6230f5c554
This refactors default_current_user_provider in a few ways: - Introduce a generic `api_parameter_allowed?` method which checks for whitelisted routes/formats - Only read the api_key parameter on allowed routes. It is now completely ignored on other routes (previously it would raise a 403) - Start reading user_api_key parameter on allowed routes - Refactor tests as end-end integration tests A plugin API for PARAMETER_API_PATTERNS will be added soon |
||
|---|---|---|
| .. | ||
| default_current_user_provider_spec.rb | ||
| discord_authenticator_spec.rb | ||
| facebook_authenticator_spec.rb | ||
| github_authenticator_spec.rb | ||
| google_oauth2_authenticator_spec.rb | ||
| instagram_authenticator_spec.rb | ||
| managed_authenticator_spec.rb | ||
| twitter_authenticator_spec.rb | ||