles")
+		return nil, false
+	}
+
+	ctx := revactx.ContextSetUser(r.Context(), user)
+	ctx = revactx.ContextSetToken(ctx, authenticateResponse.GetToken())
+
+	r = r.WithContext(ctx)
 
 	return r, true
 }