Restrict expensive viewer endpoints (Refs #72)

2026-10-09 16:57:22 -04:00
parent 9eb3aa84c3
commit 15fb90200a
3 changed files with 26 additions and 0 deletions
@@ -47,6 +47,11 @@ cannot save keys indirectly through a launch request. An operator's content
 permissions include executable scripts and plugins; assign that role only to
 people trusted to operate the game fleet.

+Drift previews (`/api/drift`) and GitHub release lookups
+(`/api/plugins/github/release`) require operator or administrator access, including
+`GET` and `HEAD` requests. These endpoints initiate fleet file scans or use GitHub
+API quota; viewers cannot trigger them.
+
 RCON failure replies are available only to operators and administrators in the
 server's Diagnostics tab. Player addresses are redacted before diagnostics are
 saved; successful checks clear the saved reply. Fleet snapshots and live status