Clean up Admin API calls requiring an API token
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 1.1k
- Forks
- 564
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 29
Description
There are several Admin API calls that check for a token, when it is expected that these API will be protected on other ways (and many of the calls don't, so we don't have consistency).
Of the ones that do, some just check and don't do anything with the token - these should have that logic removed.
Others need to the user to call a command - but we have a different way to get a default admin (though we likely should clean that up too).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files, tests, or specific Admin API entry points are named. Start by inventorying the Admin API calls that check for an API token and compare them with calls that rely on other protection or default-admin handling. Done means the unnecessary token checks and unused-token logic are consistently addressed, with the remaining command-related behavior clarified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, authentication, backend
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100