mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-03 07:28:15 +00:00
Anso
82cc13951b
The container list, the per-container log stream, and the ports-in-use endpoint served data with only the global auth gate, while every mutating route on the same router already enforced a role check. Align these reads with the read model used across the stacks router by gating each on stack:read, so a future restricted role cannot read container output it is not entitled to. Every current role carries stack:read, so behavior is unchanged today; this closes the gap before a more limited role exists. Adds an authorization test covering denial, the admitted read model, and the guard running ahead of the log stream's header flush.