also looking at this
Close unauthenticated /api/requests CRUD, and make the session cookie HttpOnly
#77
11 files
+552
-57
Review threads live on the whole diff, not on one commit, so none are shown here - a thread's line means something in the branch's final form, and painting it into an intermediate step would put it on code it is not about.
| @@ -13,7 +13,31 @@ export default defineModel({ | ||
| 13 | 13 | useSeeder: { |
| 14 | 14 | count: 50, |
| 15 | 15 | }, |
| 16 | useApi: true, | |
| 16 | ||
| 17 | // SECURITY: no auto-generated routes at all. | |
| 18 | // | |
| 19 | // `useApi.routes` is opt-OUT, not opt-in: `useApi: true` (what this model | |
| 20 | // carried) makes the ORM generator emit index, show, store, update, | |
| 21 | // destroy AND a bulk-delete at /api/requests — and the generated write | |
| 22 | // handlers have no 401 path. `storage/framework/orm/routes.ts` resolves | |
| 23 | // the authed user only to feed the optional `authedFill` hook, and its | |
| 24 | // sole 401 branch sits inside `if (own.enforced)`, which needs an | |
| 25 | // `ownership` config this model does not declare. | |
| 26 | // | |
| 27 | // This table is request telemetry — it holds `ip_address`, `user_agent`, | |
| 28 | // `path` and `status_code`. Readable, that is an unmetered log of who | |
| 29 | // visited what, which on a site whose whole premise is anonymous reviews | |
| 30 | // is a de-anonymisation primitive: correlate an IP against a | |
| 31 | // POST /api/reviews hit and the "anonymous" author is named. Writable, it | |
| 32 | // lets anyone forge or wipe telemetry that the framework dashboard renders | |
| 33 | // (defaults/routes/dashboard.ts -> Dashboard/Infrastructure/RequestIndexAction). | |
| 34 | // | |
| 35 | // Nothing in this app reads or writes the table today, so there was no | |
| 36 | // live leak — but the endpoints were real. `routes: []` is the opt-out. | |
| 37 | useApi: { | |
| 38 | uri: 'requests', | |
| 39 | routes: [], | |
| 40 | }, | |
| 17 | 41 | }, |
| 18 | 42 | |
| 19 | 43 | attributes: { |