imbajin commented on code in PR #500: URL: https://github.com/apache/hugegraph-doc/pull/500#discussion_r4111056063
########## content/en/docs/clients/restful-api/auth.md: ########## @@ -8,6 +8,16 @@ description: "Authentication REST API: Manage users, roles, permissions, and acc > **Version Change Notice**: > - 1.7.0+: Auth API paths use GraphSpace format, such as > `/graphspaces/DEFAULT/auth/users`, and group/target IDs match their names > (e.g., `admin`) > - 1.5.x and earlier: Auth API paths include graph name, and group/target IDs > use format like `-69:grant`. See [HugeGraph 1.5.x RESTful > API](https://github.com/apache/hugegraph-doc/tree/release-1.5.0) +> +> Group paths are the exception in 1.7.0: there `GroupAPI` is served at `/auth/groups` +> with no GraphSpace prefix, while on 1.5.x it carried the graph name +> (`/graphs/{graph}/auth/groups`) like the other auth APIs. The +> `/graphspaces/{graphspace}/auth/groups` forms below need a build that includes +> [apache/hugegraph#3096](https://github.com/apache/hugegraph/pull/3096), which is newer +> than the 1.7.0 release. On 1.7.0 that route is unregistered rather than 404: +> `AuthenticationFilter` is `@PreMatching`, so it runs before route matching and answers +> 401 (no credentials) or 403 (IP outside the white list); 404 comes back only when +> authentication is disabled. Review Comment: Updated in 494d750. The notice now says an unregistered route can return 404 after authentication succeeds, in addition to 404 when authentication is disabled. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
