feat(ical): allow revenue_manager to list, read and sync feeds - #318
Merged
telivity-otaip merged 2 commits intoAug 13, 2026
Merged
Conversation
Every iCal route required admin. A scheduler that keeps import feeds fresh (hourly cron pulling OTA calendar exports) then has to hold admin credentials permanently — the broadest role in the realm for the most routine job in the system. This widens exactly three routes to revenue_manager: feed list, feed read, feed sync. Create, update, delete and rotate-token stay admin-only — a scheduler needs to trigger and observe, not manage.
telivity-otaip
pushed a commit
that referenced
this pull request
Aug 16, 2026
) #318 relaxed listing, reading and syncing feeds to revenue_manager, but GET /ical/feeds/:id/blocks was missed, so an integration can list the feeds and sync them while being unable to see what they imported. Reading the blocks is no more privileged than reading the feed beside it — they are the busy dates a sync just fetched, not credentials. Without it any consumer that reconciles imported availability against its own calendar has to hold admin purely to read. Co-authored-by: Charles Pizzato <311327716+modernitconsultants@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every iCal route requires
admin. A scheduler that keeps import feeds fresh — an hourly cron pulling OTA calendar exports, surely the common deployment shape — then has to hold admin credentials permanently: the broadest role in the realm for the most routine job in the system.This widens exactly three routes to
revenue_manager: feed list, feed read, feed sync. Create, update, delete and rotate-token stay admin-only — a scheduler needs to trigger and observe, not manage.(Running this in production: our sync CronJob authenticates as a service account holding
revenue_manager, and feed creation remains a deliberate admin act. The split has felt right in practice.)