Lauri Ojansivu
c71a97cba2
since after WeKan v7.93 and only generated docs for the `login`/`register` endpoints (2 operations) instead of the full API. The Meteor 3 migration moved the REST routes from `models/*.js` (`JsonRoutes.add(...)`) into `server/models/*.js` (`WebApp.handlers.get/post/put/delete(...)`) and introduced optional chaining (`?.`) that the `esprima` Python parser cannot read, so `openapi/generate_openapi.py` silently skipped every route file. The generator now understands both routing styles, scans both `models/` and `server/models/`, downlevels modern JS syntax so files parse, handles the `type: Array` SimpleSchema idiom, and `releases/rebuild-docs.sh` works directly with Python 3.12.x (PEP 668). The generated `public/api/wekan.yml` / `wekan.html` now cover the full API again (89 operations / 61 paths). Thanks to Claude. **Documented the attachment / file REST API in the OpenAPI docs** — file upload, download, info, listing a board's files, copy, move and delete (the `/api/attachment/*` endpoints registered via `WebApp.handlers.use()`, which the generator cannot auto-discover) are now documented in `openapi/extra_paths.yml` and injected into the generated docs, including their authentication and permission requirements. Thanks to Claude. **Security: attachment write operations in the REST/DDP API now require board write access, not just membership (CWE-862, CWE-639).** Both attachment API implementations (`server/routes/attachmentApi.js` HTTP routes and `server/attachmentApi.js` Meteor methods) gated upload / copy / move / delete on `board.hasMember()`, which is true for any active member regardless of role. This let read-only, comment-only, no-comments, worker and assigned-only board members add, copy, move and delete attachments through the API — actions the UI forbids for those roles. They now require board write access (global site admins still allowed); read operations (download / list / info) keep membership-level access. Added security tests in `server/lib/tests/attachmentApi.tests.js`. Thanks to Claude. **The attachment copy API now honours the admin "Admin Panel / Attachments" API transfer limits.** Copying an attachment creates a new attachment but skipped the `apiUploadBlocked` / `apiUploadMaxBytes` checks that upload enforces; copy now respects them in both API implementations. Thanks to Claude. **SVG image uploads are now sanitized instead of rejected.** Uploaded SVGs (attachments and avatars) are cleaned in place in `onAfterUpload` via the new `models/lib/sanitizeSvg.js`, which removes JavaScript (`<script>`, inline `on*=` event handlers, `javascript:`/`vbscript:` URIs, `<foreignObject>` / `<iframe>` / `<object>` / `<embed>` and similar active content) and XML loops (`<!DOCTYPE>` / `<!ENTITY>` entity-expansion / XXE constructs and `<?xml-stylesheet?>`), so SVG images can be uploaded safely. Thanks to Claude.
OpenAPI tools and doc generation
Open API generation
This folder contains a script (generate_openapi.py) that extracts
the REST API of Wekan and exports it under the OpenAPI 2.0 specification
(Swagger 2.0).
dependencies
- python3
- esprima-python
calling the tool
python3 generate_openapi.py --release v7.92 > ../public/api/wekan.yml
Generating docs
Now that we have the OpenAPI, it's easy enough to convert the YAML file into some nice Markdown with shins and api2html, or even ReDoc:
api2html -c ../public/logo-header.png -o api.html ../public/wekan_api.yml
or
redoc-cli serve ../public/wekan_api.yml