FelisMC/Felis
2
0 Fork 0
Code Issues Pull Requests 6 Actions Packages Projects Releases Wiki Activity

fix: restrict platform maintenance and backup visibility to Owner

Browse Source
This commit is contained in:
Lemon-miaow committed 2026-10-07 16:47:57 +08:00
1 parent 285c56955d
commit 07973a4bbd
9 files changed
+68 -55
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

panel/dev/mockApi.ts
+8 -8
View File
@@ -1073,8 +1073,8 @@ async function handleSession(ctx: SessionContext): Promise<boolean> {
sendJSON(ctx.res, 200, { sources: [{ tag: "mojang", prefix: "", lookup_available: true }, ...ctx.state.authSources.sources.filter((source) => source.enabled).map((source) => ({ tag: source.tag, prefix: source.prefix, lookup_available: !!source.api_url || source.url.endsWith("/sessionserver/session/minecraft/hasJoined") }))] });
return true;
case "GET platform/db-backup": {
if (!isAdmin(ctx.account.role)) {
sendError(ctx.res, 403, "forbidden", "admin account required");
if (ctx.account.role !== "owner") {
sendError(ctx.res, 403, "forbidden", "owner account required");
return true;
}
// Yesterday's daily run: fresh, so the card shows its healthy state.
@@ -1097,8 +1097,8 @@ async function handleSession(ctx: SessionContext): Promise<boolean> {
return true;
}
case "GET updates/report": {
if (!isAdmin(ctx.account.role)) {
sendError(ctx.res, 403, "forbidden", "admin account required");
if (ctx.account.role !== "owner") {
sendError(ctx.res, 403, "forbidden", "owner account required");
return true;
}
// Last night's timer run: one update waiting, one feed unreachable, one
@@ -1122,15 +1122,15 @@ async function handleSession(ctx: SessionContext): Promise<boolean> {
return true;
}
case "GET updates/window":
if (!isAdmin(ctx.account.role)) {
sendError(ctx.res, 403, "forbidden", "admin account required");
if (ctx.account.role !== "owner") {
sendError(ctx.res, 403, "forbidden", "owner account required");
return true;
}
sendJSON(ctx.res, 200, ctx.state.updateWindow);
return true;
case "PUT updates/window": {
if (!isAdmin(ctx.account.role)) {
sendError(ctx.res, 403, "forbidden", "admin account required");
if (ctx.account.role !== "owner") {
sendError(ctx.res, 403, "forbidden", "owner account required");
return true;
}
const body = await readJSON<{ start: string | null; end: string | null }>(ctx.req);