Restrict raw beta file downloads to operators

2026-10-05 23:27:41 -04:00
parent f8ac2436b5
commit d6ff59b129
3 changed files with 13 additions and 0 deletions
@@ -61,6 +61,7 @@ describe('management route permissions', () => {
    it.each([
        '/configs/[id]', '/api/configs/[id]', '/api/configs/inspect',
        '/api/campaigns/[id]/file/[fileId]', '/api/deployments/[id]/file/[fileId]',
+        '/api/betas/[id]/revisions/[revision]/files/[scriptId]',
        '/api/servers/[name]/logs/[file]', '/api/servers/[name]/telemetry-requests'
    ])('prevents viewer access to secret-bearing raw content at %s', route => {
        for (const method of ['GET', 'HEAD']) {