pigui/task-stream
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(api): typed OpenAPI query params and not-found messages that hide private projects

Browse Source 
- Query DTO properties with a default value (limit, offset, days, perColumn,
  assignedToMe, search, archived, requiresReason, force) were documented as
  `object` in openapi.json, which broke generated clients. They now declare
  their type explicitly.
- Reading a private project, ticket, release or its comments without access
  answered "Project <internal id> not found", confirming the project exists.
  ReadAccess now reports what the caller asked for (e2e covered).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Josep Piguillem
2026-10-07 18:59:38 +02:00
parent e656222b54
commit 71dc2d6f2d
11 changed files with 82 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
apps/api/e2e/tracker.e2e-spec.ts
View File

@@ -977,7 +977,14 @@ describe('task-stream (e2e)', () => {
() => rest(null, 'GET', `/projects/${key}`),
(r) => r.status === 404,
);
expect((await rest(null, 'GET', `/issues/${issue}`)).status).toBe(404);
const hidden = await rest(null, 'GET', `/issues/${issue}`);
expect(hidden.status).toBe(404);
// The answer names what was asked, not the private project behind it.
expect(hidden.body['message']).toContain(issue);
expect(hidden.body['message']).not.toContain(projectId);
const project = await rest(null, 'GET', `/projects/${key}`);
expect(project.body['message']).toContain(key);
expect(project.body['message']).not.toContain(projectId);
});
it('deletes a project with everything in it (cascade saga) and frees its key', async () => {

116
apps/api/openapi.json
View File

@@ -179,11 +179,7 @@
"description": "Name or email",
"schema": {
"default": "",
"allOf": [
{
"$ref": "#/components/schemas/Object"
}
]
"type": "string"
}
},
{
@@ -194,11 +190,7 @@
"minimum": 1,
"maximum": 100,
"default": 20,
"allOf": [
{
"$ref": "#/components/schemas/Object"
}
]
"type": "number"
}
}
],
@@ -1023,11 +1015,7 @@
"minimum": 1,
"maximum": 200,
"default": 50,
"allOf": [
{
"$ref": "#/components/schemas/Object"
}
]
"type": "number"
}
}
],
@@ -1206,11 +1194,7 @@
"minimum": 7,
"maximum": 365,
"default": 90,
"allOf": [
{
"$ref": "#/components/schemas/Object"
}
]
"type": "number"
}
}
],
@@ -1313,11 +1297,7 @@
"minimum": 1,
"maximum": 200,
"default": 50,
"allOf": [
{
"$ref": "#/components/schemas/Object"
}
]
"type": "number"
}
},
{
@@ -1752,11 +1732,7 @@
"minimum": 1,
"maximum": 200,
"default": 50,
"allOf": [
{
"$ref": "#/components/schemas/Object"
}
]
"type": "number"
}
},
{
@@ -1766,11 +1742,7 @@
"schema": {
"minimum": 0,
"default": 0,
"allOf": [
{
"$ref": "#/components/schemas/Object"
}
]
"type": "number"
}
},
{
@@ -1780,11 +1752,7 @@
"description": "true: tickets assigned to me. false: any ticket of my projects (e.g. ?assignedToMe=false&category=QA)",
"schema": {
"default": true,
"allOf": [
{
"$ref": "#/components/schemas/Object"
}
]
"type": "boolean"
}
},
{
@@ -1900,11 +1868,7 @@
"minimum": 1,
"maximum": 200,
"default": 50,
"allOf": [
{
"$ref": "#/components/schemas/Object"
}
]
"type": "number"
}
},
{
@@ -1914,11 +1878,7 @@
"schema": {
"minimum": 0,
"default": 0,
"allOf": [
{
"$ref": "#/components/schemas/Object"
}
]
"type": "number"
}
},
{
@@ -2981,11 +2941,7 @@
"minimum": 1,
"maximum": 200,
"default": 50,
"allOf": [
{
"$ref": "#/components/schemas/Object"
}
]
"type": "number"
}
},
{
@@ -2995,11 +2951,7 @@
"schema": {
"minimum": 0,
"default": 0,
"allOf": [
{
"$ref": "#/components/schemas/Object"
}
]
"type": "number"
}
}
],
@@ -3201,11 +3153,7 @@
"minimum": 1,
"maximum": 200,
"default": 50,
"allOf": [
{
"$ref": "#/components/schemas/Object"
}
]
"type": "number"
}
},
{
@@ -3215,11 +3163,7 @@
"schema": {
"minimum": 0,
"default": 0,
"allOf": [
{
"$ref": "#/components/schemas/Object"
}
]
"type": "number"
}
}
],
@@ -3511,11 +3455,7 @@
"minimum": 1,
"maximum": 50,
"default": 10,
"allOf": [
{
"$ref": "#/components/schemas/Object"
}
]
"type": "number"
}
}
],
@@ -4149,11 +4089,7 @@
"minimum": 1,
"maximum": 200,
"default": 50,
"allOf": [
{
"$ref": "#/components/schemas/Object"
}
]
"type": "number"
}
},
{
@@ -4163,11 +4099,7 @@
"schema": {
"minimum": 0,
"default": 0,
"allOf": [
{
"$ref": "#/components/schemas/Object"
}
]
"type": "number"
}
}
],
@@ -4730,10 +4662,6 @@
"message"
]
},
"Object": {
"type": "object",
"properties": {}
},
"UserDto": {
"type": "object",
"properties": {
@@ -5168,11 +5096,11 @@
]
},
"requiresReason": {
"type": "object",
"type": "boolean",
"default": false
},
"archived": {
"type": "object",
"type": "boolean",
"default": false
}
},
@@ -5233,7 +5161,7 @@
]
},
"archived": {
"type": "object",
"type": "boolean",
"default": false
}
},
@@ -5257,7 +5185,7 @@
"maxLength": 40
},
"archived": {
"type": "object",
"type": "boolean",
"default": false
}
},
@@ -6410,7 +6338,7 @@
"type": "object",
"properties": {
"force": {
"type": "object",
"type": "boolean",
"default": false,
"description": "Publish even with unfinished tickets"
}