salman/igny8
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implement security enhancements and unified response formats across API endpoints. Update permission classes for various ViewSets to ensure proper tenant isolation and compliance with API standards. Refactor authentication endpoints to utilize success and error response helpers, improving error tracking and response consistency. Complete documentation updates reflecting these changes and achieving full compliance with API Standard v1.0.

Browse Source
This commit is contained in:
Desktop
2025-11-16 11:35:47 +05:00
parent d492b74d40
commit 64b8280bce
8 changed files with 739 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
CHANGELOG.md
View File

@@ -46,6 +46,45 @@ Each entry follows this format:
---
## [1.1.1] - 2025-01-XX
### Security
- **CRITICAL**: Fixed `AIPromptViewSet` security vulnerability - changed from `permission_classes = []` (allowing unauthenticated access) to `IsAuthenticatedAndActive + HasTenantAccess`
- Added `IsEditorOrAbove` permission check for `save_prompt` and `reset_prompt` actions in `AIPromptViewSet`
- All billing ViewSets now require `IsAuthenticatedAndActive + HasTenantAccess` for proper tenant isolation
- `CreditTransactionViewSet` now requires `IsAdminOrOwner` per API Standard v1.0 (billing/transactions require admin/owner)
- All system settings ViewSets now use standard permissions (`IsAuthenticatedAndActive + HasTenantAccess`)
- All auth ViewSets now explicitly include `IsAuthenticatedAndActive + HasTenantAccess` for proper tenant isolation
### Changed
- **Auth Endpoints**: All authentication endpoints (`RegisterView`, `LoginView`, `ChangePasswordView`, `MeView`) now use unified response format with `success_response()` and `error_response()` helpers
- All responses now include `request_id` for error tracking
- Error responses follow unified format with `error` and `errors` fields
- Success responses follow unified format with `success`, `data`, and `message` fields
- **Billing Module**: Refactored `CreditUsageViewSet` and `CreditTransactionViewSet` to inherit from `AccountModelViewSet` instead of manual account filtering
- Account filtering now handled automatically by base class
- Improved code maintainability and consistency
- **System Settings**: All 5 system settings ViewSets now use standard permission classes
- `SystemSettingsViewSet`, `AccountSettingsViewSet`, `UserSettingsViewSet`, `ModuleSettingsViewSet`, `AISettingsViewSet`
- Write operations require `IsAdminOrOwner` per standard
- **Integration Settings**: Added `HasTenantAccess` permission to `IntegrationSettingsViewSet` for proper tenant isolation
- **Auth ViewSets**: Added explicit standard permissions to all auth ViewSets
- `UsersViewSet`, `AccountsViewSet`, `SubscriptionsViewSet`, `SiteUserAccessViewSet` now include `IsAuthenticatedAndActive + HasTenantAccess`
- `SiteViewSet`, `SectorViewSet` now include `IsAuthenticatedAndActive + HasTenantAccess`
### Fixed
- Fixed auth endpoints not returning unified format (were using raw `Response()` instead of helpers)
- Fixed missing `request_id` in auth endpoint responses
- Fixed inconsistent error response format in auth endpoints
- Fixed billing ViewSets not using base classes (manual account filtering replaced with `AccountModelViewSet`)
- Fixed all ViewSets missing standard permissions (`IsAuthenticatedAndActive + HasTenantAccess`)
### Documentation
- Updated implementation plan to reflect completion of all remaining API Standard v1.0 items
- All 8 remaining items from audit completed (100% compliance achieved)
---
## [1.1.0] - 2025-01-XX
### Added