github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-08-01 10:56:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

✨ Gate nitrate bulk-create-profiles behind a flag (#10785)

Browse Source 
The bulk profile creation endpoint creates already active profiles that
skip email verification and onboarding, so it should not be reachable on
production deployments. Add the `nitrate-bulk-create-profiles` flag,
disabled by default, and reject the call when it is not enabled.

Signed-off-by: Juanfran <juanfran.ag@gmail.com>
This commit is contained in:
Juanfran 2026-07-23 09:33:32 +02:00 committed by GitHub
parent 4383cf183a
commit 4900d4b24a
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
backend/src/app/rpc/management/nitrate.clj
View File

@ -980,12 +980,19 @@ RETURNING id, deleted_at;")
created users skip email verification and onboarding. Emails that already created users skip email verification and onboarding. Emails that already
belong to an existing profile are skipped. Intended for the Nitrate admin belong to an existing profile are skipped. Intended for the Nitrate admin
bulk-creation screen; access is gated by the shared key and, in Nitrate, an bulk-creation screen; access is gated by the shared key and, in Nitrate, an
email allow-list." email allow-list. Requires the `nitrate-bulk-create-profiles` flag, disabled
by default so it is only available on test environments."
{::doc/added "2.19" {::doc/added "2.19"
::sm/params schema:bulk-create-profiles-params ::sm/params schema:bulk-create-profiles-params
::sm/result schema:bulk-create-profiles-result ::sm/result schema:bulk-create-profiles-result
::rpc/auth false} ::rpc/auth false}
[cfg {:keys [password emails]}] [cfg {:keys [password emails]}]
(when-not (contains? cf/flags :nitrate-bulk-create-profiles)
(ex/raise :type :restriction
:code :nitrate-bulk-create-profiles-not-allowed
:hint "Bulk profile creation is disabled by config."))
(let [derived (aauth/derive-password password)] (let [derived (aauth/derive-password password)]
(db/tx-run! (db/tx-run!
cfg cfg

5
common/src/app/common/flags.cljc
View File

@ -167,6 +167,11 @@
;; Activates the nitrate module ;; Activates the nitrate module
:nitrate :nitrate
;; disabled by default. When enabled, allows the nitrate
;; `bulk-create-profiles` method to create batches of already
;; active profiles. Only intended for test environments.
:nitrate-bulk-create-profiles
:mcp :mcp
:background-blur :background-blur
:available-viewer-wasm :available-viewer-wasm