From 071b7e9b01e41d4048b1bbb3d9caaac4c8a526de Mon Sep 17 00:00:00 2001
From: Anders Betts <anders.betts@gmail.com>
Date: Thu, 17 Sep 2026 21:48:00 +0200
Subject: Add token login to bokfctl and enforce admin scope for tokens

- bokfctl: --token / BOKFD_TOKEN via client_token_login
- tokens must carry the admin scope for admin commands (was bypassed)
- docs: token-based snapshot for restic backups
---
 clients/bokfctl.c | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

(limited to 'clients/bokfctl.c')

diff --git a/clients/bokfctl.c b/clients/bokfctl.c
index 1f1372c..b5ecf47 100644
--- a/clients/bokfctl.c
+++ b/clients/bokfctl.c
@@ -17,6 +17,7 @@ static void usage(void)
             "                   (env BOKFD_SOCKET, default /run/bokfd/bokfd.sock)\n"
             "  --user NAME      login user (env BOKFD_USER)\n"
             "  --password PW    login password (env BOKFD_PASSWORD)\n"
+            "  --token TOKEN    API token instead of user/password (env BOKFD_TOKEN)\n"
             "  --org ID         active org for this request\n"
             "  --version\n"
             "\n"
@@ -39,6 +40,7 @@ int main(int argc, char **argv)
         target = "/run/bokfd/bokfd.sock";
     const char *user = getenv("BOKFD_USER");
     const char *password = getenv("BOKFD_PASSWORD");
+    const char *token = getenv("BOKFD_TOKEN");
     int64_t org = 0;
     const char *cmd = NULL;
     const char *args_json = NULL;
@@ -70,6 +72,14 @@ int main(int argc, char **argv)
                 return 2;
             }
             password = val;
+        } else if (!strncmp(a, "--token", 7) &&
+                   (a[7] == '\0' || a[7] == '=')) {
+            val = a[7] == '=' ? a + 8 : (i + 1 < argc ? argv[++i] : NULL);
+            if (!val) {
+                fprintf(stderr, "bokfctl: --token requires a value\n");
+                return 2;
+            }
+            token = val;
         } else if (!strncmp(a, "--org", 5) &&
                    (a[5] == '\0' || a[5] == '=')) {
             val = a[5] == '=' ? a + 6 : (i + 1 < argc ? argv[++i] : NULL);
@@ -111,14 +121,19 @@ int main(int argc, char **argv)
 
     char *session = NULL;
     if (!is_local_cmd(cmd)) {
-        if (!user || !password) {
+        char *lerr = NULL;
+        int login_rc;
+        if (token && *token) {
+            login_rc = client_token_login(&conn, token, &session, &lerr);
+        } else if (user && password) {
+            login_rc = client_login(&conn, user, password, &session, &lerr);
+        } else {
             fprintf(stderr,
-                    "bokfctl: set BOKFD_USER and BOKFD_PASSWORD (or --user/--password) to log in\n");
+                    "bokfctl: set BOKFD_TOKEN or BOKFD_USER/BOKFD_PASSWORD (or --token/--user/--password) to log in\n");
             client_close(&conn);
             return 2;
         }
-        char *lerr = NULL;
-        if (client_login(&conn, user, password, &session, &lerr) != 0) {
+        if (login_rc != 0) {
             fprintf(stderr, "%s\n", lerr ? lerr : "login failed");
             int rc = lerr && lerr[0] == '{' ? 1 : 2;
             free(lerr);
-- 
cgit v1.3