Revert "fix: updating metric library" - #110
Conversation
This reverts commit f663650.
|
| Filename | Overview |
|---|---|
| app/core/auth/api_key.py | Removes the organization-active guard, allowing existing keys for previously disabled tenants to authenticate. |
| app/core/auth/local.py | Removes the disabled-organization check from local bearer-token authentication. |
| app/core/auth/oidc_common.py | Allows OIDC identities mapped to previously disabled organizations to receive principals. |
| app/api/v1/routes/auth.py | Removes disabled-organization filtering from login, refresh, and organization-switching flows. |
| app/api/v1/routes/metrics.py | Reverts draft lifecycle endpoints and filtering; persisted draft rows may remain but are disabled. |
| app/models/database.py | Removes platform administration, draft lifecycle, and Metrics Studio ORM models while deployed databases may retain their schema. |
| frontend/src/App.tsx | Removes platform administration and Metrics Studio routes and restores the previous metrics pages. |
| app/migrations/057_platform_admin.py | Deletes the migration file without downgrading already-upgraded databases, preserving prior disabled-organization state. |
Reviews (1): Last reviewed commit: "Revert "fix: updating metric library"" | Re-trigger Greptile
| @@ -38,8 +37,6 @@ def authenticate(self, cred: RawCredential, db: Session) -> Principal: | |||
| if not db_key: | |||
| raise AuthError("Invalid API key") | |||
|
|
|||
There was a problem hiding this comment.
Disabled organization access bypass
If a database contains an organization disabled before this revert, API-key, local, OIDC, refresh-token, and organization-switching flows now issue or accept organization-scoped principals without checking the retained disabled state, causing suspended users and clients to regain access to the tenant's routes and data.
How this was verified: Every changed authentication path reaches principal construction or token issuance without any remaining organization-active guard.
|
Closing: revert already merged to main via #109. Feature changes will land via new PR from feat/metric-library. |
This reverts commit f663650.
What Changed?
Briefly describe what this PR changes.
Why?
Explain the problem this solves and why this approach was chosen.
How to Test?
List clear steps for reviewers to verify the change.
Release Label
Select one semantic version bump intent for this PR:
major- breaking change, next release bumps major versionminor- backward-compatible feature, next release bumps minor versionfix- backward-compatible bug fix, next release bumps patch versionIf you do not have permission to apply labels, mention the intended release label here and a maintainer will set it.
Checklist
CONTRIBUTING.mdguide.