This repository was archived by the owner on Sep 30, 2024. It is now read-only.
support getting other orgs on dotcom from the GraphQL API#63941
Merged
Conversation
Comment on lines
196
to
201
Check notice
Code scanning / Semgrep OSS
Semgrep Finding: security-semgrep-rules.semgrep-rules.generic.comment-tagging-rule
25ab300 to
267cc6b
Compare
427642c to
3fe4db0
Compare
Previously, the GraphQL API on dotcom only let org members query for an org (through `organization(name: ...)` or otherwise). This made sense as a strict security safeguard in a world where an org had only private resources, not public resources. However, with search contexts, saved searches, and now the new prompt library, we want orgs on dotcom to be able to create things that (if we or they intentionally make them public) all users can see, and can see the association with the org owner. That requires all users to be able to query for the org and see its name. We continue to enforce the secrecy of much org data: members (only org members can list the other members of the org), settings (only org members can view this). But the name, displayName, and existence of an org will now be considered public.
3fe4db0 to
87ad4bd
Compare
sqs
referenced
this pull request
Jul 20, 2024
Followup from https://github.com/sourcegraph/sourcegraph/pull/63941. I forgot to make it so site admins could list org members in that PR. As for the new ability for site admins to see user and org settings: Site admins could already add themselves to orgs as members and see settings that way. I considered still keeping it stricter, but it is valuable for site admins to be able to view settings to help users troubleshoot.
sqs
referenced
this pull request
Jul 20, 2024
…com (#63963) Followup from https://github.com/sourcegraph/sourcegraph/pull/63941. I forgot to make it so site admins could list org members in that PR. As for the new ability for site admins to see user and org settings: Site admins could already add themselves to orgs as members and see settings that way. I considered still keeping it stricter, but it is valuable for site admins to be able to view settings to help users troubleshoot. ## Test plan In dotcom mode, as a site admin, view a user or org (that the site admin is not a member of). Confirm that the settings can be viewed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Previously, the GraphQL API on dotcom only let org members query for an org (through
organization(name: ...)or otherwise). This made sense as a strict security safeguard in a world where an org had only private resources, not public resources.However, with search contexts, saved searches, and now the new prompt library, we want orgs on dotcom to be able to create things that (if we or they intentionally make them public) all users can see, and can see the association with the org owner. That requires all users to be able to query for the org and see its name.
We continue to enforce the secrecy of much org data: members (only org members can list the other members of the org), settings (only org members can view this).
But the name, displayName, and existence of an org will now be considered public.
Test plan
In dotcom mode, view an organization.