lock down sync api in lexbox to only be available to admins for now

sillsdev · May 17, 2024 · b6fc351 · b6fc351
1 parent 03dd80f
commit b6fc351
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/backend/LexBoxApi/Program.cs b/backend/LexBoxApi/Program.cs
@@ -162,7 +162,7 @@
 app.MapQuartzUI("/api/quartz").RequireAuthorization(new AdminRequiredAttribute());
 app.MapControllers();
 app.MapLfClassicApi().RequireAuthorization(new AdminRequiredAttribute()).WithOpenApi();
-app.MapSyncApi().AllowAnonymous().WithOpenApi();
+app.MapSyncApi().WithOpenApi();
 app.MapTus("/api/tus-test",
         async context => await context.RequestServices.GetRequiredService<TusService>().GetTestConfig(context))
     .RequireAuthorization(new AdminRequiredAttribute());

diff --git a/backend/LexBoxApi/Services/CrdtSyncRoutes.cs b/backend/LexBoxApi/Services/CrdtSyncRoutes.cs
@@ -1,4 +1,5 @@
 using Crdt.Core;
+using LexBoxApi.Auth.Attributes;
 using LexData;
 using LexData.Entities;
 
@@ -9,7 +10,8 @@ public static class CrdtSyncRoutes
     public static IEndpointConventionBuilder MapSyncApi(this IEndpointRouteBuilder endpoints,
         string path = "/api/sync/{id}")
     {
-        var group = endpoints.MapGroup(path);
+        //todo determine if the user has permission to access the project, for now lock down to admin only
+        var group = endpoints.MapGroup(path).RequireAuthorization(new AdminRequiredAttribute());
         group.MapGet("/get",
             async (Guid id, LexBoxDbContext dbContext) =>
             {