From 7f06260c1a1eb2956128de7c14484b04f60bfb58 Mon Sep 17 00:00:00 2001 From: stroblme Date: Tue, 6 Oct 2026 12:01:53 +0200 Subject: [PATCH] Read secret names in the node panel only as a superuser GET /secrets/ is a superuser's, so every node a non-superuser opened showed "You do not have permission to do that". The query now runs only for a superuser; anyone else gets no secret suggestions, silently. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ --- frontend/src/components/Flow/NodePanel.tsx | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/frontend/src/components/Flow/NodePanel.tsx b/frontend/src/components/Flow/NodePanel.tsx index a1eec1c..a49e6f6 100644 --- a/frontend/src/components/Flow/NodePanel.tsx +++ b/frontend/src/components/Flow/NodePanel.tsx @@ -815,7 +815,12 @@ function ParamsForm({ > const entries = Object.entries(properties) - const { data: secretList } = useQuery(secretsQueryOptions()) + // Secret names are a superuser's to read; anyone else has none to offer. + const { user } = useAuth() + const { data: secretList } = useQuery({ + ...secretsQueryOptions(), + enabled: Boolean(user?.is_superuser), + }) const secrets = secretList?.data ?? [] // A type with nothing to fill in has nothing to suggest, and the other flows // are not worth reading for it.