Repository navigation
Promote edge to stable: owner checks on invite administration, CLI conversation list - #3069
Merged
Merged
Conversation
`polis conversation list` sent `mine`, `offset` and `search` to GET /api/v3/conversations and required an owner-paginated object in return; the API ignores those parameters and answers with an array, so every signed-in run ended with capability_unavailable (exit 8). The command now sends only what the API reads (limit, is_active, is_draft), keeps the rows whose server-set is_owner is true, applies --search as a literal case-insensitive topic match to the rows read, and reports pagination as limit / server_rows / returned / truncated. --offset is removed (the API has none); --limit accepts 1-9999 as the API does. An answer that is not an array of rows with a boolean is_owner is refused as invalid_response. `polis conversations list` (plural) is accepted as an alias of the canonical group. Claude-Session: https://claude.ai/code/session_018NVGBuYCk4EZmiz4csUv9s Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* Owner checks on invite administration routes Restrict the invite-administration routes to the conversation's owner or a moderator on the owner's site, the same ownership gate the data export and conversation UUID routes already use. Observable changes: - GET and POST /api/v3/treevite/waves, GET /api/v3/treevite/invites and GET /api/v3/treevite/invites/csv return 403 to callers who are neither the owner nor a site moderator (previously any valid token received 200/201). The admin UI, operated by the owner or a moderator, is unaffected. - POST /api/v3/users/invite returns 403 to the same non-owner callers. - GET /api/v3/conversations no longer treats an `xid` query parameter specially: listing conversations no longer creates single-use invite rows as a side effect, and each returned `url` is the ordinary conversation url. No in-repo client sends `xid` to this route. - POST /api/v3/treevite/acceptInvite records the invite against a participant in the requested conversation (creating one when needed) rather than a participant id carried by a token issued for a different conversation. Legitimate first-time accepts continue to succeed. The single-use invite insert is now a parameterised multi-row statement. Tests (server integration + unit): - For each gated route: a signed-in non-owner and an anonymous participant token from another conversation receive 403; the owner and a site moderator succeed. - acceptInvite: a token from another conversation is scoped to the requested conversation and is not rejected. - GET /api/v3/conversations with an xid writes no invite rows. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018NVGBuYCk4EZmiz4csUv9s * tests: plain describe name for the accept-invite scoping case Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018NVGBuYCk4EZmiz4csUv9s --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Delphi Coverage Report
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Owner or moderator checks on the invite administration routes and emailed invites; GET /conversations no longer writes single-use invites; acceptInvite is scoped to the requested conversation; the CLI conversation list reads the current API. No schema change; participant path untouched.