Skip to content

Jr/try if it works se 664 - #26281

Draft
judithroth wants to merge 9 commits into
devfrom
jr/try-if-it-works-se-664
Draft

judithroth wants to merge 9 commits into
devfrom
jr/try-if-it-works-se-664

Conversation

@judithroth

Copy link
Copy Markdown
Contributor

Ticket

What are you trying to accomplish?

Screenshots

What approach did you choose and why?

AI involvement

Merge checklist

  • Added/updated tests
  • Added/updated documentation in Lookbook (patterns, previews, etc)
  • Tested major browsers (Chrome, Firefox, Edge, ...)

judithroth and others added 4 commits October 23, 2026 17:10
https://community.openproject.org/wp/SE-664

- POST /api/v3/documents/:id/collaboration_token creates an encrypted
  token for the collaboration server (Hocuspocus).
- An optional `token` revokes the previous token 30 seconds later; each
  token can be revoked only once (race-free).
- Requests authenticated with a collaboration token (an OAuth token
  issued to the Documents OAuth application) are rejected with 403.
- Includes the OpenAPI docs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
https://community.openproject.org/wp/SE-664

They can not connect anyway, so why give them tokens.
Fixing the behaviour for anonymous users on instances that are public
and have a public project with documents is out of scope of this PR
though.
@judithroth judithroth self-assigned this Oct 23, 2026
@github-actions

Copy link
Copy Markdown

Warning

Flaky specs

  • rspec ./spec/features/work_packages/table/delete_work_packages_with_descendants_spec.rb[1:2:1]
🤖 Ask Copilot to investigate

Copy the prompt below into a new comment on this PR to delegate the investigation to GitHub Copilot. It will look into the flakiness and open a separate pull request with you as reviewer.

@copilot The following spec(s) are flaky in CI (first seen on PR #26281, linked for reference only):

- `rspec ./spec/features/work_packages/table/delete_work_packages_with_descendants_spec.rb[1:2:1]`

Treat this as a standalone task, unrelated to PR #26281. Create a new branch from origin/dev and open a new pull request targeting dev — do not stack it on PR #26281 or reuse that branch.

Follow the playbook in docs/development/testing/handling-flaky-tests/README.md to find the root cause and fix the underlying race — do not skip, delete, or weaken the spec to make it pass; disabling is a last resort per the playbook, and only with a bug ticket. Verify the fix by running the spec(s) repeatedly (e.g. `script/bulk_run_rspec --run-count 10`).

If you cannot reproduce the flake or are not confident in a fix after reasonable investigation, do not fabricate a change or skip the spec to force CI green. Instead, leave the pull request in draft and document what you tried, the suspected cause, and any leads in its description, then assign @judithroth to take over.

Once the fix is verified, title the PR after the spec(s) it fixes, and use the PR description to explain the root cause, how the change resolves it, and the before/after results. Label the PR `flaky-spec`, assign @judithroth, and request a review from @judithroth.
On every commit, set @judithroth as the sole co-author with a `Co-authored-by:` trailer (use their GitHub no-reply email so it links to their account), so it is traceable who dispatched the fix.

judithroth and others added 5 commits October 26, 2026 13:56
https://community.openproject.org/wp/SE-664

- Collaboration tokens only carry `edit_documents`, accepted solely by
  GET/PATCH /api/v3/documents/:id (`route_setting :oauth_scopes`).
  An existing Documents OAuth application is switched to that scope.
- All other APIv3 endpoints answer 403 `InsufficientScope`.
- The scope is internal: it's hidden from OAuth apps and metadata.
- It replaces the application-uid check.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@judithroth
judithroth force-pushed the jr/try-if-it-works-se-664 branch from bea935d to 2345374 Compare October 26, 2026 13:01

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant