Restrict raw beta file downloads to operators

2026-10-05 23:27:41 -04:00
parent f8ac2436b5
commit d6ff59b129
3 changed files with 13 additions and 0 deletions
@@ -39,6 +39,7 @@ export function routePermission(routeId: string | null, method: string): RoutePe
    // bytes, and unfiltered diagnostics may contain runtime credentials.
    if (routeId === '/configs/[id]' || routeId === '/api/configs/[id]' || routeId === '/api/configs/inspect'
        || routeId === '/api/campaigns/[id]/file/[fileId]' || routeId === '/api/deployments/[id]/file/[fileId]'
+        || routeId === '/api/betas/[id]/revisions/[revision]/files/[scriptId]'
        || routeId === '/api/servers/[name]/logs/[file]' || routeId === '/api/servers/[name]/telemetry-requests') return 'operator';

    return reading ? 'viewer' : 'operator';