Skip to content

feat: Add a bulk publisher revocation endpoint#1860

Open
autumnfound wants to merge 6 commits into
eclipse-openvsx:mainfrom
autumnfound:malowe/main/10109-open-vsx_org
Open

feat: Add a bulk publisher revocation endpoint#1860
autumnfound wants to merge 6 commits into
eclipse-openvsx:mainfrom
autumnfound:malowe/main/10109-open-vsx_org

Conversation

@autumnfound
Copy link
Copy Markdown
Contributor

@autumnfound autumnfound commented May 21, 2026

Related to the request EclipseFdn/open-vsx.org#10109

This endpoint, using the admin access token as authentication, allows for multiple publishers to be unpublished simulataneously. This additionally adds optional support for adding a reason to the audit log for revoking publisher contributions.

Resolves EclipseFdn/open-vsx.org#10109
To ensure full removal of revoked publishers, removal of namespace
memberships was added to the publisher revocation flow.
As a new guard rail, any publishers that are also admins pushed for
revocation via the API gets rejected and must first have their admin
role revoked.
@autumnfound autumnfound requested review from gnugomez and netomi May 21, 2026 18:57
)
public ResponseEntity<BulkPublisherRevokeResponseJson> revokeBulkPublishers(
@RequestParam(value = "token") @Parameter(description = "A personal access token") String tokenValue,
@RequestBody BulkPublisherRevokeRequestJson request
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

question: why are you using a request body in here?

for what I can see in the rest of the APIs using the body is more common when updating/creating a new entity, but for this more specific operations params are more common.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The reason I chose json is the main request content is a list of username and provider tuples. Trying to cram this into parameters would be problematic and overly difficult for no gain.

Comment thread server/src/main/java/org/eclipse/openvsx/admin/AdminAPI.java Outdated
Comment thread server/src/main/java/org/eclipse/openvsx/admin/AdminAPI.java Outdated
Comment thread server/src/main/java/org/eclipse/openvsx/admin/AdminAPI.java Outdated
Comment thread server/src/main/java/org/eclipse/openvsx/admin/AdminAPI.java
Comment thread server/src/main/java/org/eclipse/openvsx/admin/AdminAPI.java Outdated
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants