Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Add an endpoint for Biiikes to check whether an email address organizes an event

未关闭
  • 哪里不对？
#1,106 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 7 天内回复

还没有人认领这个 Issue。

  • #1107 来自 @gangster —— 已关闭，未合并

评估

难度
4/5
预计耗时
3-5 天
新手友好度
25/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
活跃
技术栈
javascript, php
领域
api, authorization, backend, security

调研方向

Start with events.php and the proposed api/biiikes_match.php, plus the delete_test.js test style and CALENDAR_API.md. The two open questions (endpoint naming and base URL) need a maintainer decision before code, and the auth, rate-limit and timing requirements need careful design. Done means maintainers answer those questions, and the endpoint returns the specified yes/no responses with tests.

由索引模型根据 Issue 内容生成。

描述

Biiikes (biiikes.com) is a Portland group-ride calendar that imports Shift's public events through events.php. An imported ride has no owner on our side. When a ride leader wants to manage their ride on Biiikes, we need to confirm they really are that event's organizer, without Shift ever giving us organizer email addresses.

Proposal

A small, read-only endpoint that answers one question: does this email address belong to this event's organizer?

POST /api/biiikes_match.php
Authorization: Bearer <token>
Content-Type: application/json

{"series_id": "1234", "email": "[email protected]"}

200 {"leads": true}    the event exists, is published, isn't deleted, and its organizer email matches
200 {"leads": false}   everything else
  • The leader types their email address into Biiikes. Only that address is sent, and only a yes or no comes back. Shift never sends us its addresses.
  • Biiikes sends the confirmation email to the leader itself. Shift sends no mail, and nothing about Shift's mail or templates changes.
  • No schema change, no new state, no new dependency.

Privacy and abuse

This endpoint can be used to test whether an address organizes a given event, so it needs limits:

  • Off by default. It answers 404 until an admin sets BIIIKES_MATCH_TOKENS on the server, and it needs a bearer token. Revoking access means removing the token.
  • A per-token ceiling on Shift's side. About 100 requests an hour (BIIIKES_MATCH_PER_HOUR), answering 429 past it.
  • "No" looks the same every time. A wrong address, an unknown id, an unpublished event and a deleted event all get the same reply, in the same time, so it can't be used to discover events.
  • Addresses aren't logged. They're never logged or echoed, including on malformed requests. It's a POST body, never a query string, so addresses stay out of access logs.
  • Biiikes limits before it calls. Five wrong addresses per device and then an hour's lockout, three confirmation emails per address per day, and at most 50 wrong addresses per event per hour.

Implementation

I have a branch ready, with tests in the style of delete_test.js and docs in CALENDAR_API.md: about 90 lines of endpoint code, plus tests and docs. I'm happy to open the PR against this issue, and to rename or reshape anything to fit how you'd like it.

Questions for maintainers:

  1. Is a partner-specific endpoint OK, or would you prefer a general name that other approved callers could use?
  2. Which base URL should a server-to-server caller use: www.shift2bikes.org/api/ or api.shift2bikes.org/api/?
主要语言
JavaScript
星标
30
派生
26
平均合并
6 天 23 小时
30 天内合并 PR
3

环境准备

  • 提供 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 没有贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

shift-org/shift-docs 的其他 Issue

查看 shift-org/shift-docs 的全部 Issue

相似的 Issue

更多 JavaScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。