feat(myopencre): implement MyOpenCRE frontend functionality behind backend capability flag#704
Open
PRAteek-singHWY wants to merge 26 commits intoOWASP:mainfrom
Open
Conversation
- Validate file type, encoding, and required headers - Accept CSVs generated from CRE catalogue export - Skip empty and padding rows present in exported templates - Validate CRE format only when CRE references exist - Guard against misaligned rows with extra columns - Return structured validation errors before import This keeps the importer aligned with the exporter while preventing malformed inputs from causing server errors.
… header error handling
Contributor
Author
|
Hey @northdpole , Sir Thanks for the feedback earlier ! I've implemented runtime flag gating for MyOpenCRE to ensure it’s only available on self-hosted/admin-controlled OpenCRE instances. This prevents accidental exposure on platforms like opencre.org. With this setup, MyOpenCRE will only be active when enabled via the ENABLE_MYOPENCRE flag on self-hosted instances. For opencre.org, the feature remains inactive. Looking ahead, once user scoping (#586) is in place, we’ll implement feature flagging at the user level to control visibility based on roles (e.g., admin vs non-admin), offering finer access control. Appreciate your guidance, and I look forward to continuing the work! Would love to hear your thoughts on this! |
This was referenced Jan 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR introduces the MyOpenCRE frontend functionality, enabling the MyOpenCRE feature to be conditionally displayed based on the ENABLE_MYOPENCRE runtime flag. This feature ensures that MyOpenCRE functionality is only available when the flag is enabled, in alignment with the backend capability gating.
This PR depends on #700, which implements the backend for MyOpenCRE. With this PR, we have connected the frontend to the backend, allowing MyOpenCRE UI elements to appear and function only when the backend provides the capability signal.
Files Modified
The following files were modified as part of this PR:
Other changes are incidental (formatting, imports) and do not affect the logical behavior of the application.
What Changed
true)./api/capabilitiesendpoint, which informs whether MyOpenCRE should be displayed based on the current deployment configuration.Why This Change Was Introduced
The MyOpenCRE feature requires administrative control for self-hosted deployments. By gating the feature behind a runtime flag, it prevents accidental exposure on public platforms and ensures that it’s only accessible when explicitly enabled. This PR ensures that the frontend only shows the MyOpenCRE features when they are actually available, preventing user confusion.
This change:
Testing
ENABLE_MYOPENCRE=false (default):
ENABLE_MYOPENCRE=true:
Stacking / Follow-ups
This PR depends on #700 for the backend functionality (capability gating).
Next Steps
Conclusion
This PR provides the frontend functionality for MyOpenCRE based on the backend ENABLE_MYOPENCRE flag. It ensures that MyOpenCRE is only available when the backend allows it and is ready to be used in self-hosted deployments. Future work will refine user role-based controls and feature flagging for even finer control.