From 8e928c3ffb3ffec06c40fcc2ee621aa08509e5a5 Mon Sep 17 00:00:00 2001 From: stroblme Date: Tue, 6 Oct 2026 12:01:53 +0200 Subject: [PATCH] Read secret names in the node panel only as a superuser GET /secrets/ is a superuser's, so every node a non-superuser opened showed "You do not have permission to do that". The query now runs only for a superuser; anyone else gets no secret suggestions, silently. --- frontend/src/components/Flow/NodePanel.tsx | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/frontend/src/components/Flow/NodePanel.tsx b/frontend/src/components/Flow/NodePanel.tsx index a1eec1c..a49e6f6 100644 --- a/frontend/src/components/Flow/NodePanel.tsx +++ b/frontend/src/components/Flow/NodePanel.tsx @@ -815,7 +815,12 @@ function ParamsForm({ > const entries = Object.entries(properties) - const { data: secretList } = useQuery(secretsQueryOptions()) + // Secret names are a superuser's to read; anyone else has none to offer. + const { user } = useAuth() + const { data: secretList } = useQuery({ + ...secretsQueryOptions(), + enabled: Boolean(user?.is_superuser), + }) const secrets = secretList?.data ?? [] // A type with nothing to fill in has nothing to suggest, and the other flows // are not worth reading for it.