Restrict expensive viewer endpoints (Refs #72)

2026-10-09 16:57:22 -04:00
parent 9eb3aa84c3
commit 15fb90200a
3 changed files with 26 additions and 0 deletions
@@ -272,6 +272,24 @@ describe('browser authentication guard', () => {
            }
        }
    );
+    it.each([
+        ['GET', '/api/drift'],
+        ['HEAD', '/api/drift'],
+        ['GET', '/api/plugins/github/release'],
+        ['HEAD', '/api/plugins/github/release']
+    ])('restricts expensive %s %s requests before handler execution', async (method, route) => {
+        const anonymous = requestFor(route, { method, cookie: null });
+        expect((await anonymous.invoke()).status).toBe(401);
+        expect(anonymous.resolve).not.toHaveBeenCalled();
+
+        for (const role of ['viewer', 'operator', 'admin'] as const) {
+            signIn(role);
+            const call = requestFor(route, { method });
+            expect((await call.invoke()).status).toBe(role === 'viewer' ? 403 : 200);
+            if (role === 'viewer') expect(call.resolve).not.toHaveBeenCalled();
+            else expect(call.resolve).toHaveBeenCalledOnce();
+        }
+    });
    it('requires temporary-password users to change it even if their role is administrator', async () => {
        signIn('admin', true);
        await expect(requestFor('/settings').invoke()).rejects.toMatchObject({