Tighten legacy v1 API boundaries#3015
Open
e-q wants to merge 3 commits into
Open
Conversation
Require unsafe v1 requests to authenticate with active staff API keys provided through the Authorization header. Limit collection DELETE methods to the endpoints that intentionally support them, and keep release-file replacement scoped to exactly one release value. Add Tastypie regression coverage for authentication, credential source, and collection-method boundaries.
sethmlarson
suggested changes
Jun 2, 2026
Contributor
sethmlarson
left a comment
sethmlarson
left a comment
There was a problem hiding this comment.
Thank you! Some comments and questions:
Validate ApiKey Authorization payloads before splitting credentials. Clarify the staff API-key authorization marker and simplify legacy credential source checks. Add regression coverage for malformed ApiKey headers.
sethmlarson
approved these changes
Jun 2, 2026
Contributor
sethmlarson
left a comment
sethmlarson
left a comment
There was a problem hiding this comment.
All my comments have been resolved, LGTM. Thank you!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Authorizationheader.only when scoped to exactly one release value.
authentication, credential source, and collection-method boundaries.
Testing