kenzuya/unshackle
1
0
Fork 2
mirror of https://github.com/unshackle-dl/unshackle.git synced 2026-11-13 12:35:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): stop serve leaking server credentials, paths, and cross-tenant data

Browse Source
This commit is contained in:
imSp4rky
2026-09-08 16:43:39 -06:00
parent fc13cda0c4
commit 0b055e43ba
11 changed files with 495 additions and 111 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/configuration/services.md
+2
View File
@@ -147,6 +147,8 @@ client that asks anyway gets a `FORBIDDEN` error. Because a download job always
an API key without `server_cdm` for that service also cannot submit or retry `/api/download`
jobs. Keys that have no `users` entry, such as `api_secret`, keep server CDM access.
`admin` is a boolean that lets the API key run the maintenance endpoints (clear-cache, clear-temp, refresh-services). It is `false` unless the entry sets it. Keys that have no `users` entry, such as `api_secret`, keep that access.
A `tier` names an entry under `serve.tiers`, which holds the settings that several API keys
share. Today a tier carries `rate_limit`, the requests per hour that API key may make; an API
key can also set its own `rate_limit`, which wins over its tier's. An API key with neither has