fix(network): защитить ключи WireGuard и режим просмотра операций

backend/src/routes/wireguard.ts

@@ -43,6 +43,7 @@ import { parseWireguardSnapshot, planWireguardRestore, planStaticInterfaceAddres
 import { executeRosOps } from "../services/ros-ops.js"
 import { parseDbServerId } from "../utils/server-id.js"
 import { z } from "zod"
+import { hasPermission } from "../lib/permissions.js"
 
 function serverIdParam(v: string): string {
   return decodeURIComponent(v)
@@ -126,6 +127,9 @@ const wireguardRoutes: FastifyPluginAsyncZod = async (app) => {
   app.get("/wireguard", async (req, reply) => {
     const q = req.query as { serverId?: string; includePrivateKey?: string }
     const includePrivateKey = q.includePrivateKey === "1" || q.includePrivateKey === "true"
+    if (includePrivateKey && req.authUser && !hasPermission(req.authUser.permissions, "mm:network:write")) {
+      return reply.status(403).send({ error: "Для чтения приватного ключа WireGuard нужны права на изменение сети" })
+    }
     const result = await listWireGuardInterfaces({
       serverId: q.serverId,
       includePrivateKey,