Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Add an endpoint for Biiikes to check whether an email address organizes an event

オープン
  • 何か問題がありますか？
#1,106 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 7 日以内に返信

まだ誰も着手していません。

  • #1107 @gangster による — マージされずにクローズ

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
25/100
issue の種類
機能追加
明瞭さ
おおむね明確
活発さ
活発
技術スタック
javascript, php
領域
api, authorization, backend, security

調査の方向性

Start with events.php and the proposed api/biiikes_match.php, plus the delete_test.js test style and CALENDAR_API.md. The two open questions (endpoint naming and base URL) need a maintainer decision before code, and the auth, rate-limit and timing requirements need careful design. Done means maintainers answer those questions, and the endpoint returns the specified yes/no responses with tests.

索引モデルが issue の本文から書いたものです。

説明

Biiikes (biiikes.com) is a Portland group-ride calendar that imports Shift's public events through events.php. An imported ride has no owner on our side. When a ride leader wants to manage their ride on Biiikes, we need to confirm they really are that event's organizer, without Shift ever giving us organizer email addresses.

Proposal

A small, read-only endpoint that answers one question: does this email address belong to this event's organizer?

POST /api/biiikes_match.php
Authorization: Bearer <token>
Content-Type: application/json

{"series_id": "1234", "email": "[email protected]"}

200 {"leads": true}    the event exists, is published, isn't deleted, and its organizer email matches
200 {"leads": false}   everything else
  • The leader types their email address into Biiikes. Only that address is sent, and only a yes or no comes back. Shift never sends us its addresses.
  • Biiikes sends the confirmation email to the leader itself. Shift sends no mail, and nothing about Shift's mail or templates changes.
  • No schema change, no new state, no new dependency.

Privacy and abuse

This endpoint can be used to test whether an address organizes a given event, so it needs limits:

  • Off by default. It answers 404 until an admin sets BIIIKES_MATCH_TOKENS on the server, and it needs a bearer token. Revoking access means removing the token.
  • A per-token ceiling on Shift's side. About 100 requests an hour (BIIIKES_MATCH_PER_HOUR), answering 429 past it.
  • "No" looks the same every time. A wrong address, an unknown id, an unpublished event and a deleted event all get the same reply, in the same time, so it can't be used to discover events.
  • Addresses aren't logged. They're never logged or echoed, including on malformed requests. It's a POST body, never a query string, so addresses stay out of access logs.
  • Biiikes limits before it calls. Five wrong addresses per device and then an hour's lockout, three confirmation emails per address per day, and at most 50 wrong addresses per event per hour.

Implementation

I have a branch ready, with tests in the style of delete_test.js and docs in CALENDAR_API.md: about 90 lines of endpoint code, plus tests and docs. I'm happy to open the PR against this issue, and to rename or reshape anything to fit how you'd like it.

Questions for maintainers:

  1. Is a partner-specific endpoint OK, or would you prefer a general name that other approved callers could use?
  2. Which base URL should a server-to-server caller use: www.shift2bikes.org/api/ or api.shift2bikes.org/api/?
主要言語
JavaScript
スター
30
フォーク
26
平均マージ
6日 23時間
マージ済み PR（30日）
3

環境構築

  • Dockerfile または Docker Compose ファイルあり
  • プルリクエストのテンプレートなし
  • コントリビューションガイドなし

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

shift-org/shift-docs のほかの issue

shift-org/shift-docs の issue をすべて見る

似ている issue

JavaScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。