Repository navigation
Merge development into production [minor] - #571
Merged
Merged
Conversation
Links and buttons marked data-confirm="confirmation" now open an Alpine-driven <dialog> that shows the title and message as text, and submit the method form with DOM methods. The grid's export messages use notify(). The bootbox package, which has an unfixed XSS advisory, is removed.
Replace bootbox with a native dialog for confirmations
GET /v1/projects and /v1/expeditions (list and show) return the projects and expeditions shown on the public site, for tokens with the new public:read ability. Lists are paginated (per_page up to 100); expeditions filter by project_uuid and status. The WeDigBio dashboard keeps its own ability list, so a public:read token cannot read it. The API page now documents the new endpoints. Closes #82
Add read-only API endpoints for public projects and expeditions
The new API Tokens resource lists Sanctum tokens, creates them for a chosen user with abilities picked from checkboxes and an optional expiry, shows the new token once with a copy button, and revokes them. The known abilities are an ApiAbility enum, which the v1 route middleware now uses too.
Add an admin page for API tokens
The expiry picker read the chosen time as UTC, so a time picked in local time could be refused as already past or saved hours off. The picker and the list's times now use the signed-in admin's profile timezone, times are still stored in UTC, and the expiry can't be set before now in that timezone.
Show API token times in the admin's timezone
21 tasks done
This was referenced Oct 17, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Releases 4 PRs as 3.3.0 (minor bump from 3.2.0). All were merged to
developmentand verified there (latest development deploy: run 39058285819). The checklist is #567: every check before release is ticked except releasing itself; the "After releasing to production" items remain. No migrations.Closes #82
Merge with Create a merge commit and keep
[minor]in the message; that tag sets the version bump. Release while the export and OCR queues are idle.data-confirm) open a native<dialog>instead of bootbox, which has an unfixed XSS advisory and is removed/v1/projects,/v1/expeditions) behind a newpublic:readability; the API home page documents them. Closes #82ApiAbilityenum shared with the v1 route middlewareWhat changes in production
GET /v1/projects,/v1/projects/{uuid},/v1/expeditionsand/v1/expeditions/{uuid}onapi.biospex.org, for tokens withpublic:read. The WeDigBio dashboard route still accepts its existing four abilities, so current tokens keep working./admin/dashboard/api-tokensinstead of in tinker. This unblocks Split the API token: a read-only token for the WeDigBio Reports dashboard #551 (awedigbio-dashboard:read-only token for WeDigBio Reports, then revoking the*token).Verified on development
Confirmation dialogs (GET, POST and DELETE confirms, inside the expedition tools modal, grid export notifications); the projects and expeditions API (totals and paging match the public pages, filters, 404s,
participatelinks match the public cards, API home page); the API Tokens page (create, token shown once, abilities enforced, expiry in local time and 401 after it, revoke with confirmation, non-admins refused); WeDigBio Reports reading the dashboard with awedigbio-dashboard:read-only token. Details are on #567.After deploy
Work through "After releasing to production" on #567, then #551 on production.
Rollback, if needed:
dep rollback productionswitches back to the 3.2.0 release. Tokens created on the new page stay inpersonal_access_tokens;wedigbio-dashboard:readtokens keep working on the dashboard, but the projects and expeditions endpoints go away until the release is redeployed.