Restrict raw beta file downloads to operators

2026-10-05 23:27:41 -04:00
parent f8ac2436b5
commit d6ff59b129
3 changed files with 13 additions and 0 deletions
@@ -125,6 +125,17 @@ describe('browser authentication guard', () => {
        if (expectedStatus === 200) { expect(call.resolve).toHaveBeenCalledOnce(); expect(call.event.locals.user).toEqual(session.user); }
        else expect(call.resolve).not.toHaveBeenCalled();
    });
+    it.each(['GET', 'HEAD'])('restricts raw beta file %s requests to operators and administrators', async method => {
+        for (const role of ['viewer', 'operator', 'admin'] as const) {
+            signIn(role);
+            const call = requestFor('/api/betas/[id]/revisions/[revision]/files/[scriptId]', {
+                method, path: '/api/betas/1/revisions/1/files/1'
+            });
+            expect((await call.invoke()).status).toBe(role === 'viewer' ? 403 : 200);
+            if (role === 'viewer') expect(call.resolve).not.toHaveBeenCalled();
+            else expect(call.resolve).toHaveBeenCalledOnce();
+        }
+    });
    it('requires temporary-password users to change it even if their role is administrator', async () => {
        signIn('admin', true);
        await expect(requestFor('/settings').invoke()).rejects.toMatchObject({ status: 303, location: '/account' });