feat(v4.0): GitHub routes + CSRF exemptions for share/publish

- app/routers/github_routes.py: /api/github/status + disconnect - CSRF: ajout /api/github, /api/pages, /api/recents aux exclusions - main.py: registration github_router
2026-07-14 12:19:37 -04:00
parent bd6fd62734
commit 29ef0fb054
6 changed files with 71 additions and 4 deletions
@@ -16,7 +16,7 @@ class CSRFMiddleware(BaseHTTPMiddleware):
    """

    SAFE_METHODS = {"GET", "HEAD", "OPTIONS"}
-    EXCLUDED_PATHS = {"/api/webhook", "/api/v1", "/auth/callback", "/auth/register", "/auth/local-login", "/api/user", "/board/api/pages", "/board/api/favorites", "/api/workspace", "/api/local-workspace", "/api/settings", "/db/", "/workspace", "/api/frontend-error", "/api/admin", "/api/gitea"}
+    EXCLUDED_PATHS = {"/api/webhook", "/api/v1", "/auth/callback", "/auth/register", "/auth/local-login", "/api/user", "/board/api/pages", "/board/api/favorites", "/api/workspace", "/api/local-workspace", "/api/settings", "/db/", "/workspace", "/api/frontend-error", "/api/admin", "/api/gitea", "/api/github", "/api/pages", "/api/recents"}

    async def dispatch(self, request: Request, call_next):
        # Webhook receiver, OAuth callback, and internal API are exempt