Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Add an endpoint for Biiikes to check whether an email address organizes an event

Abierto
  • ¿Algo no está bien?
#1,106 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 7 días

Nadie ha tomado este issue todavía.

  • #1107 de @gangster — cerrado sin fusionar

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
25/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
javascript, php
Área
api, authorization, backend, security

Línea de trabajo

Start with events.php and the proposed api/biiikes_match.php, plus the delete_test.js test style and CALENDAR_API.md. The two open questions (endpoint naming and base URL) need a maintainer decision before code, and the auth, rate-limit and timing requirements need careful design. Done means maintainers answer those questions, and the endpoint returns the specified yes/no responses with tests.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Biiikes (biiikes.com) is a Portland group-ride calendar that imports Shift's public events through events.php. An imported ride has no owner on our side. When a ride leader wants to manage their ride on Biiikes, we need to confirm they really are that event's organizer, without Shift ever giving us organizer email addresses.

Proposal

A small, read-only endpoint that answers one question: does this email address belong to this event's organizer?

POST /api/biiikes_match.php
Authorization: Bearer <token>
Content-Type: application/json

{"series_id": "1234", "email": "[email protected]"}

200 {"leads": true}    the event exists, is published, isn't deleted, and its organizer email matches
200 {"leads": false}   everything else
  • The leader types their email address into Biiikes. Only that address is sent, and only a yes or no comes back. Shift never sends us its addresses.
  • Biiikes sends the confirmation email to the leader itself. Shift sends no mail, and nothing about Shift's mail or templates changes.
  • No schema change, no new state, no new dependency.

Privacy and abuse

This endpoint can be used to test whether an address organizes a given event, so it needs limits:

  • Off by default. It answers 404 until an admin sets BIIIKES_MATCH_TOKENS on the server, and it needs a bearer token. Revoking access means removing the token.
  • A per-token ceiling on Shift's side. About 100 requests an hour (BIIIKES_MATCH_PER_HOUR), answering 429 past it.
  • "No" looks the same every time. A wrong address, an unknown id, an unpublished event and a deleted event all get the same reply, in the same time, so it can't be used to discover events.
  • Addresses aren't logged. They're never logged or echoed, including on malformed requests. It's a POST body, never a query string, so addresses stay out of access logs.
  • Biiikes limits before it calls. Five wrong addresses per device and then an hour's lockout, three confirmation emails per address per day, and at most 50 wrong addresses per event per hour.

Implementation

I have a branch ready, with tests in the style of delete_test.js and docs in CALENDAR_API.md: about 90 lines of endpoint code, plus tests and docs. I'm happy to open the PR against this issue, and to rename or reshape anything to fit how you'd like it.

Questions for maintainers:

  1. Is a partner-specific endpoint OK, or would you prefer a general name that other approved callers could use?
  2. Which base URL should a server-to-server caller use: www.shift2bikes.org/api/ or api.shift2bikes.org/api/?
Lenguaje dominante
JavaScript
Estrellas
30
Forks
26
Merge medio
6 d 23 h
PR fusionados (30 d)
3

Preparar el entorno

  • Incluye un Dockerfile o un archivo de Docker Compose
  • Sin plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de shift-org/shift-docs

Todos los issues de shift-org/shift-docs

Issues similares

Más issues de JavaScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.