source-academy / backend / 177a80efd5197c4a294167f5793cee5f8c145700

87%

push

github

Add hardened mode restricting course creation to super admins (#1370)

* Add hardened mode restricting course creation to super admins

Under hardened mode (config :cadet, hardened_mode: true, default off),
POST /v2/config/create is limited to users with super_admin. Non-super
admins receive an opaque 401 "Unauthorised" -- identical to the auth
error handler -- so the restriction is not disclosed; the real reason
is logged server-side only. No frontend changes required.

- config/config.exs: declare hardened_mode flag (default false)
- lib/cadet/env.ex: add Cadet.Env.hardened_mode?/0 helper
- lib/cadet_web/controllers/courses_controller.ex: enforce in create/2
- config/cadet.exs.example: document the prod runtime option
- test: cover super-admin success and non-super-admin opaque 401

* Rename hardened_mode flag to restrict_course_creation

The flag only gates course creation for now, so name it for its purpose.
Renames Cadet.Env.hardened_mode?/0 to restrict_course_creation?/0 and
updates the config default, prod example, and tests accordingly.

* Return 403 instead of 401 when course creation is restricted

401 would incorrectly trigger the frontend token-refresh flow, and 403
matches the sibling too-many-courses branch and the router's authz
rejections. Uses the generic opaque "Forbidden" body.

* Remove unnecessary fallback

16 of 16 new or added lines in 2 files covered. (100.0%)

4015 of 4585 relevant lines covered (87.57%)

6986.19 hits per line