Set up forms app with authentication #1497
Conversation
jchristgit
force-pushed
the
forms-bootstrap
branch
2 times, most recently
from
0a51298 to
8b6dbeb
Compare
This begins the work of integrating the forms backend into the site. Changes, until complete, will be merged into the `forms` tracking branch.
jchristgit
force-pushed
the
forms-bootstrap
branch
from
8b6dbeb to
603e046
Compare
There was a problem hiding this comment.
Copilot reviewed 18 out of 19 changed files in this pull request and generated 3 comments.
Files not reviewed (1)
- .coveragerc: Language not supported
Comments suppressed due to low confidence (1)
pydis_site/apps/forms/tests/test_api.py:127
- [nitpick] Consider revising or removing the informal comment to maintain a professional tone in test files.
# the ultimate power trip...
| FORMS_SECRET_KEY = SECRET_KEY | ||
|
|
There was a problem hiding this comment.
The FORMS_SECRET_KEY is assigned multiple times (in DEBUG, CI, and then from the environment). Consider consolidating its configuration to avoid potential inconsistencies during authentication.
| FORMS_SECRET_KEY = SECRET_KEY |
Copilot is powered by AI, so mistakes are possible. Review output carefully before use.
| def has_permission(self, request: HttpRequest, view: View) -> bool: | ||
| """Only allow authenticated users with the configured set of scopes to access this resource.""" | ||
| # XXX: this should check for superset, not strict equality. | ||
| return request.user.is_authenticated and request.auth and frozenset(request.auth.scopes) == self.scopes |
There was a problem hiding this comment.
Using strict equality for scope comparison may lead to authorization issues. Consider checking if the user’s scopes are a superset of the required scopes instead.
| return request.user.is_authenticated and request.auth and frozenset(request.auth.scopes) == self.scopes | |
| return request.user.is_authenticated and request.auth and frozenset(request.auth.scopes).issuperset(self.scopes) |
Copilot is powered by AI, so mistakes are possible. Review output carefully before use.
| oldest = min(role.last_update for role in roles) | ||
| if not util.is_stale(oldest, 60 * 60 * 24): # 1 day | ||
| return tuple(roles) | ||
|
|
There was a problem hiding this comment.
If no roles are present in the database, calling min() could raise an error. Consider adding a check to ensure the queryset is not empty before finding the minimum timestamp.
| oldest = min(role.last_update for role in roles) | |
| if not util.is_stale(oldest, 60 * 60 * 24): # 1 day | |
| return tuple(roles) | |
| if roles: | |
| oldest = min(role.last_update for role in roles) | |
| if not util.is_stale(oldest, 60 * 60 * 24): # 1 day | |
| return tuple(roles) |
Copilot is powered by AI, so mistakes are possible. Review output carefully before use.
This begins the work of integrating the forms backend into the site.
Changes, until complete, will be merged into the
formstrackingbranch.