Addresses review feedback

jeramysoucy · jeramysoucy · commit a3af1addd4ce · 2026-02-13T16:41:08.000+01:00
diff --git a/x-pack/platform/plugins/shared/security/server/user_profile/user_profile_service.test.ts b/x-pack/platform/plugins/shared/security/server/user_profile/user_profile_service.test.ts
@@ -79,7 +79,7 @@ describe('UserProfileService', () => {
     let mockRequest: ReturnType<typeof httpServerMock.createKibanaRequest>;
     beforeEach(() => {
       mockRequest = httpServerMock.createKibanaRequest({
-        headers: { cookie: 'some-cookie' },
+        headers: { sid: 'some-cookie' },
       });
 
       mockUserProfile = userProfileMock.createWithSecurity({
@@ -99,7 +99,13 @@ describe('UserProfileService', () => {
     });
 
     describe(`with session`, () => {
-      // ToDo: test anonymous access case
+      beforeEach(() => {
+        mockStartParams.session.getSID.mockResolvedValue('some-session-id');
+      });
+
+      afterEach(() => {
+        mockStartParams.session.getSID.mockReset();
+      });
 
       it('returns `null` if session is not available', async () => {
         const startContract = userProfileService.start(mockStartParams);
diff --git a/x-pack/platform/plugins/shared/security/server/user_profile/user_profile_service.ts b/x-pack/platform/plugins/shared/security/server/user_profile/user_profile_service.ts
@@ -265,8 +265,7 @@ export class UserProfileService {
     const base64Credentials = authHeader.trim().substring('basic '.length);
     const [username, password] = Buffer.from(base64Credentials, 'base64').toString().split(':');
     if (!username || !password) {
-      this.logger.debug(`Basic credentials are malformed, cannot extract username and password.`);
-      return undefined;
+      throw new Error(`Malformed basic credentials in Authorization header.`);
     }
 
     const activatedProfile = await this.activate(clusterClient, {
@@ -338,16 +337,15 @@ export class UserProfileService {
     { request, dataPath }: UserProfileGetCurrentParams
   ) {
     if (request.auth.isAuthenticated === false) {
-      this.logger.debug(`Request to get current user profile is not authenticated.`);
-      return null;
+      throw new Error('Request to get current user profile is not authenticated.');
     }
 
     let profileId: string | undefined;
     let sessionId: string | undefined;
     let profileActivationRequired: boolean | undefined;
     let apiKeyRetrievalRequired: boolean | undefined;
 
-    if (request.headers.cookie) {
+    if (await session.getSID(request)) {
       this.logger.debug(`Request to get current user profile is authenticated via session.`);
       ({ profileId, sessionId } = await this.getCurrentUserProfileIdViaSession(session, request));
     } else {
