GithubBackup/MoviePilot
1
0
Fork 0
mirror of https://github.com/jxxghp/MoviePilot.git synced 2026-08-03 20:27:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

docs(security): clarify api token admin contract (#6048)

Browse Source
This commit is contained in:
InfinityPacer
2026-07-05 09:22:59 +08:00
committed by GitHub
parent 6c3c5e042d
commit d14d401c86
6 changed files with 26 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/rules/11-quality-and-security.md
View File

@@ -78,6 +78,8 @@ The `API_TOKEN` value in `settings` is the source of truth. It is set at initial
### Endpoint Authorization
- API-token authenticated integration endpoints are administrator-level surfaces unless a specific endpoint documents a narrower contract.
- Do not infer user-scoped authorization from a valid `API_TOKEN`; use an explicit user identity dependency when behavior must be scoped to a logged-in user.
- Use the existing FastAPI dependency functions (e.g., `get_current_user`, `get_current_active_superuser`) — check `app/api/endpoints/` for usage patterns.
- Do not add manual token parsing inside endpoint functions. Always use the project's dependency injection.
- Superuser-only operations must explicitly require the superuser dependency.