fix: only return config parse error to authenticated users

The raw PyYAML parser error embeds the config file path and line context.
The /config endpoint is unauthenticated, so gate CONFIG_FILE_PARSE_ERROR
behind auth like EJS_NETPLAY_ICE_SERVERS, returning None to anonymous callers.

Generated-By: PostHog Code
Task-Id: 3d4f28a8-5157-4ca4-97a6-f283f5d6329e

Author: gantoine

backend/endpoints/configs.py

@@ -42,7 +42,10 @@ def get_config(request: Request) -> ConfigResponse:
     return ConfigResponse(
         CONFIG_FILE_MOUNTED=cfg.CONFIG_FILE_MOUNTED,
         CONFIG_FILE_WRITABLE=cfg.CONFIG_FILE_WRITABLE,
-        CONFIG_FILE_PARSE_ERROR=cfg.CONFIG_FILE_PARSE_ERROR,
+        # Raw parser error may leak the config file path, so only send when authenticated
+        CONFIG_FILE_PARSE_ERROR=(
+            cfg.CONFIG_FILE_PARSE_ERROR if request.user.is_authenticated else None
+        ),
         EXCLUDED_PLATFORMS=cfg.EXCLUDED_PLATFORMS,
         EXCLUDED_SINGLE_EXT=cfg.EXCLUDED_SINGLE_EXT,
         EXCLUDED_SINGLE_FILES=cfg.EXCLUDED_SINGLE_FILES,

backend/tests/endpoints/test_config.py

@@ -31,6 +31,28 @@ def test_config(client):
     assert config.get("GAMELIST_MEDIA_IMAGE") == "screenshot"
 
 
+def test_config_parse_error_gated_by_auth(client, access_token: str):
+    # The raw parser error can leak the config file path, so it is only
+    # returned to authenticated users.
+    cfg = cm.get_config()
+    cfg.CONFIG_FILE_PARSE_ERROR = 'in "/data/config.yml", line 2'
+
+    with patch.object(cm, "get_config", return_value=cfg):
+        anon = client.get("/api/config")
+        assert anon.status_code == status.HTTP_200_OK
+        assert anon.json().get("CONFIG_FILE_PARSE_ERROR") is None
+
+        auth = client.get(
+            "/api/config",
+            headers={"Authorization": f"Bearer {access_token}"},
+        )
+        assert auth.status_code == status.HTTP_200_OK
+        assert (
+            auth.json().get("CONFIG_FILE_PARSE_ERROR")
+            == 'in "/data/config.yml", line 2'
+        )
+
+
 def test_add_platform_binding_payload_shape(client, access_token: str):
     with patch.object(cm, "add_platform_binding") as add_platform_binding:
         response = client.post(