External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: enforce settings authority boundaries (#618)

Browse Source 
Close generic settings authorization bypasses and enforce per-setting authority, validation, redaction, transactional config import, and route-local write rate limiting.
This commit is contained in:
SnapOtter
2026-07-22 20:15:38 +08:00
committed by GitHub
parent 0467e87bfe
commit 44d8109486
63 changed files with 2287 additions and 731 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/e2e/rbac.spec.ts
+2 -2
View File
@@ -176,7 +176,7 @@ base.describe("RBAC - User sees restricted tabs", () => {
const settingsRes = await fetch(`${API}/api/v1/settings`, {
method: "PUT",
headers: authJson(bearerToken),
body: JSON.stringify({ testSetting: "hacked" }),
body: JSON.stringify({ defaultTheme: "dark" }),
});
expect(settingsRes.status).toBe(403);
});
@@ -278,7 +278,7 @@ base.describe("RBAC - Editor sees collaborative tabs", () => {
const settingsRes = await fetch(`${API}/api/v1/settings`, {
method: "PUT",
headers: authJson(token as string),
body: JSON.stringify({ testSetting: "hacked" }),
body: JSON.stringify({ defaultTheme: "dark" }),
});
expect(settingsRes.status).toBe(403);
});