youngkermit8-coder opened a new issue, #1718: URL: https://github.com/apache/rocketmq-dashboard/issues/1718
## Problem When login enforcement is enabled, authenticated reader users can call `GET /api/llm/models` because all GET endpoints are read-accessible by default. `LlmConfigService.listModels()` loads the stored LLM configuration, and `OpenAiCompatibleLlmClient.listModels()` sends an outbound provider request with the stored API key in the Authorization header. This lets a reader cause the Studio backend to use administrator-configured credentials for provider-backed model discovery. It is inconsistent with the administrator-only LLM configuration and connection-test endpoints. ## Proposed fix Treat `/api/llm/models` as an administrator-only GET path in `AuthInterceptor` and add reader/admin regression coverage. Built-in AI chat access remains unchanged. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
