Repository navigation
server: remove the unused POST /api/v3/participants route - #3080
Merged
Merged
Conversation
POST /api/v3/participants has no caller in any client, test helper, tool or doc, and given any bearer token it created a participant past the invite-only, external-id and closed-conversation gates; a signed-in account could then vote in an invite-only conversation. The route and its handler are removed; GET /api/v3/participants stays. Observable change: POST /api/v3/participants answers 404 and writes nothing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018NVGBuYCk4EZmiz4csUv9s
Delphi Coverage Report
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Observable change:
POST /api/v3/participantsanswers 404 for every caller and writes nothing.GET /api/v3/participantsis unchanged. No schema change; votes, comments, nextComment and participationInit are not in the diff.Why. No client, test helper, CLI or doc posts to it: the legacy client's participant model is set locally and never saved. Given any bearer token, it created a participant past the invite-only, external-id and closed-conversation gates, and a signed-in account could then vote in an invite-only conversation.
Tests. New
post-participants.test.ts(5): 404 for no credential, for another conversation's anonymous token, and for a signed-in account; no participant row written in invite-only or closed conversations; votes in an invite-only conversation still refuse; GET still 200. Two tests that used the route were trimmed. Locally the participation-path suites pass, apart from cases needing the SES/DynamoDB emulators, which fail identically on unchanged code.tsc, eslint and prettier are clean, and the vote-sign lint reports 0 new sites.Note. The route characterization inventory pins the registration count, so it needs the usual refresh with the next re-record. Some error codes in the contracts crate's catalogue are no longer emitted.
🤖 Generated with Claude Code