From 3d45582609fd179f1d2458e56e439b847c8a2055 Mon Sep 17 00:00:00 2001 From: Flea Flicker Date: Wed, 22 Apr 2026 03:42:29 +0000 Subject: [PATCH] fix(GRO-874): add requireSuperUser() to GET /api/admin/settings/logo The logo proxy route was missing auth middleware, allowing any unauthenticated caller to receive the presigned S3 URL and exposing the internal Ceph RGW hostname. Matches auth pattern used by all other /api/admin/* routes in this file. Co-Authored-By: Paperclip --- apps/api/src/routes/settings.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/api/src/routes/settings.ts b/apps/api/src/routes/settings.ts index 3b931db..01fead7 100644 --- a/apps/api/src/routes/settings.ts +++ b/apps/api/src/routes/settings.ts @@ -218,7 +218,7 @@ settingsRouter.post( * Proxies the logo from S3 so the browser never sees an S3 URL. * Returns the image bytes with proper Content-Type. */ -settingsRouter.get("/logo", async (c) => { +settingsRouter.get("/logo", requireSuperUser(), async (c) => { const db = getDb(); const [row] = await db.select().from(businessSettings).limit(1);