josh/electric-cherry
1
0
Fork 0
Code Issues 18 Pull Requests Actions Packages Projects Releases Wiki Activity

Restrict fleet settings reads to administrators (Refs #99)

Browse Source
This commit is contained in:
josh
2026-10-09 15:33:34 -04:00
parent 967b2a1c8a
commit 8ed059b8d3
3 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unit/auth-access.test.ts
+6 -2
View File
@@ -39,7 +39,11 @@ describe('management route permissions', () => {
expect(allows('admin', route, method)).toBe(true);
});
it.each(['/api/users', '/api/users/[id]', '/api/users/[id]/password', '/settings', '/settings/users', '/server-keys', '/keys', '/api/server-keys', '/api/provisioning/[id]/override'])('reserves all methods on %s for administrators', route => {
it.each([
'/api/users', '/api/users/[id]', '/api/users/[id]/password', '/settings', '/settings/users',
'/api/settings', '/api/settings/retention', '/api/settings/retention/preview',
'/server-keys', '/keys', '/api/server-keys', '/api/provisioning/[id]/override'
])('reserves all methods on %s for administrators', route => {
for (const method of ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE']) {
expect(routePermission(route, method)).toBe('admin');
expect(allows('viewer', route, method)).toBe(false);
@@ -51,7 +55,7 @@ describe('management route permissions', () => {
it.each([
['/api/hosts', 'POST'], ['/api/hosts/[id]', 'PATCH'], ['/api/hosts/[id]', 'DELETE'], ['/api/hosts/[id]/enrollment', 'POST'],
['/api/hosts/[id]/credentials', 'DELETE'], ['/api/hosts/[id]/credentials', 'POST'],
['/api/hosts/[id]/operations', 'POST'], ['/api/settings', 'PUT'], ['/api/game-files', 'POST'],
['/api/hosts/[id]/operations', 'POST'], ['/api/game-files', 'POST'],
['/api/game-files/[id]/download', 'POST'], ['/api/game-files/[id]/upload/files/[...path]', 'PUT'],
['/api/game-files/[id]/upload/complete', 'POST'], ['/api/maintenance', 'POST'], ['/api/watchdog', 'POST'], ['/api/plutonium', 'POST']
])('protects host, game-file, and global policy mutations at %s', (route, method) => {
tests/unit/auth-guard.test.ts
+9
View File
@@ -142,6 +142,15 @@ describe('browser authentication guard', () => {
if (expectedStatus === 200) { expect(call.resolve).toHaveBeenCalledOnce(); expect(call.event.locals.user).toEqual(session.user); }
else expect(call.resolve).not.toHaveBeenCalled();
});
it.each(['GET', 'HEAD'])('restricts global settings %s requests to administrators', async method => {
for (const role of ['viewer', 'operator', 'admin'] as const) {
signIn(role);
const call = requestFor('/api/settings', { method });
expect((await call.invoke()).status).toBe(role === 'admin' ? 200 : 403);
if (role === 'admin') expect(call.resolve).toHaveBeenCalledOnce();
else expect(call.resolve).not.toHaveBeenCalled();
}
});
it.each(['GET', 'HEAD'])('restricts raw beta file %s requests to operators and administrators', async method => {
for (const role of ['viewer', 'operator', 'admin'] as const) {
signIn(role);