Linus Rath 05fe7f8780 fix: stop handing instance details to visitors who are not signed in ...

Several endpoints answered anyone with what fingerprints a deployment:
`/api/health?detailed=true` (versions, memory), the update status
(exact version and the text of a pending security advisory, even with
`loginShowVersion` off), `/api/plugins` (installed plugins and the hosts
they may reach), the admin policy (push relays, sidebar app URLs,
plugin lists) and `/api/config` (every domain each server serves).

Visitors without a session now get:

- the plain liveness answer from `/api/health`;
- the update status only where the login page shows the version, and
  never the advisory text;
- a 401 from `/api/plugins`, which the client only syncs after signing
  in;
- the policy without plugin lists, push relays and sidebar apps, marked
  `X-Bulwark-Policy-Scope: public`; the client fetches the full policy
  once it signs in;
- server domain lists only when servers are picked by domain.

A mailbox session, a remembered session cookie or the admin session
counts as signed in. Deployments without a session secret cannot tell
sessions apart and keep the old answers.

2026-09-26 17:03:24 +02:00

..

route.ts

fix: stop handing instance details to visitors who are not signed in

2026-09-26 17:03:24 +02:00