Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Add an endpoint for Biiikes to check whether an email address organizes an event

Aperta
  • Qualcosa non va?
#1,106 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 7 giorni

Nessuno ha ancora preso questa issue.

  • #1107 di @gangster — chiusa senza merge

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
25/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
javascript, php
Ambito
api, authorization, backend, security

Direzione di ricerca

Start with events.php and the proposed api/biiikes_match.php, plus the delete_test.js test style and CALENDAR_API.md. The two open questions (endpoint naming and base URL) need a maintainer decision before code, and the auth, rate-limit and timing requirements need careful design. Done means maintainers answer those questions, and the endpoint returns the specified yes/no responses with tests.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Biiikes (biiikes.com) is a Portland group-ride calendar that imports Shift's public events through events.php. An imported ride has no owner on our side. When a ride leader wants to manage their ride on Biiikes, we need to confirm they really are that event's organizer, without Shift ever giving us organizer email addresses.

Proposal

A small, read-only endpoint that answers one question: does this email address belong to this event's organizer?

POST /api/biiikes_match.php
Authorization: Bearer <token>
Content-Type: application/json

{"series_id": "1234", "email": "[email protected]"}

200 {"leads": true}    the event exists, is published, isn't deleted, and its organizer email matches
200 {"leads": false}   everything else
  • The leader types their email address into Biiikes. Only that address is sent, and only a yes or no comes back. Shift never sends us its addresses.
  • Biiikes sends the confirmation email to the leader itself. Shift sends no mail, and nothing about Shift's mail or templates changes.
  • No schema change, no new state, no new dependency.

Privacy and abuse

This endpoint can be used to test whether an address organizes a given event, so it needs limits:

  • Off by default. It answers 404 until an admin sets BIIIKES_MATCH_TOKENS on the server, and it needs a bearer token. Revoking access means removing the token.
  • A per-token ceiling on Shift's side. About 100 requests an hour (BIIIKES_MATCH_PER_HOUR), answering 429 past it.
  • "No" looks the same every time. A wrong address, an unknown id, an unpublished event and a deleted event all get the same reply, in the same time, so it can't be used to discover events.
  • Addresses aren't logged. They're never logged or echoed, including on malformed requests. It's a POST body, never a query string, so addresses stay out of access logs.
  • Biiikes limits before it calls. Five wrong addresses per device and then an hour's lockout, three confirmation emails per address per day, and at most 50 wrong addresses per event per hour.

Implementation

I have a branch ready, with tests in the style of delete_test.js and docs in CALENDAR_API.md: about 90 lines of endpoint code, plus tests and docs. I'm happy to open the PR against this issue, and to rename or reshape anything to fit how you'd like it.

Questions for maintainers:

  1. Is a partner-specific endpoint OK, or would you prefer a general name that other approved callers could use?
  2. Which base URL should a server-to-server caller use: www.shift2bikes.org/api/ or api.shift2bikes.org/api/?
Lingua principale
JavaScript
Stelle
30
Fork
26
Merge medio
6g 23h
PR unite (30g)
3

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di shift-org/shift-docs

Tutte le issue di shift-org/shift-docs

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.