pub fn is_write(method: &str, url: &str) -> boolExpand description
Whether a request is a write, in the sense a seed refuses (D80).
Two halves, one rule each. git: whatever git_requirement grades
at Level::Propose or above, which is every step of a push and no
step of a clone, and is decided before git http-backend is spawned.
The API: every POST under /api/. That one is by method rather
than by grant level on purpose, because level grades authority and
not mutation: a verdict or a comment needs only read over the
repository (see op_level) and still appends to the log. Every
/api/ read is a GET, and every /api/ POST changes something,
the log or a store beside it, so the method is the classification that
cannot let a write through as a read.
The pre-authentication routes (signing in, asking for access) are not asked, because they never reach the point where this is.