josh/electric-cherry
1
0
Fork 0
Code Issues 18 Pull Requests Actions Packages Projects Releases Wiki Activity

Restrict fleet settings reads to administrators (Refs #99)

Browse Source
This commit is contained in:
josh
2026-10-09 15:33:34 -04:00
parent 967b2a1c8a
commit 8ed059b8d3
3 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/lib/server/auth/access.ts
+2 -3
View File
@@ -25,11 +25,10 @@ export function routePermission(routeId: string | null, method: string): RoutePe
if ((routeId === '/api/auth/login' || routeId === '/api/auth/setup') && method === 'POST') return 'public';
if (routeId === '/account' || ['/api/auth/me', '/api/auth/logout', '/api/auth/password'].includes(routeId)) return 'authenticated';
if (within(routeId, '/api/users') || within(routeId, '/settings') || within(routeId, '/api/auth')
if (within(routeId, '/api/users') || within(routeId, '/settings') || within(routeId, '/api/settings') || within(routeId, '/api/auth')
|| within(routeId, '/api/server-keys') || within(routeId, '/server-keys') || within(routeId, '/keys')) return 'admin';
if (!reading && ['/api/hosts', '/api/settings', '/api/game-files'].some(base => within(routeId, base))) return 'admin';
if (within(routeId, '/api/settings/retention')) return 'admin';
if (!reading && ['/api/hosts', '/api/game-files'].some(base => within(routeId, base))) return 'admin';
if (routeId === '/api/provisioning/[id]/override') return 'admin';
// These endpoints mix operational actions with global policy and schedule
// changes. Per-incident/job actions remain available to operators.