From e39e153ca01fc5225b31e0e97da36843c9284426 Mon Sep 17 00:00:00 2001 From: henrygd Date: Tue, 8 Sep 2026 09:57:58 -0400 Subject: [PATCH] fix(hub): prevent readonly users listing tokens of their shared systems via api --- internal/hub/collections.go | 4 ++-- internal/hub/collections_test.go | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/internal/hub/collections.go b/internal/hub/collections.go index eb88da62..667f4bf8 100644 --- a/internal/hub/collections.go +++ b/internal/hub/collections.go @@ -99,8 +99,8 @@ func setCollectionAuthSettings(app core.App) error { } if err := applyCollectionRules(app, []string{"fingerprints"}, collectionRules{ - list: &systemScopedReadRule, - view: &systemScopedReadRule, + list: &systemScopedWriteRule, + view: &systemScopedWriteRule, create: &systemScopedWriteRule, update: &systemScopedWriteRule, delete: &systemScopedWriteRule, diff --git a/internal/hub/collections_test.go b/internal/hub/collections_test.go index 0bbf0604..969b2782 100644 --- a/internal/hub/collections_test.go +++ b/internal/hub/collections_test.go @@ -88,8 +88,8 @@ func TestCollectionRulesDefault(t *testing.T) { // fingerprints collection fingerprintsCollection, err := hub.FindCollectionByNameOrId("fingerprints") require.NoError(t, err, "Failed to find fingerprints collection") - assert.Equal(t, isUserInSystemUsers, *fingerprintsCollection.ListRule) - assert.Equal(t, isUserInSystemUsers, *fingerprintsCollection.ViewRule) + assert.Equal(t, isUserInSystemUsersNotReadonly, *fingerprintsCollection.ListRule) + assert.Equal(t, isUserInSystemUsersNotReadonly, *fingerprintsCollection.ViewRule) assert.Equal(t, isUserInSystemUsersNotReadonly, *fingerprintsCollection.CreateRule) assert.Equal(t, isUserInSystemUsersNotReadonly, *fingerprintsCollection.UpdateRule) assert.Equal(t, isUserInSystemUsersNotReadonly, *fingerprintsCollection.DeleteRule) @@ -216,8 +216,8 @@ func TestCollectionRulesShareAllSystems(t *testing.T) { // fingerprints collection fingerprintsCollection, err := hub.FindCollectionByNameOrId("fingerprints") require.NoError(t, err, "Failed to find fingerprints collection") - assert.Equal(t, isUser, *fingerprintsCollection.ListRule) - assert.Equal(t, isUser, *fingerprintsCollection.ViewRule) + assert.Equal(t, isUserNotReadonly, *fingerprintsCollection.ListRule) + assert.Equal(t, isUserNotReadonly, *fingerprintsCollection.ViewRule) assert.Equal(t, isUserNotReadonly, *fingerprintsCollection.CreateRule) assert.Equal(t, isUserNotReadonly, *fingerprintsCollection.UpdateRule) assert.Equal(t, isUserNotReadonly, *fingerprintsCollection.DeleteRule)