Aaron Kimbrell 974a27329e fix(dashboard): DataTables queries count as reads for read-only API keys ...

POST /api/tables/... only reads, so read-only keys may use it (and the
API docs list it for them). Keys limited to some addresses can't open
the WebSocket, whose address isn't checked, nor keys whose allowed
paths leave out /ws. Refusals are audited without an account target.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-09-28 22:31:03 -05:00

11 KiB

Raw Blame History

View Raw