[hma] Cleanup /m/lookup Hash + Match API

[Dcallies]

Some users have asked for an API that will allow them to combine the hash+match API into one call. It turns out this already exists as /m/lookup, but this triggers hashing (high CPU cost) even if the hashing role is not enabled, which defeats the point of roles!

There's also a development/UI version of this already here: https://github.com/facebook/ThreatExchange/blob/main/hasher-matcher-actioner/src/OpenMediaMatch/blueprints/ui.py#L170 - this probably should be replaced with the new and improved method.

Your mission, should you choose to accept it:

1. Refactor /lookup so that that the URL and POST versions are only enabled when the hashing role is enabled. At the very worst, you can just check for the role in the app config and throw if it's not.
2. Delete the /ui version of lookup and replace it with your new fixed version (can be a separate PR)
3. Make sure everything is tested

[aryzle]

@Dcallies I can start working on this now

[Dcallies]

Gopher it!

[aryzle]

Hey @Dcallies just want to a clarify a few things, maybe I'm missing some context

What type of refactoring did you have in mind? It's easy enough to check for the ROLE_HASHER role and abort if it's false, but the lookup function itself looks ok to me - no glaring errors.

In the ui endpoint /ui/query we could also check for the role, but do you mean have the match form POST to /m/lookup instead of /ui/query ? looks like they return diff things (list vs dict)

• also the ui bp isn't registered if ROLE_HASHER=False so as it stands no need to check for the role in /ui/query

[Dcallies]

Lookup should not allow lookup by URL or lookup by POST with content (which triggers hashing) unless the hashing role is enabled.

When you say you looked at the lookup API and it looked fine, did you check to see if you can trigger hashing without the hash role?

[aryzle]

so there's lookup_get, lookup_post and they both call lookup. lookup_get and lookup_post are where the hashing role can be checked, that's what I'm saying is easy enough. Do you want the lookup method refactored? and what sort of refactoring did you have in mind?

I already implemented the hashing role checks and tested them yup, can't do a GET with a URL or a POST with files unless the hashing role is enabled ✅