josh/electric-cherry
1
0
Fork 0
Code Issues 18 Pull Requests Actions Packages Projects Releases Wiki Activity

Allow public leaderboard API reads

Browse Source
This commit is contained in:
josh
2026-10-05 16:46:44 -04:00
parent bd10c1c5d2
commit 083d29323f
5 changed files with 83 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unit/auth-access.test.ts
+14 -1
View File
@@ -8,7 +8,7 @@ const allows = (role: UserRole, route: string | null, method = 'GET') => roleAll
describe('management route permissions', () => {
it.each([
'/', '/api/fleet', '/capacity', '/api/capacity', '/api/servers', '/servers/[name]', '/api/servers/[name]/scripts',
'/api/metrics', '/metrics', '/api/matches', '/matches/[id]', '/api/leaderboard',
'/api/metrics', '/metrics', '/api/matches', '/matches/[id]',
'/leaderboard/players/[game]/[guid]', '/api/campaigns/[id]', '/campaigns/[id]',
'/api/provisioning/[id]', '/provisioning/[id]', '/api/provisioning/[id]/events',
'/api/betas/[id]', '/api/scripts/[id]', '/api/configs', '/api/plugins', '/api/hosts/[id]',
@@ -72,6 +72,19 @@ describe('management route permissions', () => {
});
describe('authentication and machine boundaries', () => {
it('makes only leaderboard API reads public', () => {
for (const method of ['GET', 'HEAD']) {
expect(routePermission('/api/leaderboard', method)).toBe('public');
for (const route of ['/leaderboard', '/leaderboard/players/[guid]',
'/leaderboard/players/[game]/[guid]', '/api/leaderboard/players/[guid]',
'/api/leaderboard-extra', '/api/matches', '/api/servers/[name]/matches', '/matches/[id]']) {
expect(routePermission(route, method)).toBe('viewer');
}
}
for (const method of ['POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS']) {
expect(routePermission('/api/leaderboard', method)).toBe('operator');
}
});
it('makes only the intended login/bootstrap methods public', () => {
for (const route of ['/login', '/setup']) {
expect(routePermission(route, 'GET')).toBe('public');