Deny access to methods other than GET for readonly access tokens #390
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Running tests threw a `undefined method 'deprecator'` error. This is related to the `time_helpers` from activesupport. This issue is defined here: rails/rails#49495 which suggests this as a workaround rails/rails#49495 (comment)
We aren't using active_storage_blob tables so these would never run.
The prefix breaks the output from Lograge and we are specifying the request id already. [1] Also moving the stdout as default to application.rb so that it applies to all environments, without needing the env var as we are removing that. [1]: #369 (comment)
lfdebrux
force-pushed
the
ldeb-add-access-tokens-permissions
branch
from
70e6132 to
29af0e6
Compare
lfdebrux
force-pushed
the
ldeb-add-access-tokens-permissions
branch
3 times, most recently
from
2b52f7a to
8f57543
Compare
lfdebrux
force-pushed
the
ldeb-add-access-tokens-permissions
branch
from
8f57543 to
c09f41e
Compare
|
chao-xian
force-pushed
the
update-rails-7.1
branch
2 times, most recently
from
4e89ec5 to
7d80966
Compare
chao-xian
force-pushed
the
update-rails-7.1
branch
from
7d80966 to
c7b2327
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What problem does this pull request solve?
This PR adds a crude form of access control to the API. Access tokens now have associated permissions; either
:allor:readonly. Access tokens with:readonlypermissions can only be used forGETrequests.Otherwise, nothing else should be changed with using the API. The aim is to make us able to feel more free as developers about using the API for debugging or inspecting production systems.
Things to consider when reviewing