Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Remove the v1 user routes and keep complete simulation and report results final

Abierto
  • ¿Algo no está bien?
#4,028 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 2 días

@MaxGhenis ya está trabajando en esto.

Desde el 23/10/2026.

  • #4029 de @MaxGhenis — abierto

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
45/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
python
Área
api, security

Línea de trabajo

Start by locating the v1 user-profile and user-policy route definitions and the PATCH handlers for simulation and report; the issue gives no file or test names. Read how those handlers authorize requests and determine whether a stored result is complete. Done means the legacy routes are removed and updates to complete results are accepted unchanged when identical or rejected with 409 when they differ; run the relevant API tests.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

The 2026-10-22 security review of the deployed API found two authorization gaps in v1 routes.

  1. Legacy user routes. /{country_id}/user-profile (GET, POST, PUT) and /{country_id}/user-policy (GET, POST, PUT) read and change user profiles and saved policies by a user_id, auth0_id or record id taken from the request, and check no credential. App v2 does not call them, and #4017 reports no production requests to them in the 30 days to 2026-10-19. Signed-in users' saved work is served by the /v2 routes, which take the owner from the verified credential.
  2. Result updates. PATCH /{country_id}/simulation and PATCH /{country_id}/report take no credential and can replace a result that is already complete. These records are shared (identical requests reuse one record), so one caller's update changes what every viewer of that record sees.

Plan:

  • Remove the v1 user routes. #4017 removes them too, but it is held for the legacy site's shutdown because of the other routes it removes.
  • Make a complete result final: an update that repeats it is accepted and changes nothing, and one that would change it answers 409. Today the browser that ran the calculation writes its result, so there is no compute-worker credential to require; making the server the only writer of results is a follow-up.
Lenguaje dominante
Python
Estrellas
18
Forks
33
Merge medio
2 d 13 h
PR fusionados (30 d)
56

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de PolicyEngine/policyengine-api

Todos los issues de PolicyEngine/policyengine-api

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.