Repository navigation
chore: remove blob download branch restriction - #70
Merged
Merged
Conversation
The REST blob endpoint had a dormant branch-based authorization feature: `RESTRICTED_BRANCH_NAME` plus `isBlobRestricted()` / `CHECK_BLOB_RESTRICTED_QUERY`, wired through a commented-out 403 block in `rest-routes.ts`. It only ever gated Windows binaries (Microsoft redistribution licensing), and the public corpus carries no Windows blobs, so it guarded nothing. Removed: - `src/blob-authorization.ts`, `CHECK_BLOB_RESTRICTED_QUERY` - `RESTRICTED_BRANCH_NAME` env validation and the commented-out enforcement block - the now-unused `driver` argument to `createRestRouter()` - the dedicated docs (`configure-blob-restrictions.md`, `blob-authorization.md`) and the restriction sections of the blob-API and access-restrictions references Sensitive registry value redaction (`SENSITIVE_REGISTRY_VALUES`) is a separate feature and is untouched. The implementation stays in git history. Verified: tsc, eslint, prettier --check, and `npm test` (52 pass; the one pre-existing git-log suite failure is unrelated). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014WnrRvhmHcMPj6iwJ2NnzK
This was referenced Sep 7, 2026
Wenzel
added a commit
to OSWatcher/oswatcher-deploy
that referenced
this pull request
Sep 7, 2026
The API dropped its blob branch-restriction feature (OSWatcher/graphql-api#70), so this variable no longer does anything. Remove it from the api service environment and the CLAUDE.md notes. Verified: `docker compose config --quiet` passes for the prod and dev overlays. Claude-Session: https://claude.ai/code/session_014WnrRvhmHcMPj6iwJ2NnzK Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Wenzel
added a commit
to OSWatcher/frontend
that referenced
this pull request
Sep 7, 2026
The API removed branch-based blob restrictions (OSWatcher/graphql-api#70), so a download can no longer return 403 for a restricted blob. Fold that branch into the generic failure path. Claude-Session: https://claude.ai/code/session_014WnrRvhmHcMPj6iwJ2NnzK Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The REST blob endpoint carried a dormant branch-based authorization feature —
RESTRICTED_BRANCH_NAMEplusisBlobRestricted()/CHECK_BLOB_RESTRICTED_QUERY, wired through a commented-out 403 block inrest-routes.ts. It only ever gated Windows binaries (Microsoft redistribution licensing), and the public corpus carries no Windows blobs, so it guarded nothing.Removed
Code
src/blob-authorization.tsandCHECK_BLOB_RESTRICTED_QUERYRESTRICTED_BRANCH_NAMEenv validation, the arg tocreateRestRouter(), and the commented-out enforcement blockdriverargument tocreateRestRouter()Docs
docs/how-to/configure-blob-restrictions.md,docs/explanation/blob-authorization.md(deleted)blob-api.md,access-restrictions.md(kept: registry redaction),integrate-blob-api.md,docs/README.md,README.md,CLAUDE.mdSensitive registry value redaction (
SENSITIVE_REGISTRY_VALUES) is a separate feature and is untouched. Implementation stays in git history.Validation
npx tsc,npx eslint . --ext .ts,npm run format-checkpassnpm test: 52 pass (the one pre-existingtests/git-log/index.test.tsfailure — TS1378 top-level await — is on master too, unrelated)🤖 Generated with Claude Code