From 1c7c82dfac4cdf4337671c177ee92cb3f3ecba86 Mon Sep 17 00:00:00 2001
From: cynfo3000 <cynfo3000@cynfo.net>
Date: Tue, 10 Mar 2026 01:08:14 +0100
Subject: [PATCH] fix: agent permission erlaubt firmware + agents endpoints
 fuer rmm-updater OTA

---
 backend/api/middleware.go | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/backend/api/middleware.go b/backend/api/middleware.go
index 991a406..1445267 100644
--- a/backend/api/middleware.go
+++ b/backend/api/middleware.go
@@ -129,10 +129,13 @@ func hasAPIKeyPermission(key *db.APIKey, r *http.Request) bool {
 
 	switch perm {
 	case "agent":
-		// Nur Agent-Endpunkte: Registrierung, WS-Connect, Heartbeat
+		// Agent-Endpunkte: Registrierung, WS-Connect, Heartbeat, OTA-Update
 		return path == "/api/v1/agent/ws" ||
 			path == "/api/v1/agent/heartbeat" ||
-			path == "/api/v1/agent/register"
+			path == "/api/v1/agent/register" ||
+			path == "/api/v1/firmware" ||
+			path == "/api/v1/firmware/download" ||
+			strings.HasPrefix(path, "/api/v1/agents/")
 
 	case "read":
 		// Nur GET-Requests, keine destruktiven Aktionen