Chris Hill-Scott 43bcb56ff4 Revoke API keys when changing broadcast settings ...

On a regular Notify service anyone with permission can create an API
key. If this service then is given permission to send emergency alerts
it will have an API key which can create emergency alerts. This feels
dangerous.

Secondly, if a service which legitimately has an API key for sending
alerts in training mode is changed to live mode you now have an API key
which people will think isn’t going to create a real alert but actually
will. This feels really dangerous.

Neither of these scenarios are things we should be doing, but having
them possible still makes me feel uncomfortable.

This commit revokes all API keys for a service when its broadcast
settings change, same way we remove all permissions for its users.

2021-07-29 10:11:38 +01:00

..

app

Revoke API keys when changing broadcast settings

2021-07-29 10:11:38 +01:00

__init__.py

…

conftest.py

Add a type table for broadcast providers

2021-05-06 15:30:04 +01:00

test_all_queues_used.py

…