Skip to content

test(api): classify the approval-details route in the AuthPublic CSRF guard (fixes red main) #1003

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cristim merged 1 commit into from
Oct 16, 2026
Merged

test(api): classify the approval-details route in the AuthPublic CSRF guard (fixes red main) #1003

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 21 additions & 20 deletions internal/api/authpublic_csrf_guard_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,26 +67,27 @@ const (
// row, keyed by csrfRouteKey. Each entry says why. Add a route here only if it
// never acts on the caller's session credential.
var authPublicCSRFExempt = map[string]string{
"GET /api/purchases/revoke/*": "renders the confirmation form only; revokeViaEmailToken returns before reading the session",
"POST /api/ri-exchange/reject/*": "token-only; rejectRIExchange takes no request, so it cannot read a session",
"POST /api/auth/login": "pre-session: issues the session, so there is no session to protect yet",
"GET /api/auth/check-admin": "read-only",
"POST /api/auth/setup-admin": "pre-session: first-admin bootstrap",
"POST /api/auth/forgot-password": "pre-session: sends a reset email",
"POST /api/auth/reset-password": "pre-session: authorized by the reset token",
"GET /api/auth/reset-password/status": "read-only",
"GET /api/notifications/unsubscribe": "HMAC-signed token only; never reads the session and moves no money",
"POST /api/notifications/unsubscribe": "HMAC-signed token only (RFC 8058); never reads the session and moves no money",
"POST /api/register": "public registration; creates a pending request an admin must approve",
"GET /api/register/*": "read-only",
"ANY /health": "read-only health check",
"ANY /api/health": "read-only health check",
"GET /api/info": "read-only",
"GET /version": "read-only",
"GET /api/docs*": "read-only",
"HEAD /api/docs*": "read-only",
"GET /docs*": "read-only",
"HEAD /docs*": "read-only",
"GET /api/purchases/revoke/*": "renders the confirmation form only; revokeViaEmailToken returns before reading the session",
"POST /api/ri-exchange/reject/*": "token-only; rejectRIExchange takes no request, so it cannot read a session",
"POST /api/purchases/approve/*/details": "read-only (moves no money); still runs validateCSRF before the lookup via requireSessionBeforeLookup, pinned by TestHandleRequest_ApprovalDetails_SessionAndCSRFBeforeLookup (#529)",
"POST /api/auth/login": "pre-session: issues the session, so there is no session to protect yet",
"GET /api/auth/check-admin": "read-only",
"POST /api/auth/setup-admin": "pre-session: first-admin bootstrap",
"POST /api/auth/forgot-password": "pre-session: sends a reset email",
"POST /api/auth/reset-password": "pre-session: authorized by the reset token",
"GET /api/auth/reset-password/status": "read-only",
"GET /api/notifications/unsubscribe": "HMAC-signed token only; never reads the session and moves no money",
"POST /api/notifications/unsubscribe": "HMAC-signed token only (RFC 8058); never reads the session and moves no money",
"POST /api/register": "public registration; creates a pending request an admin must approve",
"GET /api/register/*": "read-only",
"ANY /health": "read-only health check",
"ANY /api/health": "read-only health check",
"GET /api/info": "read-only",
"GET /version": "read-only",
"GET /api/docs*": "read-only",
"HEAD /api/docs*": "read-only",
"GET /docs*": "read-only",
"HEAD /docs*": "read-only",
}

// csrfGuardFixture is one route's handler plus the checks for both
Expand Down
Loading