Repository navigation
Promote edge to stable: XID participant identity, XID download behind sign-in, privacy fixes - #3078
Merged
Merged
Conversation
…criptions, referrer and logs (#3076) * server: the participant XID download requires an owner or moderator GET /api/v3/xid/<uuid>-xid.csv returned the full participant-to-xid map to anyone holding the UUID. Minting the UUID was already owner/moderator-only, but a copied or logged link still exposed every xid. The download now takes the same owner/moderator check: no sign-in is 401, anyone else 403 (polis_err_xid_report_auth); the owner gets the same bytes as before and an unknown UUID is still 404. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018NVGBuYCk4EZmiz4csUv9s * client-admin: download the participant XID list with the signed-in account The XID list download is now an authenticated request: the button fetches it with the admin's token and saves the file, instead of a bare link, and shows an error when the site refuses. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018NVGBuYCk4EZmiz4csUv9s * server: no subscription address is stored when subscriptions are off POST /api/v3/convSubscriptions stored the participant's email even when the conversation had subscriptions turned off. It now refuses with 403 (polis_err_subscriptions_disabled) and stores nothing; unsubscribing is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018NVGBuYCk4EZmiz4csUv9s * server: store the participant referrer without its query string The embedding page's URL was stored as the participant's referrer with its query string, which can carry the participant's xid. The referrer is now stored as origin and path only, at both places it is written. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018NVGBuYCk4EZmiz4csUv9s * server: redact identity parameters from the request log The access log and the error handler recorded full URLs, including xid, email, token and invite or login code query parameters, next to the IP and user agent. Those parameters are now logged as [redacted]; path, status, timing, IP and user agent are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018NVGBuYCk4EZmiz4csUv9s --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…t and the start (#3077) - A request whose xid differs from the xid bound to its participant token is treated as that xid's participant, with the conversation's XID gates applied to it, and receives a token bound to it; it no longer acts as the token's participant. An empty or blank xid is treated as absent. - An XID token issued for another conversation carries no user or participant into this one; its xid is resolved here like a first visit. - When the identity is an xid and the conversation uses the XID allow-list, the xid must be on the owner's list on every action (join, vote, comment, next statement, participation init), so removing it takes effect. The list is the owner's: an xid listed from any of the owner's conversations is admitted to each of them, and never-listed xids are refused. Replacing the list replaces the owner's list, and reading it returns the owner's list. - The allow-list setting is fixed once a conversation has started: changing it after anyone from outside the owner's site has joined is refused with 409 polis_err_xid_whitelist_fixed_after_start, and the update is not applied. Claude-Session: https://claude.ai/code/session_018NVGBuYCk4EZmiz4csUv9s Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Delphi Coverage Report
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
XID participant identity follows the request, the owner's allow-list and the conversation start; the participant XID download requires an owner or moderator; no subscription address stored when subscriptions are off; referrer stored without its query string; identity parameters redacted in the request log. No schema change.