fix(ui): проверять права каждого источника дашборда

lib/dashboard-permissions.test.ts

@@ -0,0 +1,8 @@
+import assert from "node:assert/strict"
+import {test} from "node:test"
+import {dashboardRequestPermission} from "./dashboard-permissions"
+import {permissionForRequest} from "../backend/src/lib/permissions"
+test("dashboard reader gates match real backend permissions including fallback diagnostic POST",()=>{
+ for(const [method,path] of [["GET","/api/uptime/overview?range=1h"],["GET","/api/servers"],["GET","/api/filters/rules"],["GET","/api/bgp/sessions"],["GET","/api/internet-path/latest"],["GET","/api/filters/gre-tunnels"],["GET","/api/wireguard"],["GET","/api/traffic/servers?range=1h"],["GET","/api/vxlan"],["GET","/api/events?limit=6"],["GET","/api/servers/1/wan-runtime"],["POST","/api/servers/1/probes/run"],["GET","/api/uptime/speed-probes"]])assert.equal(dashboardRequestPermission(method,path),permissionForRequest(method,path))
+ assert.throws(()=>dashboardRequestPermission("GET","/api/unmapped"));assert.throws(()=>dashboardRequestPermission("POST","/api/events"))
+})

lib/dashboard-permissions.ts

@@ -0,0 +1,12 @@
+/** Limited to API paths consumed by useDashboardLive; matches backend request gates. */
+export function dashboardRequestPermission(method:string,path:string):string{
+ const pathname=path.split("?")[0],write=method.toUpperCase()!=="GET"
+ if(pathname.startsWith("/api/servers"))return write?"mm:servers:write":"mm:servers:read"
+ if(pathname.startsWith("/api/uptime"))return write?"mm:uptime:write":"mm:uptime:read"
+ if(pathname.startsWith("/api/filters"))return write?"mm:filters:write":"mm:filters:read"
+ if(pathname.startsWith("/api/bgp"))return write?"mm:bgp:write":"mm:bgp:read"
+ if(pathname.startsWith("/api/traffic"))return write?"mm:traffic:write":"mm:traffic:read"
+ if(pathname.startsWith("/api/internet-path")||pathname.startsWith("/api/wireguard"))return write?"mm:network:write":"mm:network:read"
+ if(!write&&(pathname==="/api/vxlan"||pathname.startsWith("/api/events")))return "mm:dashboard:read"
+ throw Error("Неизвестный источник дашборда")
+}