Add optional configuration for restricting access to admin functionality by username #5
Conversation
| if not admin_users: | ||
| return is_authenticated() | ||
|
|
||
| return is_authenticated() and session['gh-username'] in admin_users |
There was a problem hiding this comment.
will session always have the 'gh-username' (once you're authenticated)?
There was a problem hiding this comment.
unless we go with some other authentication method (other than github)
There was a problem hiding this comment.
think gh-only is a fair assumption for now
did we add some way to restrict to an "allowed set" of gh users?
There was a problem hiding this comment.
In terms of user facing, #8 should prevent users from seeing pull requests from repos they have no access to. Do you think we need another authorisation layer?
|
this is ok for now, but possibly not a great pattern since missing/bad config lets more people in |
|
can switch the condition to require an admin list to be configured if you'd prefer? |
|
yes, let's |
|
👍 |
Add optional configuration for restricting access to admin functionality by username
No description provided.