Skip username authorization for public web apps sessions

When HqUserDetailsBean.publicSession is true, isAuthorized() no longer
requires the request's username to equal the bean's username. Public web
apps sessions authenticate via a single-use key that HQ validates
server-to-server, and their username is a synthetic per-session string
(not a real account), so echoing it is not a meaningful membership control.

The requested domain is still required to be the session's domain
(domains.contains(domain)). This keeps a session key from being
replayed against a different domain.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: nospame

src/main/java/org/commcare/formplayer/beans/auth/HqUserDetailsBean.java

@@ -53,6 +53,12 @@ public HqUserDetailsBean(String domain, String[] domains, String username, boole
     }
 
     public boolean isAuthorized(String domain, String username) {
+        if (publicSession) {
+            // Public web apps sessions authenticate via a single-use key that HQ has already
+            // validated and tied to exactly one domain. There is no real HQ account, so the
+            // per-session username is not a meaningful check.
+            return Arrays.asList(domains).contains(domain);
+        }
         return isSuperUser || Arrays.asList(domains).contains(domain) && this.username.equals(
                 username);
     }

src/test/java/org/commcare/formplayer/tests/HqUserDetailsTests.java

@@ -39,6 +39,33 @@ public void testCommCareUserIsAuthorized() {
         Assertions.assertFalse(user.isAuthorized("domain", "wrong-bilbo"));
     }
 
+    @Test
+    public void testPublicSessionIsAuthorized() {
+        HqUserDetailsBean publicUser = new HqUserDetailsBean("domain",
+                new String[]{"domain"}, "public_abc123@domain.commcarehq.org",
+                false, new String[]{}, new String[]{});
+        publicUser.setPublicSession(true);
+
+        // Synthetic username is not checked for a public session...
+        Assertions.assertTrue(publicUser.isAuthorized("domain", "public_abc123@domain.commcarehq.org"));
+        Assertions.assertTrue(publicUser.isAuthorized("domain", "some-other-name"));
+
+        // ...but the requested domain must still be the session's domain.
+        Assertions.assertFalse(publicUser.isAuthorized("other-domain", "public_abc123@domain.commcarehq.org"));
+        Assertions.assertFalse(publicUser.isAuthorized("other-domain", "some-other-name"));
+    }
+
+    @Test
+    public void testNonPublicSessionStillEnforcesUsername() {
+        // Same shape as the public case but publicSession=false: the username check is enforced.
+        HqUserDetailsBean regularUser = new HqUserDetailsBean("domain",
+                new String[]{"domain"}, "real@domain.commcarehq.org",
+                false, new String[]{}, new String[]{});
+
+        Assertions.assertTrue(regularUser.isAuthorized("domain", "real@domain.commcarehq.org"));
+        Assertions.assertFalse(regularUser.isAuthorized("domain", "some-other-name"));
+    }
+
     @Test
     public void testPublicSessionDeserialization() throws Exception {
         ObjectMapper mapper = new ObjectMapper();