[ApiToken] disables unused endpoints

claroline · Oct 11, 2023 · bf4d9bf · bf4d9bf
1 parent c00fff8
commit bf4d9bf
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 2 deletions.
diff --git a/src/main/authentication/Controller/ApiTokenController.php b/src/main/authentication/Controller/ApiTokenController.php
@@ -49,6 +49,11 @@ public function getName(): string
         return 'apitoken';
     }
 
+    public function getIgnore(): array
+    {
+        return ['exist', 'copyBulk', 'schema', 'find'];
+    }
+
     protected function getDefaultHiddenFilters(): array
     {
         if (!$this->authorization->isGranted('IS_AUTHENTICATED_FULLY')) {

diff --git a/src/main/authentication/Security/Voter/ApiTokenVoter.php b/src/main/authentication/Security/Voter/ApiTokenVoter.php
@@ -33,7 +33,7 @@ public function checkPermission(TokenInterface $token, $object, array $attribute
                     }
                     // no break
                 case self::CREATE:
-                case self::VIEW:
+                case self::OPEN:
                     $isAdmin = $this->hasAdminToolAccess($token, 'integration');
                     if ($isAdmin || (!empty($object->getUser()) && $object->getUser()->getUuid() === $token->getUser()->getUuid())) {
                         return VoterInterface::ACCESS_GRANTED;
@@ -52,6 +52,6 @@ public function getClass(): string
 
     public function getSupportedActions(): array
     {
-        return [self::VIEW, self::CREATE, self::EDIT, self::DELETE];
+        return [self::OPEN, self::CREATE, self::EDIT, self::DELETE];
     }
 }