3 Commits

Author	SHA1	Message	Date
YueGuobin	d4389b7068	fix(rbac): guard None current_user on websocket auth failure ... get_current_active_user_from_websocket returns None after closing the socket on an auth failure (revoked token, bad credentials, inactive user). has_privilege_on_websocket dereferenced current_user.is_superadmin without a None check, so any websocket auth failure surfaced as an AttributeError traceback instead of a clean close. Bail out early when current_user is None, mirroring the guard already present in ws_console.	2026-07-16 00:51:45 +08:00
grossmj	0077fd98aa	Add required privileges to all endpoints	2023-09-02 17:54:24 +07:00
grossmj	60ce1172e0	Use an ACL table to check for privileges	2023-08-27 18:20:42 +10:00