From b4366176e1280320857100fe312ee1e4f212f535 Mon Sep 17 00:00:00 2001 From: "GL.iNet-Yongping.Xie" Date: Wed, 14 Oct 2026 00:38:39 -0700 Subject: [PATCH] fix(api): limit script-info to users who may add devices The endpoint returns the device registration token and the TURN credentials, but only required a login. Gate it on device.write, which is what the "add device" entry in the UI already checks. Signed-off-by: GL.iNet-Yongping.Xie --- internal/http/router.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/internal/http/router.go b/internal/http/router.go index be442e9..f27f8ba 100755 --- a/internal/http/router.go +++ b/internal/http/router.go @@ -71,8 +71,8 @@ func RegisterAPIRoutes(r *gin.Engine, d Deps) { api := r.Group("/api") api.Use(middleware.Auth(d.SessionStore, d.UserSvc, d.PermSvc)) - // device script info (requires login) - api.GET("/script-info", func(c *gin.Context) { + // device script info (admin only: it returns the device token and TURN credentials) + api.GET("/script-info", middleware.Require(permission.DeviceWrite), func(c *gin.Context) { traceID := middleware.GetTraceID(c) // Get domain info