fix(security): enforce API authentication rules on collection (#214)

- Add authentication and authorization rules to prevent unauthorized access via REST API endpoints.
This commit is contained in:
Tola Leng
2026-02-27 00:17:45 +07:00
parent 9dbd267a22
commit f2c338ced9
25 changed files with 793 additions and 355 deletions
@@ -1,11 +1,11 @@
[
{
"id": "pbc_1938176441",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "alert_configurations",
"type": "base",
"fields": [
@@ -380,11 +380,11 @@
},
{
"id": "pbc_2889059272",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "data_settings",
"type": "base",
"fields": [
@@ -478,11 +478,11 @@
},
{
"id": "pbc_285611395",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "dns_data",
"type": "base",
"fields": [
@@ -717,11 +717,11 @@
},
{
"id": "pbc_3168803865",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "docker_metrics",
"type": "base",
"fields": [
@@ -978,11 +978,11 @@
},
{
"id": "pbc_583547467",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "dockers",
"type": "base",
"fields": [
@@ -1249,11 +1249,11 @@
},
{
"id": "pbc_2189087560",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "incidents",
"type": "base",
"fields": [
@@ -1511,11 +1511,11 @@
},
{
"id": "pbc_1738231158",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "maintenance",
"type": "base",
"fields": [
@@ -1741,11 +1741,11 @@
},
{
"id": "pbc_3662317132",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "operational_page",
"type": "base",
"fields": [
@@ -1932,11 +1932,11 @@
},
{
"id": "pbc_1168766540",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "ping_data",
"type": "base",
"fields": [
@@ -2199,11 +2199,11 @@
},
{
"id": "pbc_171698555",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "regional_service",
"type": "base",
"fields": [
@@ -2331,11 +2331,11 @@
},
{
"id": "pbc_1998570700",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "server_metrics",
"type": "base",
"fields": [
@@ -2648,11 +2648,11 @@
},
{
"id": "pbc_1965843930",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "server_notification_templates",
"type": "base",
"fields": [
@@ -2948,11 +2948,11 @@
},
{
"id": "pbc_1464856393",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "server_threshold_templates",
"type": "base",
"fields": [
@@ -3094,11 +3094,11 @@
},
{
"id": "pbc_3738798621",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "servers",
"type": "base",
"fields": [
@@ -3556,11 +3556,11 @@
},
{
"id": "pbc_763794515",
"listRule": null,
"viewRule": null,
"createRule": null,
"updateRule": null,
"deleteRule": null,
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "service_group",
"type": "base",
"fields": [
@@ -3646,11 +3646,11 @@
},
{
"id": "pbc_1572233440",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "service_notification_templates",
"type": "base",
"fields": [
@@ -3806,11 +3806,11 @@
},
{
"id": "pbc_863811952",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "services",
"type": "base",
"fields": [
@@ -4162,11 +4162,11 @@
},
{
"id": "pbc_3575570325",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "services_metrics",
"type": "base",
"fields": [
@@ -4509,11 +4509,11 @@
},
{
"id": "pbc_1836745630",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "ssl_certificates",
"type": "base",
"fields": [
@@ -4841,11 +4841,11 @@
},
{
"id": "pbc_1753185970",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "ssl_history",
"type": "base",
"fields": [
@@ -5004,11 +5004,11 @@
},
{
"id": "pbc_351174173",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "ssl_notification_templates",
"type": "base",
"fields": [
@@ -5122,11 +5122,11 @@
},
{
"id": "pbc_1636150439",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "status_page_components",
"type": "base",
"fields": [
@@ -5252,11 +5252,11 @@
},
{
"id": "pbc_2331916230",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "tcp_data",
"type": "base",
"fields": [
@@ -5449,11 +5449,11 @@
},
{
"id": "pbc_67962705",
"listRule": "",
"viewRule": "",
"createRule": "",
"updateRule": "",
"deleteRule": "",
"listRule": "@request.auth.id != \"\"",
"viewRule": "@request.auth.id != \"\"",
"createRule": "@request.auth.id != \"\"",
"updateRule": "@request.auth.id != \"\"",
"deleteRule": "@request.auth.id != \"\"",
"name": "uptime_data",
"type": "base",
"fields": [
@@ -5657,239 +5657,5 @@
],
"indexes": [],
"system": false
},
{
"id": "_pb_users_auth_",
"listRule": "id = @request.auth.id",
"viewRule": "id = @request.auth.id",
"createRule": null,
"updateRule": "id = @request.auth.id",
"deleteRule": "id = @request.auth.id",
"name": "users",
"type": "auth",
"fields": [
{
"autogeneratePattern": "[a-z0-9]{15}",
"hidden": false,
"id": "text3208210256",
"max": 15,
"min": 15,
"name": "id",
"pattern": "^[a-z0-9]+$",
"presentable": false,
"primaryKey": true,
"required": true,
"system": true,
"type": "text"
},
{
"cost": 0,
"hidden": true,
"id": "password901924565",
"max": 0,
"min": 8,
"name": "password",
"pattern": "",
"presentable": false,
"required": true,
"system": true,
"type": "password"
},
{
"autogeneratePattern": "[a-zA-Z0-9]{50}",
"hidden": true,
"id": "text2504183744",
"max": 60,
"min": 30,
"name": "tokenKey",
"pattern": "",
"presentable": false,
"primaryKey": false,
"required": true,
"system": true,
"type": "text"
},
{
"exceptDomains": null,
"hidden": false,
"id": "email3885137012",
"name": "email",
"onlyDomains": null,
"presentable": false,
"required": false,
"system": true,
"type": "email"
},
{
"hidden": false,
"id": "bool1547992806",
"name": "emailVisibility",
"presentable": false,
"required": false,
"system": true,
"type": "bool"
},
{
"hidden": false,
"id": "bool256245529",
"name": "verified",
"presentable": false,
"required": false,
"system": true,
"type": "bool"
},
{
"autogeneratePattern": "",
"hidden": false,
"id": "text1579384326",
"max": 255,
"min": 0,
"name": "full_name",
"pattern": "",
"presentable": false,
"primaryKey": false,
"required": false,
"system": false,
"type": "text"
},
{
"hidden": false,
"id": "file376926767",
"maxSelect": 1,
"maxSize": 0,
"mimeTypes": [
"image/jpeg",
"image/png",
"image/svg+xml",
"image/gif",
"image/webp"
],
"name": "avatar",
"presentable": false,
"protected": false,
"required": false,
"system": false,
"thumbs": null,
"type": "file"
},
{
"autogeneratePattern": "",
"hidden": false,
"id": "text4166911607",
"max": 0,
"min": 0,
"name": "username",
"pattern": "",
"presentable": false,
"primaryKey": false,
"required": false,
"system": false,
"type": "text"
},
{
"hidden": false,
"id": "select2063623452",
"maxSelect": 1,
"name": "status",
"presentable": false,
"required": false,
"system": false,
"type": "select",
"values": [
"active",
"inactive"
]
},
{
"hidden": false,
"id": "autodate2990389176",
"name": "created",
"onCreate": true,
"onUpdate": false,
"presentable": false,
"system": false,
"type": "autodate"
},
{
"hidden": false,
"id": "autodate3332085495",
"name": "updated",
"onCreate": true,
"onUpdate": true,
"presentable": false,
"system": false,
"type": "autodate"
}
],
"indexes": [
"CREATE UNIQUE INDEX `idx_tokenKey__pb_users_auth_` ON `users` (`tokenKey`)",
"CREATE UNIQUE INDEX `idx_email__pb_users_auth_` ON `users` (`email`) WHERE `email` != ''"
],
"system": false,
"authRule": "",
"manageRule": null,
"authAlert": {
"enabled": true,
"emailTemplate": {
"subject": "Login from a new location",
"body": "<p>Hello,</p>\n<p>We noticed a login to your {APP_NAME} account from a new location.</p>\n<p>If this was you, you may disregard this email.</p>\n<p><strong>If this wasn't you, you should immediately change your {APP_NAME} account password to revoke access from all other locations.</strong></p>\n<p>\n Thanks,<br/>\n {APP_NAME} team\n</p>"
}
},
"oauth2": {
"mappedFields": {
"id": "",
"name": "",
"username": "",
"avatarURL": "avatar"
},
"enabled": false
},
"passwordAuth": {
"enabled": true,
"identityFields": [
"email"
]
},
"mfa": {
"enabled": false,
"duration": 1800,
"rule": ""
},
"otp": {
"enabled": false,
"duration": 180,
"length": 8,
"emailTemplate": {
"subject": "OTP for {APP_NAME}",
"body": "<p>Hello,</p>\n<p>Your one-time password is: <strong>{OTP}</strong></p>\n<p><i>If you didn't ask for the one-time password, you can ignore this email.</i></p>\n<p>\n Thanks,<br/>\n {APP_NAME} team\n</p>"
}
},
"authToken": {
"duration": 604800
},
"passwordResetToken": {
"duration": 1800
},
"emailChangeToken": {
"duration": 1800
},
"verificationToken": {
"duration": 259200
},
"fileToken": {
"duration": 180
},
"verificationTemplate": {
"subject": "Verify your {APP_NAME} email",
"body": "<p>Hello,</p>\n<p>Thank you for joining us at {APP_NAME}.</p>\n<p>Click on the button below to verify your email address.</p>\n<p>\n <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-verification/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Verify</a>\n</p>\n<p>\n Thanks,<br/>\n {APP_NAME} team\n</p>"
},
"resetPasswordTemplate": {
"subject": "Reset your {APP_NAME} password",
"body": "<p>Hello,</p>\n<p>Click on the button below to reset your password.</p>\n<p>\n <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-password-reset/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Reset password</a>\n</p>\n<p><i>If you didn't ask to reset your password, you can ignore this email.</i></p>\n<p>\n Thanks,<br/>\n {APP_NAME} team\n</p>"
},
"confirmEmailChangeTemplate": {
"subject": "Confirm your {APP_NAME} new email address",
"body": "<p>Hello,</p>\n<p>Click on the button below to confirm your new email address.</p>\n<p>\n <a class=\"btn\" href=\"{APP_URL}/_/#/auth/confirm-email-change/{TOKEN}\" target=\"_blank\" rel=\"noopener\">Confirm new email</a>\n</p>\n<p><i>If you didn't ask to change your email address, you can ignore this email.</i></p>\n<p>\n Thanks,<br/>\n {APP_NAME} team\n</p>"
}
}
]
]