From 301bf659700daf428920dc13929bfd9cb7610cb4 Mon Sep 17 00:00:00 2001 From: Maryam Sulemani Date: Tue, 6 Sep 2022 13:25:49 +0400 Subject: [PATCH 1/5] v0.29: update keys --- reference/api/keys.md | 40 ++++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/reference/api/keys.md b/reference/api/keys.md index 0e4e7c093a..2a5cd24868 100644 --- a/reference/api/keys.md +++ b/reference/api/keys.md @@ -62,26 +62,26 @@ Since the `key` field depends on the master key, it is computed at runtime and t **Default value**: N/A **Description**: An array of API actions permitted for the key, represented as strings. API actions are only possible on authorized [`indexes`](#indexes). `["*"]` for all actions -| Name | Description | -| :--------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| **`search`** | Provides access to both [`POST`](/reference/api/search.md#search-in-an-index-with-post-route) and [`GET`](/reference/api/search.md#search-in-an-index-with-get-route) search endpoints | -| **`documents.add`** | Provides access to the [add documents](/reference/api/documents.md#add-or-replace-documents) and [update documents](/reference/api/documents.md#add-or-update-documents) endpoints | -| **`documents.get`** | Provides access to the [get one document](/reference/api/documents.md#get-one-document) and [get documents](/reference/api/documents.md#get-documents) endpoints | -| **`documents.delete`** | Provides access to the [delete one document](/reference/api/documents.md#delete-one-document), [delete all documents](/reference/api/documents.md#delete-all-documents), and [batch delete](/reference/api/documents.md#delete-documents-by-batch) endpoints | -| **`indexes.create`** | Provides access to the [create index](/reference/api/indexes.md#create-an-index) endpoint | -| **`indexes.get`** | Provides access to the [get one index](/reference/api/indexes.md#get-one-index) and [list all indexes](/reference/api/indexes.md#list-all-indexes) endpoints. **Non-authorized `indexes` will be omitted from the response** | -| **`indexes.update`** | Provides access to the [update index](/reference/api/indexes.md#update-an-index) endpoint | -| **`indexes.delete`** | Provides access to the [delete index](/reference/api/indexes.md#delete-an-index) endpoint | -| **`tasks.get`** | Provides access to the [get one task](/reference/api/tasks.md#get-one-task) and [get tasks](/reference/api/tasks.md#get-tasks) endpoints. **Tasks from non-authorized `indexes` will be omitted from the response** | -| **`settings.get`** | Provides access to the [get settings](/reference/api/settings.md#get-settings) endpoint and equivalents for all subroutes | -| **`settings.update`** | Provides access to the [update settings](/reference/api/settings.md#update-settings) and [reset settings](/reference/api/settings.md#reset-settings) endpoints and equivalents for all subroutes | -| **`stats.get`** | Provides access to the [get stats of an index](/reference/api/stats.md#get-stats-of-an-index) endpoint and the [get stats of all indexes](/reference/api/stats.md#get-stats-of-all-indexes) endpoint. For the latter, **non-authorized `indexes` are omitted from the response** | -| **`dumps.create`** | Provides access to the [create dump](/reference/api/dump.md#create-a-dump) endpoint. **Not restricted by `indexes`** | -| **`version`** | Provides access to the [get Meilisearch version](/reference/api/version.md#get-version-of-meilisearch) endpoint | -| **`keys.get`** | Provides access to the [get all keys](#get-all-keys) endpoint | -| **`keys.create`** | Provides access to the [create key](#create-a-key) endpoint | -| **`keys.update`** | Provides access to the [update key](#update-a-key) endpoint | -| **`keys.delete`** | Provides access to the [delete key](#delete-a-key) endpoint | +| Name | Description | +| :--------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| **`search`** | Provides access to both [`POST`](/reference/api/search.md#search-in-an-index-with-post-route) and [`GET`](/reference/api/search.md#search-in-an-index-with-get-route) search endpoints | +| **`documents.add`** | Provides access to the [add documents](/reference/api/documents.md#add-or-replace-documents) and [update documents](/reference/api/documents.md#add-or-update-documents) endpoints. Use `documents.*` for all document actions | +| **`documents.get`** | Provides access to the [get one document](/reference/api/documents.md#get-one-document) and [get documents](/reference/api/documents.md#get-documents) endpoints. Use `documents.*` for all document actions | +| **`documents.delete`** | Provides access to the [delete one document](/reference/api/documents.md#delete-one-document), [delete all documents](/reference/api/documents.md#delete-all-documents), and [batch delete](/reference/api/documents.md#delete-documents-by-batch) endpoints. Use `documents.*` for all document actions | +| **`indexes.create`** | Provides access to the [create index](/reference/api/indexes.md#create-an-index) endpoint. Use `indexes.*` for all index actions | +| **`indexes.get`** | Provides access to the [get one index](/reference/api/indexes.md#get-one-index) and [list all indexes](/reference/api/indexes.md#list-all-indexes) endpoints. **Non-authorized `indexes` will be omitted from the response**. Use `indexes.*` for all index actions | +| **`indexes.update`** | Provides access to the [update index](/reference/api/indexes.md#update-an-index) endpoint. Use `indexes.*` for all index actions | +| **`indexes.delete`** | Provides access to the [delete index](/reference/api/indexes.md#delete-an-index) endpoint. Use `indexes.*` for all index actions | +| **`tasks.get`** | Provides access to the [get one task](/reference/api/tasks.md#get-one-task) and [get tasks](/reference/api/tasks.md#get-tasks) endpoints. **Tasks from non-authorized `indexes` will be omitted from the response** | +| **`settings.get`** | Provides access to the [get settings](/reference/api/settings.md#get-settings) endpoint and equivalents for all subroutes. Use `settings.*` for all settings actions | +| **`settings.update`** | Provides access to the [update settings](/reference/api/settings.md#update-settings) and [reset settings](/reference/api/settings.md#reset-settings) endpoints and equivalents for all subroutes. Use `settings.*` for all settings actions | +| **`stats.get`** | Provides access to the [get stats of an index](/reference/api/stats.md#get-stats-of-an-index) endpoint and the [get stats of all indexes](/reference/api/stats.md#get-stats-of-all-indexes) endpoint. For the latter, **non-authorized `indexes` are omitted from the response** | +| **`dumps.create`** | Provides access to the [create dump](/reference/api/dump.md#create-a-dump) endpoint. **Not restricted by `indexes`** | +| **`version`** | Provides access to the [get Meilisearch version](/reference/api/version.md#get-version-of-meilisearch) endpoint | +| **`keys.get`** | Provides access to the [get all keys](#get-all-keys) endpoint | +| **`keys.create`** | Provides access to the [create key](#create-a-key) endpoint | +| **`keys.update`** | Provides access to the [update key](#update-a-key) endpoint | +| **`keys.delete`** | Provides access to the [delete key](#delete-a-key) endpoint | ### `indexes` From ecdcd38223cd90b7057f7cd25288ce47a250c8bc Mon Sep 17 00:00:00 2001 From: Maryam Sulemani Date: Tue, 6 Sep 2022 13:35:44 +0400 Subject: [PATCH 2/5] update keys.md --- reference/api/keys.md | 46 ++++++++++++++++++++++--------------------- 1 file changed, 24 insertions(+), 22 deletions(-) diff --git a/reference/api/keys.md b/reference/api/keys.md index 2a5cd24868..079fcfd3c1 100644 --- a/reference/api/keys.md +++ b/reference/api/keys.md @@ -60,28 +60,30 @@ Since the `key` field depends on the master key, it is computed at runtime and t **Type**: Array **Default value**: N/A -**Description**: An array of API actions permitted for the key, represented as strings. API actions are only possible on authorized [`indexes`](#indexes). `["*"]` for all actions - -| Name | Description | -| :--------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| **`search`** | Provides access to both [`POST`](/reference/api/search.md#search-in-an-index-with-post-route) and [`GET`](/reference/api/search.md#search-in-an-index-with-get-route) search endpoints | -| **`documents.add`** | Provides access to the [add documents](/reference/api/documents.md#add-or-replace-documents) and [update documents](/reference/api/documents.md#add-or-update-documents) endpoints. Use `documents.*` for all document actions | -| **`documents.get`** | Provides access to the [get one document](/reference/api/documents.md#get-one-document) and [get documents](/reference/api/documents.md#get-documents) endpoints. Use `documents.*` for all document actions | -| **`documents.delete`** | Provides access to the [delete one document](/reference/api/documents.md#delete-one-document), [delete all documents](/reference/api/documents.md#delete-all-documents), and [batch delete](/reference/api/documents.md#delete-documents-by-batch) endpoints. Use `documents.*` for all document actions | -| **`indexes.create`** | Provides access to the [create index](/reference/api/indexes.md#create-an-index) endpoint. Use `indexes.*` for all index actions | -| **`indexes.get`** | Provides access to the [get one index](/reference/api/indexes.md#get-one-index) and [list all indexes](/reference/api/indexes.md#list-all-indexes) endpoints. **Non-authorized `indexes` will be omitted from the response**. Use `indexes.*` for all index actions | -| **`indexes.update`** | Provides access to the [update index](/reference/api/indexes.md#update-an-index) endpoint. Use `indexes.*` for all index actions | -| **`indexes.delete`** | Provides access to the [delete index](/reference/api/indexes.md#delete-an-index) endpoint. Use `indexes.*` for all index actions | -| **`tasks.get`** | Provides access to the [get one task](/reference/api/tasks.md#get-one-task) and [get tasks](/reference/api/tasks.md#get-tasks) endpoints. **Tasks from non-authorized `indexes` will be omitted from the response** | -| **`settings.get`** | Provides access to the [get settings](/reference/api/settings.md#get-settings) endpoint and equivalents for all subroutes. Use `settings.*` for all settings actions | -| **`settings.update`** | Provides access to the [update settings](/reference/api/settings.md#update-settings) and [reset settings](/reference/api/settings.md#reset-settings) endpoints and equivalents for all subroutes. Use `settings.*` for all settings actions | -| **`stats.get`** | Provides access to the [get stats of an index](/reference/api/stats.md#get-stats-of-an-index) endpoint and the [get stats of all indexes](/reference/api/stats.md#get-stats-of-all-indexes) endpoint. For the latter, **non-authorized `indexes` are omitted from the response** | -| **`dumps.create`** | Provides access to the [create dump](/reference/api/dump.md#create-a-dump) endpoint. **Not restricted by `indexes`** | -| **`version`** | Provides access to the [get Meilisearch version](/reference/api/version.md#get-version-of-meilisearch) endpoint | -| **`keys.get`** | Provides access to the [get all keys](#get-all-keys) endpoint | -| **`keys.create`** | Provides access to the [create key](#create-a-key) endpoint | -| **`keys.update`** | Provides access to the [update key](#update-a-key) endpoint | -| **`keys.delete`** | Provides access to the [delete key](#delete-a-key) endpoint | +**Description**: An array of API actions permitted for the key, represented as strings. API actions are only possible on authorized [`indexes`](#indexes). `["*"]` for all actions. + +You can use `*` as a wildcard to access all endpoints for the `documents`, `indexes`, `tasks`, `settings`, `stats` and `dumps` actions. For example, `documents.*` gives access to all document actions. + +| Name | Description | +| :--------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| **`search`** | Provides access to both [`POST`](/reference/api/search.md#search-in-an-index-with-post-route) and [`GET`](/reference/api/search.md#search-in-an-index-with-get-route) search endpoints | +| **`documents.add`** | Provides access to the [add documents](/reference/api/documents.md#add-or-replace-documents) and [update documents](/reference/api/documents.md#add-or-update-documents) endpoints | +| **`documents.get`** | Provides access to the [get one document](/reference/api/documents.md#get-one-document) and [get documents](/reference/api/documents.md#get-documents) endpoints | +| **`documents.delete`** | Provides access to the [delete one document](/reference/api/documents.md#delete-one-document), [delete all documents](/reference/api/documents.md#delete-all-documents), and [batch delete](/reference/api/documents.md#delete-documents-by-batch) endpoints | +| **`indexes.create`** | Provides access to the [create index](/reference/api/indexes.md#create-an-index) endpoint | +| **`indexes.get`** | Provides access to the [get one index](/reference/api/indexes.md#get-one-index) and [list all indexes](/reference/api/indexes.md#list-all-indexes) endpoints. **Non-authorized `indexes` will be omitted from the response** | +| **`indexes.update`** | Provides access to the [update index](/reference/api/indexes.md#update-an-index) endpoint | +| **`indexes.delete`** | Provides access to the [delete index](/reference/api/indexes.md#delete-an-index) endpoints | +| **`tasks.get`** | Provides access to the [get one task](/reference/api/tasks.md#get-one-task) and [get tasks](/reference/api/tasks.md#get-tasks) endpoints. **Tasks from non-authorized `indexes` will be omitted from the response** | +| **`settings.get`** | Provides access to the [get settings](/reference/api/settings.md#get-settings) endpoint and equivalents for all subroutes | +| **`settings.update`** | Provides access to the [update settings](/reference/api/settings.md#update-settings) and [reset settings](/reference/api/settings.md#reset-settings) endpoints and equivalents for all subroutes | +| **`stats.get`** | Provides access to the [get stats of an index](/reference/api/stats.md#get-stats-of-an-index) endpoint and the [get stats of all indexes](/reference/api/stats.md#get-stats-of-all-indexes) endpoint. For the latter, **non-authorized `indexes` are omitted from the response** | +| **`dumps.create`** | Provides access to the [create dump](/reference/api/dump.md#create-a-dump) endpoint. **Not restricted by `indexes`** | +| **`version`** | Provides access to the [get Meilisearch version](/reference/api/version.md#get-version-of-meilisearch) endpoint | +| **`keys.get`** | Provides access to the [get all keys](#get-all-keys) endpoint | +| **`keys.create`** | Provides access to the [create key](#create-a-key) endpoint | +| **`keys.update`** | Provides access to the [update key](#update-a-key) endpoint | +| **`keys.delete`** | Provides access to the [delete key](#delete-a-key) endpoint | ### `indexes` From 13b877f1f21825434a98b3fab4090770f7053a8e Mon Sep 17 00:00:00 2001 From: Maryam Sulemani Date: Tue, 6 Sep 2022 17:17:05 +0400 Subject: [PATCH 3/5] update based on review --- reference/api/keys.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/reference/api/keys.md b/reference/api/keys.md index 079fcfd3c1..8346aeaec0 100644 --- a/reference/api/keys.md +++ b/reference/api/keys.md @@ -62,6 +62,10 @@ Since the `key` field depends on the master key, it is computed at runtime and t **Default value**: N/A **Description**: An array of API actions permitted for the key, represented as strings. API actions are only possible on authorized [`indexes`](#indexes). `["*"]` for all actions. +::: warning +We do not recommend creating keys that can perform all actions as it would almost be the same as the master key. +::: + You can use `*` as a wildcard to access all endpoints for the `documents`, `indexes`, `tasks`, `settings`, `stats` and `dumps` actions. For example, `documents.*` gives access to all document actions. | Name | Description | From e8fc94bff864270d54de73ad0fde5de1bda04d42 Mon Sep 17 00:00:00 2001 From: Maryam <90181761+maryamsulemani97@users.noreply.github.com> Date: Tue, 6 Sep 2022 17:40:04 +0400 Subject: [PATCH 4/5] Update reference/api/keys.md --- reference/api/keys.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reference/api/keys.md b/reference/api/keys.md index 8346aeaec0..e9e88b91e9 100644 --- a/reference/api/keys.md +++ b/reference/api/keys.md @@ -63,7 +63,7 @@ Since the `key` field depends on the master key, it is computed at runtime and t **Description**: An array of API actions permitted for the key, represented as strings. API actions are only possible on authorized [`indexes`](#indexes). `["*"]` for all actions. ::: warning -We do not recommend creating keys that can perform all actions as it would almost be the same as the master key. +We do not recommend creating keys that can perform all actions. ::: You can use `*` as a wildcard to access all endpoints for the `documents`, `indexes`, `tasks`, `settings`, `stats` and `dumps` actions. For example, `documents.*` gives access to all document actions. From 91b9f9fcb02a16e3fb0c360dd4bf8d83bbc847cc Mon Sep 17 00:00:00 2001 From: Maryam Sulemani Date: Thu, 8 Sep 2022 14:19:15 +0400 Subject: [PATCH 5/5] update based on review --- reference/api/keys.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/reference/api/keys.md b/reference/api/keys.md index e9e88b91e9..ce2f7e2781 100644 --- a/reference/api/keys.md +++ b/reference/api/keys.md @@ -62,12 +62,12 @@ Since the `key` field depends on the master key, it is computed at runtime and t **Default value**: N/A **Description**: An array of API actions permitted for the key, represented as strings. API actions are only possible on authorized [`indexes`](#indexes). `["*"]` for all actions. +You can use `*` as a wildcard to access all endpoints for the `documents`, `indexes`, `tasks`, `settings`, `stats` and `dumps` actions. For example, `documents.*` gives access to all document actions. + ::: warning -We do not recommend creating keys that can perform all actions. +For security reasons, we do not recommend creating keys that can perform all actions. ::: -You can use `*` as a wildcard to access all endpoints for the `documents`, `indexes`, `tasks`, `settings`, `stats` and `dumps` actions. For example, `documents.*` gives access to all document actions. - | Name | Description | | :--------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **`search`** | Provides access to both [`POST`](/reference/api/search.md#search-in-an-index-with-post-route) and [`GET`](/reference/api/search.md#search-in-an-index-with-get-route) search endpoints |