v2/samplesanalysis/analysistypes endpoint exposes the list of analysis types without enforcing authentication or validating the data-partition-id header

Pawel Bartkowiak
2026-03-31T14:43:02Z

**Issue Summary**\
**`GET /api/rafs-ddms/v2/samplesanalysis/analysistypes`** exposes the list of analysis types without enforcing authentication or validating the **`data-partition-id`** header. The endpoint returns data even for unauthenticated calls and accepts any (or empty) partition header value.

**Description**\
When calling **`GET /api/rafs-ddms/v2/samplesanalysis/analysistypes`**:

1. **No authentication required**
* Requests without a bearer token succeed and return the analysis type list.
* This bypasses standard RAFS authorization requirements and exposes information to anonymous callers.
2. **Accepts any `data-partition-id` (including empty)**
* The header can be left blank or set to any arbitrary string. The endpoint still returns the same analysis type list.

Both behaviors are inconsistent with other RAFS endpoints and pose a security/data-leak risk. We should enforce the usual bearer-token requirement and validate the **`data-partition-id`** header so that only authenticated users with access to a given partition can retrieve its analysis types.