fix: exclude resource/download ssoInterceptor #289
Conversation
WalkthroughAdded the material-center resource download path to the SSO interceptor exclusion list in LoginConfig, updating the set of excluded paths without changing method signatures or control flow. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI agents
In `@base/src/main/java/com/tinyengine/it/login/config/LoginConfig.java`:
- Around line 45-46: LoginConfig currently whitelists
"/material-center/api/resource/download/*", making downloads publicly
accessible; confirm whether that is intentional. If it is intentional, document
the decision by adding a clear comment and/or configuration flag (e.g.,
allowPublicResourceDownloads) near the whitelist in LoginConfig and add a
unit/integration test that verifies public access; if it is NOT intentional,
remove "/material-center/api/resource/download/*" from the whitelist (or move it
behind SSO enforcement) so the download endpoints require authentication.
| "/app-center/api/chat/completions", | ||
| "/material-center/api/resource/download/*" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Search for how download endpoints are defined to understand the expected URL structure
echo "=== Searching for resource download endpoint definitions ==="
rg -n --type java -C3 'download|resource.*download' -g '!*Test*' | head -100
echo ""
echo "=== Searching for other excludePathPatterns usage to verify pattern style ==="
rg -n --type java 'excludePathPatterns' -C2 | head -100
echo ""
echo "=== Check the full LoginConfig.java file to understand context ==="
cat -n "base/src/main/java/com/tinyengine/it/login/config/LoginConfig.java" 2>/dev/null || echo "File not found at expected path"
echo ""
echo "=== Search for LoginConfig in the repository ==="
fd -t f "LoginConfig.java" 2>/dev/nullRepository: opentiny/tiny-engine-backend-java
Length of output: 4553
Confirm the security intent for unauthenticated resource downloads.
Excluding /material-center/api/resource/download/* from SSO means resource downloads will be accessible without authentication. Please confirm this is intentional and that these resources are meant to be publicly accessible.
🤖 Prompt for AI Agents
In `@base/src/main/java/com/tinyengine/it/login/config/LoginConfig.java` around
lines 45 - 46, LoginConfig currently whitelists
"/material-center/api/resource/download/*", making downloads publicly
accessible; confirm whether that is intentional. If it is intentional, document
the decision by adding a clear comment and/or configuration flag (e.g.,
allowPublicResourceDownloads) near the whitelist in LoginConfig and add a
unit/integration test that verifies public access; if it is NOT intentional,
remove "/material-center/api/resource/download/*" from the whitelist (or move it
behind SSO enforcement) so the download endpoints require authentication.
2 participants
English | 简体中文
PR
PR Checklist
Please check if your PR fulfills the following requirements:
PR Type
What kind of change does this PR introduce?
Background and solution
What is the current behavior?
Issue Number: N/A
What is the new behavior?
Does this PR introduce a breaking change?
Other information
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.