mirror of
https://github.com/we-promise/sure.git
synced 2026-07-27 12:12:13 +00:00
f8615f0e9c
The "Advanced" settings section is gated to admins in the navigation, but the controllers exposing family-wide data performed no server-side authorization — any authenticated user could reach them by navigating directly to the URL. Add `before_action :require_admin!` to the controllers that expose family-wide data: - Settings::AiPromptsController (family AI assistant config) - Settings::LlmUsagesController (family LLM usage/billing) This mirrors the existing guards on Settings::ProvidersController and Settings::HostingsController. Non-admins are redirected with the standard "Only admins can perform this action" message (403 for turbo_stream/json). API key and MCP token management are intentionally left open: both are user-scoped self-management. Their actions are already scoped to Current.user, and any signed-in user (not just admins) can create an API key or authorize an MCP client, so gating them would leave members unable to view or revoke their own credentials. Adds controller tests covering admin-only access for the family-wide pages (member and guest rejected) and member self-service access for the API key and MCP pages.