Repository navigation
Conversation
tire-fire
force-pushed
the
fix/enforce-graph-flags
branch
from
November 13, 2026 05:37
fd046b1 to
80ad8ca
Compare
…lers Both flags existed in config but neither was checked by the handlers; the graph APIs were always publicly accessible. Anonymous callers are now refused when EnablePublicGraphs is off; team-role callers when DisableGraphsForBlueTeam is on. Admins always pass.
tire-fire
force-pushed
the
fix/enforce-graph-flags
branch
from
November 13, 2026 05:45
80ad8ca to
1e276f7
Compare
- gofmt alignment fix in graphs_test.go - Remove two tautological assert.NotEqual(StatusForbidden) lines that were implied by the preceding assert.True(checkGraphAccess) result - GraphPage now gates on EnablePublicGraphs (redirects anon to /login) and DisableGraphsForBlueTeam (403 for team-role callers), mirroring the checkGraphAccess guard already applied to the three API endpoints
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
EnablePublicGraphsandDisableGraphsForBlueTeamexisted in the config but neither was checked by the graph API handlers; the three graph endpoints (/api/graphs/services,/api/graphs/scores,/api/graphs/uptimes) were always publicly accessible regardless of their values.A new
checkGraphAccesshelper, called beforeCheckCompetitionStartedin all three handlers, enforces both flags:EnablePublicGraphs = false: anonymous callers (no session) get403 Forbidden.DisableGraphsForBlueTeam = true: callers with theteamrole but notadminget403 Forbidden.Admins always pass. The graph page (
/graphs) already shows a countdown before the competition starts and is unaffected; this change is to the API endpoints only.Verification
TestGraphsPublicDisabled,TestGraphsBlueTeamDisabled,TestGraphsAdminAlwaysPassescover the three handlers for each scenario. Without the flag checks, anonymous callers reach the nil DB and panic rather than getting 403.go test -short ./www/api/ -run TestGraphspasses.