Skip to content

Conversation

Copy link

Copilot AI commented Nov 24, 2025

The Frozen field on holes was being exposed to all users. This admin-only field should only be visible to administrators.

Changes

  • Model: Changed Frozen field to json:"-" to prevent default serialization; added FrozenFrontend *bool with json:"frozen,omitempty" for conditional exposure
  • Serialization: Modified Preprocess() to set FrozenFrontend only for admin users
  • Docs: Regenerated Swagger specs

Behavior

// Non-admin response
{"id": 1, "hidden": false, "locked": false, ...}

// Admin response  
{"id": 1, "hidden": false, "locked": false, "frozen": true, ...}

The implementation follows the fail-safe pattern: if user context is unavailable, the field is omitted.

Original prompt

This section details on the original issue you should resolve

<issue_title>[BUG] 后端不应当向前端返回已冻结信息</issue_title>
<issue_description></issue_description>

<agent_instructions>Keep modifications minimal.</agent_instructions>

Comments on the Issue (you are @copilot in this section)


✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Copilot AI changed the title [WIP] Fix backend returning frozen information to frontend Hide frozen field from non-admin users in API responses Nov 24, 2025
Copilot AI requested a review from KYLN24 November 24, 2025 06:31
@KYLN24 KYLN24 requested review from Copilot and ppolariss and removed request for KYLN24 November 24, 2025 09:48
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR implements access control for the Frozen field on holes, restricting visibility to administrators only. The implementation follows a fail-safe pattern where the field is omitted from API responses unless the user is confirmed to be an admin.

Key Changes:

  • Modified the Frozen field serialization to use a dual-field pattern: database field excluded from JSON (json:"-") and a separate pointer field (FrozenFrontend) for conditional frontend exposure
  • Updated Preprocess() to conditionally populate FrozenFrontend only for admin users
  • Updated API documentation to reflect the admin-only nature of the frozen field

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated no comments.

Show a summary per file
File Description
models/hole.go Changed Frozen field to use json:"-", added FrozenFrontend *bool with json:"frozen,omitempty", and updated Preprocess() to set field only for admins
docs/swagger.yaml Updated frozen field description from implementation detail to "admin-only visibility"
docs/swagger.json Updated frozen field description to match swagger.yaml changes
docs/docs.go Updated frozen field description in generated documentation
.gitignore Added compiled binary outputs (treehole and treehole.exe) to gitignore

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@ppolariss
Copy link
Member

直接改 frozen,要不前端还得改

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] 后端不应当向前端返回已冻结信息

3 participants