Read secret names in the node panel only as a superuser
GET /secrets/ is a superuser's, so every node a non-superuser opened showed "You do not have permission to do that". The query now runs only for a superuser; anyone else gets no secret suggestions, silently.
This commit is contained in:
@@ -815,7 +815,12 @@ function ParamsForm({
|
||||
>
|
||||
const entries = Object.entries(properties)
|
||||
|
||||
const { data: secretList } = useQuery(secretsQueryOptions())
|
||||
// Secret names are a superuser's to read; anyone else has none to offer.
|
||||
const { user } = useAuth()
|
||||
const { data: secretList } = useQuery({
|
||||
...secretsQueryOptions(),
|
||||
enabled: Boolean(user?.is_superuser),
|
||||
})
|
||||
const secrets = secretList?.data ?? []
|
||||
// A type with nothing to fill in has nothing to suggest, and the other flows
|
||||
// are not worth reading for it.
|
||||
|
||||
Reference in New Issue
Block a user