feat(perm): filter GET /api/bot to allowed bots; prune access on bot delete

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
saopig1andClaude Opus 4.8 committed 2026-05-30 13:38:57 +08:00
1 parent cd6f2c6078
commit 1f0f162f66
4 files changed
+108 -4

No files matched your search

+7 -2
View File
@@ -17,8 +17,13 @@ export function createBotRouter(
): Router {
const router = Router();
router.get("/", (_req, res) => {
const bots = botManager.getAllBots().map((b) => b.getStatus());
router.get("/", (req, res) => {
const all = botManager.getAllBots().map((b) => b.getStatus());
const u = req.user!;
const bots =
u.role === "admin" || u.bots === "all"
? all
: all.filter((b) => u.bots instanceof Set && u.bots.has(b.id));
res.json({ bots });
});