From bc15e3331b779bc3e47a451e333497b08f737049 Mon Sep 17 00:00:00 2001
From: grossmj <grossmj@gns3.net>
Date: Sun, 31 May 2026 19:26:47 +0200
Subject: [PATCH] Add privilege dependencies for the new API endpoints

---
 gns3server/api/routes/controller/templates.py | 23 +++++++++++--------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/gns3server/api/routes/controller/templates.py b/gns3server/api/routes/controller/templates.py
index d991ac086..05fa6482c 100644
--- a/gns3server/api/routes/controller/templates.py
+++ b/gns3server/api/routes/controller/templates.py
@@ -231,16 +231,18 @@ async def duplicate_template(
     template = await TemplatesService(templates_repo).duplicate_template(template_id)
     return template
 
-@router.get("/{template_id}/base-config/{filename}")
+@router.get(
+    "/{template_id}/base-config/{filename}",
+    dependencies=[Depends(has_privilege("Template.Audit"))]
+)
 async def get_base_config(
     template_id: UUID,
     filename: str,
     templates_repo: TemplatesRepository = Depends(get_repository(TemplatesRepository)),
 ):
+
     service = TemplatesService(templates_repo)
-
     await service.get_template(template_id)
-
     content = service.get_file(str(template_id), filename)
 
     return {
@@ -250,7 +252,10 @@ async def get_base_config(
     }
 
 
-@router.put("/{template_id}/base-config/{filename}")
+@router.put(
+    "/{template_id}/base-config/{filename}",
+    dependencies=[Depends(has_privilege("Template.Modify"))]
+)
 async def update_base_config(
     template_id: UUID,
     filename: str,
@@ -261,9 +266,7 @@ async def update_base_config(
         raise ControllerBadRequestError("Missing 'content' field")
 
     service = TemplatesService(templates_repo)
-
     await service.get_template(template_id)
-
     service.update_file(str(template_id), filename, body["content"])
 
     return {
@@ -273,14 +276,14 @@ async def update_base_config(
     }
 
 
-@router.get("/{template_id}/base-configs")
+@router.get(
+    "/{template_id}/base-configs",
+    dependencies=[Depends(has_privilege("Template.Audit"))]
+)
 async def list_base_configs(
     template_id: UUID,
     templates_repo: TemplatesRepository = Depends(get_repository(TemplatesRepository)),
 ):
     service = TemplatesService(templates_repo)
-
     await service.get_template(template_id)
-
     return service.list_files(str(template_id))
-