feat(security): implement safe guest auth flow and harden request_jwt

- Patched request_jwt to strip privileged IDs when signing with public keys
- Updated AccountContext and V3 dependencies to preserve JWT payloads for guests
- Whitelisted Archive, Post, Event, and other core objects for public read access
- Added 'default_qry_str' to Event searchable fields
- Added test_e2e_jwt_guest_auth.py for security verification
This commit is contained in:
Scott Idem
2026-01-20 14:56:56 -05:00
parent 8a22ac324c
commit dc7732ab5f
11 changed files with 179 additions and 16 deletions

View File

@@ -61,6 +61,7 @@ events_presentation_obj_li = {
'table_name_alt': 'v_event_presentation_w_file_count',
'tbl_name_update': 'event_presentation',
'base_name': Event_Presentation_Base,
'public_read': True,
# V3 Search Security:
'searchable_fields': [
'event_presentation_id_random', 'event_id_random',
@@ -85,6 +86,7 @@ events_presentation_obj_li = {
'table_name_alt': 'v_event_presenter_w_file_count',
'tbl_name_update': 'event_presenter',
'base_name': Event_Presenter_Base,
'public_read': True,
'exp_default': [
'event_presenter_id_random',
'title_names', 'given_name', 'middle_name', 'family_name', 'designations',
@@ -119,6 +121,7 @@ events_presentation_obj_li = {
'table_name': 'v_event_session',
'tbl_name_update': 'event_session',
'base_name': Event_Session_Base,
'public_read': True,
# V3 Search Security:
'searchable_fields': [
'event_session_id_random', 'event_id_random',