Alerts: configuration, test and search entries are a superuser's; subscribing a browser stays open

Any signed-in account could save an ntfy channel with its own `server` and a `{"$secret": ...}` token and press Test, which sent the stored secret to that host. The config GET/PUT, the test route and the global search's alert entries now answer to superusers, like /secrets. The webpush key and subscribe routes stay open to every account, and the Alerts page shows a non-superuser only the button for its own browser. The events table in the docs gains run_finished.
2026-10-28 12:40:44 +01:00
parent 29f4d93c2a
commit 2dc20911a3
8 changed files with 153 additions and 14 deletions
@@ -2975,7 +2975,8 @@ export class SearchService {
     * instance of any ordinary size, so one fetch when the panel opens beats a
     * round trip per keystroke — and the client already has a matcher.
     *
-     * Secrets are named only to a superuser, which is who ``/secrets`` answers to.
+     * Secrets and alert channels are named only to a superuser, which is who
+     * ``/secrets`` and ``/alerts`` answer to.
     * @returns SearchEntry Successful Response
     * @throws ApiError
     */