mirror of
https://github.com/discourse/discourse.git
synced 2024-12-01 21:19:41 -06:00
f4f5524190
previously we supported blanket read and write for user API, this change amends it so we can define more limited scopes. A scope only covers a few routes. You can not grant access to part of the site and leave a large amount of the information hidden to API consumer.
14 lines
537 B
Ruby
14 lines
537 B
Ruby
class AddScopesToUserApiKeys < ActiveRecord::Migration
|
|
def change
|
|
add_column :user_api_keys, :scopes, :text, array: true, null: false, default: []
|
|
|
|
execute "UPDATE user_api_keys SET scopes = scopes || ARRAY['write'] WHERE write"
|
|
execute "UPDATE user_api_keys SET scopes = scopes || ARRAY['read'] WHERE read"
|
|
execute "UPDATE user_api_keys SET scopes = scopes || ARRAY['push'] WHERE push"
|
|
|
|
remove_column :user_api_keys, :read
|
|
remove_column :user_api_keys, :write
|
|
remove_column :user_api_keys, :push
|
|
end
|
|
end
|