sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-19 21:29:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

Cut self-scoped provider model lists to the caller's effective set

Browse Source 
The caller-scoped provider list now reduces each provider's models
through the same effective computation the setup answer and the proxy
use: allowlist guardrails intersected with the operator's declared
models, with bare entries synthesized when the operator declared none.
The dashboard's model filter therefore never offers a self-scoped caller
a model their own requests could not use. Grant holders keep the full
declared lists — their usage view spans everyone's requests, and their
own setup page already answers with the caller-scoped effective set.
This commit is contained in:
mlsmaycon
2026-08-27 12:10:05 +00:00
parent 5294f5be35
commit 9286c58ed2
4 changed files with 111 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
agent-network/README.md
+5 -2
View File
@@ -124,8 +124,11 @@ more). The regular usage and access-log endpoints self-scope instead of denying:
a caller without the account-wide grant gets their own rows back, so "my usage"
and "my requests" are the same endpoints the admin dashboard uses. The provider
list self-scopes the same way — a caller without the providers grant gets the
providers their own policies authorize, reduced to the display surface, which
is what feeds the dashboard's provider filter. Role
providers their own policies authorize, reduced to the display surface, with
each provider's model list cut to what the caller's policy guardrails and the
provider's declared models effectively permit (the same computation the setup
answer and the proxy use). This feeds the dashboard's provider and model
filters. Role
definitions live in
[`management/server/permissions/roles/`](../management/server/permissions/roles).