@@ -121,7 +121,7 @@ defmodule PlausibleWeb.Plugs.AuthorizePublicAPI do
121121
122122 defp verify_by_scope ( conn , api_key , "stats:read:" <> _ = scope ) do
123123 with :ok <- check_scope ( api_key , scope ) ,
124- { :ok , site } <- find_site ( conn . params [ "site_id" ] ) ,
124+ { :ok , site } <- find_site ( conn . params [ "site_id" ] , api_key ) ,
125125 :ok <- verify_site_access ( api_key , site ) do
126126 Plausible.OpenTelemetry . add_site_attributes ( site )
127127 site = Plausible.Repo . preload ( site , :completed_imports )
@@ -173,9 +173,18 @@ defmodule PlausibleWeb.Plugs.AuthorizePublicAPI do
173173 end
174174 end
175175
176- defp find_site ( nil ) , do: { :error , :missing_site_id }
176+ defp find_site ( nil , _api_key ) , do: { :error , :missing_site_id }
177177
178- defp find_site ( site_id ) do
178+ defp find_site ( "rollup:" <> team_identifier , api_key ) do
179+ with true <- Plausible.Auth . is_super_admin? ( api_key . user ) ,
180+ % Plausible.Teams.Team { } = team <- Plausible.Teams . get ( team_identifier ) do
181+ { :ok , Plausible.Site . rollup ( team ) }
182+ else
183+ _ -> { :error , :invalid_api_key }
184+ end
185+ end
186+
187+ defp find_site ( site_id , _api_key ) do
179188 domain_based_search =
180189 from s in Plausible.Site , where: s . domain == ^ site_id or s . domain_changed_from == ^ site_id
181190
0 commit comments