refactor: separate runtime and administration routes - #26
Conversation
Includes branch changelog.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 327195b913
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const adminRequest = typeof req.originalUrl === 'string' && req.originalUrl.startsWith('/admin/'); | ||
| const configured = adminRequest ? process.env.ADMIN_API_KEY : process.env.API_KEY; |
There was a problem hiding this comment.
Because Express routing is case-insensitive by default and src/app.ts never enables case-sensitive routing, a request such as /ADMIN/api/definitions/list still reaches the router mounted at /admin/api, while this case-sensitive prefix check sets adminRequest to false. A caller with the runtime API_KEY can therefore authenticate to definition/model management endpoints, defeating the separate admin credential; select the required key when constructing or mounting each router instead of inferring it from the URL spelling.
Useful? React with 👍 / 👎.
| return router; | ||
| } | ||
|
|
||
| /** Definition administration is mounted separately under /admin/api. */ | ||
| adminConfig() { |
There was a problem hiding this comment.
For v1 clients calling DELETE /api/datastore/deleteInstances, this new early return removes the existing endpoint from the runtime router; its declaration at line 639 is now part of adminConfig(), so the old URL returns 404 and the operation is only available as /admin/api/datastore/deleteInstances with ADMIN_API_KEY. Instance deletion is not a definition/model route and was swept into the admin router solely because it appeared later in the file, contrary to the stated boundary that keeps operational calls under /api.
Useful? React with 👍 / 👎.
1 participant
Summary
Separates runtime workflow routes and credentials from model-administration routes.
/adminADMIN_API_KEYStack
This is web #2 and the base for the canonical v1 route PR.