Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-05 22:42:07 +08:00
Code Packages Activity Actions
discourse/spec/models
History
Exact
Mark VanLandingham 7c82423416
 FIX: Prevent read-only keys being created without scopes (#42280) 
## Summary

Prevent read-only API keys from being created without scopes, which
previously granted them unscoped access. This was already enforced for
Api keys created via the UI. The fix enforces a mandatory 'global:read'
scope for read-only keys at the model and API levels, and includes a
migration to revoke existing invalid keys.

## Source

- Patch Triage: https://patch.discourse.org/patch-triage/1192
2026-08-03 15:45:48 -05:00
..
concerns DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
reports PERF: Use daily rollups for DAU/MAU reports (#41958) 2026-07-24 09:52:40 +08:00
about_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
access_control_list_spec.rb FEATURE: Support users in DAccessControl and backend (#41358) 2026-07-15 09:18:06 +10:00
admin_dashboard_data_spec.rb DEV: Remove old problem check system - part 2 (#34403) 2025-08-20 16:15:21 +08:00
admin_dashboard_report_spec.rb DEV: Scaffold backend for the new admin dashboard Reports section (#40017) 2026-05-20 09:53:26 +03:00
admin_dashboard_section_spec.rb DEV: Persist dashboard configuration in table and *not* on closure of the dialog (#40546) 2026-06-04 10:53:59 +08:00
admin_notice_spec.rb FIX: Linkify site setting references in dashboard problem messages (#41763) 2026-07-16 14:46:25 +02:00
api_key_scope_spec.rb DEV: Add tests for intentional granular API key behavior for /about (#39922) 2026-05-12 09:05:11 -05:00
api_key_spec.rb FIX: Prevent read-only keys being created without scopes (#42280) 2026-08-03 15:45:48 -05:00
application_request_spec.rb
associated_group_spec.rb DEV: fix a large amount of typos (#37428) 2026-02-02 16:31:58 +11:00
badge_grouping_spec.rb
badge_spec.rb FIX: Allow badges with SQL queries to be manually granted (#36866) 2026-01-09 13:58:09 +01:00
badge_type_spec.rb
bookmark_spec.rb FIX: notification reminder is deleted with bookmark (#35141) 2025-10-03 08:34:19 +02:00
browser_pageview_country_daily_rollup_spec.rb PERF: Daily rollups for top countries and top referrers reports (#40285) 2026-05-26 14:35:20 +08:00
browser_pageview_event_spec.rb FIX: Split browser pageview rollup source at the cutover date (#42013) 2026-07-24 14:56:36 +08:00
browser_pageview_referrer_daily_rollup_spec.rb FIX: Backfill normalized referrer for historical browser pageviews (#40357) 2026-06-09 09:04:57 +08:00
browser_pageview_session_engagement_daily_rollup_spec.rb DEV: Penalize pageviews with no engagement in CrawlerScorer (#42118) 2026-07-29 13:13:42 +08:00
browser_pageview_session_engagement_spec.rb DEV: Track browser session engagement for crawler detection (#41215) 2026-07-01 09:17:48 +08:00
category_activity_daily_rollup_spec.rb PERF: Serve the activity_by_category report from daily rollups (#42046) 2026-07-28 12:53:29 +08:00
category_featured_topic_spec.rb
category_group_spec.rb
category_list_spec.rb FIX: only show first paragraph of localized category descriptions (#41511) 2026-07-10 16:59:40 -04:00
category_localization_spec.rb FIX: only show first paragraph of localized category descriptions (#41511) 2026-07-10 16:59:40 -04:00
category_posting_review_group_spec.rb FEATURE: Support group based category posting review modes (#38707) 2026-04-07 10:41:16 +08:00
category_scope_site_setting_spec.rb DEV: Introduce a category scope enum for flexible category selection (#41505) 2026-07-08 15:54:10 +08:00
category_setting_spec.rb FEATURE: Add nested replies category conversion (#41236) 2026-07-06 08:22:22 -05:00
category_spec.rb SECURITY: Harden ListController top period query against SQL injection (#41718) 2026-07-15 12:17:50 +08:00
category_tag_stat_spec.rb
category_user_spec.rb FIX: Respect user's manual topic notification level changes (#39037) 2026-04-02 11:05:00 +02:00
child_theme_spec.rb
color_scheme_color_spec.rb
color_scheme_spec.rb FEATURE: Allow editing theme-owned palettes (#34722) 2025-10-06 09:02:39 +03:00
custom_emoji_spec.rb DEV: Retroactive review and refactor of custom emoji bulk import/export (#41860) 2026-07-22 10:06:54 +10:00
developer_spec.rb
digest_email_site_setting_spec.rb
directory_item_spec.rb PERF: DirectoryItem.refresh! daily can take an extremely long time (#35860) 2025-11-10 13:23:23 +10:00
discourse_connect_spec.rb FIX: Reject DiscourseConnect SSO payloads when secret is blank (#40830) 2026-06-12 15:17:16 +03:00
do_not_disturb_timing_spec.rb
draft_sequence_spec.rb
draft_spec.rb FIX: certain edge cases could leave phantom drafts behind (#37130) 2026-01-16 13:17:18 +11:00
duplicate_topic_titles_site_setting_spec.rb FIX: Scope duplicate topic title check to what the user can see (#41871) 2026-07-24 15:35:35 +02:00
email_change_request_spec.rb
email_log_spec.rb
email_login_code_spec.rb FEATURE: Log in with a one-time email code (#40804) 2026-06-17 12:34:48 -07:00
email_token_spec.rb
embeddable_host_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
embeddable_host_tag_spec.rb
emoji_spec.rb FEATURE: Add emoji_picker_pinned_groups for pinning groups in the picker (#41881) 2026-07-22 09:51:15 -07:00
flag_spec.rb FIX: Ensure each flag gets a unique name_key (#40899) 2026-06-24 16:37:59 +02:00
form_template_spec.rb DEV: Expand top_tags, topic.tags, etc, to return an array of tag objects instead of tag names (#36678) 2026-02-02 10:03:02 +08:00
given_daily_like_spec.rb
global_setting_spec.rb DEV: Allow loading specific plugins in development (#39975) 2026-05-13 14:13:32 +01:00
group_archived_message_spec.rb FIX: Scope group archive and inbox actions to the group's messages (#41662) 2026-07-14 10:05:10 +05:30
group_associated_group_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
group_history_spec.rb
group_request_spec.rb
group_spec.rb FIX: Make auto pseudogroups visible to logged on users (#41498) 2026-07-08 09:28:18 +10:00
group_user_spec.rb PERF: Add Users to Group Improvements Pt. 3 (#39091) 2026-04-20 09:38:16 -05:00
homepage_site_setting_spec.rb FEATURE: explicit default homepage setting (#41785) 2026-07-22 16:22:19 -04:00
ignored_user_spec.rb DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
incoming_link_spec.rb
incoming_links_report_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
invite_redeemer_spec.rb FEATURE: Allow inviting staff as admins or moderators (#41880) 2026-07-21 14:05:21 -07:00
invite_spec.rb FEATURE: Allow inviting staff as admins or moderators (#41880) 2026-07-21 14:05:21 -07:00
javascript_cache_spec.rb
locale_site_setting_spec.rb DEV: Enable Rails/FilePath rubocop rule (#40097) 2026-05-19 19:07:54 +02:00
mailing_list_mode_site_setting_spec.rb
moved_post_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
notification_spec.rb DEV: route nested view through topic route (#40820) 2026-06-15 11:42:20 -05:00
onebox_locale_site_setting_spec.rb
optimized_image_spec.rb DEV: Add image-processing regression coverage (#42117) 2026-07-30 15:28:07 +08:00
optimized_video_spec.rb DEV: Ensure optimized videos have the correct acl (#36364) 2025-12-01 19:50:08 -07:00
permalink_spec.rb SECURITY: prevent permalink redirects from leaking restricted slugs 2026-01-28 17:11:14 +00:00
plugin_store_spec.rb
post_action_spec.rb DEV: Restore and update a post_action spec (#39594) 2026-04-28 18:48:50 +02:00
post_action_type_spec.rb
post_analyzer_spec.rb
post_detail_spec.rb
post_localization_spec.rb FEATURE: Add support for uploads on translated posts (#35871) 2025-11-12 08:55:21 -08:00
post_mover_spec.rb FIX: Select better featured posters (#39691) 2026-07-24 16:10:46 -04:00
post_reply_key_spec.rb
post_reply_spec.rb
post_revision_spec.rb
post_spec.rb FEATURE: Localize local oneboxes (#40493) 2026-06-08 11:49:55 +08:00
post_stripper_spec.rb
post_timing_spec.rb DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
private_message_topic_tracking_state_spec.rb FEATURE: Exclude small actions from topic counters and unread tracking (#40481) 2026-06-08 08:03:55 +02:00
problem_check_tracker_spec.rb DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
published_page_spec.rb
quoted_post_spec.rb
remote_theme_spec.rb FEATURE: Show theme d-compat/* refs in admin UI (#40649) 2026-06-17 22:13:45 +01:00
report_spec.rb PERF: Use daily rollups for DAU/MAU reports (#41958) 2026-07-24 09:52:40 +08:00
reviewable_claimed_topic_spec.rb FEATURE: Sync Reviewable Status (#31901) 2025-03-24 14:27:18 +11:00
reviewable_flagged_post_spec.rb FEATURE: Allow suspending and silencing users from the review queue (#42205) 2026-07-31 14:47:40 +02:00
reviewable_history_spec.rb
reviewable_note_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
reviewable_post_spec.rb FEATURE: Allow suspending and silencing users from the review queue (#42205) 2026-07-31 14:47:40 +02:00
reviewable_queued_post_spec.rb FEATURE: Allow suspending and silencing users from the review queue (#42205) 2026-07-31 14:47:40 +02:00
reviewable_score_spec.rb SECURITY: Respect topic visibility in reviewable score serializer 2026-07-28 16:40:22 +02:00
reviewable_spec.rb SECURITY: Scope PM reviewables to their allowed audience 2026-07-28 16:40:22 +02:00
reviewable_user_spec.rb FEATURE: Allow suspending and silencing users from the review queue (#42205) 2026-07-31 14:47:40 +02:00
s3_region_site_setting_spec.rb
screened_email_spec.rb
screened_ip_address_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
screened_url_spec.rb
search_log_spec.rb UX: Focus dashboard search analytics on member searches (#41647) 2026-07-13 12:41:19 +08:00
sidebar_section_link_spec.rb
sidebar_section_localization_spec.rb FEATURE: Allow admins to localize custom sidebar section and links (#41795) 2026-07-21 21:45:50 +08:00
sidebar_section_spec.rb FEATURE: dynamic search when in /filter route (#33614) 2025-07-22 16:08:10 +10:00
sidebar_url_localization_spec.rb FEATURE: Allow admins to localize custom sidebar section and links (#41795) 2026-07-21 21:45:50 +08:00
sidebar_url_spec.rb
site_setting_localization_spec.rb FEATURE: Localizable /about page fields via its settings page (#41123) 2026-06-26 20:41:08 +08:00
site_setting_spec.rb FEATURE: Upcoming change to lower the pending users reminder delay default (#42019) 2026-07-28 14:24:30 +02:00
site_spec.rb FIX: Make auto pseudogroups visible to logged on users (#41498) 2026-07-08 09:28:18 +10:00
sitemap_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
skipped_email_log_spec.rb
stat_spec.rb FIX: Stat type grouping (#40783) 2026-06-11 16:59:33 +10:00
stylesheet_cache_spec.rb
tag_group_spec.rb FIX: Enforce tag group permissions for non-admin staff (#37377) 2026-01-29 18:06:38 +08:00
tag_localization_spec.rb FIX: Clean localized tag names (#38488) 2026-03-12 12:54:50 +08:00
tag_spec.rb FEATURE: Allow selection of multiple content languages when viewing topics and posts (#42128) 2026-07-30 12:19:44 +08:00
tag_user_spec.rb FIX: Respect user's manual topic notification level changes (#39037) 2026-04-02 11:05:00 +02:00
theme_field_spec.rb DEV: Add resolve_group_membership functionality to theme settings (#41360) 2026-07-08 09:29:21 +10:00
theme_modifier_set_spec.rb
theme_setting_spec.rb FIX: type: objects uploads should be stored as IDs (#40178) 2026-05-21 13:45:27 -03:00
theme_settings_migration_spec.rb
theme_site_setting_spec.rb DEV: Refactor and add missing tests for upload type in objects schema (#36285) 2025-11-28 04:02:23 +08:00
theme_spec.rb DEV: Drop empty core mobile/desktop stylesheets (#41988) 2026-07-23 20:30:13 +01:00
theme_svg_sprite_spec.rb
top_menu_item_spec.rb
top_topic_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_allowed_user_spec.rb
topic_converter_spec.rb FIX: Allow selecting tags that are only used in personal messages (#41918) 2026-07-24 12:27:03 +02:00
topic_embed_spec.rb FIX: Embed not loading when canonical URL points to different host due to discourseEmbedUrl not being used (#39647) 2026-05-11 21:06:29 -05:00
topic_featured_users_spec.rb FIX: Select better featured posters (#39691) 2026-07-24 16:10:46 -04:00
topic_group_spec.rb
topic_hot_scores_spec.rb FIX: Exclude unlisted topics from hot scores (#37312) 2026-01-27 13:46:57 +11:00
topic_invite_spec.rb
topic_link_click_spec.rb DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
topic_link_spec.rb FIX: Honor silent=true on internal links with other query params (#41365) 2026-07-02 16:51:44 +02:00
topic_list_spec.rb DEV: Expand top_tags, topic.tags, etc, to return an array of tag objects instead of tag names (#36678) 2026-02-02 10:03:02 +08:00
topic_localization_spec.rb DEV: Add rake task to backfill localization excerpts which were empty (#36901) 2025-12-30 17:04:36 +08:00
topic_participant_groups_summary_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_participants_summary_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
topic_posters_summary_spec.rb FIX: Select better featured posters (#39691) 2026-07-24 16:10:46 -04:00
topic_spec.rb FIX: Scope duplicate topic title check to what the user can see (#41871) 2026-07-24 15:35:35 +02:00
topic_tag_spec.rb
topic_thumbnail_spec.rb FEATURE: Add animated_topic_thumbnails site setting (#39165) 2026-04-08 23:51:01 +02:00
topic_timer_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
topic_tracking_state_spec.rb DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
topic_user_spec.rb DEV: Enable Style/RedundantBegin rubocop rule (#40096) 2026-05-19 18:44:54 +02:00
topic_view_item_spec.rb
translation_override_spec.rb UX: Display interpolation keys as interactive pills in admin editors (#37254) 2026-02-27 21:21:26 +01:00
trust_level3_requirements_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
trust_level_and_staff_setting_spec.rb
trust_level_setting_spec.rb
unsubscribe_key_spec.rb
upcoming_change_event_spec.rb FIX: Do not notify new sites or plugins enabled of old upcoming changes (#42045) 2026-07-30 09:51:08 +10:00
upload_reference_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
upload_spec.rb Revert "DEV: Switch letter avatar generation, topic OG image generati… (#42265) 2026-08-03 13:50:43 +01:00
user_action_spec.rb SECURITY: Restrict user action removal messages (#41405) 2026-07-03 17:56:04 +08:00
user_api_key_spec.rb FEATURE: User API key device authorization flow (#40189) 2026-06-10 16:09:44 -04:00
user_archived_message_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_associated_group_spec.rb FIX: Do not remove user from group with no association inadvertently (#39854) 2026-05-08 12:48:56 -04:00
user_auth_token_spec.rb SECURITY: Bind shared session key to auth token and enforce user gates (#41610) 2026-07-14 13:25:05 +08:00
user_avatar_spec.rb
user_badge_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_bookmark_list_spec.rb
user_custom_field_spec.rb
user_email_spec.rb FIX: allow users with normalized emails to change emails and remove + / . (#37133) 2026-01-16 07:36:58 +11:00
user_export_spec.rb
user_field_spec.rb
user_history_spec.rb SECURITY: Restrict staff action logs visibility for moderators 2026-01-28 17:11:14 +00:00
user_notification_schedule_spec.rb
user_option_spec.rb FEATURE: Allow selection of multiple content languages when viewing topics and posts (#42128) 2026-07-30 12:19:44 +08:00
user_password_spec.rb
user_profile_spec.rb
user_profile_view_spec.rb DEV: add shortcut fab!(:variable, :fabricator) to specs (#33577) 2025-07-11 11:16:34 -03:00
user_search_spec.rb FIX: Enforce group visibility when filtering users by group (#41370) 2026-07-03 07:08:52 +02:00
user_second_factor_spec.rb
user_security_key_spec.rb
user_spec.rb DEV: Prefer RSpec primitives for test setup (#42122) 2026-07-30 11:17:22 +08:00
user_stat_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
user_status_spec.rb
user_summary_spec.rb SECURITY: Replying to a whisper lets non-whisperers create staff-only whisper posts 2026-05-19 00:26:04 +01:00
user_visit_daily_rollup_spec.rb PERF: Use daily rollups for DAU/MAU reports (#41958) 2026-07-24 09:52:40 +08:00
user_visit_spec.rb PERF: Rewrite DAU/MAU rolling count as a non-correlated sweep (#40692) 2026-06-10 17:21:49 +08:00
username_validator_spec.rb DEV: Enable Style/RedundantParentheses rubocop rule (#40095) 2026-05-19 15:48:09 +02:00
watched_word_group_spec.rb
watched_word_spec.rb
web_crawler_request_spec.rb
web_hook_event_spec.rb
web_hook_event_type_spec.rb FEAT: add webhooks for calendar events (#38315) 2026-03-09 12:30:19 -05:00
web_hook_events_daily_aggregate_spec.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
web_hook_spec.rb PERF: Add Users to Group Pt. 1 (#38737) 2026-03-26 09:11:22 -05:00