From 982b4c9353bc3415d65c916c33a418ade19a248f Mon Sep 17 00:00:00 2001 From: Agent Zero Date: Sun, 23 Aug 2026 15:09:39 +0200 Subject: [PATCH] fix(arch-003): active-manifests available to every authenticated user --- app/routes/plugins.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/app/routes/plugins.py b/app/routes/plugins.py index 6b309aa..380146f 100644 --- a/app/routes/plugins.py +++ b/app/routes/plugins.py @@ -11,6 +11,7 @@ from sqlalchemy.ext.asyncio import AsyncSession from app.core.db import get_db from app.deps import require_admin, require_permission +from app.deps import get_current_user from app.plugins.migration_runner import MigrationValidationError from app.services.plugin_service import get_plugin_service @@ -94,7 +95,10 @@ async def check_plugin_updates( @router.get("/active-manifests") async def get_active_manifests( db: AsyncSession = Depends(get_db), - current_user: dict = Depends(require_permission("plugins:read")), + # ARCH-003 fix: every authenticated user needs the UI manifests for the + # dynamic sidebar/routes — the data is pure UI metadata; actual data + # access stays protected by each endpoint's own permission. + current_user: dict = Depends(get_current_user), ): """Get UI manifests for all active plugins.