Tech: l'authentification admin doit précéder retrieve_procedure (RAILS-K79)#13323
Merged
Conversation
…ontroller prepend_before_action :retrieve_procedure ran before the inherited authenticate_administrateur! callback, so anonymous requests hit current_administrateur.procedures with a nil receiver and raised a 500 instead of being redirected to sign in. Register retrieve_procedure as a regular before_action placed before `include SimpliscoreConcern` so the order becomes authenticate -> retrieve_procedure -> simpliscore guards, preserving both constraints. Fixes RAILS-K79 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
mmagn
force-pushed
the
worktree-radiant-knitting-catmull
branch
from
June 18, 2026 13:59
9f0cc42 to
1294f55
Compare
mmagn
marked this pull request as ready for review
June 18, 2026 14:03
mmagn
changed the title
colinux
approved these changes
Jun 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sur
TypesDeChampController,retrieve_procedureétait déclaré enprepend_before_action, donc exécuté avantauthenticate_administrateur!. Pour une requête non authentifiée (essentiellement des bots tapant les URLs/admin/.../simplify/...),current_administrateurestnil→nil.procedureslève unNoMethodError(500) au lieu de rediriger vers la connexion. C'est l'unique contrôleur admin dans ce cas (tous les autres utilisent unbefore_actionclassique).Le
prependavait été ajouté pour queretrieve_procedurepasse avant les guards deSimpliscoreConcern(ensure_simpliscore_enabled,ensure_valid_tunnel) qui dépendent de@procedure. Le correctif le repositionne enbefore_actionclassique avantinclude SimpliscoreConcern, ce qui donne l'ordre :authenticate_administrateur!→retrieve_procedure→ guards Simpliscore. Les deux contraintes sont respectées.Fixes RAILS-K79
https://demarches-simplifiees.sentry.io/issues/RAILS-K79