TiddlyWiki / TiddlyWiki/MultiWikiServer
Checklist
Open
Nobody has claimed this yet.
quality control
- Dominant language
- TypeScript
- Stars
- 60
- Forks
- 16
- PR merge metrics
- No merged PRs in 30d
Description
- Verify that anonymous users only have the access defined by allowAnon.
- No access to owned bags.
- No access to bags with ACL defined.
- Verify that logged in users only have the access expected
- No access to bags owned by other users.
- Unless they are in the ACL for the bag.
- No more access than what is granted by the ACL.
- Verify that all admin permissions are based on the admin role, not the first user.
- Verify that admin's cannot remove the admin role from themselves.
- Verify that ACl checks are actually returning the correct results in as many permutations as possible.
I should be able to make tests that create a test database and then run the ACL checks against the database. This would allow us to catch regressions as well.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files or existing test entry points. Start by locating the ACL checks, admin-role permission logic, and any existing test-database setup; then define database-backed tests for anonymous, logged-in, ACL, and admin-role permutations. Done means the listed access restrictions are covered and regressions can be detected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- authorization, security, testing
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100