api: remove as_su

as_su has a vulnerability.
It was originally added for dropping su priviledges, but is now
unecessary due to django-impersonate.

core/api/utils/last_modified.py

@@ -20,15 +20,10 @@ class GenericAPIViewWithDebugInfo(generics.GenericAPIView):
     def get_admin_url(self):
         return None
 
-    def get_as_su(self):
-        return False
-
     def get(self, *args, **kwargs):
         resp = super().get(*args, **kwargs)
         if admin_url := self.get_admin_url():
             resp["X-Admin-URL"] = admin_url
-        if self.get_as_su():
-            resp["X-As-SU"] = "true"
 
         return resp
 

core/api/utils/polymorphism.py

@@ -59,20 +59,13 @@ def get_providers_by_operation(
 
 
 class ObjectAPIView(generics.GenericAPIView):
-    def get_as_su(self):
-        return self.as_su
-
     def initial(self, *args, **kwargs):
         super().initial(*args, **kwargs)
         self.request.mutate = self.mutate
         self.request.kind = self.kind
         self.request.detail = self.detail
         self.provider = provider = get_provider(kwargs.pop("type"))(self.request)
-        if as_su := (self.request.GET.get("as-su") == "true"):
-            self.permission_classes = [permissions.AllowAny]
-        else:
-            self.permission_classes = provider.permission_classes
-        self.as_su = as_su  # if the user is a SU
+        self.permission_classes = provider.permission_classes
         self.serializer_class = provider.serializer_class
         self.additional_lookup_fields = self._compile_lookup_fields()
         self.listing_filters = getattr(