GET /api/drift (unused by the UI) scans files on every server, and any viewer can call it.
GET /api/plugins/github/release uses up the unauthenticated GitHub API quota on any repo a viewer names.
Fix
Remove /api/drift or restrict it to operators
Restrict the GitHub release lookup to operators, limit it to known repos, and/or cache responses
- `GET /api/drift` (unused by the UI) scans files on every server, and any viewer can call it.
- `GET /api/plugins/github/release` uses up the unauthenticated GitHub API quota on any repo a viewer names.
**Fix**
- [x] Remove `/api/drift` or restrict it to operators
- [x] Restrict the GitHub release lookup to operators, limit it to known repos, and/or cache responses
Reviewed 15fb90200a. Viewers can no longer trigger drift scans or GitHub release lookups, so I'm closing this.
Checklist
Restrict /api/drift to operators.access.ts:64 makes every method on /api/drift operator-only, including GET and HEAD. No page calls it, so nothing in the UI loses access.
Restrict the GitHub release lookup to operators. The same rule covers /api/plugins/github/release. A new auth-guard.test.ts case covers both routes with GET and HEAD. Anonymous requests get 401, viewers get 403 without the handler running, and operators and admins get through. authentication.md documents the change.
Review notes
The access tests pass locally (2 files, 175 tests), and CI run 839 passed on this commit.
Minor and non-blocking: the plugin detail page and the Plugins page still show viewers the GitHub release form (PluginGithubImport.svelte:186). Submitting it now shows "Operator access is required for this action." Other pages hide operator controls with canOperate. This page could do the same.
GET /api/plugins/updates still runs GitHub lookups for viewers. That one is tracked in #98.
Reviewed 15fb90200a02c8339cd4c5e3c45a06a9a3fae0c4. Viewers can no longer trigger drift scans or GitHub release lookups, so I'm closing this.
**Checklist**
- [x] **Restrict `/api/drift` to operators.** `access.ts:64` makes every method on `/api/drift` operator-only, including GET and HEAD. No page calls it, so nothing in the UI loses access.
- [x] **Restrict the GitHub release lookup to operators.** The same rule covers `/api/plugins/github/release`. A new `auth-guard.test.ts` case covers both routes with GET and HEAD. Anonymous requests get 401, viewers get 403 without the handler running, and operators and admins get through. `authentication.md` documents the change.
**Review notes**
- The access tests pass locally (2 files, 175 tests), and CI [run 839](https://gitea.thewrightserver.net/josh/electric-cherry/actions/runs/839) passed on this commit.
- Minor and non-blocking: the plugin detail page and the Plugins page still show viewers the GitHub release form (`PluginGithubImport.svelte:186`). Submitting it now shows "Operator access is required for this action." Other pages hide operator controls with `canOperate`. This page could do the same.
- `GET /api/plugins/updates` still runs GitHub lookups for viewers. That one is tracked in #98.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
GET /api/drift(unused by the UI) scans files on every server, and any viewer can call it.GET /api/plugins/github/releaseuses up the unauthenticated GitHub API quota on any repo a viewer names.Fix
/api/driftor restrict it to operatorsReviewed
15fb90200a. Viewers can no longer trigger drift scans or GitHub release lookups, so I'm closing this.Checklist
/api/driftto operators.access.ts:64makes every method on/api/driftoperator-only, including GET and HEAD. No page calls it, so nothing in the UI loses access./api/plugins/github/release. A newauth-guard.test.tscase covers both routes with GET and HEAD. Anonymous requests get 401, viewers get 403 without the handler running, and operators and admins get through.authentication.mddocuments the change.Review notes
PluginGithubImport.svelte:186). Submitting it now shows "Operator access is required for this action." Other pages hide operator controls withcanOperate. This page could do the same.GET /api/plugins/updatesstill runs GitHub lookups for viewers. That one is tracked in #98.