Repository navigation
Participant XID download behind owner sign-in; privacy fixes for subscriptions, referrer and logs - #3076
Merged
Conversation
GET /api/v3/xid/<uuid>-xid.csv returned the full participant-to-xid map to anyone holding the UUID. Minting the UUID was already owner/moderator-only, but a copied or logged link still exposed every xid. The download now takes the same owner/moderator check: no sign-in is 401, anyone else 403 (polis_err_xid_report_auth); the owner gets the same bytes as before and an unknown UUID is still 404. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018NVGBuYCk4EZmiz4csUv9s
…count The XID list download is now an authenticated request: the button fetches it with the admin's token and saves the file, instead of a bare link, and shows an error when the site refuses. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018NVGBuYCk4EZmiz4csUv9s
POST /api/v3/convSubscriptions stored the participant's email even when the conversation had subscriptions turned off. It now refuses with 403 (polis_err_subscriptions_disabled) and stores nothing; unsubscribing is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018NVGBuYCk4EZmiz4csUv9s
The embedding page's URL was stored as the participant's referrer with its query string, which can carry the participant's xid. The referrer is now stored as origin and path only, at both places it is written. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018NVGBuYCk4EZmiz4csUv9s
The access log and the error handler recorded full URLs, including xid, email, token and invite or login code query parameters, next to the IP and user agent. Those parameters are now logged as [redacted]; path, status, timing, IP and user agent are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018NVGBuYCk4EZmiz4csUv9s
Delphi Coverage Report
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Five observable changes, one commit each. No schema change. Votes, comments, nextComment and participationInit are untouched; the referrer change adds one string split inside an existing asynchronous write at participant creation.
GET /api/v3/xid/<uuid>-xid.csv: with no sign-in it now returns 401, and anyone but an owner/moderator gets 403polis_err_xid_report_auth(previously 200 with the full participant-to-xid map for anyone holding the UUID). Owners get the same bytes; an unknown UUID is still 404.POST /api/v3/convSubscriptionson a conversation withsubscribe_type = 0returns 403polis_err_subscriptions_disabledand stores nothing (previously 200, and the email was stored). Unsubscribe is unchanged.[redacted]for xid, email, token, and invite or login code parameters. Path, status, timing, IP and user agent are unchanged.Tests. New:
xid-report-auth(5),conv-subscriptions-disabled(3),participant-referrer(2) andrequestLogRedaction(16). The CSV fetches inconversation-uuid-authandzinvites-uuid-clear-migrationnow use the owner's session. client-adminParticipantXidshas 27 tests (3 new); the full client-admin suite passes. Locally, every affected server suite and the participation-path suites pass, apart from those needing the SES/DynamoDB emulators, which fail identically on unchanged code.tsc --noEmitis clean, and the vote-sign lint reports 0 new sites.🤖 Generated with Claude Code