IXG Platform
ixgadmin
ef6f217e45
RBACMiddleware only guarded non-staff users, so any staff account stepped past the role routing for /admin/ — an ops or buyer account with the flag set could reach the admin index, which embeds the model registry, and a later permission grant would have been inherited. Restrict /admin/ to the admin role (superuser excepted) and hide the ops Admin link from non-admins. Also close the second finding: the seed set is_staff only on creation, so a buyer whose flag had drifted stayed staff on every re-run. Derive it from the role on the update path too, and align existing rows with a one-off migration so the flag never disagrees with the role. |
||
|---|---|---|
| apps | ||
| docs | ||
| dsp_platform | ||
| nginx | ||
| scripts | ||
| templates | ||
| .dockerignore | ||
| .gitignore | ||
| create_agent.py | ||
| docker-compose.yml | ||
| Dockerfile | ||
| manage.py | ||
| requirements.txt | ||
| SESSION_CHECKPOINT.md | ||