From ddce5bd8f2a8e1999080e05ab309d4ceab2c1c69 Mon Sep 17 00:00:00 2001
From: Harsh Mahajan <115500013+007harshmahajan@users.noreply.github.com>
Date: Sun, 31 May 2026 06:25:06 +0530
Subject: [PATCH] fix: adding root auth for config/reload API (#12279)

---
 src/handler/http/request/status/mod.rs | 22 ++++++++++++++++------
 src/handler/http/router/mod.rs         |  4 ++++
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/src/handler/http/request/status/mod.rs b/src/handler/http/request/status/mod.rs
index 9f8cc4e991..e007961a1b 100644
--- a/src/handler/http/request/status/mod.rs
+++ b/src/handler/http/request/status/mod.rs
@@ -76,10 +76,14 @@ use {
 };
 
 use crate::{
-    common::meta::{
-        http::HttpResponse as MetaHttpResponse,
-        user::{AuthTokens, AuthTokensExt},
+    common::{
+        meta::{
+            http::HttpResponse as MetaHttpResponse,
+            user::{AuthTokens, AuthTokensExt},
+        },
+        utils::auth::{UserEmail, is_root_user},
     },
+    handler::http::extractors::Headers,
     service::{
         db,
         search::{
@@ -787,7 +791,14 @@ pub async fn cache_status() -> impl IntoResponse {
     axum::Json(stats)
 }
 
-pub async fn config_reload() -> impl IntoResponse {
+pub async fn config_reload(Headers(user_email): Headers<UserEmail>) -> impl IntoResponse {
+    let user_id = user_email.user_id.as_str();
+    if !is_root_user(user_id) {
+        return (
+            StatusCode::FORBIDDEN,
+            axum::Json(serde_json::json!({"message": "Only root users can reload config"})),
+        );
+    }
     if let Err(e) = config::refresh_config() {
         return (
             StatusCode::INTERNAL_SERVER_ERROR,
@@ -805,8 +816,7 @@ pub async fn config_reload() -> impl IntoResponse {
     // Audit this event
     #[cfg(feature = "enterprise")]
     audit(AuditMessage {
-        // Since this is not a protected route, there is no way to get the user email
-        user_email: "".to_string(),
+        user_email: user_id.to_string(),
         org_id: "".to_string(),
         _timestamp: now_micros(),
         protocol: Protocol::Http,
diff --git a/src/handler/http/router/mod.rs b/src/handler/http/router/mod.rs
index 10e937b3cc..47345d039c 100644
--- a/src/handler/http/router/mod.rs
+++ b/src/handler/http/router/mod.rs
@@ -550,6 +550,8 @@ pub fn basic_routes() -> Router {
 #[cfg(not(feature = "enterprise"))]
 pub fn config_routes() -> Router {
     Router::new()
+        .route("/reload", get(status::config_reload))
+        .route_layer(middleware::from_fn(auth_middleware))
         .route("/", get(status::zo_config))
         .route("/logout", get(status::logout))
 }
@@ -557,6 +559,8 @@ pub fn config_routes() -> Router {
 #[cfg(feature = "enterprise")]
 pub fn config_routes() -> Router {
     Router::new()
+        .route("/reload", get(status::config_reload))
+        .route_layer(middleware::from_fn(auth_middleware))
         .route("/", get(status::zo_config))
         .route("/logout", get(status::logout))
         .route("/redirect", get(status::redirect))