Skip to content

v0.11.0

Choose a tag to compare

View all tags
@obakeng-develops obakeng-develops released this 03 Sep 12:24
· 19 commits to main since this release
v0.11.0
e5cc45e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Campsend has an HTTP API.

Deliveries over plain HTTP

GET /api/v1/deliveries, POST /api/v1/deliveries and GET /api/v1/deliveries/:identifier, authenticated with an API token as a bearer token. Create, list and read were already there over MCP, but MCP is JSON-RPC, which a shell script or an automation tool cannot speak.

Read and write scopes are enforced. A delivery belonging to somebody else answers 404 rather than 403, so nobody can probe which identifiers exist. No response carries an access token, a token digest or a signed storage URL.

Direct uploads take a token

This is the half that makes the rest usable. Api::V1::DirectUploadsController read the session, so a token holder could not upload anything and could only send files a browser had already put there.

It now accepts a bearer token as well as a session, and requires the write scope when one is used. So a script can reserve an upload, put the bytes at the URL it is given and send the delivery, with no browser anywhere.

CSRF verification is skipped only for token callers. A bearer token is not a cookie, so there is nothing for a forged request to ride on, and a browser session still carries one and still gets checked.

Full changelog: v0.10.0...v0.11.0

Assets 2
Loading