Skip to content

fix!: acl api roles#170

Open
Lars Kemper (larskemper) wants to merge 4 commits intotrunkfrom
fix/acl-api-roles
Open

fix!: acl api roles#170
Lars Kemper (larskemper) wants to merge 4 commits intotrunkfrom
fix/acl-api-roles

Conversation

@larskemper
Copy link
Copy Markdown
Member

related https://github.com/shopware/shopware-private/issues/217

Changes

  • /api/_action/migration/check-connection should have swag_migration.editor as acl role (finding)
  • /api/_action/migration/download-logs-of-run should require authentication auth_required = true (finding)

@larskemper Lars Kemper (larskemper) changed the title fix: acl api roles fix!: acl api roles Apr 14, 2026
name: 'api.admin.migration.download-logs-of-run',
methods: [Request::METHOD_POST],
defaults: ['auth_required' => false, PlatformRequest::ATTRIBUTE_ACL => ['swag_migration.viewer']]
defaults: [PlatformRequest::ATTRIBUTE_ACL => ['swag_migration.viewer']]
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have you manually tested and confirmed that the download still works fine? I could imagine that the auth_required flag was there on purpose to support the way JS was calling it 🤔

path: '/api/_action/migration/check-connection',
name: 'api.admin.migration.check-connection',
defaults: [PlatformRequest::ATTRIBUTE_ACL => ['swag_migration.viewer']],
defaults: [PlatformRequest::ATTRIBUTE_ACL => ['swag_migration.editor']],
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is editor really the right call here? Because I think every time you open the migration module we perform a connection check and if you are only viewer, what else is left that you could view?

this.$refs.downloadForm.submit();
async submitDownload() {
try {
const blob = await this.migrationApiService.downloadLogsOfRun(this.migrationRun.id);
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure if this is best practice, would need to research that myself. I could imagine that this could be annoying for larger files (which the log files could be). Imagine you clicking on download and nothing happens for 20s because you have a slow connection and its a bigger file. Then suddenly you get your browser download showing up and finishing instantly.

I'm not sure how this behaves but it's worth a closer look. I think the old implementation let the browser do the download from an URL, which would show proper progress in the download UI of the browser 🤔

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants