Any viewer can read the global fleet settings, but the docs say only administrators can.
access.ts:31 restricts only non-GET /api/settings to admins, so GET falls through to viewer access.
settings/+server.ts:5 returns fleetSettings().
Its only caller is the admin-only settings page (settings/+page.svelte:15).
authentication.md:41 gives viewers and operators "No" for global settings. The data is only retention days and concurrency limits (fleet-settings.ts:1-37), so nothing secret leaks.
Fix
Make GET /api/settings admin-only in access.ts, or change the docs table to match
Any viewer can read the global fleet settings, but the docs say only administrators can.
- `access.ts:31` restricts only non-GET `/api/settings` to admins, so GET falls through to viewer access.
- `settings/+server.ts:5` returns `fleetSettings()`.
- Its only caller is the admin-only settings page (`settings/+page.svelte:15`).
`authentication.md:41` gives viewers and operators "No" for global settings. The data is only retention days and concurrency limits (`fleet-settings.ts:1-37`), so nothing secret leaks.
**Fix**
- Make GET `/api/settings` admin-only in `access.ts`, or change the docs table to match
Reviewed 8ed059b8d3. GET /api/settings is now admin-only and the docs table matches, so I'm closing this.
Checklist
Make GET /api/settings admin-only.access.ts:47 now reserves every method under /api/settings for administrators, and the non-GET rule no longer lists it. The separate /api/settings/retention rule was redundant, so removing it is safe. auth-access.test.ts checks all six methods on /api/settings, /api/settings/retention and /api/settings/retention/preview. A new auth-guard.test.ts case shows viewers and operators get 403 on GET and HEAD, while admins get through.
Review notes
The only browser callers are settings/+page.svelte, SettingsEditor.svelte and RetentionTools.svelte, and all three are used only on the admin-only /settings page, so no page loses access. authentication.md:41 now matches the code.
The 2 affected test files pass locally (171 tests), and the full suite at HEAD passes (208 files, 2,629 tests).
Minor and non-blocking: settings.md:10 still says settings are "writable only by administrators". Reads are admin-only now too.
Reviewed 8ed059b8d360f2bf599d524f9249d42a1fedb2c2. GET `/api/settings` is now admin-only and the docs table matches, so I'm closing this.
**Checklist**
- [x] **Make GET `/api/settings` admin-only.** `access.ts:47` now reserves every method under `/api/settings` for administrators, and the non-GET rule no longer lists it. The separate `/api/settings/retention` rule was redundant, so removing it is safe. `auth-access.test.ts` checks all six methods on `/api/settings`, `/api/settings/retention` and `/api/settings/retention/preview`. A new `auth-guard.test.ts` case shows viewers and operators get 403 on GET and HEAD, while admins get through.
**Review notes**
- The only browser callers are `settings/+page.svelte`, `SettingsEditor.svelte` and `RetentionTools.svelte`, and all three are used only on the admin-only `/settings` page, so no page loses access. `authentication.md:41` now matches the code.
- The 2 affected test files pass locally (171 tests), and the full suite at HEAD passes (208 files, 2,629 tests).
- Minor and non-blocking: `settings.md:10` still says settings are "writable only by administrators". Reads are admin-only now too.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Any viewer can read the global fleet settings, but the docs say only administrators can.
access.ts:31restricts only non-GET/api/settingsto admins, so GET falls through to viewer access.settings/+server.ts:5returnsfleetSettings().settings/+page.svelte:15).authentication.md:41gives viewers and operators "No" for global settings. The data is only retention days and concurrency limits (fleet-settings.ts:1-37), so nothing secret leaks.Fix
/api/settingsadmin-only inaccess.ts, or change the docs table to matchReviewed
8ed059b8d3. GET/api/settingsis now admin-only and the docs table matches, so I'm closing this.Checklist
/api/settingsadmin-only.access.ts:47now reserves every method under/api/settingsfor administrators, and the non-GET rule no longer lists it. The separate/api/settings/retentionrule was redundant, so removing it is safe.auth-access.test.tschecks all six methods on/api/settings,/api/settings/retentionand/api/settings/retention/preview. A newauth-guard.test.tscase shows viewers and operators get 403 on GET and HEAD, while admins get through.Review notes
settings/+page.svelte,SettingsEditor.svelteandRetentionTools.svelte, and all three are used only on the admin-only/settingspage, so no page loses access.authentication.md:41now matches the code.settings.md:10still says settings are "writable only by administrators". Reads are admin-only now too.