Fluksio/app
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make changing engine-run code superuser-only

Browse Source 
Writing node source, installing modules and any flow save that adds,
retypes or repoints a code node (Function, Command), edits a Command
node's settings or changes a node's resources.env now answer 403 for
everyone but a superuser. MCP tools and the assistant reach the same
routes, so they inherit the gate. Node types report runs_code.

The editor shows code read-only with a note, disables a Command node's
settings, leaves code nodes and reusable nodes out of the palette and
paste, and the Modules page offers no install.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
This commit is contained in:
stroblme
2026-10-06 11:36:30 +02:00
co-authored by Claude Opus 5.5
parent de7ee759f9
commit 7370105cd8
19 changed files with 391 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/node-types.md
+1
View File
@@ -244,6 +244,7 @@ The cheapest fix for a sensor that reports every second and changes every hour.
### Command
**`exec`** — run a command in the engine's container and read its output.
Adding one or changing its settings is a superuser's, since the command is code.
| Setting | Default | Notes |
|---|---|---|