mirror of
https://github.com/we-promise/sure.git
synced 2026-07-27 20:22:16 +00:00
f8615f0e9c
The "Advanced" settings section is gated to admins in the navigation, but the controllers exposing family-wide data performed no server-side authorization — any authenticated user could reach them by navigating directly to the URL. Add `before_action :require_admin!` to the controllers that expose family-wide data: - Settings::AiPromptsController (family AI assistant config) - Settings::LlmUsagesController (family LLM usage/billing) This mirrors the existing guards on Settings::ProvidersController and Settings::HostingsController. Non-admins are redirected with the standard "Only admins can perform this action" message (403 for turbo_stream/json). API key and MCP token management are intentionally left open: both are user-scoped self-management. Their actions are already scoped to Current.user, and any signed-in user (not just admins) can create an API key or authorize an MCP client, so gating them would leave members unable to view or revoke their own credentials. Adds controller tests covering admin-only access for the family-wide pages (member and guest rejected) and member self-service access for the API key and MCP pages.
24 lines
697 B
Ruby
24 lines
697 B
Ruby
require "test_helper"
|
|
|
|
class Settings::LlmUsagesControllerTest < ActionDispatch::IntegrationTest
|
|
test "admin can view family LLM usage" do
|
|
sign_in users(:family_admin)
|
|
get settings_llm_usage_path
|
|
assert_response :success
|
|
end
|
|
|
|
test "non-admin member cannot view family LLM usage" do
|
|
sign_in users(:family_member)
|
|
get settings_llm_usage_path
|
|
assert_redirected_to accounts_path
|
|
assert_equal I18n.t("shared.require_admin"), flash[:alert]
|
|
end
|
|
|
|
test "guest cannot view family LLM usage" do
|
|
sign_in users(:intro_user)
|
|
get settings_llm_usage_path
|
|
assert_redirected_to accounts_path
|
|
assert_equal I18n.t("shared.require_admin"), flash[:alert]
|
|
end
|
|
end
|