Author-trust gate for credential/broker references (issue #213).
Using a stored credential/broker profile is a trusted-author privilege — the
same tier the profile catalog is gated on (global editor/admin). An ACL-only
editor (a global viewer holding a per-dashboard edit grant) is NOT trusted to
attach a secret to settings they control: the authenticated datasource gateway
flow injects the referenced secret into the author-controlled URL without an
allowPublicUse check, so adding or redirecting such a datasource would let an
untrusted author exfiltrate the secret. An untrusted author may therefore only
add/modify datasources that reference allowPublicUse (public) profiles; a
pre-existing datasource left byte-identical is allowed, so a non-editor can still
edit a shared board that already uses the owner's key without being able to
re-target it.
Pure: the caller resolves isNonPublicProfileId from the profile store and only
invokes this for untrusted authors (trusted authors skip it entirely).
Author-trust gate for credential/broker references (issue #213).
Using a stored credential/broker profile is a trusted-author privilege — the same tier the profile catalog is gated on (global
editor/admin). An ACL-only editor (a global viewer holding a per-dashboard edit grant) is NOT trusted to attach a secret to settings they control: the authenticated datasource gateway flow injects the referenced secret into the author-controlled URL without anallowPublicUsecheck, so adding or redirecting such a datasource would let an untrusted author exfiltrate the secret. An untrusted author may therefore only add/modify datasources that referenceallowPublicUse(public) profiles; a pre-existing datasource left byte-identical is allowed, so a non-editor can still edit a shared board that already uses the owner's key without being able to re-target it.Pure: the caller resolves
isNonPublicProfileIdfrom the profile store and only invokes this for untrusted authors (trusted authors skip it entirely).