sbp commented on issue #962: URL: https://github.com/apache/tooling-trusted-releases/issues/962#issuecomment-4753968362
> please explain via an example where this "non-API" edge case will exist? On all embargoed endpoints. The problem is in the authentication mechanism: we have metadata on a web session telling us if the user is an ASF member, but when we get a user's ASF UID from their API token we don't. We could make an extra LDAP lookup, but we try to avoid being inefficient like that, especially in the API. We could cache it, e.g. looking up the entire membership when the server first loads and then updating it via PubSub, but that's a lot of complexity. We could store the ASF membership property in their User object in the database when they sign in to ATR on the web, but then that data goes stale and it could be very stale by the time they next use the API. On balance, therefore, I decided to just not support the API, though as with all excluded functionality this can always be revisited and added later. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
