Enable PATCH and DELETE member to be cookie authenticated

hypothesis · Nov 27, 2024 · 751be6c · 751be6c
1 parent da67cc8
commit 751be6c
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/h/security/policy/_api_cookie.py b/h/security/policy/_api_cookie.py
@@ -8,7 +8,9 @@
 COOKIE_AUTHENTICATABLE_API_REQUESTS = [
     ("api.groups", "POST"),  # Create a new group.
     ("api.group", "PATCH"),  # Edit an existing group.
-    ("api.group_members", "GET"),  # List group members
+    ("api.group_members", "GET"),  # List group members.
+    ("api.group_member", "PATCH"),  # Edit group membership.
+    ("api.group_member", "DELETE"),  # Remove group member.
 ]