Unleash / unleash-edge / #734

80%

push

fix(#274): use the validated token to calculate flags to return (#275)

* fix(#274): use the validated token to calculate flags to return

This change fixes a bug where the client API would return all flags
that existed in the cache, even if the api token did not have access
to those flags. Crucially, the API token had to have access to
multiple (but not all) projects for this to happen.

The root cause is that we used the incoming edge token to check which
flags to return. Before it gets validated, its `projects` property is
just an empty list. In the filtering, this causes edge to return all
available. Features.

The solution was to instead use the validated edge token that we
create further up.

There is also a test that confirms this behavior is what we expect.

## Discussion point

Could we make it so that the `with_filter` function can only take
validated edge tokens or would that break something else? Might be a
good way to future proof it.

* fix(#274): update more uses

I suspect these will have the same issue

* Update server/src/client_api.rs

Co-authored-by: Simon Hornby <liquidwicked64@gmail.com>

---------

Co-authored-by: Simon Hornby <liquidwicked64@gmail.com>

4 of 4 new or added lines in 1 file covered. (100.0%)

1124 of 1382 relevant lines covered (81.33%)

1.74 hits per line