Skip to content

fix(api/security): restrict history settings read to admins#58

Open
Micsi wants to merge 1 commit into
mainfrom
codex/fix-history-settings-endpoint-credential-leak
Open

fix(api/security): restrict history settings read to admins#58
Micsi wants to merge 1 commit into
mainfrom
codex/fix-history-settings-endpoint-credential-leak

Conversation

@Micsi
Copy link
Copy Markdown
Owner

@Micsi Micsi commented May 18, 2026

Motivation

  • Prevent disclosure of sensitive backend credentials (InfluxDB tokens/username/password and TimescaleDB DSN) that were returned by GET /api/v1/system/history/settings to any authenticated user.
  • Ensure consistency with the existing admin-only PUT /history/settings and POST /history/test routes.

Description

  • Require admin authorization by changing the dependency from Depends(get_current_user) to Depends(get_admin_user) on the GET /history/settings route in obs/api/v1/system.py and update the route docstring to indicate admin-only access.
  • A related route dependency was also tightened in obs/api/v1/system.py to use get_admin_user where present (keeps behavior limited to privileged callers).
  • Kept the response model and payload unchanged for authorized admin callers to preserve existing admin functionality.

Testing

  • Ran python -m py_compile obs/api/v1/system.py which completed successfully.
  • Attempted pytest -q tests/integration/test_history.py tests/integration/test_auth.py, which could not run in this environment due to a missing test dependency (pytest_asyncio).

Codex Task

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant