Intent: #4818, landed. Pull #4824 built it on branch scout/4818-the-forge-button-s-note-door-lands-a-not (head 1399ada9). Three reviews found the HTTP side sound apart from one High finding, and the pull did not move again after it.
Start from that branch.
Done:
[ ] everything pull #4824 carries, rebased on main
[ ] the one change:/__forge/note/moderate is removed from the app host. Code in the app or in a pull's preview could call it same-origin with a visiting admin's grant cookie, and sameOrigin() does not defend against the app itself. On the app host only POST /__forge/note and GET /__forge/notes are answered. The moderation function stays, for #4819's forge-origin screen to call
[ ] a test: /__forge/note/moderate (any method) is a 404 on the app host, even with an admin grant cookie
[ ] the README's note-door paragraph says that moderation happens on the forge, not on the app
Not in scope: the reviewer's non-blocking note that a preview's script can file a note as the visiting person. Leave it as it is and name it in the pull.
Intent: #4818, landed. Pull #4824 built it on branch
scout/4818-the-forge-button-s-note-door-lands-a-not(head 1399ada9). Three reviews found the HTTP side sound apart from one High finding, and the pull did not move again after it.Start from that branch.
Done:
/__forge/note/moderateis removed from the app host. Code in the app or in a pull's preview could call it same-origin with a visiting admin's grant cookie, andsameOrigin()does not defend against the app itself. On the app host only POST/__forge/noteand GET/__forge/notesare answered. The moderation function stays, for #4819's forge-origin screen to call/__forge/note/moderate(any method) is a 404 on the app host, even with an admin grant cookieNot in scope: the reviewer's non-blocking note that a preview's script can file a note as the visiting person. Leave it as it is and name it in the pull.