feat(security): implement safe guest auth flow and harden request_jwt
- Patched request_jwt to strip privileged IDs when signing with public keys - Updated AccountContext and V3 dependencies to preserve JWT payloads for guests - Whitelisted Archive, Post, Event, and other core objects for public read access - Added 'default_qry_str' to Event searchable fields - Added test_e2e_jwt_guest_auth.py for security verification
This commit is contained in:
@@ -102,6 +102,7 @@ other_obj_li = {
|
||||
'table_name': 'v_archive_content',
|
||||
'tbl_name_update': 'archive_content',
|
||||
'base_name': Archive_Content_Base,
|
||||
'public_read': True,
|
||||
# V3 Search Security:
|
||||
'searchable_fields': [
|
||||
'archive_content_id_random', 'account_id_random', 'archive_id_random',
|
||||
@@ -122,6 +123,7 @@ other_obj_li = {
|
||||
'table_name': 'v_hosted_file',
|
||||
'tbl_name_update': 'hosted_file',
|
||||
'base_name': Hosted_File_Base,
|
||||
'public_read': True,
|
||||
'exp_default': [
|
||||
'hosted_file_id_random',
|
||||
'hash_sha256',
|
||||
|
||||
Reference in New Issue
Block a user