Restrict plugin lookups and reuse cached chat reads (Refs #98)

2026-10-17 10:31:13 -04:00
parent b9bc897d6e
commit f3b9699317
8 changed files with 311 additions and 10 deletions
@@ -82,7 +82,7 @@ describe('management route permissions', () => {
        expect(allows('super_viewer', '/api/settings/retention/preview', 'POST')).toBe(true);
        expect(allows('operator', '/api/settings/retention/preview', 'POST')).toBe(false);
        expect(allows('super_viewer', '/api/settings/retention', 'POST')).toBe(false);
-        for (const route of ['/api/drift', '/api/plugins/github/release'])
+        for (const route of ['/api/drift', '/api/plugins/github/release', '/api/plugins/updates'])
            for (const method of ['GET', 'HEAD'])
                expect(allows('super_viewer', route, method)).toBe(false);
    });