From 306d40c4d100ad9360fe49b45de3d1c2ae7feba0 Mon Sep 17 00:00:00 2001 From: Jarek Krochmalski Date: Sun, 6 Sep 2026 17:03:47 +0530 Subject: [PATCH] backup restore preview works for view-only roles --- src/routes/api/backup/restore/preview/+server.ts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/routes/api/backup/restore/preview/+server.ts b/src/routes/api/backup/restore/preview/+server.ts index 3f6a3b6..89f43ee 100644 --- a/src/routes/api/backup/restore/preview/+server.ts +++ b/src/routes/api/backup/restore/preview/+server.ts @@ -19,7 +19,9 @@ import { jobResult } from '$lib/server/sse'; */ export const POST: RequestHandler = async ({ request, cookies }) => { const auth = await authorize(cookies); - const rbacDenied = await requireBackups(auth, 'manage'); + // Read-only: restic ls/dump + host probes, writes nothing (like snapshots dump/browse), + // so it gates on view. The actual restore (restore/+server.ts) still needs manage. + const rbacDenied = await requireBackups(auth, 'view'); if (rbacDenied) return rbacDenied; const body = await request.json();