Allow public leaderboard API reads

2026-10-05 16:46:44 -04:00
parent bd10c1c5d2
commit 083d29323f
5 changed files with 83 additions and 37 deletions
@@ -20,6 +20,7 @@ export function routePermission(routeId: string | null, method: string): RoutePe

    if (within(routeId, '/api/agent')) return 'machine';
    if (routeId === '/api/telemetry' && method === 'POST') return 'machine';
+    if (routeId === '/api/leaderboard' && reading) return 'public';
    if ((routeId === '/login' || routeId === '/setup') && reading) return 'public';
    if ((routeId === '/api/auth/login' || routeId === '/api/auth/setup') && method === 'POST') return 'public';
    if (routeId === '/account' || ['/api/auth/me', '/api/auth/logout', '/api/auth/password'].includes(routeId)) return 'authenticated';