pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-07-31 04:12:10 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(db): enforce stricter validation for api key model access

Browse Source
This commit is contained in:
nyatoru
2026-02-24 00:14:50 +07:00
parent d2bee37e76
commit 7ed40c2139
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/lib/db/apiKeys.ts
View File

@@ -291,7 +291,10 @@ export async function getApiKeyMetadata(key) {
* @returns {boolean} - true if allowed, false if not
*/
export async function isModelAllowedForKey(key, modelId) {
if (!key || !modelId) return true; // No key or model = allow (backward compatibility)
// If no key provided, allow (request may be using different auth method like JWT)
// If no modelId provided, deny (invalid request)
if (!key) return true;
if (!modelId) return false;
// Create cache key
const cacheKey = `${key}:${modelId}`;
@@ -304,7 +307,8 @@ export async function isModelAllowedForKey(key, modelId) {
}
const metadata = await getApiKeyMetadata(key);
if (!metadata) return true; // Key not found = allow (backward compatibility)
// SECURITY: Key not found in database = deny access (invalid/non-existent key)
if (!metadata) return false;
const { allowedModels } = metadata;