pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-20 14:12:59 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): require management auth for mutable cloud routes (#6233) (#6233)

Browse Source 
fix(security): require management auth for mutable cloud routes (#6233). Verified: 3 PR tests + full authz/route-guard suite 241/241 green. Thanks @vittoroliveira-dev. Integrated into release/v3.8.45.
This commit is contained in:
Vittor Guilherme Borges de Oliveira
2026-07-05 05:33:19 -03:00
committed by GitHub
parent 9ebb53e432
commit 7e2b839935
9 changed files with 323 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
src/app/api/cloud/credentials/update/route.ts
View File

@@ -1,10 +1,17 @@
import { NextResponse } from "next/server";
import { validateApiKey, getProviderConnections, updateProviderConnection } from "@/models";
import { getProviderConnections, updateProviderConnection } from "@/models";
import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
import { cloudCredentialUpdateSchema } from "@/shared/validation/schemas";
import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
// Update provider credentials (for cloud token refresh)
export async function PUT(request: Request) {
const authError = await requireManagementAuth(request, {
alwaysRequireAuth: true,
invalidApiKeyStatus: 401,
});
if (authError) return authError;
let rawBody;
try {
rawBody = await request.json();
@@ -16,24 +23,12 @@ export async function PUT(request: Request) {
}
try {
const authHeader = request.headers.get("Authorization");
if (!authHeader?.startsWith("Bearer ")) {
return NextResponse.json({ error: "Missing API key" }, { status: 401 });
}
const apiKey = authHeader.slice(7);
const validation = validateBody(cloudCredentialUpdateSchema, rawBody);
if (isValidationFailure(validation)) {
return NextResponse.json({ error: validation.error }, { status: 400 });
}
const { provider, credentials } = validation.data;
// Validate API key
const isValid = await validateApiKey(apiKey);
if (!isValid) {
return NextResponse.json({ error: "Invalid API key" }, { status: 401 });
}
// Find active connection for provider
const connections = await getProviderConnections({ provider, isActive: true });
const connection = connections[0];

19
src/app/api/cloud/models/alias/route.ts
View File

@@ -1,5 +1,6 @@
import { NextResponse } from "next/server";
import { validateApiKey, getModelAliases, setModelAlias, isCloudEnabled } from "@/models";
import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
import { getConsistentMachineId } from "@/shared/utils/machineId";
import { syncToCloud } from "@/lib/cloudSync";
import { cloudModelAliasUpdateSchema } from "@/shared/validation/schemas";
@@ -7,6 +8,12 @@ import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
// PUT /api/cloud/models/alias - Set model alias (for cloud/CLI)
export async function PUT(request: Request) {
const authError = await requireManagementAuth(request, {
alwaysRequireAuth: true,
invalidApiKeyStatus: 401,
});
if (authError) return authError;
let rawBody;
try {
rawBody = await request.json();
@@ -18,18 +25,6 @@ export async function PUT(request: Request) {
}
try {
const authHeader = request.headers.get("authorization");
const apiKey = authHeader?.replace("Bearer ", "");
if (!apiKey) {
return NextResponse.json({ error: "Missing API key" }, { status: 401 });
}
const isValid = await validateApiKey(apiKey);
if (!isValid) {
return NextResponse.json({ error: "Invalid API key" }, { status: 401 });
}
const validation = validateBody(cloudModelAliasUpdateSchema, rawBody);
if (isValidationFailure(validation)) {
return NextResponse.json({ error: validation.error }, { status: 400 });