S34: declare AdminMounter + register before lifecycle
- SHA
9d2664dd8bb6914ea4ae67a34805eb5ab9064190- Parents
-
d526321 - Tree
6358932
tenseleyflow/shithub
/
9d2664d
Browse files
1 changed file
| Status | File | + | - |
|---|---|---|---|
| M |
internal/web/handlers/handlers.go
|
7 | 0 |
internal/web/handlers/handlers.gomodified@@ -120,6 +120,10 @@ type Deps struct { | ||
| 120 | 120 | // OrgInvitationsMounter registers /invitations/{token} + |
| 121 | 121 | // accept/decline. RequireUser at the wiring layer. |
| 122 | 122 | OrgInvitationsMounter func(chi.Router) |
| 123 | + // AdminMounter, when non-nil, registers /admin/* routes (S34). | |
| 124 | + // The mounter wraps the handler chain in RequireUser + | |
| 125 | + // RequireSiteAdmin so non-admins receive 404, not 403. | |
| 126 | + AdminMounter func(chi.Router) | |
| 123 | 127 | // GitHTTPMounter, when non-nil, registers the smart-HTTP git routes |
| 124 | 128 | // (`*.git/info/refs`, `git-upload-pack`, `git-receive-pack`). MUST |
| 125 | 129 | // land in a route group that bypasses CSRF, response compression, |
@@ -288,6 +292,9 @@ func RegisterChi(r *chi.Mux, deps Deps) (*chi.Mux, middleware.PanicHandler, http | ||
| 288 | 292 | // Lifecycle danger-zone + transfers + restore. Order: after |
| 289 | 293 | // RepoHome so explicit settings paths are matched first, before |
| 290 | 294 | // Profile's /{username} catch-all. |
| 295 | + if deps.AdminMounter != nil { | |
| 296 | + deps.AdminMounter(r) | |
| 297 | + } | |
| 291 | 298 | if deps.RepoLifecycleMounter != nil { |
| 292 | 299 | deps.RepoLifecycleMounter(r) |
| 293 | 300 | } |