GET routes that change state: logout by link, and others #1163

New issue

Closed

opened 2026-10-13 01:58:12 +00:00 by claude-bot · 0 comments

claude-bot commented

2026-10-13 01:58:12 +00:00

Collaborator

Found while building #1138 (wiki pictures). A scan of GET handlers that write; it can miss writes inside helpers.

Worth fixing

GET /auth/logout ends the session. Any link to it (wiki text, a discussion, an email) logs the reader out when followed. Make it a POST (the frontend calls it; keep a GET that only shows a confirm page, or drop it).
GET of a discussion thread calls mark_read (routers/discussions.py ~155). A prefetch or preview marks a thread read. Move to an explicit POST, or accept and document.

Probably fine, confirm and document

GET /auth/callback, GET /auth/link: OIDC and the Discord link token; protocol-bound, protected by state/token.
GET /api/campaigns/{id}/lore/{eid}/image: moves a legacy file and commits (lazy migration).
GET /api/campaigns/{id}/ownership/offer: commits lazy expiry.
GET /sheets/editable, /sheet-definitions, /sheets/creations, /admin/sheet-definitions: ensure_builtin then commit.
GET /planning/names/{category}: sets a cache entry.
GET /discord-guilds, .../channels, /record/live, /admin/settings/bot/ping, /bot/identity: call out to the bot.

Intended approach: fix the first two, add a test that pins the list of GET handlers allowed to write, so a new one is a deliberate choice.

Found while building #1138 (wiki pictures). A scan of GET handlers that write; it can miss writes inside helpers. **Worth fixing** - `GET /auth/logout` ends the session. Any link to it (wiki text, a discussion, an email) logs the reader out when followed. Make it a POST (the frontend calls it; keep a GET that only shows a confirm page, or drop it). - `GET` of a discussion thread calls `mark_read` (`routers/discussions.py` ~155). A prefetch or preview marks a thread read. Move to an explicit POST, or accept and document. **Probably fine, confirm and document** - `GET /auth/callback`, `GET /auth/link`: OIDC and the Discord link token; protocol-bound, protected by state/token. - `GET /api/campaigns/{id}/lore/{eid}/image`: moves a legacy file and commits (lazy migration). - `GET /api/campaigns/{id}/ownership/offer`: commits lazy expiry. - `GET /sheets/editable`, `/sheet-definitions`, `/sheets/creations`, `/admin/sheet-definitions`: `ensure_builtin` then commit. - `GET /planning/names/{category}`: sets a cache entry. - `GET /discord-guilds`, `.../channels`, `/record/live`, `/admin/settings/bot/ping`, `/bot/identity`: call out to the bot. Intended approach: fix the first two, add a test that pins the list of GET handlers allowed to write, so a new one is a deliberate choice.

claude-bot added this to the v4.5.1 - Fixes after the redesign milestone

2026-10-13 02:06:18 +00:00