mirror of
https://github.com/wanderer-industries/wanderer
synced 2026-09-23 05:26:01 +00:00
Guarzo
b0593de99a
Review cleanups, no behavior change to the authorization model. * Normalize the trusted-actor bypass to `MapScoped.trusted()` in all 18 resources. Half previously used the bare `MapScoped.Trusted` module and half the helper. The blocks are meant to be scanned as one repeated template, so an inconsistent first line defeats the point. * Drop the `WriteDirect` check. After update/destroy moved to filter checks it had a single caller, `MapDefaultSettings.create`, where it is equivalent to `create_map_matches_token/0`: map_id is `allow_nil? false` with no InjectMapFromActor, so the "absent map_id" branch is unreachable and an omitted map_id fails validation before persisting. Removes ~35 lines and one concept from the policy module. Comments in map.ex / map_system.ex / map_connection.ex that referenced it by name were updated. * Document why CreateMapMatchesToken reads params before the attribute and checks both key types. This is the check enforcing the foreign-map_id breaking change, and the ordering is load-bearing: InjectMapFromActor overwrites the attribute with the token's map before policies run, so reading only the attribute would compare the token map against itself and authorize every foreign map_id. The map-duplication fixes that were previously bundled here have moved to their own branch (fix/map-duplication-attrs) -- they are unrelated to /api/v1 scoping and fix a bug that reproduces on main.