Deliberately readable without a session, like the rest of the harvest reads -- which sources feed an open data portal is public information, it is the contract the frontend and upstream udata are built on, and test_get_source_permissions_as_anonymous draws that anonymous 200 explicitly.

What makes it safe is that no secret reaches the payload, not that nobody is looking: url is redacted here and in harvests.csv for anyone without edit, config is served only to those same readers because it carries the CKAN apikey, HarvestError and HarvestLog are redacted as they are built and again as they are serialized, and the source URL copied onto harvested dataservices is redacted at the copy. @api.secure would not have replaced any of that -- it only demands an account, and anyone can create one, so a registered reader would have seen exactly what an anonymous one did.

The confirmation oracle that used to be accepted here is gone: the text index no longer covers url, so ?q=<password> matches nothing, and a source URL can no longer be stored with credentials at all (LEDG-2502).

odspt and maaf used to build public dataset resource URLs and remote ids out of the source URL, which is the same defect in a place where redacting breaks a working download link. That was settled by redacting anyway: a link that only works because it carries somebody else's password is the defect, not a feature.

See LEDG-2477, LEDG-2500, LEDG-2502 and LEDG-2514.

{
  "backend": "ckan",
  "last_job": {
    "items": [
      {
        "dataservice": {
          "title": "My awesome API"
        },
        "status": "pending"
      }
    ],
    "status": "pending"
  },
  "validation": {
    "state": "pending"
  }
}