Won't those two routes/actions be unguarded since they aren't declared?
There's no defined permission matched to them.
On May 22, 2014 9:32 AM, "Ivan Necas" <notifications@github.com> wrote:

> In lib/katello/permissions/capsule_content_permissions.rb:
>
> > @@ -0,0 +1,9 @@
> > +require 'katello/plugin.rb'
> > +
> > +Foreman::Plugin.find(:katello).security_block :capsule_content do
> > +  permission :manage_capsule_content,
> > +             {
> > +                 'katello/api/v2/capsule_content' => [:lifecycle_environments, :available_lifecycle_environments, :add_lifecycle_environment, :remove_lifecycle_environment, :sync]
>
> It just inherits from the smart proxy, so we get the permissions from
> there as well
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/Katello/katello/pull/4118/files#r12949400>
> .
>