Adding a tag doesn't seem to require API key authorization about docat HOT 4 CLOSED

Why? adding tags is not destructive

from docat.

Agree that it's not directly destructive, but it could still have a significant impact if a tag is changed incorrectly.

As an example, the tag may be used in pipelines to deploy the latest version of a code.
Even for manual usage it could mislead the user if a wrong tag is applied.

Not big issue for me, but I was surprised that it worked w/o API key.

from docat.

Also your assumption that you need a token to upload is wrong https://github.com/docat-org/docat/blob/main/docat/docat/app.py#L227 only the destructive action of overriding a existing version requires the token

this was a deliberate decision to make the usage as simple as possible but less secure

im closing this for now, maybe this is something that could be configurable - but its more code and complexity

from docat.

Thanks for the clarification.

from docat.