Alexandre Teixeira 26483661da Restrict provider discovery to admins ...

Require admin access before serving provider discovery data from
GET /api/providers. This prevents normal authenticated users from
triggering provider discovery or receiving cached provider host data.

Keep GET /api/models available to normal users and leave the existing
admin-only GET /api/discover behavior unchanged.

Add a focused regression test to ensure unauthorized callers cannot
trigger discovery and cannot receive cached provider data.

2026-06-02 05:54:40 +09:00

16 KiB

Raw Blame History

View Raw