Restrict fleet settings reads to administrators (Refs #99)

2026-10-09 15:33:34 -04:00
parent 967b2a1c8a
commit 8ed059b8d3
3 changed files with 17 additions and 5 deletions
@@ -142,6 +142,15 @@ describe('browser authentication guard', () => {
        if (expectedStatus === 200) { expect(call.resolve).toHaveBeenCalledOnce(); expect(call.event.locals.user).toEqual(session.user); }
        else expect(call.resolve).not.toHaveBeenCalled();
    });
+    it.each(['GET', 'HEAD'])('restricts global settings %s requests to administrators', async method => {
+        for (const role of ['viewer', 'operator', 'admin'] as const) {
+            signIn(role);
+            const call = requestFor('/api/settings', { method });
+            expect((await call.invoke()).status).toBe(role === 'admin' ? 200 : 403);
+            if (role === 'admin') expect(call.resolve).toHaveBeenCalledOnce();
+            else expect(call.resolve).not.toHaveBeenCalled();
+        }
+    });
    it.each(['GET', 'HEAD'])('restricts raw beta file %s requests to operators and administrators', async method => {
        for (const role of ['viewer', 'operator', 'admin'] as const) {
            signIn(role);