jnd/beszel-ipv6
1
0
Fork 0
mirror of https://github.com/henrygd/beszel.git synced 2026-09-21 08:57:48 +02:00
Code Issues Packages Projects Releases 2 Wiki Activity

fix(hub): prevent readonly users listing tokens of their shared systems via api

Browse Source
This commit is contained in:
henrygd
2026-09-08 09:57:58 -04:00
parent 5b87f7d7cb
commit e39e153ca0
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
internal/hub/collections.go
View File

@@ -99,8 +99,8 @@ func setCollectionAuthSettings(app core.App) error {
} }
if err := applyCollectionRules(app, []string{"fingerprints"}, collectionRules{ if err := applyCollectionRules(app, []string{"fingerprints"}, collectionRules{
list: &systemScopedReadRule, list: &systemScopedWriteRule,
view: &systemScopedReadRule, view: &systemScopedWriteRule,
create: &systemScopedWriteRule, create: &systemScopedWriteRule,
update: &systemScopedWriteRule, update: &systemScopedWriteRule,
delete: &systemScopedWriteRule, delete: &systemScopedWriteRule,

8
internal/hub/collections_test.go
View File

@@ -88,8 +88,8 @@ func TestCollectionRulesDefault(t *testing.T) {
// fingerprints collection // fingerprints collection
fingerprintsCollection, err := hub.FindCollectionByNameOrId("fingerprints") fingerprintsCollection, err := hub.FindCollectionByNameOrId("fingerprints")
require.NoError(t, err, "Failed to find fingerprints collection") require.NoError(t, err, "Failed to find fingerprints collection")
assert.Equal(t, isUserInSystemUsers, *fingerprintsCollection.ListRule) assert.Equal(t, isUserInSystemUsersNotReadonly, *fingerprintsCollection.ListRule)
assert.Equal(t, isUserInSystemUsers, *fingerprintsCollection.ViewRule) assert.Equal(t, isUserInSystemUsersNotReadonly, *fingerprintsCollection.ViewRule)
assert.Equal(t, isUserInSystemUsersNotReadonly, *fingerprintsCollection.CreateRule) assert.Equal(t, isUserInSystemUsersNotReadonly, *fingerprintsCollection.CreateRule)
assert.Equal(t, isUserInSystemUsersNotReadonly, *fingerprintsCollection.UpdateRule) assert.Equal(t, isUserInSystemUsersNotReadonly, *fingerprintsCollection.UpdateRule)
assert.Equal(t, isUserInSystemUsersNotReadonly, *fingerprintsCollection.DeleteRule) assert.Equal(t, isUserInSystemUsersNotReadonly, *fingerprintsCollection.DeleteRule)
@@ -216,8 +216,8 @@ func TestCollectionRulesShareAllSystems(t *testing.T) {
// fingerprints collection // fingerprints collection
fingerprintsCollection, err := hub.FindCollectionByNameOrId("fingerprints") fingerprintsCollection, err := hub.FindCollectionByNameOrId("fingerprints")
require.NoError(t, err, "Failed to find fingerprints collection") require.NoError(t, err, "Failed to find fingerprints collection")
assert.Equal(t, isUser, *fingerprintsCollection.ListRule) assert.Equal(t, isUserNotReadonly, *fingerprintsCollection.ListRule)
assert.Equal(t, isUser, *fingerprintsCollection.ViewRule) assert.Equal(t, isUserNotReadonly, *fingerprintsCollection.ViewRule)
assert.Equal(t, isUserNotReadonly, *fingerprintsCollection.CreateRule) assert.Equal(t, isUserNotReadonly, *fingerprintsCollection.CreateRule)
assert.Equal(t, isUserNotReadonly, *fingerprintsCollection.UpdateRule) assert.Equal(t, isUserNotReadonly, *fingerprintsCollection.UpdateRule)
assert.Equal(t, isUserNotReadonly, *fingerprintsCollection.DeleteRule) assert.Equal(t, isUserNotReadonly, *fingerprintsCollection.DeleteRule)