API-34434 Reject non-gateway requests to some APIs

[caseywilliams]

Summary

Updates APIs in the appeals_api, va_forms, and vba_documents modules so that they return an Unauthorized error if the request did not come through the gateway (only applies in production mode)

Related issue(s)

• API-34434

Testing done

• New code is covered by unit tests
• Describe what the old behavior was prior to the change
• Describe the steps required to verify your changes are working as expected. Exclusively stating 'Specs run' is NOT acceptable as appropriate testing
• If this work is behind a flipper:
  • Tests need to be written for both the flipper on and flipper off scenarios. Docs.
  • What is the testing plan for rolling out the feature?

What areas of the site does it impact?

• All endpoints in the modules listed above which inherit from their local ApplicationControllers are affected

Acceptance criteria

• I fixed|updated|added unit tests and integration tests for each feature (if applicable).
• No error nor warning in the console.
• Events are being sent to the appropriate logging solution
• Documentation has been updated (link to documentation)
• No sensitive information (i.e. PII/credentials/internal URLs/etc.) is captured in logging, hardcoded, or specs
• Feature/bug has a monitor built into Datadog or Grafana (if applicable)
• If app impacted requires authentication, did you login to a local build and verify all authenticated routes work as expected
• I added a screenshot of the developed feature

[kristen-brown]

This code looks good at first glance, but have you confirmed that we definitely receive a source parameter? I checked our controller logs in Datadog and didn't see it listed alongside our params like id, icn, receiptDate, etc., which concerned me. Is it there but just being excluded from our logs?

[caseywilliams]

@cilestin told me that the source parameter is added automatically by Kong, but I don't know how to confirm that for sure

[cilestin]

@caseywilliams Let's put this behind a feature flag so that we can change it live should things go wonky. Default to false and we can turn it on in different envs to ensure Prod isn't affected until we've tested it.

[cilestin]

@caseywilliams Let's put this behind a feature flag so that we can change it live should things go wonky. Default to false and we can turn it on in different envs to ensure Prod isn't affected until we've tested it.