Expose listing sites via Sites API to all API keys

plausible · Jul 1, 2024 · 8433332 · 8433332
1 parent f003173
commit 8433332
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 2 deletions.
diff --git a/lib/plausible_web/plugs/authorize_api.ex b/lib/plausible_web/plugs/authorize_api.ex
@@ -13,7 +13,7 @@ defmodule PlausibleWeb.AuthorizeApiPlug do
   alias PlausibleWeb.Api.Helpers, as: H
 
   # Scopes permitted implicitly for every API key
-  @implicit_scopes ["stats:read:*"]
+  @implicit_scopes ["stats:read:*", "sites:read:*"]
 
   def init(opts) do
     opts

diff --git a/lib/plausible_web/router.ex b/lib/plausible_web/router.ex
@@ -185,14 +185,19 @@ defmodule PlausibleWeb.Router do
     scope "/api/v1/sites", PlausibleWeb.Api do
       pipe_through :public_api
 
+      scope assigns: %{api_scope: "sites:read:*"} do
+        pipe_through PlausibleWeb.AuthorizeApiPlug
+
+        get "/:site_id", ExternalSitesController, :get_site
+      end
+
       scope assigns: %{api_scope: "sites:provision:*"} do
         pipe_through PlausibleWeb.AuthorizeApiPlug
 
         post "/", ExternalSitesController, :create_site
         put "/shared-links", ExternalSitesController, :find_or_create_shared_link
         put "/goals", ExternalSitesController, :find_or_create_goal
         delete "/goals/:goal_id", ExternalSitesController, :delete_goal
-        get "/:site_id", ExternalSitesController, :get_site
         put "/:site_id", ExternalSitesController, :update_site
         delete "/:site_id", ExternalSitesController, :delete_site
       end