gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-25 17:57:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(containers): guard container and port reads with stack:read (#1416)

Browse Source 
The container list, the per-container log stream, and the ports-in-use
endpoint served data with only the global auth gate, while every mutating
route on the same router already enforced a role check. Align these reads
with the read model used across the stacks router by gating each on
stack:read, so a future restricted role cannot read container output it is
not entitled to. Every current role carries stack:read, so behavior is
unchanged today; this closes the gap before a more limited role exists.

Adds an authorization test covering denial, the admitted read model, and the
guard running ahead of the log stream's header flush.
This commit is contained in:
Anso
2026-06-22 20:54:04 -04:00
committed by GitHub
parent 69ba0e6d21
commit 82cc13951b
2 changed files with 119 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/routes/containers.ts
+4
View File
@@ -2,11 +2,13 @@ import { Router, type Request, type Response } from 'express';
import DockerController from '../services/DockerController';
import { FileSystemService } from '../services/FileSystemService';
import { requireAdmin } from '../middleware/tierGates';
import { requirePermission } from '../middleware/permissions';
import { invalidateNodeCaches } from '../helpers/cacheInvalidation';
export const containersRouter = Router();
containersRouter.get('/', async (req: Request, res: Response) => {
if (!requirePermission(req, res, 'stack:read')) return;
try {
const dockerController = DockerController.getInstance(req.nodeId);
const containers = await dockerController.getRunningContainers();
@@ -17,6 +19,7 @@ containersRouter.get('/', async (req: Request, res: Response) => {
});
containersRouter.get('/:id/logs', async (req: Request, res: Response) => {
if (!requirePermission(req, res, 'stack:read')) return;
try {
const id = req.params.id as string;
const dockerController = DockerController.getInstance(req.nodeId);
@@ -68,6 +71,7 @@ containersRouter.post('/:id/restart', async (req: Request, res: Response) => {
export const portsRouter = Router();
portsRouter.get('/in-use', async (req: Request, res: Response) => {
if (!requirePermission(req, res, 'stack:read')) return;
try {
const fsService = FileSystemService.getInstance(req.nodeId);
const stacks = await fsService.getStacks();