0 Fork 0

mirror of https://github.com/webstudio-is/webstudio.git synced 2026-10-28 07:37:36 +09:00

Files

T

Kathir EswaranandOleg Isonen ce84ddcf12 fix: Remove hardcoded template allowlist and require authorization tokens (#6041 )

## Description

Removes the hardcoded template-project allowlist from
`checkProjectPermit`. Marketplace projects now use their existing viewer
authorization tokens, matching how the marketplace passes `authToken`
through builder URLs and the builder loader.

Token authorization is also scoped to the requested project, so a valid
token for one project cannot grant access to another project.

## Changes

- Removed the 15-project template allowlist and its unconditional view
grant.
- Scoped `AuthorizationToken` permit queries by `projectId`.
- Added regression coverage for former template IDs, valid viewer
tokens, missing tokens, and cross-project token use.
- Removed the proposed token backfill and unrelated Prisma schema drift
change; existing marketplace tokens remain the source of access.

## Verification

- [x] Demonstrated the cross-project regression test fails before the
project constraint.
- [x] `pnpm --filter @webstudio-is/trpc-interface test --
src/authorize/project.server.test.ts`
- [x] `pnpm --filter @webstudio-is/trpc-interface typecheck`
- [x] Reviewed documentation impact; no documentation changes are
required.
- [x] Verified fixture inputs and outputs are not affected.

## Before merging

- [x] Made a self-review.
- [x] Added regression tests.
- [x] Confirmed no environment variables are added.
- [ ] Confirm GitHub checks pass.

---------

Co-authored-by: Oleg Isonen <oleg008@gmail.com>

2026-08-07 19:57:24 +02:00

src

fix: Remove hardcoded template allowlist and require authorization tokens (#6041 )

2026-08-07 19:57:24 +02:00

LICENSE

Change license from MIT to AGPL V3 (#1980 )

2023-07-26 01:06:21 +02:00

package.json

chore: migrate toolchain to oxc (oxfmt, oxlint, rolldown-vite) and typeScript 7 (#5868 )

2026-07-12 01:03:36 +02:00

README.md

Add initial trpc interface package (#780 )

2023-01-16 21:31:58 +03:00

tsconfig.json

Check types outside of src folder (#1789 )

2023-06-14 23:37:24 +03:00

README.md

trpc-interface

trpc-interface can implement various TRPC server routers.
it can act as a proxy for TRPC services implemented in any other apps (those services must have the same API interface).