User permissions not applied via API

[MeshMATIC]

Hello,

I've very recently installed an instance of MeshMonitor and this is really a great tool ! Thanks a lot !

I haven't found any topics related to permissions, so I'm creating a new one. I hope I didn't miss a similar discussion somewhere else...

So, I've created a dedicated user with only read access to Dashboard, Nodes, Ch1, Ch2 and Info.
I've generated an API key for this user so I could use it to send and aggregate data to a MeshManager.

When I log on to my MeshMonitor instance with that user, permissions are respected, and I don't see discussions from my personal CH0 and only CH1 and CH2 are visible.

On the MeshManager side, using the API key of that user, I see all discussions from CH0, CH1 and CH2.
I would expect CH0 messages not to be sent over the API.

So I assume the API access is not restricted based on user permission ?
Did I miss something? Is there any way to avoid messages from my CH0 being sent through API ?

Also, on the MeshMonitor side, when logged in with that restricted user, all Nodes known because of CH0 are also visible with all the locations normally sent only through CH0.
Is there any way to avoid this position access to restricted users ? (Private Positions not granted)

To bypass these two issues, I've reset all data on my MeshMonitor and I have removed the configuration for my personal CH0.
But it would be great to be able to exploit personal channels and positions and share other non-personal stuff through the same MeshMonitor instance.

Cheers,

[Yeraze]

Hrm. This is a bug.

[Yeraze]

REsolved in PR #1517

[MeshMATIC]

Thanks a lot for this very quick correction !!

What about the second point ?
"on the MeshMonitor side, when logged in with that restricted user, all Nodes known because of CH0 are also visible with all the locations normally sent only through CH0.
Is there any way to avoid this position access to restricted users ? (Private Positions not granted)"

In other words :
Some nodes and nodes locations are known because information could be decrypted from CH0.
In that case, could these nodes and location be filtered and no be shown to my user which don't have access to CH0 ?

[Yeraze]

hrm.. I'l take a look. That's a pretty extensive change, but I'll see what I can do.

[MeshMATIC]

Thank you.
There are many people in my area using MeshMonitor, and I would like to federate them in a kind of regional MeshManager so we can have a better idea of the mesh topology in our area.
So having a proper way to secure exposed data in MeshMonitor will hopefully facilitate people's adhesion to the idea :-)

I would mysef like to monitor some personal nodes position from my MeshMonitor but not expose those to the shared MeshManager.

[Yeraze]

Come join us on Discord to discuss this more :) https://discord.gg/JVR3VBETQE

There's a potential issue here that if/when i implement this.. Anonymous must have read permissions to some used channel, or the map will be empty. Not sure if that's acceptable or something I need to work around...