Read secret names in the node panel only as a superuser

GET /secrets/ is a superuser's, so every node a non-superuser opened
showed "You do not have permission to do that". The query now runs only
for a superuser; anyone else gets no secret suggestions, silently.
This commit is contained in:
2026-10-06 12:01:53 +02:00
parent a168bcbdee
commit 8e928c3ffb
+6 -1
View File
@@ -815,7 +815,12 @@ function ParamsForm({
>
const entries = Object.entries(properties)
const { data: secretList } = useQuery(secretsQueryOptions())
// Secret names are a superuser's to read; anyone else has none to offer.
const { user } = useAuth()
const { data: secretList } = useQuery({
...secretsQueryOptions(),
enabled: Boolean(user?.is_superuser),
})
const secrets = secretList?.data ?? []
// A type with nothing to fill in has nothing to suggest, and the other flows
// are not worth reading for it.