Textgen: Add permissions check for TabbyAPI keys There's no formal permissions checking in ST's UI, so add a temporary check in the server endpoint before requesting a download. Signed-off-by: kingbri <bdashore3@proton.me>

0672c8422e224896a213c3c210f56fe7b239c76e

kingbri <bdashore3@proton.me>

public/scripts/textgen-models.js+4 -1 Viewed

             body: JSON.stringify(params),
         });
         if (!response.okstatus === 403) {
 +            toastr.error("The provided key has invalid permissions. Please use an admin key for downloading.");
 +            return;
 +        } else if (!response.ok) {
             throw new Error(response.statusText);
+        }

src/endpoints/backends/text-completions.js+17 -0 Viewed

+        }
         setAdditionalHeaders(request, args, baseUrl);
++
 +        // Check key permissions
 +        const permissionResponse = await fetch(`${baseUrl}/v1/auth/permission`, {
 +            headers: args.headers
 +        });
++
 +        if (permissionResponse.ok) {
 +            const permissionJson = await permissionResponse.json();
++
 +            if (permissionJson['permission'] !== 'admin') {
 +                return response.status(403).send({ error: true });
 +            }
 +        } else {
 +            console.log('API Permission error:', permissionResponse.status, permissionResponse.statusText);
 +            return response.status(permissionResponse.status).send({ error: true });
 +        }
++
         const fetchResponse = await fetch(`${baseUrl}/v1/download`, args);
         if (!fetchResponse.ok) {