Merge pull request #86 from globekeeper/daniel/auth-profile-api

🔒 Make /profile API authenticated.
globekeeper · May 22, 2024 · b23f241 · b23f241
2 parents 7465729 + f942bcb
commit b23f241
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/clientapi/clientapi_test.go b/clientapi/clientapi_test.go
@@ -447,6 +447,7 @@ func TestSetDisplayname(t *testing.T) {
 				// check profile after initial account creation
 				rec := httptest.NewRecorder()
 				req := httptest.NewRequest(http.MethodGet, "/_matrix/client/v3/profile/"+tc.user.ID, strings.NewReader(""))
+				req.Header.Set("Authorization", "Bearer "+accessTokens[tc.user].accessToken)
 				t.Logf("%s", req.URL.String())
 				routers.Client.ServeHTTP(rec, req)
 
@@ -559,6 +560,7 @@ func TestSetAvatarURL(t *testing.T) {
 				// check profile after initial account creation
 				rec := httptest.NewRecorder()
 				req := httptest.NewRequest(http.MethodGet, "/_matrix/client/v3/profile/"+tc.user.ID, strings.NewReader(""))
+				req.Header.Set("Authorization", "Bearer "+accessTokens[tc.user].accessToken)
 				t.Logf("%s", req.URL.String())
 				routers.Client.ServeHTTP(rec, req)
 

diff --git a/clientapi/routing/routing.go b/clientapi/routing/routing.go
@@ -888,9 +888,9 @@ func Setup(
 	).Methods(http.MethodPut)
 
 	// Element user settings
-
+	// GK-CUSTOMIZATION: Make /profile endpoints authenticated
 	v3mux.Handle("/profile/{userID}",
-		httputil.MakeExternalAPI("profile", func(req *http.Request) util.JSONResponse {
+		httputil.MakeAuthAPI("profile", userAPI, func(req *http.Request, device *userapi.Device) util.JSONResponse {
 			vars, err := httputil.URLDecodeMapValues(mux.Vars(req))
 			if err != nil {
 				return util.ErrorResponse(err)