sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-07 07:21:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Self-scope the provider list for callers without the read grant

Browse Source 
The providers endpoints now fall back to the caller's own authorized
providers instead of denying, mirroring the usage and log endpoints: a
plain user gets the providers their policies reference — the same
selection the self-service setup answer derives from, now shared through
authorizedProvidersForGroups — reduced to the display surface. A single
provider outside that scope answers not-found, indistinguishable from a
nonexistent one. This feeds the dashboard's provider and model filters on
the self-scoped Usage & Logs view.
This commit is contained in:
mlsmaycon
2026-08-27 10:13:17 +00:00
parent f263b540b5
commit fc15704fbc
4 changed files with 204 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
agent-network/README.md
View File

@@ -122,7 +122,10 @@ self-service endpoint `GET /api/agent-network/me/setup` (the endpoint, providers
and models the caller's own policies allow — what a local AI tool needs and nothing
more). The regular usage and access-log endpoints self-scope instead of denying:
a caller without the account-wide grant gets their own rows back, so "my usage"
and "my requests" are the same endpoints the admin dashboard uses. Role
and "my requests" are the same endpoints the admin dashboard uses. The provider
list self-scopes the same way — a caller without the providers grant gets the
providers their own policies authorize, reduced to the display surface, which
is what feeds the dashboard's provider filter. Role
definitions live in
[`management/server/permissions/roles/`](../management/server/permissions/roles).