mirror of
https://github.com/pgadmin-org/pgadmin4.git
synced 2026-08-19 01:15:04 -05:00
Dave Page
461c3afba9
Flask-Security's permissions_required only guards HTTP routes; pgAdmin's Socket.IO event handlers had no permission-aware equivalent and relied on socket_login_required, which checks authentication but not the tool permission. Add socket_permissions_required as the socket counterpart of permissions_required so that event handlers can enforce the same tool-level RBAC as the routes. It reads the user's permissions via has_permission() rather than flask_principal's Permission().can(), so it does not depend on the principal identity having been loaded onto the socket request context, and it honours pgAdmin's Administrator bypass. On failure it disconnects and raises ConnectionRefusedError, mirroring socket_login_required.