Private presets are being pushed as part of async-presets message

[talboren]

Even if the preset is private, it's still being added to users who doesn't own the preset

[Matvey-Kuk]

/bounty 50

[algora-pbc]

💎 $50 bounty • Keep (YC W23)

Steps to solve:

1. Start working: Comment /attempt #1163 with your implementation plan
2. Submit work: Create a pull request including /claim #1163 in the PR body to claim the bounty
3. Receive payment: 100% of the bounty is received 2-5 days post-reward. Make sure you are eligible for payouts

Thank you for contributing to keephq/keep!

Add a bounty • Share on socials

Attempt	Started (GMT+0)	Solution
🟢 @Savokr	Jul 31, 2024, 2:12:02 PM	WIP
🟢 @rajeshj11	Aug 3, 2024, 9:05:53 PM	#1526

[Savokr]

/attempt #1163

Options

• Cancel my attempt

[Savokr]

Hey @talboren, I am trying to properly reproduce the bug but creating new users from the UI is failing, saying that "password is required". Is there a simple way how I can test private presets, possibly via an API or otherwise, how can I fix the password problem during user creation. Here is the screenshot of what happens when I am trying to add new users:

[soylent-grin]

@Savokr you need to run in SINGLE_TENANT mode (default is NO_AUTH). For example, add this in docker-compose.dev.yml

  keep-frontend-dev:
    environment:
      - AUTH_TYPE=SINGLE_TENANT
  ...
  keep-backend-dev:
    environment:
      - AUTH_TYPE=SINGLE_TENANT
      - KEEP_JWT_SECRET=verysecretkey
      - KEEP_DEFAULT_USERNAME=keep
      - KEEP_DEFAULT_PASSWORD=keep

[rajesh-jonnalagadda]

/attempt #1163

Algora profile	Completed bounties	Tech	Active attempts	Options
@rajeshj11	1 keephq bounty + 15 bounties from 7 projects	JavaScript, TypeScript, HTML		Cancel attempt

[algora-pbc]

💡 @rajeshj11 submitted a pull request that claims the bounty. You can visit your bounty board to reward.

[algora-pbc]

🎉🎈 @rajeshj11 has been awarded $50! 🎈🎊

• Share on socials
• Give feedback

[Matvey-Kuk]

This issue is claimed by and assigned to @Savokr , @rajeshj11 thank you for the contribution, but please don't over-come others the next time 🙏

[rajesh-jonnalagadda]

This issue is claimed by and assigned to @Savokr , @rajeshj11 thank you for the contribution, but please don't over-come others the next time 🙏

@Matvey-Kuk Will remember that. thanks for letting me know about it.

[rajesh-jonnalagadda]

@Savokr I apologize for any confusion regarding this issue. While I completed the task first, I understand you were also working on it. If you’ve made any progress or invested time, I’m available to assist with any other issue to make it right. (without split)

[soylent-grin]

Actually, the issue persists, because all private presets are still being pushed to all users within a tenant (and can be visible via e.g. devtools), they are just not visible in ui. Not sure if this is a security or performance concern for now

[talboren]

Actually, the issue persists, because all private presets are still being pushed to all users within a tenant (and can be visible via e.g. devtools), they are just not visible in ui. Not sure if this is a security or performance concern for now

It's a viable concern for now but not really urgent. The fact is when they enter the preset, they'll not get any results because the preset does not exist for them (they can "catch" it on devtools but do nothing with it for real).
Thanks!

[rajesh-jonnalagadda]

@talboren @soylent-grin if you want me to work on the event push data. I can give it a try.