feat(security): implement safe guest auth flow and harden request_jwt
- Patched request_jwt to strip privileged IDs when signing with public keys - Updated AccountContext and V3 dependencies to preserve JWT payloads for guests - Whitelisted Archive, Post, Event, and other core objects for public read access - Added 'default_qry_str' to Event searchable fields - Added test_e2e_jwt_guest_auth.py for security verification
This commit is contained in:
@@ -61,6 +61,7 @@ events_presentation_obj_li = {
|
||||
'table_name_alt': 'v_event_presentation_w_file_count',
|
||||
'tbl_name_update': 'event_presentation',
|
||||
'base_name': Event_Presentation_Base,
|
||||
'public_read': True,
|
||||
# V3 Search Security:
|
||||
'searchable_fields': [
|
||||
'event_presentation_id_random', 'event_id_random',
|
||||
@@ -85,6 +86,7 @@ events_presentation_obj_li = {
|
||||
'table_name_alt': 'v_event_presenter_w_file_count',
|
||||
'tbl_name_update': 'event_presenter',
|
||||
'base_name': Event_Presenter_Base,
|
||||
'public_read': True,
|
||||
'exp_default': [
|
||||
'event_presenter_id_random',
|
||||
'title_names', 'given_name', 'middle_name', 'family_name', 'designations',
|
||||
@@ -119,6 +121,7 @@ events_presentation_obj_li = {
|
||||
'table_name': 'v_event_session',
|
||||
'tbl_name_update': 'event_session',
|
||||
'base_name': Event_Session_Base,
|
||||
'public_read': True,
|
||||
# V3 Search Security:
|
||||
'searchable_fields': [
|
||||
'event_session_id_random', 'event_id_random',
|
||||
|
||||
Reference in New Issue
Block a user