Config: refresh bundled channel metadata and config doc baselines#116
Conversation
There was a problem hiding this comment.
Code Review
This pull request introduces configuration metadata for a new X (Twitter) channel plugin, defining its schema for credentials, polling intervals, and access control. The review feedback suggests improving security by allowing sensitive credentials to be loaded from external secret providers (such as environment variables or files) rather than just plaintext strings. Additionally, it is recommended to allow both strings and numbers in the 'allowFrom' and 'actionsAllowFrom' fields to ensure consistency with other plugins and better handle numeric user IDs.
| consumerKey: { | ||
| type: "string", | ||
| }, |
There was a problem hiding this comment.
For better security, credentials like consumerKey should support being loaded from a secrets provider (e.g., environment variables, files) instead of only accepting a plaintext string. This prevents storing sensitive information directly in the configuration file.
This applies to consumerSecret, accessToken, and accessTokenSecret as well, both at the top level and within each entry under accounts.
You can follow the pattern used by other plugins in this file, like discord's token property:
{
"anyOf": [
{
"type": "string"
},
{
"oneOf": [
{
"type": "object",
"properties": {
"source": { "type": "string", "const": "env" },
"provider": { "type": "string", "pattern": "^[a-z][a-z0-9_-]{0,63}$" },
"id": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]{0,127}$" }
},
"required": ["source", "provider", "id"],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"source": { "type": "string", "const": "file" },
"provider": { "type": "string", "pattern": "^[a-z][a-z0-9_-]{0,63}$" },
"id": { "type": "string" }
},
"required": ["source", "provider", "id"],
"additionalProperties": false
},
{
"type": "object",
"properties": {
"source": { "type": "string", "const": "exec" },
"provider": { "type": "string", "pattern": "^[a-z][a-z0-9_-]{0,63}$" },
"id": { "type": "string" }
},
"required": ["source", "provider", "id"],
"additionalProperties": false
}
]
}
]
}| items: { | ||
| type: "string", | ||
| }, |
There was a problem hiding this comment.
For consistency with other channel plugins like discord and bluebubbles, allowFrom should probably allow an array of strings or numbers. This would make the configuration more robust if a user provides a numeric user ID as a number instead of a string. This also applies to actionsAllowFrom and the corresponding properties under accounts.
items: {
anyOf: [
{
type: "string"
},
{
type: "number"
}
]
}
No description provided.