Textgen: Add permissions check for TabbyAPI keys There's no formal permissions checking in ST's UI, so add a temporary check in the server endpoint before requesting a download. Signed-off-by: kingbri <bdashore3@proton.me>

0672c8422e224896a213c3c210f56fe7b239c76e

kingbri <bdashore3@proton.me>

public/scripts/textgen-models.js+4 -1 Viewed

             body: JSON.stringify(params),
         });
-        if (!response.ok) {
+        if (response.status === 403) {
+            toastr.error("The provided key has invalid permissions. Please use an admin key for downloading.");
+            return;
+        } else if (!response.ok) {
             throw new Error(response.statusText);
+        }

src/endpoints/backends/text-completions.js+17 -0 Viewed

+        }
         setAdditionalHeaders(request, args, baseUrl);
+        // Check key permissions
+        const permissionResponse = await fetch(`${baseUrl}/v1/auth/permission`, {
+            headers: args.headers
+        });
+        if (permissionResponse.ok) {
+            const permissionJson = await permissionResponse.json();
+            if (permissionJson['permission'] !== 'admin') {
+                return response.status(403).send({ error: true });
+            }
+        } else {
+            console.log('API Permission error:', permissionResponse.status, permissionResponse.statusText);
+            return response.status(permissionResponse.status).send({ error: true });
+        }
         const fetchResponse = await fetch(`${baseUrl}/v1/download`, args);
         if (!fetchResponse.ok) {