mirror of
https://github.com/CopilotKit/CopilotKit.git
synced 2026-09-14 16:26:20 +08:00
Jordan Ritter
83ec206d80
Audit of staging + production PocketBase rules turned up two open holes: - users.createRule = "" allowed any anonymous client to POST to /api/collections/users/records and create a real account. The dashboard exposes no signup UX — operators authenticate via the superuser credentials in PbAuthPrompt — so create should be admin-only. - baseline.updateRule = "" (production only) allowed any anonymous client to PATCH baseline rows, including silently flipping status cells and overwriting the updated_by/updated_at audit fields. The dashboard's baseline edit flow already gates writes behind PbAuthPrompt, so locking updateRule to admin-only keeps the existing operator workflow intact while removing the open hole. Both changes were applied via the PocketBase admin API to staging first (verified dashboard still renders and live status SSE still flows), then to production (same verification, plus 403 confirmations on the anonymous signup + anonymous baseline PATCH requests that previously returned 200). All other collection rules already had the right shape: status, status_history, probe_runs, baseline retain listRule/viewRule = "" because the dashboard reads them unauthenticated via the PocketBase JS SDK; create/update/delete rules stayed null because the harness writes with the superuser JWT.