discourse/plugins/discourse-ai/app/controllers/discourse_ai/ai_credits_controller.rb
Sam Saffron c0f6e9a903 SECURITY: Unscoped status lookups leak restricted metadata
Unscoped credit-status lookups in CreditStatusChecker leak restricted persona, feature, and LLM model metadata to any logged-in user regardless of authorization (IDOR vulnerability).
2026-03-19 15:21:28 +00:00

32 lines
872 B
Ruby
Vendored

# frozen_string_literal: true
module DiscourseAi
class AiCreditsController < ::ApplicationController
requires_plugin PLUGIN_NAME
requires_login
CREDIT_STATUS_CACHE_TTL = 5.seconds
def status
CreditStatusChecker.call(params: status_params, guardian: guardian) do |result|
on_success do
expires_in CREDIT_STATUS_CACHE_TTL, public: false
render json: {
agents: result[:agents],
features: result[:features],
llm_models: result[:llm_models],
}.compact
end
on_failed_contract do |contract|
raise Discourse::InvalidParameters.new(contract.errors.full_messages.join(", "))
end
end
end
private
def status_params
params.permit(agent_ids: [], features: [], llm_model_ids: [])
end
end
end