wyl/hertzbeat
1
0
Fork 0
mirror of https://github.com/dromara/hertzbeat.git synced 2026-09-17 09:40:58 +00:00
Code Issues Projects Releases Wiki Activity

[fix] stop exposing the jwt and aes master keys over the config api (#4270)

Browse Source
This commit is contained in:
Duansg
2026-08-03 11:30:56 +08:00
committed by GitHub
parent 16d420a245
commit b1a4f9630e
10 changed files with 202 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
script/docker-compose/hertzbeat-mysql-iotdb/conf/sureness.yml
+10
View File
@@ -54,6 +54,16 @@ resourceRole:
- /api/collector/**===post===[admin,user]
- /api/collector/**===put===[admin,user]
- /api/collector/**===delete===[admin]
# the secret config holds the jwt signing key and the aes key protecting stored
# credentials, so it stays admin only and is additionally refused by the controller
- /api/config/secret===get===[admin]
- /api/config/secret===post===[admin]
# the mute toggle sits in the notification widget every signed in user sees
- /api/config/mute===post===[admin,user,guest]
- /api/config/**===get===[admin,user,guest]
- /api/config/**===post===[admin]
- /api/config/**===put===[admin]
- /api/config/**===delete===[admin]
- /api/status/page/**===get===[admin,user,guest]
- /api/status/page/**===post===[admin,user]
- /api/status/page/**===put===[admin,user]
script/docker-compose/hertzbeat-mysql-tdengine/conf/sureness.yml
+10
View File
@@ -54,6 +54,16 @@ resourceRole:
- /api/collector/**===post===[admin,user]
- /api/collector/**===put===[admin,user]
- /api/collector/**===delete===[admin]
# the secret config holds the jwt signing key and the aes key protecting stored
# credentials, so it stays admin only and is additionally refused by the controller
- /api/config/secret===get===[admin]
- /api/config/secret===post===[admin]
# the mute toggle sits in the notification widget every signed in user sees
- /api/config/mute===post===[admin,user,guest]
- /api/config/**===get===[admin,user,guest]
- /api/config/**===post===[admin]
- /api/config/**===put===[admin]
- /api/config/**===delete===[admin]
- /api/status/page/**===get===[admin,user,guest]
- /api/status/page/**===post===[admin,user]
- /api/status/page/**===put===[admin,user]
script/docker-compose/hertzbeat-mysql-victoria-metrics/conf/sureness.yml
+10
View File
@@ -54,6 +54,16 @@ resourceRole:
- /api/collector/**===post===[admin,user]
- /api/collector/**===put===[admin,user]
- /api/collector/**===delete===[admin]
# the secret config holds the jwt signing key and the aes key protecting stored
# credentials, so it stays admin only and is additionally refused by the controller
- /api/config/secret===get===[admin]
- /api/config/secret===post===[admin]
# the mute toggle sits in the notification widget every signed in user sees
- /api/config/mute===post===[admin,user,guest]
- /api/config/**===get===[admin,user,guest]
- /api/config/**===post===[admin]
- /api/config/**===put===[admin]
- /api/config/**===delete===[admin]
- /api/status/page/**===get===[admin,user,guest]
- /api/status/page/**===post===[admin,user]
- /api/status/page/**===put===[admin,user]
script/docker-compose/hertzbeat-postgresql-greptimedb/conf/sureness.yml
+10
View File
@@ -54,6 +54,16 @@ resourceRole:
- /api/collector/**===post===[admin,user]
- /api/collector/**===put===[admin,user]
- /api/collector/**===delete===[admin]
# the secret config holds the jwt signing key and the aes key protecting stored
# credentials, so it stays admin only and is additionally refused by the controller
- /api/config/secret===get===[admin]
- /api/config/secret===post===[admin]
# the mute toggle sits in the notification widget every signed in user sees
- /api/config/mute===post===[admin,user,guest]
- /api/config/**===get===[admin,user,guest]
- /api/config/**===post===[admin]
- /api/config/**===put===[admin]
- /api/config/**===delete===[admin]
- /api/status/page/**===get===[admin,user,guest]
- /api/status/page/**===post===[admin,user]
- /api/status/page/**===put===[admin,user]
script/docker-compose/hertzbeat-postgresql-victoria-metrics/conf/sureness.yml
+10
View File
@@ -54,6 +54,16 @@ resourceRole:
- /api/collector/**===post===[admin,user]
- /api/collector/**===put===[admin,user]
- /api/collector/**===delete===[admin]
# the secret config holds the jwt signing key and the aes key protecting stored
# credentials, so it stays admin only and is additionally refused by the controller
- /api/config/secret===get===[admin]
- /api/config/secret===post===[admin]
# the mute toggle sits in the notification widget every signed in user sees
- /api/config/mute===post===[admin,user,guest]
- /api/config/**===get===[admin,user,guest]
- /api/config/**===post===[admin]
- /api/config/**===put===[admin]
- /api/config/**===delete===[admin]
- /api/status/page/**===get===[admin,user,guest]
- /api/status/page/**===post===[admin,user]
- /api/status/page/**===put===[admin,user]
script/sureness.yml
+10
View File
@@ -54,6 +54,16 @@ resourceRole:
- /api/collector/**===post===[admin,user]
- /api/collector/**===put===[admin,user]
- /api/collector/**===delete===[admin]
# the secret config holds the jwt signing key and the aes key protecting stored
# credentials, so it stays admin only and is additionally refused by the controller
- /api/config/secret===get===[admin]
- /api/config/secret===post===[admin]
# the mute toggle sits in the notification widget every signed in user sees
- /api/config/mute===post===[admin,user,guest]
- /api/config/**===get===[admin,user,guest]
- /api/config/**===post===[admin]
- /api/config/**===put===[admin]
- /api/config/**===delete===[admin]
- /api/status/page/**===get===[admin,user,guest]
- /api/status/page/**===post===[admin,user]
- /api/status/page/**===put===[admin,user]