source-academy / backend / d652c84f3b039e0f70c67551f3e333edf04c042f-PR-1370

88%

master: 87%

Pull #1370

github

Add hardened mode restricting course creation to super admins

Under hardened mode (config :cadet, hardened_mode: true, default off),
POST /v2/config/create is limited to users with super_admin. Non-super
admins receive an opaque 401 "Unauthorised" -- identical to the auth
error handler -- so the restriction is not disclosed; the real reason
is logged server-side only. No frontend changes required.

- config/config.exs: declare hardened_mode flag (default false)
- lib/cadet/env.ex: add Cadet.Env.hardened_mode?/0 helper
- lib/cadet_web/controllers/courses_controller.ex: enforce in create/2
- config/cadet.exs.example: document the prod runtime option
- test: cover super-admin success and non-super-admin opaque 401

16 of 16 new or added lines in 2 files covered. (100.0%)

4015 of 4585 relevant lines covered (87.57%)

6986.23 hits per line