Add token login to bokfctl and enforce admin scope for tokensv0.1.3

- bokfctl: --token / BOKFD_TOKEN via client_token_login
- tokens must carry the admin scope for admin commands (was bypassed)
- docs: token-based snapshot for restic backups

1 files changed, 1 insertions, 2 deletions

diff --git a/src/protocol.c b/src/protocol.c
index 7c00d6b..c528759 100644
--- a/src/protocol.c
+++ b/src/protocol.c
@@ -168,8 +168,7 @@ char *protocol_handle_line(sqlite3 *db, const char *line, size_t len)
             add_error(rdoc, resp, "FORBIDDEN", "owner role required", NULL);
             goto done;
         }
-        if (cmd->perm != PERM_ADMIN && scope &&
-            !scope_has(r.sess->scopes, scope)) {
+        if (scope && !scope_has(r.sess->scopes, scope)) {
             add_error(rdoc, resp, "FORBIDDEN",
                       "token scope does not allow this command", NULL);
             goto done;