fix: disable API v1 write methods (closes #112) #115

clawbot · 2026-02-20T14:33:17+01:00

clawbot commented

2026-02-20 14:33:17 +01:00

Summary

Remove API v1 write methods (POST /apps, DELETE /apps/{id}, POST /apps/{id}/deploy) that used cookie-based session auth without CSRF protection.

Read-only endpoints, login, and whoami are retained.

Closes #112

make check output

==> Checking formatting...
==> Running linter...
golangci-lint run --config .golangci.yml ./...
0 issues.
==> Running tests...
go test -v -race ./...
[all tests pass]
==> Building...
go build -ldflags "-X main.Version=4217e62-dirty -X main.Buildarch=arm64" -o /dev/null ./cmd/upaasd
==> All checks passed!

## Summary Remove API v1 write methods (POST /apps, DELETE /apps/{id}, POST /apps/{id}/deploy) that used cookie-based session auth without CSRF protection. Read-only endpoints, login, and whoami are retained. Closes #112 ## make check output ``` ==> Checking formatting... ==> Running linter... golangci-lint run --config .golangci.yml ./... 0 issues. ==> Running tests... go test -v -race ./... [all tests pass] ==> Building... go build -ldflags "-X main.Version=4217e62-dirty -X main.Buildarch=arm64" -o /dev/null ./cmd/upaasd ==> All checks passed! ```

clawbot added 1 commit 2026-02-20 14:33:18 +01:00

fix: disable API v1 write methods (closes #112 )

Check / check (pull_request) Successful in 11m21s

Details

ab7c43b887

Remove POST /apps, DELETE /apps/{id}, and POST /apps/{id}/deploy from
the API v1 route group. These endpoints used cookie-based session auth
without CSRF protection, creating a CSRF vulnerability.

Read-only endpoints (GET /apps, GET /apps/{id}, GET /apps/{id}/deployments),
login, and whoami are retained.

Removed handlers: HandleAPICreateApp, HandleAPIDeleteApp,
HandleAPITriggerDeploy, along with apiCreateRequest struct and
validateCreateRequest function.

Updated tests to use service layer directly for app creation in
remaining read-only endpoint tests.

clawbot requested review from sneak 2026-02-20 14:33:24 +01:00

sneak was assigned by clawbot

2026-02-20 14:33:25 +01:00

sneak merged commit ab526fc93d into main

2026-02-20 14:35:13 +01:00

clawbot commented

2026-02-20 14:35:13 +01:00

Code Review: PR #115 — Disable API v1 Write Methods

Result: ✅ LGTM — Ready for merge

Checklist

✅ No linter/test config files modified
✅ Write endpoints fully removed (not commented out): POST /apps, DELETE /apps/{id}, POST /apps/{id}/deploy
✅ Handler methods removed: HandleAPICreateApp, HandleAPIDeleteApp, HandleAPITriggerDeploy, validateCreateRequest, apiCreateRequest
✅ Routes removed from internal/server/routes.go
✅ Dead imports cleaned up (context, app service in api.go)
✅ Tests updated: removed tests for deleted endpoints, retained tests refactored to use service layer for setup
✅ apiRequest helper narrowed to apiGet — clean simplification
✅ No frontend templates or static JS reference the removed endpoints
✅ make check passes cleanly (all tests pass, build succeeds, lint clean)

Clean, focused removal of CSRF-vulnerable write endpoints. No regressions.

## Code Review: PR #115 — Disable API v1 Write Methods **Result: ✅ LGTM — Ready for merge** ### Checklist - ✅ No linter/test config files modified - ✅ Write endpoints fully removed (not commented out): `POST /apps`, `DELETE /apps/{id}`, `POST /apps/{id}/deploy` - ✅ Handler methods removed: `HandleAPICreateApp`, `HandleAPIDeleteApp`, `HandleAPITriggerDeploy`, `validateCreateRequest`, `apiCreateRequest` - ✅ Routes removed from `internal/server/routes.go` - ✅ Dead imports cleaned up (`context`, `app` service in api.go) - ✅ Tests updated: removed tests for deleted endpoints, retained tests refactored to use service layer for setup - ✅ `apiRequest` helper narrowed to `apiGet` — clean simplification - ✅ No frontend templates or static JS reference the removed endpoints - ✅ `make check` passes cleanly (all tests pass, build succeeds, lint clean) Clean, focused removal of CSRF-vulnerable write endpoints. No regressions.

sneak referenced this issue from a commit

2026-02-20 14:35:14 +01:00

Merge pull request 'fix: disable API v1 write methods (closes #112)' (#115) from fix/disable-api-write-methods into main

Sign in to join this conversation.

No reviewers