josh/electric-cherry
1
0
Fork 0
Code Issues 18 Pull Requests Actions Packages Projects Releases Wiki Activity

Restrict fleet settings reads to administrators (Refs #99)

Browse Source
This commit is contained in:
josh
2026-10-09 15:33:34 -04:00
parent 967b2a1c8a
commit 8ed059b8d3
3 changed files with 17 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unit/auth-access.test.ts
+6 -2
View File
@@ -39,7 +39,11 @@ describe('management route permissions', () => {
expect(allows('admin', route, method)).toBe(true);
});
it.each(['/api/users', '/api/users/[id]', '/api/users/[id]/password', '/settings', '/settings/users', '/server-keys', '/keys', '/api/server-keys', '/api/provisioning/[id]/override'])('reserves all methods on %s for administrators', route => {
it.each([
'/api/users', '/api/users/[id]', '/api/users/[id]/password', '/settings', '/settings/users',
'/api/settings', '/api/settings/retention', '/api/settings/retention/preview',
'/server-keys', '/keys', '/api/server-keys', '/api/provisioning/[id]/override'
])('reserves all methods on %s for administrators', route => {
for (const method of ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE']) {
expect(routePermission(route, method)).toBe('admin');
expect(allows('viewer', route, method)).toBe(false);
@@ -51,7 +55,7 @@ describe('management route permissions', () => {
it.each([
['/api/hosts', 'POST'], ['/api/hosts/[id]', 'PATCH'], ['/api/hosts/[id]', 'DELETE'], ['/api/hosts/[id]/enrollment', 'POST'],
['/api/hosts/[id]/credentials', 'DELETE'], ['/api/hosts/[id]/credentials', 'POST'],
['/api/hosts/[id]/operations', 'POST'], ['/api/settings', 'PUT'], ['/api/game-files', 'POST'],
['/api/hosts/[id]/operations', 'POST'], ['/api/game-files', 'POST'],
['/api/game-files/[id]/download', 'POST'], ['/api/game-files/[id]/upload/files/[...path]', 'PUT'],
['/api/game-files/[id]/upload/complete', 'POST'], ['/api/maintenance', 'POST'], ['/api/watchdog', 'POST'], ['/api/plutonium', 'POST']
])('protects host, game-file, and global policy mutations at %s', (route, method) => {