Repository navigation
Show resource names, not config values, on /meta; front-end error log for maintainers only - #647
Merged
Merged
Conversation
…tainers only /meta and /meta/json/ are public. clastic's resource section shows the first 70 characters of repr() of each app resource, which for 'config' showed the start of the config dict to anyone. The resource section now lists each resource by name and type only (ResourceNamesPeripheral); the rest of /meta (start time, routes, host, process) is unchanged, so deploy.sh's smoke test keeps working. GET /v1/logs/feel (the front-end error log tail: usernames and error payloads) had no permission check; it now requires a maintainer, like /logs/api and /logs/api_exc. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
/metaand/meta/json/are public. clastic's "Application Resources" section shows the first 70 characters ofrepr()of each app resource, so forconfigit showed the start of the config dict to anyone.config: dict (15 items)). The rest of/meta(start time, routes, host, process) is unchanged, sodeploy.sh's smoke test still works.GET /v1/logs/feel(the tail of the front-end error log, with usernames and error payloads) had no permission check; it now requires a maintainer, like/logs/apiand/logs/api_exc.Tests:
test_meta_shows_no_config_values(no config value in/meta/or/meta/json/, the keyconfigstill listed) andtest_frontend_error_log_maintainers_only(a non-maintainer coordinator gets 403). Both fail without the change; full suite 50 passed, 1 xfailed.Written with Claude (Claude Code) on behalf of @lgelauff.
🤖 Generated with Claude Code