gsadmin/pulse
1
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-09-24 12:13:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Require proxy admin for SSH config endpoints

Browse Source
This commit is contained in:
rcourtman
2026-02-04 15:57:59 +00:00
parent 145e5c46bb
commit 5f2990deec
2 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/api/router.go
+24
View File
@@ -1902,6 +1902,18 @@ func (r *Router) handleVerifyTemperatureSSH(w http.ResponseWriter, req *http.Req
return
}
// Check admin privileges for proxy auth users
if r.config.ProxyAuthSecret != "" {
if valid, username, isAdmin := CheckProxyAuth(r.config, req); valid && !isAdmin {
log.Warn().
Str("ip", GetClientIP(req)).
Str("username", username).
Msg("Non-admin user attempted verify-temperature-ssh")
http.Error(w, "Admin privileges required", http.StatusForbidden)
return
}
}
// Require settings:write scope for API tokens (SSH probes are a privileged operation)
if !ensureScope(w, req, config.ScopeSettingsWrite) {
return
@@ -1943,6 +1955,18 @@ func (r *Router) handleSSHConfig(w http.ResponseWriter, req *http.Request) {
return
}
// Check admin privileges for proxy auth users
if r.config.ProxyAuthSecret != "" {
if valid, username, isAdmin := CheckProxyAuth(r.config, req); valid && !isAdmin {
log.Warn().
Str("ip", GetClientIP(req)).
Str("username", username).
Msg("Non-admin user attempted ssh-config update")
http.Error(w, "Admin privileges required", http.StatusForbidden)
return
}
}
// Require settings:write scope for API tokens (SSH config writes are a privileged operation)
if !ensureScope(w, req, config.ScopeSettingsWrite) {
return
internal/api/security_regression_test.go
+2
View File
@@ -1948,6 +1948,8 @@ func TestProxyAuthNonAdminDeniedAdminEndpoints(t *testing.T) {
{method: http.MethodPost, path: "/api/security/reset-lockout", body: `{}`},
{method: http.MethodPost, path: "/api/security/apply-restart", body: `{}`},
{method: http.MethodPost, path: "/api/security/oidc", body: `{}`},
{method: http.MethodPost, path: "/api/system/verify-temperature-ssh", body: `{}`},
{method: http.MethodPost, path: "/api/system/ssh-config", body: `{}`},
{method: http.MethodGet, path: "/api/ai/debug/context", body: ""},
{method: http.MethodPost, path: "/api/ai/execute", body: `{}`},
{method: http.MethodPost, path: "/api/ai/execute/stream", body: `{}`},