Skip to content

v0.0.9

Choose a tag to compare

View all tags
@arapov arapov released this 25 Jul 13:02
· 5 commits to master since this release
v0.0.9
This tag was signed with the committer’s verified signature.
arapov Anton Arapov
GPG key ID: EDDD4C5DAA149BBE
Verified
Learn about vigilant mode.
0e67bdf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Breaking upstream change — this release is required. Loomio moved API-key authentication to an HTTP bearer header and now rejects keys passed in the query string. Every request from v0.0.8 and earlier fails against an updated Loomio instance.

What changed

  • Bearer authentication. b2 and b3 now send Authorization: Bearer <key>; URLs carry no credential. Auth injection moved from buildUrl() into a single new authHeaders() in src/loomio/client.ts.
  • No configuration change. LOOMIO_API_KEY and LOOMIO_B3_API_KEY are unchanged — upgrade and restart.

Why it looked like a permissions bug

Loomio answers a query-string key with 403 {"error":"You are not authorized to access this page."} — byte-identical to its response for an invalid key or a missing group role. A rejected auth scheme is therefore indistinguishable from a permissions problem, which sends you hunting for a lost membership. Verified on a live instance:

scheme result
?api_key= 403
Authorization: Bearer 200
no credential 403 (same body as ?api_key=)

tests/loomio-auth.test.ts now pins the scheme so a regression fails in CI instead.

Note

b3 bearer support follows Loomio's published note but is untested here — it needs a server-instance B3_API_KEY, which only Loomio instance operators hold.

See CHANGELOG.md.

Assets 2
Loading