Resource and method visibility #20

New issue

Open

opened 2026-07-04 06:44:12 +02:00 by c.fahner · 0 comments

c.fahner commented

2026-07-04 06:44:12 +02:00

Owner

Add visibility attributes for Resource's. There should be two options: "public" or "internal" (default). Adds an attribute called Visibility that requires an enum value VisibilityKind (which has two cases). The Visibility attribute should also support being added to specific methods only. Marking a single method as public makes the entire resource public and trying to mark the resource itself as internal should cause an exception.

Internal resources should:

not show up on sitemaps, OpenAPI listings, etc
present any "bad request" (ie. HTTP 400 due to missing/invalid argument) as a 404 by default and treat it as a security event
only in debug mode should the "bad request" + message be shown publicly, without triggering a security event

Integration tests should be updated accordingly to make every test resource so far public.

Add visibility attributes for `Resource`'s. There should be two options: "public" or "internal" (default). Adds an attribute called `Visibility` that requires an enum value `VisibilityKind` (which has two cases). The `Visibility` attribute should also support being added to specific methods only. Marking a single method as public makes the entire resource public and trying to mark the resource itself as internal should cause an exception. Internal resources should: * not show up on sitemaps, OpenAPI listings, etc * present any "bad request" (ie. HTTP 400 due to missing/invalid argument) as a 404 by default and treat it as a security event * only in debug mode should the "bad request" + message be shown publicly, without triggering a security event Integration tests should be updated accordingly to make every test resource so far public.

c.fahner added this to the v0.2 milestone

2026-07-04 06:44:12 +02:00

c.fahner added the

Kind/Feature

label

2026-07-04 06:44:12 +02:00

c.fahner changed title from ~~Resource visibility~~ to Resource and method visibility

2026-07-04 07:10:45 +02:00