diff options
| author | Anders Betts <anders.betts@gmail.com> | 2026-09-17 21:48:00 +0200 |
|---|---|---|
| committer | Anders Betts <anders.betts@gmail.com> | 2026-09-17 21:48:00 +0200 |
| commit | 071b7e9b01e41d4048b1bbb3d9caaac4c8a526de (patch) | |
| tree | b0af0a71e0d9fff2ca166d6ca69167ff32cc2ccb /src/protocol.c | |
| parent | a145684f0a556820a183db45d27e9b2dc715f056 (diff) | |
| download | bokf-071b7e9b01e41d4048b1bbb3d9caaac4c8a526de.tar.gz bokf-071b7e9b01e41d4048b1bbb3d9caaac4c8a526de.zip | |
Add token login to bokfctl and enforce admin scope for tokensv0.1.3
- bokfctl: --token / BOKFD_TOKEN via client_token_login
- tokens must carry the admin scope for admin commands (was bypassed)
- docs: token-based snapshot for restic backups
Diffstat (limited to 'src/protocol.c')
| -rw-r--r-- | src/protocol.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/src/protocol.c b/src/protocol.c index 7c00d6b..c528759 100644 --- a/src/protocol.c +++ b/src/protocol.c @@ -168,8 +168,7 @@ char *protocol_handle_line(sqlite3 *db, const char *line, size_t len) add_error(rdoc, resp, "FORBIDDEN", "owner role required", NULL); goto done; } - if (cmd->perm != PERM_ADMIN && scope && - !scope_has(r.sess->scopes, scope)) { + if (scope && !scope_has(r.sess->scopes, scope)) { add_error(rdoc, resp, "FORBIDDEN", "token scope does not allow this command", NULL); goto done; |