AJAX endpoint is not authenticated

[vsemionov]

Checklist

• The bug is reproducible against the latest release or master.
• There are no similar issues or pull requests to fix it yet.

Describe the bug

The AJAX lookup endpoint (/{identity}/ajax/lookup) does not require any kind of authentication. This opens the possibility for anyone to view your data with a request URL like:

http://localhost:8000/admin/membership/ajax/lookup?name=user&term=test

As a workaround, I wrapped the endpoint with login_required. Of course, it's not the proper fix because this decorator is intended for HTML requests.

from sqladmin import Admin
from sqladmin.authentication import login_required

class CustomAdmin(Admin):
    # adds missing authentication to the ajax lookup endpoint
    @login_required
    async def ajax_lookup(self, *args, **kwargs):
        return await super().ajax_lookup(*args, **kwargs)

Steps to reproduce the bug

No response

Expected behavior

No response

Actual behavior

No response

Debugging material

No response

Environment

MacOS, Python 3.13. SQLAdmin 0.23.0

Additional context

No response

[mmzeynalli]

@vsemionov would you like to work on it? Or should we take it ourselves?

[vsemionov]

Hi @mmzeynalli . I moved to other projects and I don't have time. I'm sorry that I can't help you.