mirror of
https://github.com/netbirdio/netbird.git
synced 2026-08-24 16:41:30 +02:00
2ab637e885
Discovery proxies the upstream's full list, so the picker offers every model the shared provider key can reach and each one outside the policy is a request the chain denies a moment later. Restricting models is the point of the product, and the client had no way to see the restriction. Carry the resolved route's model list on the upstream rewrite and drop the rest from the listing response. Only a route that enumerates its models bounds anything: a catch-all claims every model, so its list passes through. Anything the filter cannot safely rewrite, including a compressed or oversized body, reaches the client untouched.